diff --git a/Cargo.lock b/Cargo.lock index a7be92d..dc99c86 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -589,9 +589,7 @@ dependencies = [ "anyhow", "cultcache-rs", "cultmesh-rs", - "cultnet-rs", "pretty_assertions", - "rmp-serde", "serde", "serde_json", "tempfile", diff --git a/crates/odin-core/Cargo.toml b/crates/odin-core/Cargo.toml index 4083dfa..f7a0cc8 100644 --- a/crates/odin-core/Cargo.toml +++ b/crates/odin-core/Cargo.toml @@ -14,10 +14,8 @@ anyhow = "1" cultcache-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "3bf1c0cea53e0092187fa2e59a75ba1571947ffe", package = "cultcache-rs" } cultmesh-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "3bf1c0cea53e0092187fa2e59a75ba1571947ffe", package = "cultmesh-rs" } serde_json = "1" -cultnet-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "3bf1c0cea53e0092187fa2e59a75ba1571947ffe", package = "cultnet-rs" } serde = { version = "1", features = ["derive"] } [dev-dependencies] -rmp-serde = "1.3" pretty_assertions = "1.4" tempfile = "3" diff --git a/crates/odin-core/src/documents.rs b/crates/odin-core/src/documents.rs index 8347e4e..811685c 100644 --- a/crates/odin-core/src/documents.rs +++ b/crates/odin-core/src/documents.rs @@ -1,20 +1,6 @@ use cultcache_rs::DatabaseEntry; -pub use cultnet_rs::{ - GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA, GameCultServiceTrustAnchorRecord, - IDUNN_AUTHENTICATED_PROVIDER_HEALTH_PROJECTION_SCHEMA, - IDUNN_AUTHENTICATED_PROVIDER_HEALTH_PROJECTION_SIGNING_PURPOSE, - IDUNN_DAEMON_HEALTH_TRUST_BINDING_SCHEMA, IDUNN_PROVIDER_ACTIVE_REASON, - IDUNN_PROVIDER_DEGRADED_REASON, IDUNN_PROVIDER_FAILED_REASON, IDUNN_PROVIDER_WARMING_REASON, - IDUNN_SIGNED_DAEMON_HEALTH_SCHEMA, IdunnAuthenticatedProviderHealthProjectionRecord, - IdunnDaemonHealthTrustBindingRecord, IdunnSignedDaemonHealthRecord, - authenticated_provider_health_reason_code, -}; -#[cfg(test)] -use cultnet_rs::{GameCultProviderHealthIdentity, derive_service_identity_id}; use serde_json::Value; -use anyhow::{Result, bail}; - pub const ODIN_SNAPSHOT_SCHEMA: &str = "odin.snapshot.v1"; pub const ODIN_VERSE_SCHEMA: &str = "odin.verse.v1"; pub const ODIN_SERVICE_SCHEMA: &str = "odin.service.v1"; @@ -25,39 +11,6 @@ pub const EVE_SURFACE_STATE_SCHEMA: &str = "gamecult.eve.surface_state.v1"; pub const EVE_INTERFACE_BINDING_SCHEMA: &str = "gamecult.eve.interface_binding.v1"; pub const EVE_PROVIDER_ADVERTISEMENT_SCHEMA: &str = "gamecult.eve.provider_advertisement.v1"; pub const VOIDBOT_SWARM_STATE_SNAPSHOT_SCHEMA: &str = "voidbot.swarm_state_snapshot.v1"; -pub const IDUNN_DESIRED_DAEMON_SCHEMA: &str = "idunn.desired_daemon.v1"; -pub const IDUNN_DAEMON_HEALTH_SCHEMA: &str = "idunn.daemon_health.v1"; -pub const IDUNN_SIGNED_HEALTH_ADMISSION_SCHEMA: &str = "idunn.signed_health_admission.v1"; -pub const IDUNN_KEEPALIVE_DECISION_SCHEMA: &str = "idunn.keepalive_decision.v1"; -pub const IDUNN_RESTART_REQUEST_SCHEMA: &str = "idunn.restart_request.v1"; -pub const IDUNN_RESTART_RESULT_SCHEMA: &str = "idunn.restart_result.v1"; -pub const IDUNN_DEPLOYMENT_REQUEST_SCHEMA: &str = "idunn.deployment_request.v2"; -pub const IDUNN_CURRENT_DEPLOYMENT_REQUEST_SCHEMA: &str = "idunn.current_deployment_request.v1"; -pub const IDUNN_DEPLOYMENT_RESULT_SCHEMA: &str = "idunn.deployment_result.v1"; -pub const IDUNN_LIFECYCLE_COMMAND_SCHEMA: &str = "idunn.lifecycle_command.v1"; -pub const IDUNN_RELEASE_TARGET_SCHEMA: &str = "idunn.release_target.v3"; -pub const IDUNN_DEPLOYMENT_ARTIFACT_SCHEMA: &str = "idunn.deployment_artifact.v2"; -pub const BIFROST_REPOSITORY_RELEASE_AUTHORITY_SCHEMA: &str = - "bifrost.repository_release_authority.v1"; -pub const IDUNN_STATE_MIGRATION_PLAN_SCHEMA: &str = "idunn.state_migration_plan.v1"; -pub const IDUNN_STATE_MIGRATION_RESULT_SCHEMA: &str = "idunn.state_migration_result.v1"; -pub const IDUNN_ROLLOUT_PLAN_SCHEMA: &str = "idunn.rollout_plan.v1"; -pub const IDUNN_ROLLOUT_RESULT_SCHEMA: &str = "idunn.rollout_result.v1"; -pub const IDUNN_OPERATOR_ALARM_SCHEMA: &str = "idunn.operator_alarm.v1"; -pub const IDUNN_SWARM_SURGERY_PLAN_SCHEMA: &str = "idunn.swarm_surgery_plan.v1"; -pub const IDUNN_DAEMON_SURGERY_PLAN_SCHEMA: &str = "idunn.daemon_surgery_plan.v1"; -pub const IDUNN_DAEMON_TRANSPORT_PROFILE_SCHEMA: &str = "idunn.daemon_transport_profile.v1"; -pub const IDUNN_COMMAND_BOUNDARY_SCHEMA: &str = "idunn.command_boundary.v1"; -pub const IDUNN_RUNTIME_TRANSPORT_CHECK_SCHEMA: &str = "idunn.runtime_transport_check.v1"; -pub const IDUNN_RUDP_HEALTH_INGRESS_SCHEMA: &str = "idunn.rudp_health_ingress.v1"; -pub const IDUNN_AUTHENTICATED_DAEMON_HEALTH_ADMISSION_SCHEMA: &str = - "idunn.authenticated_daemon_health_admission.v1"; -pub const IDUNN_RUNTIME_TRAFFIC_ADMISSION_SCHEMA: &str = "idunn.runtime_traffic_admission.v2"; -pub const IDUNN_CODEX_CONNECTOR_RUNTIME_TRAFFIC_ADMISSION_RECORD_KEY: &str = - "yggdrasil-codex-connector"; -pub const IDUNN_GHOSTLIGHT_RUNTIME_TRAFFIC_ADMISSION_RECORD_KEY: &str = "yggdrasil-ghostlight"; -pub const IDUNN_UNSIGNED_DAEMON_HEALTH_DIAGNOSTIC_SCHEMA: &str = - "idunn.unsigned_daemon_health_diagnostic.v1"; pub const MUNINN_TELEMETRY_SURFACE_SCHEMA: &str = "muninn.telemetry_surface.v1"; pub const MUNINN_CAPTURE_STREAM_SCHEMA: &str = "muninn.capture_stream.v1"; pub const MUNINN_CAPTURE_STREAM_COMMAND_SCHEMA: &str = "muninn.capture_stream_command.v1"; @@ -245,900 +198,6 @@ pub struct VoidBotSwarmStateSnapshotCompatRecord { pub value: Value, } -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache(type = "idunn.desired_daemon", schema = "idunn.desired_daemon.v1")] -pub struct IdunnDesiredDaemonRecord { - #[cultcache(key = 0)] - pub daemon_id: String, - #[cultcache(key = 1)] - pub verse_id: String, - #[cultcache(key = 2)] - pub name: String, - #[cultcache(key = 3)] - pub enabled: bool, - #[cultcache(key = 4)] - pub health_command: Option, - #[cultcache(key = 5)] - pub restart_command: Option, - #[cultcache(key = 6)] - pub authority: String, - #[cultcache(key = 7)] - pub max_silence_seconds: u32, - #[cultcache(key = 8)] - pub observed_at: String, - #[cultcache(key = 9)] - pub deploy_command: Option, - #[cultcache(key = 10)] - pub health_contract: String, - #[cultcache(key = 11, default)] - pub transport_profile_id: String, - #[cultcache(key = 12, default)] - pub command_boundary_id: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache(type = "idunn.daemon_health", schema = "idunn.daemon_health.v1")] -pub struct IdunnDaemonHealthRecord { - #[cultcache(key = 0)] - pub daemon_id: String, - #[cultcache(key = 1)] - pub state: String, - #[cultcache(key = 2)] - pub detail: String, - #[cultcache(key = 3)] - pub observed_at: String, - #[cultcache(key = 4)] - pub health_contract: String, - #[cultcache(key = 5, default)] - pub publication_source: String, - #[cultcache(key = 6, default)] - pub transport: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "idunn.signed_health_admission", - schema = "idunn.signed_health_admission.v1" -)] -pub struct IdunnSignedHealthAdmissionRecord { - #[cultcache(key = 0)] - pub daemon_id: String, - #[cultcache(key = 1)] - pub state: String, - #[cultcache(key = 2)] - pub observed_at: String, - #[cultcache(key = 3)] - pub admitted_at: String, - #[cultcache(key = 4)] - pub health_contract: String, - #[cultcache(key = 5)] - pub deployment_request_id: String, - #[cultcache(key = 6)] - pub release_id: String, - #[cultcache(key = 7)] - pub release_witness_sha256: String, - #[cultcache(key = 8)] - pub source_commit: String, - #[cultcache(key = 9)] - pub publisher_incarnation_id: String, - #[cultcache(key = 10)] - pub publisher_sequence: u64, - #[cultcache(key = 11)] - pub publisher_process_created_at: String, - #[cultcache(key = 12)] - pub signer_identity_id: String, - #[cultcache(key = 13)] - pub signed_health_sha256: String, -} - -/// Idunn-owned judgment joining one verified provider statement to the exact -/// root trust binding used to admit it. Managed-health reads must rejoin this -/// record with both current objects; a health row by itself is not authority. -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "idunn.authenticated_daemon_health_admission", - schema = "idunn.authenticated_daemon_health_admission.v1" -)] -pub struct IdunnAuthenticatedDaemonHealthAdmissionRecord { - #[cultcache(key = 0)] - pub schema_version: String, - #[cultcache(key = 1)] - pub daemon_id: String, - #[cultcache(key = 2)] - pub health_contract: String, - #[cultcache(key = 3)] - pub source_runtime_id: String, - #[cultcache(key = 4)] - pub state: String, - #[cultcache(key = 5)] - pub observed_at_unix_millis: u64, - #[cultcache(key = 6)] - pub admitted_at_unix_millis: u64, - #[cultcache(key = 7)] - pub trust_binding_id: String, - #[cultcache(key = 8)] - pub trust_binding_sha256: String, - #[cultcache(key = 9)] - pub signer_identity_id: String, - #[cultcache(key = 10)] - pub publisher_incarnation_id: String, - #[cultcache(key = 11)] - pub publisher_sequence: u64, - #[cultcache(key = 12)] - pub signed_health_sha256: String, - #[cultcache(key = 13)] - pub release_id: Option, - #[cultcache(key = 14)] - pub release_witness_sha256: Option, - #[cultcache(key = 15)] - pub source_commit: Option, - #[cultcache(key = 16)] - pub deployment_id: Option, - #[cultcache(key = 17)] - pub private_state_exposed: bool, - #[cultcache(key = 18, default)] - pub activation_witness_sha256: Option, -} - -impl IdunnAuthenticatedDaemonHealthAdmissionRecord { - pub fn validate(&self) -> Result<()> { - if self.schema_version != IDUNN_AUTHENTICATED_DAEMON_HEALTH_ADMISSION_SCHEMA { - bail!("authenticated daemon health admission schema is unsupported"); - } - validate_identifier(&self.daemon_id, "daemon id")?; - validate_identifier(&self.health_contract, "health contract")?; - validate_identifier(&self.source_runtime_id, "source runtime id")?; - validate_identifier(&self.trust_binding_id, "trust binding id")?; - validate_identifier(&self.signer_identity_id, "signer identity id")?; - validate_identifier(&self.publisher_incarnation_id, "publisher incarnation id")?; - if !matches!( - self.state.as_str(), - "active" | "warming" | "degraded" | "failed" - ) || self.observed_at_unix_millis == 0 - || self.admitted_at_unix_millis < self.observed_at_unix_millis - || self.publisher_sequence == 0 - || !is_sha256(&self.trust_binding_sha256) - || !is_sha256(&self.signed_health_sha256) - { - bail!("authenticated daemon health admission shape is invalid"); - } - validate_optional_release_binding( - &self.release_id, - &self.release_witness_sha256, - &self.source_commit, - )?; - validate_optional_identifier(&self.deployment_id, "deployment id")?; - if self - .activation_witness_sha256 - .as_deref() - .is_some_and(|value| !is_sha256(value)) - { - bail!("authenticated daemon health activation witness is malformed"); - } - if self.private_state_exposed { - bail!("authenticated daemon health admission exposes private state"); - } - Ok(()) - } -} - -/// Idunn-issued traffic authority for a release that has proved its exact -/// deployment, activation, and authenticated provider-health lineage. -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "idunn.runtime_traffic_admission", - schema = "idunn.runtime_traffic_admission.v2" -)] -pub struct IdunnRuntimeTrafficAdmissionRecord { - #[cultcache(key = 0)] - pub schema_version: String, - #[cultcache(key = 1)] - pub daemon_id: String, - #[cultcache(key = 2)] - pub release_id: String, - #[cultcache(key = 3)] - pub release_witness_sha256: String, - #[cultcache(key = 4)] - pub source_commit: String, - #[cultcache(key = 5)] - pub deployment_id: String, - #[cultcache(key = 6)] - pub activation_witness_sha256: String, - #[cultcache(key = 7)] - pub signed_health_sha256: String, - #[cultcache(key = 8)] - pub publisher_incarnation_id: String, - #[cultcache(key = 9)] - pub publisher_sequence: u64, - #[cultcache(key = 10)] - pub signer_identity_id: String, - #[cultcache(key = 11)] - pub runtime_process_id: u32, - #[cultcache(key = 12)] - pub runtime_process_starttime_ticks: u64, -} - -impl IdunnRuntimeTrafficAdmissionRecord { - pub fn validate(&self) -> Result<()> { - if self.schema_version != IDUNN_RUNTIME_TRAFFIC_ADMISSION_SCHEMA { - bail!("runtime traffic admission schema is unsupported"); - } - if self.daemon_id != IDUNN_CODEX_CONNECTOR_RUNTIME_TRAFFIC_ADMISSION_RECORD_KEY - && self.daemon_id != IDUNN_GHOSTLIGHT_RUNTIME_TRAFFIC_ADMISSION_RECORD_KEY - { - bail!("runtime traffic admission daemon is unsupported"); - } - validate_identifier(&self.daemon_id, "daemon id")?; - validate_identifier(&self.release_id, "release id")?; - validate_identifier(&self.deployment_id, "deployment id")?; - validate_identifier(&self.publisher_incarnation_id, "publisher incarnation id")?; - validate_identifier(&self.signer_identity_id, "signer identity id")?; - if !is_sha256(&self.release_witness_sha256) - || !is_lower_hex(&self.source_commit, 40) - || !is_sha256(&self.activation_witness_sha256) - || !is_sha256(&self.signed_health_sha256) - || self.publisher_sequence == 0 - || self.runtime_process_id == 0 - || self.runtime_process_starttime_ticks == 0 - { - bail!("runtime traffic admission lineage is malformed"); - } - Ok(()) - } -} - -/// Quarantined observation of the retired unsigned wire contract. This may -/// explain missing authenticated health but can never satisfy managed health. -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "idunn.unsigned_daemon_health_diagnostic", - schema = "idunn.unsigned_daemon_health_diagnostic.v1" -)] -pub struct IdunnUnsignedDaemonHealthDiagnosticRecord { - #[cultcache(key = 0)] - pub schema_version: String, - #[cultcache(key = 1)] - pub diagnostic_id: String, - #[cultcache(key = 2)] - pub daemon_id: String, - #[cultcache(key = 3)] - pub claimed_state: String, - #[cultcache(key = 4)] - pub claimed_detail: String, - #[cultcache(key = 5)] - pub claimed_observed_at: String, - #[cultcache(key = 6)] - pub claimed_health_contract: String, - #[cultcache(key = 7)] - pub transport_source_runtime_id: Option, - #[cultcache(key = 8)] - pub transport_source_role: Option, - #[cultcache(key = 9)] - pub received_at_unix_millis: u64, - #[cultcache(key = 10)] - pub authority: String, - #[cultcache(key = 11)] - pub private_state_exposed: bool, -} - -impl IdunnUnsignedDaemonHealthDiagnosticRecord { - pub fn validate(&self) -> Result<()> { - if self.schema_version != IDUNN_UNSIGNED_DAEMON_HEALTH_DIAGNOSTIC_SCHEMA { - bail!("unsigned daemon health diagnostic schema is unsupported"); - } - validate_identifier(&self.diagnostic_id, "diagnostic id")?; - validate_identifier(&self.daemon_id, "daemon id")?; - validate_identifier(&self.claimed_state, "claimed state")?; - validate_identifier(&self.claimed_health_contract, "claimed health contract")?; - validate_optional_identifier( - &self.transport_source_runtime_id, - "transport source runtime id", - )?; - validate_optional_identifier(&self.transport_source_role, "transport source role")?; - if self.claimed_detail.len() > 512 - || self.claimed_observed_at.trim().is_empty() - || self.received_at_unix_millis == 0 - || self.authority != "diagnostic-only" - || self.private_state_exposed - { - bail!("unsigned daemon health diagnostic shape is invalid"); - } - Ok(()) - } -} - -fn validate_identifier(value: &str, label: &str) -> Result<()> { - if value.trim().is_empty() || value.len() > 256 || value.chars().any(char::is_control) { - bail!("{label} is empty, oversized, or contains control characters"); - } - Ok(()) -} - -fn validate_optional_identifier(value: &Option, label: &str) -> Result<()> { - if let Some(value) = value { - validate_identifier(value, label)?; - } - Ok(()) -} - -fn validate_optional_release_binding( - release_id: &Option, - witness: &Option, - source_commit: &Option, -) -> Result<()> { - if release_id.is_some() || witness.is_some() || source_commit.is_some() { - validate_optional_identifier(release_id, "release id")?; - let witness = witness - .as_deref() - .ok_or_else(|| anyhow::anyhow!("release witness is absent"))?; - let commit = source_commit - .as_deref() - .ok_or_else(|| anyhow::anyhow!("source commit is absent"))?; - if release_id.is_none() || !is_sha256(witness) || !is_lower_hex(commit, 40) { - bail!("release binding is incomplete or malformed"); - } - } - Ok(()) -} - -fn is_sha256(value: &str) -> bool { - value - .strip_prefix("sha256-") - .is_some_and(|digest| is_lower_hex(digest, 64)) -} - -fn is_lower_hex(value: &str, length: usize) -> bool { - value.len() == length - && value - .bytes() - .all(|byte| byte.is_ascii_hexdigit() && !byte.is_ascii_uppercase()) -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "idunn.keepalive_decision", - schema = "idunn.keepalive_decision.v1" -)] -pub struct IdunnKeepaliveDecisionRecord { - #[cultcache(key = 0)] - pub decision_id: String, - #[cultcache(key = 1)] - pub daemon_id: String, - #[cultcache(key = 2)] - pub action: String, - #[cultcache(key = 3)] - pub reason: String, - #[cultcache(key = 4)] - pub authority: String, - #[cultcache(key = 5)] - pub decided_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache(type = "idunn.restart_request", schema = "idunn.restart_request.v1")] -pub struct IdunnRestartRequestRecord { - #[cultcache(key = 0)] - pub request_id: String, - #[cultcache(key = 1)] - pub daemon_id: String, - #[cultcache(key = 2)] - pub command: String, - #[cultcache(key = 3)] - pub authority: String, - #[cultcache(key = 4)] - pub requested_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache(type = "idunn.restart_result", schema = "idunn.restart_result.v1")] -pub struct IdunnRestartResultRecord { - #[cultcache(key = 0)] - pub result_id: String, - #[cultcache(key = 1)] - pub request_id: String, - #[cultcache(key = 2)] - pub daemon_id: String, - #[cultcache(key = 3)] - pub state: String, - #[cultcache(key = 4)] - pub detail: String, - #[cultcache(key = 5)] - pub completed_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "idunn.deployment_request", - schema = "idunn.deployment_request.v2" -)] -pub struct IdunnDeploymentRequestRecord { - #[cultcache(key = 0)] - pub request_id: String, - #[cultcache(key = 1)] - pub daemon_id: String, - #[cultcache(key = 2)] - pub command: String, - #[cultcache(key = 3)] - pub authority: String, - #[cultcache(key = 4)] - pub requested_at: String, - #[cultcache(key = 5, default)] - pub repository_full_name: String, - #[cultcache(key = 6, default)] - pub upstream_ref: String, - #[cultcache(key = 7, default)] - pub source_revision: String, - #[cultcache(key = 8, default)] - pub release_authority_id: String, - #[cultcache(key = 9, default)] - pub release_authority_envelope_sha256: String, - #[cultcache(key = 10, default)] - pub requires_bifrost_authority: bool, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "idunn.current_deployment_request", - schema = "idunn.current_deployment_request.v1" -)] -pub struct IdunnCurrentDeploymentRequestRecord { - #[cultcache(key = 0)] - pub daemon_id: String, - #[cultcache(key = 1)] - pub request_id: String, - #[cultcache(key = 2)] - pub sequence: u64, - #[cultcache(key = 3)] - pub updated_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "idunn.deployment_result", - schema = "idunn.deployment_result.v1" -)] -pub struct IdunnDeploymentResultRecord { - #[cultcache(key = 0)] - pub result_id: String, - #[cultcache(key = 1)] - pub request_id: String, - #[cultcache(key = 2)] - pub daemon_id: String, - #[cultcache(key = 3)] - pub state: String, - #[cultcache(key = 4)] - pub detail: String, - #[cultcache(key = 5)] - pub completed_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "idunn.lifecycle_command", - schema = "idunn.lifecycle_command.v1" -)] -pub struct IdunnLifecycleCommandRecord { - #[cultcache(key = 0)] - pub command_id: String, - #[cultcache(key = 1)] - pub daemon_id: String, - #[cultcache(key = 2)] - pub action: String, - #[cultcache(key = 3)] - pub state: String, - #[cultcache(key = 4)] - pub requested_by: String, - #[cultcache(key = 5)] - pub requested_at: String, - #[cultcache(key = 6)] - pub detail: String, - #[cultcache(key = 7, default)] - pub claimed_at: String, - #[cultcache(key = 8, default)] - pub result_id: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache(type = "idunn.release_target", schema = "idunn.release_target.v3")] -pub struct IdunnReleaseTargetRecord { - #[cultcache(key = 0)] - pub target_id: String, - #[cultcache(key = 1)] - pub daemon_id: String, - #[cultcache(key = 2)] - pub repo: String, - #[cultcache(key = 3)] - pub repo_path: String, - #[cultcache(key = 4)] - pub upstream_remote: String, - #[cultcache(key = 5)] - pub upstream_branch: String, - #[cultcache(key = 6)] - pub desired_revision: String, - #[cultcache(key = 7)] - pub deployed_revision: String, - #[cultcache(key = 8)] - pub artifact_strategy: String, - #[cultcache(key = 9)] - pub rollout_strategy: String, - #[cultcache(key = 10)] - pub state_migration_authority: String, - #[cultcache(key = 11)] - pub zero_downtime_capability: String, - #[cultcache(key = 12)] - pub status: String, - #[cultcache(key = 13)] - pub observed_at: String, - #[cultcache(key = 14, default)] - pub repository_full_name: String, - #[cultcache(key = 15, default)] - pub upstream_ref: String, - #[cultcache(key = 16, default)] - pub release_authority_id: String, - #[cultcache(key = 17, default)] - pub release_authority_envelope_sha256: String, - #[cultcache(key = 18, default)] - pub release_authority_status: String, - #[cultcache(key = 19, default)] - pub requires_bifrost_authority: bool, - #[cultcache(key = 20, default)] - pub observed_upstream_revision: String, - #[cultcache(key = 21)] - pub minimum_source_revision: Option, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "idunn.deployment_artifact", - schema = "idunn.deployment_artifact.v2" -)] -pub struct IdunnDeploymentArtifactRecord { - #[cultcache(key = 0)] - pub artifact_id: String, - #[cultcache(key = 1)] - pub daemon_id: String, - #[cultcache(key = 2)] - pub source_revision: String, - #[cultcache(key = 3)] - pub source_branch: String, - #[cultcache(key = 4)] - pub source_remote: String, - #[cultcache(key = 5)] - pub artifact_kind: String, - #[cultcache(key = 6)] - pub artifact_uri: String, - #[cultcache(key = 7)] - pub sha256: String, - #[cultcache(key = 8)] - pub built_at: String, - #[cultcache(key = 9, default)] - pub release_authority_id: String, - #[cultcache(key = 10, default)] - pub release_authority_envelope_sha256: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "bifrost.repository_release_authority", - schema = "bifrost.repository_release_authority.v1" -)] -pub struct BifrostRepositoryReleaseAuthorityRecord { - #[cultcache(key = 0)] - pub authority_id: String, - #[cultcache(key = 1)] - pub command_id: String, - #[cultcache(key = 2)] - pub crossing_receipt_id: String, - #[cultcache(key = 3)] - pub repository_full_name: String, - #[cultcache(key = 4)] - pub upstream_ref: String, - #[cultcache(key = 5)] - pub commit_sha: String, - #[cultcache(key = 6)] - pub decision: String, - #[cultcache(key = 7)] - pub status: String, - #[cultcache(key = 8)] - pub policy_decision_id: String, - #[cultcache(key = 9)] - pub authority_reference: String, - #[cultcache(key = 10)] - pub actor_identity: String, - #[cultcache(key = 11)] - pub source_kind: String, - #[cultcache(key = 12)] - pub source_id: String, - #[cultcache(key = 13, default)] - pub epiphany_run_id: String, - #[cultcache(key = 14, default)] - pub epiphany_lane_id: String, - #[cultcache(key = 15, default)] - pub epiphany_agent_identity: String, - #[cultcache(key = 16)] - pub external_receipt_url: String, - #[cultcache(key = 17)] - pub external_receipt_id: String, - #[cultcache(key = 18)] - pub authorized_at: String, - #[cultcache(key = 19, default)] - pub expires_at: String, - #[cultcache(key = 20, default)] - pub revoked_at: String, - #[cultcache(key = 21, default)] - pub revocation_reason: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "idunn.state_migration_plan", - schema = "idunn.state_migration_plan.v1" -)] -pub struct IdunnStateMigrationPlanRecord { - #[cultcache(key = 0)] - pub plan_id: String, - #[cultcache(key = 1)] - pub daemon_id: String, - #[cultcache(key = 2)] - pub from_schema_version: String, - #[cultcache(key = 3)] - pub to_schema_version: String, - #[cultcache(key = 4)] - pub authority: String, - #[cultcache(key = 5)] - pub command: String, - #[cultcache(key = 6)] - pub strategy: String, - #[cultcache(key = 7)] - pub backup_required: bool, - #[cultcache(key = 8)] - pub zero_downtime_required: bool, - #[cultcache(key = 9)] - pub status: String, - #[cultcache(key = 10)] - pub planned_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "idunn.state_migration_result", - schema = "idunn.state_migration_result.v1" -)] -pub struct IdunnStateMigrationResultRecord { - #[cultcache(key = 0)] - pub result_id: String, - #[cultcache(key = 1)] - pub plan_id: String, - #[cultcache(key = 2)] - pub daemon_id: String, - #[cultcache(key = 3)] - pub state: String, - #[cultcache(key = 4)] - pub detail: String, - #[cultcache(key = 5)] - pub completed_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache(type = "idunn.rollout_plan", schema = "idunn.rollout_plan.v1")] -pub struct IdunnRolloutPlanRecord { - #[cultcache(key = 0)] - pub plan_id: String, - #[cultcache(key = 1)] - pub daemon_id: String, - #[cultcache(key = 2)] - pub desired_revision: String, - #[cultcache(key = 3)] - pub deployed_revision: String, - #[cultcache(key = 4)] - pub strategy: String, - #[cultcache(key = 5)] - pub phases: Vec, - #[cultcache(key = 6)] - pub migration_plan_id: String, - #[cultcache(key = 7)] - pub artifact_id: String, - #[cultcache(key = 8)] - pub status: String, - #[cultcache(key = 9)] - pub planned_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache(type = "idunn.rollout_result", schema = "idunn.rollout_result.v1")] -pub struct IdunnRolloutResultRecord { - #[cultcache(key = 0)] - pub result_id: String, - #[cultcache(key = 1)] - pub plan_id: String, - #[cultcache(key = 2)] - pub daemon_id: String, - #[cultcache(key = 3)] - pub state: String, - #[cultcache(key = 4)] - pub detail: String, - #[cultcache(key = 5)] - pub completed_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache(type = "idunn.operator_alarm", schema = "idunn.operator_alarm.v1")] -pub struct IdunnOperatorAlarmRecord { - #[cultcache(key = 0)] - pub alarm_id: String, - #[cultcache(key = 1)] - pub daemon_id: String, - #[cultcache(key = 2)] - pub severity: String, - #[cultcache(key = 3)] - pub reason: String, - #[cultcache(key = 4)] - pub escalation_target: String, - #[cultcache(key = 5)] - pub raised_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "idunn.swarm_surgery_plan", - schema = "idunn.swarm_surgery_plan.v1" -)] -pub struct IdunnSwarmSurgeryPlanRecord { - #[cultcache(key = 0)] - pub plan_id: String, - #[cultcache(key = 1)] - pub profile: String, - #[cultcache(key = 2)] - pub status: String, - #[cultcache(key = 3)] - pub owner: String, - #[cultcache(key = 4)] - pub objective: String, - #[cultcache(key = 5)] - pub current_mechanism: String, - #[cultcache(key = 6)] - pub invariants: Vec, - #[cultcache(key = 7)] - pub phases: Vec, - #[cultcache(key = 8)] - pub current_phase: String, - #[cultcache(key = 9)] - pub next_target: String, - #[cultcache(key = 10)] - pub cut_line: String, - #[cultcache(key = 11)] - pub verification_layer: String, - #[cultcache(key = 12)] - pub updated_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "idunn.daemon_surgery_plan", - schema = "idunn.daemon_surgery_plan.v1" -)] -pub struct IdunnDaemonSurgeryPlanRecord { - #[cultcache(key = 0)] - pub plan_id: String, - #[cultcache(key = 1)] - pub daemon_id: String, - #[cultcache(key = 2)] - pub severity: String, - #[cultcache(key = 3)] - pub status: String, - #[cultcache(key = 4)] - pub owner: String, - #[cultcache(key = 5)] - pub objective: String, - #[cultcache(key = 6)] - pub current_mechanism: String, - #[cultcache(key = 7)] - pub intended_authority: String, - #[cultcache(key = 8)] - pub cut_line: String, - #[cultcache(key = 9)] - pub steps: Vec, - #[cultcache(key = 10)] - pub blockers: Vec, - #[cultcache(key = 11)] - pub updated_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "idunn.daemon_transport_profile", - schema = "idunn.daemon_transport_profile.v1" -)] -pub struct IdunnDaemonTransportProfileRecord { - #[cultcache(key = 0)] - pub profile_id: String, - #[cultcache(key = 1)] - pub daemon_id: String, - #[cultcache(key = 2)] - pub target_transport: String, - #[cultcache(key = 3)] - pub current_transport: String, - #[cultcache(key = 4)] - pub state: String, - #[cultcache(key = 5)] - pub health_contract: String, - #[cultcache(key = 6)] - pub publication_schema: String, - #[cultcache(key = 7)] - pub debug_mechanism: String, - #[cultcache(key = 8)] - pub cut_line: String, - #[cultcache(key = 9)] - pub observed_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache(type = "idunn.command_boundary", schema = "idunn.command_boundary.v1")] -pub struct IdunnCommandBoundaryRecord { - #[cultcache(key = 0)] - pub boundary_id: String, - #[cultcache(key = 1)] - pub daemon_id: String, - #[cultcache(key = 2)] - pub owner: String, - #[cultcache(key = 3)] - pub restart_authority: String, - #[cultcache(key = 4)] - pub deploy_authority: String, - #[cultcache(key = 5)] - pub health_authority: String, - #[cultcache(key = 6)] - pub alarm_authority: String, - #[cultcache(key = 7)] - pub command_lowerings: Vec, - #[cultcache(key = 8)] - pub forbidden_authority: String, - #[cultcache(key = 9)] - pub observed_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "idunn.runtime_transport_check", - schema = "idunn.runtime_transport_check.v1" -)] -pub struct IdunnRuntimeTransportCheckRecord { - #[cultcache(key = 0)] - pub check_id: String, - #[cultcache(key = 1)] - pub runtime_id: String, - #[cultcache(key = 2)] - pub transport: String, - #[cultcache(key = 3)] - pub state: String, - #[cultcache(key = 4)] - pub detail: String, - #[cultcache(key = 5)] - pub observed_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "idunn.rudp_health_ingress", - schema = "idunn.rudp_health_ingress.v1" -)] -pub struct IdunnRudpHealthIngressRecord { - #[cultcache(key = 0)] - pub ingress_id: String, - #[cultcache(key = 1)] - pub bind_address: String, - #[cultcache(key = 2)] - pub transport: String, - #[cultcache(key = 3)] - pub accepted_schema: String, - #[cultcache(key = 4)] - pub state: String, - #[cultcache(key = 5)] - pub detail: String, - #[cultcache(key = 6)] - pub observed_at: String, -} - #[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] #[cultcache(type = "muninn.capture_stream", schema = "muninn.capture_stream.v1")] pub struct MuninnCaptureStreamRecord { @@ -1800,37 +859,6 @@ cultmesh_rs::cultmesh_documents!(OdinDocuments { EveInterfaceBindingCompatRecord => EVE_INTERFACE_BINDING_SCHEMA, EveProviderAdvertisementRecord => EVE_PROVIDER_ADVERTISEMENT_SCHEMA, VoidBotSwarmStateSnapshotCompatRecord => VOIDBOT_SWARM_STATE_SNAPSHOT_SCHEMA, - IdunnDesiredDaemonRecord => IDUNN_DESIRED_DAEMON_SCHEMA, - IdunnDaemonHealthRecord => IDUNN_DAEMON_HEALTH_SCHEMA, - IdunnSignedHealthAdmissionRecord => IDUNN_SIGNED_HEALTH_ADMISSION_SCHEMA, - IdunnSignedDaemonHealthRecord => IDUNN_SIGNED_DAEMON_HEALTH_SCHEMA, - IdunnDaemonHealthTrustBindingRecord => IDUNN_DAEMON_HEALTH_TRUST_BINDING_SCHEMA, - IdunnAuthenticatedDaemonHealthAdmissionRecord => IDUNN_AUTHENTICATED_DAEMON_HEALTH_ADMISSION_SCHEMA, - IdunnRuntimeTrafficAdmissionRecord => IDUNN_RUNTIME_TRAFFIC_ADMISSION_SCHEMA, - IdunnUnsignedDaemonHealthDiagnosticRecord => IDUNN_UNSIGNED_DAEMON_HEALTH_DIAGNOSTIC_SCHEMA, - GameCultServiceTrustAnchorRecord => GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA, - IdunnAuthenticatedProviderHealthProjectionRecord => IDUNN_AUTHENTICATED_PROVIDER_HEALTH_PROJECTION_SCHEMA, - IdunnKeepaliveDecisionRecord => IDUNN_KEEPALIVE_DECISION_SCHEMA, - IdunnRestartRequestRecord => IDUNN_RESTART_REQUEST_SCHEMA, - IdunnRestartResultRecord => IDUNN_RESTART_RESULT_SCHEMA, - IdunnDeploymentRequestRecord => IDUNN_DEPLOYMENT_REQUEST_SCHEMA, - IdunnCurrentDeploymentRequestRecord => IDUNN_CURRENT_DEPLOYMENT_REQUEST_SCHEMA, - IdunnDeploymentResultRecord => IDUNN_DEPLOYMENT_RESULT_SCHEMA, - IdunnLifecycleCommandRecord => IDUNN_LIFECYCLE_COMMAND_SCHEMA, - IdunnReleaseTargetRecord => IDUNN_RELEASE_TARGET_SCHEMA, - IdunnDeploymentArtifactRecord => IDUNN_DEPLOYMENT_ARTIFACT_SCHEMA, - BifrostRepositoryReleaseAuthorityRecord => BIFROST_REPOSITORY_RELEASE_AUTHORITY_SCHEMA, - IdunnStateMigrationPlanRecord => IDUNN_STATE_MIGRATION_PLAN_SCHEMA, - IdunnStateMigrationResultRecord => IDUNN_STATE_MIGRATION_RESULT_SCHEMA, - IdunnRolloutPlanRecord => IDUNN_ROLLOUT_PLAN_SCHEMA, - IdunnRolloutResultRecord => IDUNN_ROLLOUT_RESULT_SCHEMA, - IdunnOperatorAlarmRecord => IDUNN_OPERATOR_ALARM_SCHEMA, - IdunnSwarmSurgeryPlanRecord => IDUNN_SWARM_SURGERY_PLAN_SCHEMA, - IdunnDaemonSurgeryPlanRecord => IDUNN_DAEMON_SURGERY_PLAN_SCHEMA, - IdunnDaemonTransportProfileRecord => IDUNN_DAEMON_TRANSPORT_PROFILE_SCHEMA, - IdunnCommandBoundaryRecord => IDUNN_COMMAND_BOUNDARY_SCHEMA, - IdunnRuntimeTransportCheckRecord => IDUNN_RUNTIME_TRANSPORT_CHECK_SCHEMA, - IdunnRudpHealthIngressRecord => IDUNN_RUDP_HEALTH_INGRESS_SCHEMA, MuninnTelemetrySurfaceRecord => MUNINN_TELEMETRY_SURFACE_SCHEMA, MuninnCaptureStreamRecord => MUNINN_CAPTURE_STREAM_SCHEMA, MuninnCaptureStreamCommandRecord => MUNINN_CAPTURE_STREAM_COMMAND_SCHEMA, @@ -1869,421 +897,6 @@ mod tests { use anyhow::Result; use cultmesh_rs::{CultMesh, CultMeshNodeOptions}; - fn signed_health_fixture() -> IdunnSignedDaemonHealthRecord { - IdunnSignedDaemonHealthRecord { - schema_version: IDUNN_SIGNED_DAEMON_HEALTH_SCHEMA.into(), - daemon_id: "yggdrasil-epiphany".into(), - health_contract: "epiphany.cultnet-rudp-runtime-health".into(), - source_runtime_id: "epiphany-yggdrasil".into(), - state: "active".into(), - detail: "provider-authenticated resident readiness".into(), - signer_identity_id: "epiphany-host-identity".into(), - publisher_incarnation_id: "epiphany-yggdrasil/boot-7/process-11".into(), - publisher_sequence: 42, - observed_at_unix_millis: 1_784_483_200_000, - release_id: Some("release-42".into()), - release_witness_sha256: Some(format!("sha256-{}", "a".repeat(64))), - source_commit: Some("b".repeat(40)), - deployment_id: Some("deploy:yggdrasil-epiphany:42".into()), - signature_algorithm: "ed25519".into(), - signature: vec![9; 64], - private_state_exposed: false, - activation_witness_sha256: Some(format!("sha256-{}", "f".repeat(64))), - } - } - - fn trust_binding_fixture() -> IdunnDaemonHealthTrustBindingRecord { - let health = signed_health_fixture(); - let signer_public_key = vec![7; 32]; - IdunnDaemonHealthTrustBindingRecord { - schema_version: IDUNN_DAEMON_HEALTH_TRUST_BINDING_SCHEMA.into(), - binding_id: "root/yggdrasil-epiphany/health".into(), - daemon_id: health.daemon_id, - health_contract: health.health_contract, - source_runtime_id: health.source_runtime_id, - signer_identity_id: derive_service_identity_id::( - &signer_public_key, - ) - .unwrap(), - signer_public_key, - binding_authority: "root".into(), - bound_at_unix_millis: 1_784_483_100_000, - release_binding_required: true, - private_state_exposed: false, - } - } - - fn authenticated_admission_fixture() -> IdunnAuthenticatedDaemonHealthAdmissionRecord { - let health = signed_health_fixture(); - let binding = trust_binding_fixture(); - IdunnAuthenticatedDaemonHealthAdmissionRecord { - schema_version: IDUNN_AUTHENTICATED_DAEMON_HEALTH_ADMISSION_SCHEMA.into(), - daemon_id: health.daemon_id, - health_contract: health.health_contract, - source_runtime_id: health.source_runtime_id, - state: health.state, - observed_at_unix_millis: health.observed_at_unix_millis, - admitted_at_unix_millis: health.observed_at_unix_millis + 1, - trust_binding_id: binding.binding_id, - trust_binding_sha256: format!("sha256-{}", "c".repeat(64)), - signer_identity_id: health.signer_identity_id, - publisher_incarnation_id: health.publisher_incarnation_id, - publisher_sequence: health.publisher_sequence, - signed_health_sha256: format!("sha256-{}", "d".repeat(64)), - release_id: health.release_id, - release_witness_sha256: health.release_witness_sha256, - source_commit: health.source_commit, - deployment_id: health.deployment_id, - private_state_exposed: false, - activation_witness_sha256: health.activation_witness_sha256, - } - } - - fn runtime_traffic_admission_fixture() -> IdunnRuntimeTrafficAdmissionRecord { - let admission = authenticated_admission_fixture(); - IdunnRuntimeTrafficAdmissionRecord { - schema_version: IDUNN_RUNTIME_TRAFFIC_ADMISSION_SCHEMA.into(), - daemon_id: IDUNN_CODEX_CONNECTOR_RUNTIME_TRAFFIC_ADMISSION_RECORD_KEY.into(), - release_id: admission.release_id.unwrap(), - release_witness_sha256: admission.release_witness_sha256.unwrap(), - source_commit: admission.source_commit.unwrap(), - deployment_id: admission.deployment_id.unwrap(), - activation_witness_sha256: admission.activation_witness_sha256.unwrap(), - signed_health_sha256: admission.signed_health_sha256, - publisher_incarnation_id: admission.publisher_incarnation_id, - publisher_sequence: admission.publisher_sequence, - signer_identity_id: admission.signer_identity_id, - runtime_process_id: 41, - runtime_process_starttime_ticks: 987_654, - } - } - - fn service_trust_anchor_fixture() -> GameCultServiceTrustAnchorRecord { - let signer_public_key = vec![5; 32]; - GameCultServiceTrustAnchorRecord { - schema_version: GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA.into(), - trust_anchor_id: "root/idunn/authenticated-provider-health-projection".into(), - service_id: "idunn".into(), - runtime_id: "idunn-yggdrasil".into(), - signer_identity_id: derive_service_identity_id::( - &signer_public_key, - ) - .unwrap(), - signer_public_key, - signature_algorithm: "ed25519".into(), - signing_purpose: IDUNN_AUTHENTICATED_PROVIDER_HEALTH_PROJECTION_SIGNING_PURPOSE.into(), - signed_schema: IDUNN_AUTHENTICATED_PROVIDER_HEALTH_PROJECTION_SCHEMA.into(), - binding_authority: "root".into(), - bound_at_unix_millis: 1_784_483_100_000, - expires_at_unix_millis: Some(1_815_000_000_000), - private_state_exposed: false, - } - } - - fn authenticated_provider_health_projection_fixture() - -> IdunnAuthenticatedProviderHealthProjectionRecord { - let health = signed_health_fixture(); - let binding = trust_binding_fixture(); - IdunnAuthenticatedProviderHealthProjectionRecord { - schema_version: IDUNN_AUTHENTICATED_PROVIDER_HEALTH_PROJECTION_SCHEMA.into(), - projection_id: format!("authenticated-provider-health:{}", health.daemon_id), - daemon_id: health.daemon_id, - health_contract: health.health_contract, - provider_state: health.state, - reason_code: IDUNN_PROVIDER_ACTIVE_REASON.into(), - provider_observed_at_unix_millis: health.observed_at_unix_millis, - admitted_at_unix_millis: health.observed_at_unix_millis + 1, - evaluated_at_unix_millis: health.observed_at_unix_millis + 2, - trust_binding_id: binding.binding_id, - trust_binding_sha256: format!("sha256-{}", "c".repeat(64)), - signed_health_sha256: format!("sha256-{}", "d".repeat(64)), - authenticated_admission_sha256: format!("sha256-{}", "e".repeat(64)), - provider_signer_identity_id: health.signer_identity_id, - provider_incarnation_id: health.publisher_incarnation_id, - provider_sequence: health.publisher_sequence, - release_id: health.release_id, - release_witness_sha256: health.release_witness_sha256, - source_commit: health.source_commit, - deployment_id: health.deployment_id, - idunn_runtime_id: "idunn-yggdrasil".into(), - idunn_signer_identity_id: "idunn-yggdrasil-service-identity".into(), - projection_incarnation_id: "idunn-yggdrasil/boot-3/process-8".into(), - projection_sequence: 7, - signature_algorithm: "ed25519".into(), - signature: vec![6; 64], - private_state_exposed: false, - expires_at_unix_millis: health.observed_at_unix_millis + 60_002, - } - } - - #[test] - fn outward_authenticated_provider_health_contracts_validate_and_round_trip() -> Result<()> { - let anchor = service_trust_anchor_fixture(); - let projection = authenticated_provider_health_projection_fixture(); - anchor.validate()?; - projection.validate()?; - - let temp = tempfile::tempdir()?; - let store_path = temp - .path() - .join("authenticated-provider-health-projection.cc"); - let mut node = CultMesh::create_node( - &store_path, - OdinDocuments, - CultMeshNodeOptions { - runtime_id: "authenticated-provider-health-contract-test".into(), - pull_on_start: true, - }, - )?; - node.put(&anchor.trust_anchor_id, &anchor)?; - node.put(&projection.projection_id, &projection)?; - assert_eq!( - node.get_required::(&anchor.trust_anchor_id)?, - anchor - ); - assert_eq!( - node.get_required::( - &projection.projection_id - )?, - projection - ); - assert_eq!( - authenticated_provider_health_reason_code("warming"), - Some(IDUNN_PROVIDER_WARMING_REASON) - ); - assert_eq!( - authenticated_provider_health_reason_code("degraded"), - Some(IDUNN_PROVIDER_DEGRADED_REASON) - ); - assert_eq!( - authenticated_provider_health_reason_code("failed"), - Some(IDUNN_PROVIDER_FAILED_REASON) - ); - assert_eq!(authenticated_provider_health_reason_code("missing"), None); - Ok(()) - } - - #[test] - fn outward_authenticated_provider_health_contracts_refuse_substitution_and_weak_lineage() { - let mut anchor = service_trust_anchor_fixture(); - anchor.binding_authority = "idunn".into(); - assert!(anchor.validate().is_err()); - anchor = service_trust_anchor_fixture(); - anchor.signer_public_key = vec![5; 31]; - assert!(anchor.validate().is_err()); - anchor = service_trust_anchor_fixture(); - anchor.expires_at_unix_millis = Some(anchor.bound_at_unix_millis); - assert!(anchor.validate().is_err()); - anchor = service_trust_anchor_fixture(); - anchor.private_state_exposed = true; - assert!(anchor.validate().is_err()); - anchor = service_trust_anchor_fixture(); - anchor.signing_purpose = "caller.chosen-purpose".into(); - assert!(anchor.validate().is_err()); - anchor = service_trust_anchor_fixture(); - anchor.signer_identity_id = "caller-chosen-identity".into(); - assert!(anchor.validate().is_err()); - - let mut projection = authenticated_provider_health_projection_fixture(); - projection.evaluated_at_unix_millis = projection.admitted_at_unix_millis - 1; - assert!(projection.validate().is_err()); - projection = authenticated_provider_health_projection_fixture(); - projection.expires_at_unix_millis = projection.evaluated_at_unix_millis; - assert!(projection.validate().is_err()); - projection = authenticated_provider_health_projection_fixture(); - projection.authenticated_admission_sha256 = "admitted".into(); - assert!(projection.validate().is_err()); - projection = authenticated_provider_health_projection_fixture(); - projection.projection_sequence = 0; - assert!(projection.validate().is_err()); - projection = authenticated_provider_health_projection_fixture(); - projection.signature.clear(); - assert!(projection.validate().is_err()); - projection = authenticated_provider_health_projection_fixture(); - projection.release_witness_sha256 = None; - assert!(projection.validate().is_err()); - projection = authenticated_provider_health_projection_fixture(); - projection.deployment_id = None; - assert!(projection.validate().is_err()); - projection = authenticated_provider_health_projection_fixture(); - projection.private_state_exposed = true; - assert!(projection.validate().is_err()); - projection = authenticated_provider_health_projection_fixture(); - projection.reason_code = "release_drift".into(); - assert!(projection.validate().is_err()); - projection = authenticated_provider_health_projection_fixture(); - projection.provider_state = "missing".into(); - projection.reason_code = "authenticated_provider_failed".into(); - assert!(projection.validate().is_err()); - } - - #[test] - fn generic_signed_health_contracts_validate_and_round_trip() -> Result<()> { - let health = signed_health_fixture(); - let binding = trust_binding_fixture(); - let admission = authenticated_admission_fixture(); - health.validate()?; - binding.validate()?; - admission.validate()?; - - let temp = tempfile::tempdir()?; - let store_path = temp.path().join("signed-health.cc"); - let mut node = CultMesh::create_node( - &store_path, - OdinDocuments, - CultMeshNodeOptions { - runtime_id: "idunn-test".into(), - pull_on_start: true, - }, - )?; - node.put(&health.daemon_id, &health)?; - node.put(&binding.binding_id, &binding)?; - node.put(&admission.daemon_id, &admission)?; - assert_eq!( - node.get_required::(&health.daemon_id)?, - health - ); - assert_eq!( - node.get_required::(&binding.binding_id)?, - binding - ); - assert_eq!( - node.get_required::( - &admission.daemon_id - )?, - admission - ); - Ok(()) - } - - #[test] - fn runtime_traffic_admission_is_a_closed_positional_document() -> Result<()> { - let admission = runtime_traffic_admission_fixture(); - admission.validate()?; - assert_eq!( - IdunnRuntimeTrafficAdmissionRecord::TYPE, - "idunn.runtime_traffic_admission" - ); - assert_eq!( - IdunnRuntimeTrafficAdmissionRecord::SCHEMA_NAME, - IDUNN_RUNTIME_TRAFFIC_ADMISSION_SCHEMA - ); - let payload = rmp_serde::to_vec(&admission)?; - assert_eq!(payload.first(), Some(&0x9d)); - assert_eq!( - rmp_serde::from_slice::(&payload)?, - admission - ); - let pre_process_binding = rmp_serde::to_vec(&( - admission.schema_version.clone(), - admission.daemon_id.clone(), - admission.release_id.clone(), - admission.release_witness_sha256.clone(), - admission.source_commit.clone(), - admission.deployment_id.clone(), - admission.activation_witness_sha256.clone(), - admission.signed_health_sha256.clone(), - admission.publisher_incarnation_id.clone(), - admission.publisher_sequence, - admission.signer_identity_id.clone(), - ))?; - assert_eq!(pre_process_binding.first(), Some(&0x9b)); - assert!( - rmp_serde::from_slice::(&pre_process_binding) - .is_err(), - "runtime admission v2 must not decode a pre-process-binding body" - ); - let mut ghostlight = admission.clone(); - ghostlight.daemon_id = IDUNN_GHOSTLIGHT_RUNTIME_TRAFFIC_ADMISSION_RECORD_KEY.into(); - ghostlight.validate()?; - Ok(()) - } - - #[test] - fn runtime_traffic_admission_refuses_weak_or_partial_lineage() { - let mut admission = runtime_traffic_admission_fixture(); - admission.publisher_sequence = 0; - assert!(admission.validate().is_err()); - - admission = runtime_traffic_admission_fixture(); - admission.source_commit = "F".repeat(40); - assert!(admission.validate().is_err()); - - admission = runtime_traffic_admission_fixture(); - admission.activation_witness_sha256 = "missing".into(); - assert!(admission.validate().is_err()); - - admission = runtime_traffic_admission_fixture(); - admission.schema_version = "idunn.runtime_traffic_admission.v0".into(); - assert!(admission.validate().is_err()); - - admission = runtime_traffic_admission_fixture(); - admission.daemon_id = "caller-selected-daemon".into(); - assert!(admission.validate().is_err()); - - admission = runtime_traffic_admission_fixture(); - admission.runtime_process_id = 0; - assert!(admission.validate().is_err()); - - admission = runtime_traffic_admission_fixture(); - admission.runtime_process_starttime_ticks = 0; - assert!(admission.validate().is_err()); - } - - #[test] - fn activation_binding_is_additive_for_existing_authenticated_admissions() -> Result<()> { - let mut admission = authenticated_admission_fixture(); - admission.activation_witness_sha256 = None; - let mut legacy = rmp_serde::to_vec(&admission)?; - assert_eq!(&legacy[..3], &[0xdc, 0, 19]); - assert_eq!(legacy.pop(), Some(0xc0)); - legacy[2] = 18; - let decoded: IdunnAuthenticatedDaemonHealthAdmissionRecord = - rmp_serde::from_slice(&legacy)?; - assert_eq!(decoded.activation_witness_sha256, None); - decoded.validate()?; - Ok(()) - } - - #[test] - fn generic_signed_health_contracts_refuse_weak_or_partial_authority() { - let mut health = signed_health_fixture(); - health.private_state_exposed = true; - assert!(health.validate().is_err()); - health = signed_health_fixture(); - health.signature.clear(); - assert!(health.validate().is_err()); - health = signed_health_fixture(); - health.release_witness_sha256 = None; - assert!(health.validate().is_err()); - health = signed_health_fixture(); - health.publisher_sequence = 0; - assert!(health.validate().is_err()); - health = signed_health_fixture(); - health.activation_witness_sha256 = Some(format!("sha256-{}", "F".repeat(64))); - assert!(health.validate().is_err()); - - let mut binding = trust_binding_fixture(); - binding.binding_authority = "daemon".into(); - assert!(binding.validate().is_err()); - binding = trust_binding_fixture(); - binding.signer_public_key = vec![1; 31]; - assert!(binding.validate().is_err()); - binding = trust_binding_fixture(); - binding.private_state_exposed = true; - assert!(binding.validate().is_err()); - - let mut admission = authenticated_admission_fixture(); - admission.trust_binding_sha256 = "ready".into(); - assert!(admission.validate().is_err()); - admission = authenticated_admission_fixture(); - admission.admitted_at_unix_millis = admission.observed_at_unix_millis - 1; - assert!(admission.validate().is_err()); - admission = authenticated_admission_fixture(); - admission.activation_witness_sha256 = Some("caller-selected".into()); - assert!(admission.validate().is_err()); - } - #[test] fn muninn_media_documents_round_trip_through_cultmesh() -> Result<()> { let temp = tempfile::tempdir()?; diff --git a/crates/odin-core/src/idunn.rs b/crates/odin-core/src/idunn.rs deleted file mode 100644 index a699c1d..0000000 --- a/crates/odin-core/src/idunn.rs +++ /dev/null @@ -1,672 +0,0 @@ -use crate::documents::{ - IdunnDaemonHealthRecord, IdunnDeploymentRequestRecord, IdunnDesiredDaemonRecord, - IdunnKeepaliveDecisionRecord, IdunnOperatorAlarmRecord, IdunnRestartRequestRecord, -}; - -#[derive(Clone, Debug, PartialEq, Eq)] -pub struct IdunnPlan { - pub decision: IdunnKeepaliveDecisionRecord, - pub deployment_request: Option, - pub restart_request: Option, - pub operator_alarm: Option, -} - -pub fn plan_keepalive( - desired: &IdunnDesiredDaemonRecord, - health: &IdunnDaemonHealthRecord, - now: impl Into, -) -> IdunnPlan { - let now = now.into(); - let decision_id = format!("{}:{}", desired.daemon_id, now); - - if !desired.enabled { - return IdunnPlan { - decision: decision(&decision_id, desired, "noop", "daemon is disabled", &now), - deployment_request: None, - restart_request: None, - operator_alarm: None, - }; - } - - if is_healthy(&health.state) { - return IdunnPlan { - decision: decision(&decision_id, desired, "observe", "daemon is healthy", &now), - deployment_request: None, - restart_request: None, - operator_alarm: None, - }; - } - - if health.state == "warming" { - return IdunnPlan { - decision: decision( - &decision_id, - desired, - "observe", - "daemon is warming under provider-owned progress authority", - &now, - ), - deployment_request: None, - restart_request: None, - operator_alarm: None, - }; - } - - if health.state == "degraded" || health.state == "dependency-unavailable" { - let alarm_id = format!("alarm:{}:{}", desired.daemon_id, now); - let reason = format!( - "health is {}; local restart/deploy is not the owner of this failure: {}", - health.state, health.detail - ); - return IdunnPlan { - decision: decision(&decision_id, desired, "alarm", &reason, &now), - deployment_request: None, - restart_request: None, - operator_alarm: Some(IdunnOperatorAlarmRecord { - alarm_id, - daemon_id: desired.daemon_id.clone(), - severity: "operator-action-required".to_string(), - reason, - escalation_target: "bifrost.operator-notification".to_string(), - raised_at: now, - }), - }; - } - - if let Some(command) = desired.deploy_command.as_deref() { - if !command.trim().is_empty() && health.state == "stale-deployment" { - let request_id = format!("deploy:{}:{}", desired.daemon_id, now); - return IdunnPlan { - decision: decision( - &decision_id, - desired, - "deploy", - &format!( - "health is {}; deployment authority is available", - health.state - ), - &now, - ), - deployment_request: Some(IdunnDeploymentRequestRecord { - request_id, - daemon_id: desired.daemon_id.clone(), - command: command.to_string(), - authority: desired.authority.clone(), - requested_at: now, - repository_full_name: String::new(), - upstream_ref: String::new(), - source_revision: String::new(), - release_authority_id: String::new(), - release_authority_envelope_sha256: String::new(), - requires_bifrost_authority: false, - }), - restart_request: None, - operator_alarm: None, - }; - } - } - - if health.state == "stale-deployment" { - let alarm_id = format!("alarm:{}:{}", desired.daemon_id, now); - let reason = format!( - "health is stale-deployment under {}; no deploy command authority is available", - desired.health_contract - ); - return IdunnPlan { - decision: decision(&decision_id, desired, "alarm", &reason, &now), - deployment_request: None, - restart_request: None, - operator_alarm: Some(IdunnOperatorAlarmRecord { - alarm_id, - daemon_id: desired.daemon_id.clone(), - severity: "operator-action-required".to_string(), - reason, - escalation_target: "bifrost.operator-notification".to_string(), - raised_at: now, - }), - }; - } - - match desired.restart_command.as_deref() { - Some(command) if !command.trim().is_empty() => { - let request_id = format!("restart:{}:{}", desired.daemon_id, now); - IdunnPlan { - decision: decision( - &decision_id, - desired, - "restart", - &format!("health is {}; restart authority is available", health.state), - &now, - ), - restart_request: Some(IdunnRestartRequestRecord { - request_id, - daemon_id: desired.daemon_id.clone(), - command: command.to_string(), - authority: desired.authority.clone(), - requested_at: now, - }), - deployment_request: None, - operator_alarm: None, - } - } - _ => { - let alarm_id = format!("alarm:{}:{}", desired.daemon_id, now); - let reason = format!( - "health is {}; no restart command authority is available", - health.state - ); - IdunnPlan { - decision: decision(&decision_id, desired, "alarm", &reason, &now), - deployment_request: None, - restart_request: None, - operator_alarm: Some(IdunnOperatorAlarmRecord { - alarm_id, - daemon_id: desired.daemon_id.clone(), - severity: "operator-action-required".to_string(), - reason, - escalation_target: "bifrost.operator-notification".to_string(), - raised_at: now, - }), - } - } - } -} - -fn is_healthy(state: &str) -> bool { - matches!(state, "active" | "healthy" | "ok" | "running") -} - -fn decision( - decision_id: &str, - desired: &IdunnDesiredDaemonRecord, - action: &str, - reason: &str, - decided_at: &str, -) -> IdunnKeepaliveDecisionRecord { - IdunnKeepaliveDecisionRecord { - decision_id: decision_id.to_string(), - daemon_id: desired.daemon_id.clone(), - action: action.to_string(), - reason: reason.to_string(), - authority: desired.authority.clone(), - decided_at: decided_at.to_string(), - } -} - -#[cfg(test)] -mod tests { - use super::*; - use crate::documents::{ - IDUNN_COMMAND_BOUNDARY_SCHEMA, IDUNN_DAEMON_SURGERY_PLAN_SCHEMA, - IDUNN_DAEMON_TRANSPORT_PROFILE_SCHEMA, IDUNN_DEPLOYMENT_ARTIFACT_SCHEMA, - IDUNN_DESIRED_DAEMON_SCHEMA, IDUNN_RELEASE_TARGET_SCHEMA, IDUNN_ROLLOUT_PLAN_SCHEMA, - IDUNN_STATE_MIGRATION_PLAN_SCHEMA, IDUNN_SWARM_SURGERY_PLAN_SCHEMA, - IdunnCommandBoundaryRecord, IdunnDaemonSurgeryPlanRecord, - IdunnDaemonTransportProfileRecord, IdunnDeploymentArtifactRecord, IdunnReleaseTargetRecord, - IdunnRolloutPlanRecord, IdunnRuntimeTransportCheckRecord, IdunnStateMigrationPlanRecord, - IdunnSwarmSurgeryPlanRecord, OdinDocuments, - }; - use anyhow::Result; - use cultmesh_rs::{CultMesh, CultMeshNodeOptions}; - - fn desired(restart_command: Option<&str>) -> IdunnDesiredDaemonRecord { - IdunnDesiredDaemonRecord { - daemon_id: "voidbot".to_string(), - verse_id: "local".to_string(), - name: "VoidBot".to_string(), - enabled: true, - health_command: None, - restart_command: restart_command.map(ToString::to_string), - authority: "idunn-supervisor-command".to_string(), - max_silence_seconds: 60, - observed_at: "2026-06-04T00:00:00Z".to_string(), - deploy_command: None, - health_contract: "test.cultnet-rudp-health".to_string(), - transport_profile_id: "transport:voidbot".to_string(), - command_boundary_id: "command-boundary:voidbot".to_string(), - } - } - - fn health(state: &str) -> IdunnDaemonHealthRecord { - IdunnDaemonHealthRecord { - daemon_id: "voidbot".to_string(), - state: state.to_string(), - detail: "unit daemon publication".to_string(), - observed_at: "2026-06-04T00:00:01Z".to_string(), - health_contract: "test.cultnet-rudp-health".to_string(), - publication_source: "debug-command".to_string(), - transport: "debug.local-command".to_string(), - } - } - - #[test] - fn healthy_daemon_is_observed_without_restart() { - let plan = plan_keepalive( - &desired(Some("npm start")), - &health("active"), - "2026-06-04T00:00:02Z", - ); - - assert_eq!(plan.decision.action, "observe"); - assert!(plan.deployment_request.is_none()); - assert!(plan.restart_request.is_none()); - assert!(plan.operator_alarm.is_none()); - } - - #[test] - fn warming_daemon_is_observed_without_actuation_or_promotion() { - let mut desired = desired(Some("systemctl restart epiphany")); - desired.deploy_command = Some("deploy epiphany".to_string()); - let plan = plan_keepalive(&desired, &health("warming"), "2026-07-17T00:00:02Z"); - - assert_eq!(plan.decision.action, "observe"); - assert!(plan.decision.reason.contains("provider-owned progress")); - assert!(plan.deployment_request.is_none()); - assert!(plan.restart_request.is_none()); - assert!(plan.operator_alarm.is_none()); - } - - #[test] - fn unhealthy_daemon_with_restart_authority_requests_restart() { - let plan = plan_keepalive( - &desired(Some("npm start")), - &health("failed"), - "2026-06-04T00:00:02Z", - ); - - assert_eq!(plan.decision.action, "restart"); - assert!(plan.deployment_request.is_none()); - assert_eq!(plan.restart_request.unwrap().command, "npm start"); - assert!(plan.operator_alarm.is_none()); - } - - #[test] - fn unhealthy_daemon_with_deploy_authority_requests_deployment_before_restart() { - let mut desired = desired(Some("systemctl restart gjallar")); - desired.deploy_command = Some("deploy gjallar".to_string()); - let plan = plan_keepalive( - &desired, - &health("stale-deployment"), - "2026-06-04T00:00:02Z", - ); - - assert_eq!(plan.decision.action, "deploy"); - assert_eq!(plan.deployment_request.unwrap().command, "deploy gjallar"); - assert!(plan.restart_request.is_none()); - assert!(plan.operator_alarm.is_none()); - } - - #[test] - fn failed_daemon_with_deploy_and_restart_authority_restarts_instead_of_redeploying() { - let mut desired = desired(Some("systemctl restart gjallar")); - desired.deploy_command = Some("deploy gjallar".to_string()); - let plan = plan_keepalive(&desired, &health("failed"), "2026-06-04T00:00:02Z"); - - assert_eq!(plan.decision.action, "restart"); - assert!(plan.deployment_request.is_none()); - assert_eq!( - plan.restart_request.unwrap().command, - "systemctl restart gjallar" - ); - assert!(plan.operator_alarm.is_none()); - } - - #[test] - fn dependency_unavailable_raises_alarm_instead_of_redeploying_or_restarting() { - let mut desired = desired(Some("systemctl restart gjallar")); - desired.deploy_command = Some("deploy gjallar".to_string()); - let plan = plan_keepalive( - &desired, - &health("dependency-unavailable"), - "2026-06-04T00:00:02Z", - ); - - assert_eq!(plan.decision.action, "alarm"); - assert!(plan.deployment_request.is_none()); - assert!(plan.restart_request.is_none()); - assert!(plan.operator_alarm.is_some()); - } - - #[test] - fn stale_deployment_without_deploy_authority_raises_alarm_instead_of_restarting() { - let plan = plan_keepalive( - &desired(Some("systemctl restart old-app")), - &health("stale-deployment"), - "2026-06-04T00:00:02Z", - ); - - assert_eq!(plan.decision.action, "alarm"); - assert!(plan.deployment_request.is_none()); - assert!(plan.restart_request.is_none()); - assert!(plan.operator_alarm.is_some()); - } - - #[test] - fn unhealthy_daemon_without_authority_raises_operator_alarm() { - let plan = plan_keepalive(&desired(None), &health("failed"), "2026-06-04T00:00:02Z"); - - assert_eq!(plan.decision.action, "alarm"); - assert!(plan.deployment_request.is_none()); - assert!(plan.restart_request.is_none()); - assert_eq!( - plan.operator_alarm.unwrap().escalation_target, - "bifrost.operator-notification" - ); - } - - #[test] - fn idunn_records_round_trip_through_cultmesh() -> Result<()> { - let temp = tempfile::tempdir()?; - let store_path = temp.path().join("idunn.cc"); - let desired = desired(Some("npm start")); - let health = health("failed"); - let plan = plan_keepalive(&desired, &health, "2026-06-04T00:00:02Z"); - let request = plan.restart_request.unwrap(); - - let mut node = CultMesh::create_node( - &store_path, - OdinDocuments, - CultMeshNodeOptions { - runtime_id: "idunn-test".to_string(), - pull_on_start: true, - }, - )?; - node.put(&desired.daemon_id, &desired)?; - node.put(&health.daemon_id, &health)?; - node.put(&plan.decision.decision_id, &plan.decision)?; - node.put(&request.request_id, &request)?; - let surgery_plan = IdunnDaemonSurgeryPlanRecord { - plan_id: "surgery:voidbot".to_string(), - daemon_id: "voidbot".to_string(), - severity: "high".to_string(), - status: "transport-surgery-required".to_string(), - owner: "VoidBot internal provider stack".to_string(), - objective: "Publish VoidBot internal daemon health over CultNet/RUDP".to_string(), - current_mechanism: "daemon-published RUDP health".to_string(), - intended_authority: "daemon-owned CultNet/RUDP health record".to_string(), - cut_line: "daemon health must be published over CultNet/RUDP".to_string(), - steps: vec![ - "update CultLib".to_string(), - "publish RUDP health".to_string(), - ], - blockers: vec!["runtime CultLib update".to_string()], - updated_at: "2026-06-04T00:00:02Z".to_string(), - }; - let swarm_surgery_plan = IdunnSwarmSurgeryPlanRecord { - plan_id: "swarm-surgery:starfire-local".to_string(), - profile: "starfire-local".to_string(), - status: "active-transport-migration".to_string(), - owner: "Idunn swarm supervisor".to_string(), - objective: "Move daemon awareness to CultNet/RUDP".to_string(), - current_mechanism: "daemon-published RUDP health required".to_string(), - invariants: vec!["daemon truth is typed RUDP state".to_string()], - phases: vec!["install Muninn RUDP health".to_string()], - current_phase: "Phase 2".to_string(), - next_target: "starfire-muninn".to_string(), - cut_line: "daemon health must be published over CultNet/RUDP".to_string(), - verification_layer: "CultMesh keepalive store".to_string(), - updated_at: "2026-06-04T00:00:02Z".to_string(), - }; - node.put(&swarm_surgery_plan.plan_id, &swarm_surgery_plan)?; - node.put(&surgery_plan.plan_id, &surgery_plan)?; - let transport_profile = IdunnDaemonTransportProfileRecord { - profile_id: "transport:voidbot".to_string(), - daemon_id: "voidbot".to_string(), - target_transport: "cultnet.transport.rudp.v0".to_string(), - current_transport: "missing-daemon-published-rudp-health".to_string(), - state: "migration-required".to_string(), - health_contract: "test.cultnet-rudp-health".to_string(), - publication_schema: "idunn.daemon_health.v1".to_string(), - debug_mechanism: "none".to_string(), - cut_line: "daemon health must be published over CultNet/RUDP".to_string(), - observed_at: "2026-06-04T00:00:02Z".to_string(), - }; - node.put(&transport_profile.profile_id, &transport_profile)?; - let command_boundary = IdunnCommandBoundaryRecord { - boundary_id: "command-boundary:voidbot".to_string(), - daemon_id: "voidbot".to_string(), - owner: "idunn-supervisor-command-boundary".to_string(), - restart_authority: "idunn-supervisor-command.restart".to_string(), - deploy_authority: "none".to_string(), - health_authority: "daemon-published-rudp-health".to_string(), - alarm_authority: "bifrost.operator-notification".to_string(), - command_lowerings: vec!["npm start".to_string()], - forbidden_authority: "debug probes do not own truth".to_string(), - observed_at: "2026-06-04T00:00:02Z".to_string(), - }; - node.put(&command_boundary.boundary_id, &command_boundary)?; - let release_target = IdunnReleaseTargetRecord { - target_id: "release-target:voidbot".to_string(), - daemon_id: "voidbot".to_string(), - repo: "VoidBot".to_string(), - repo_path: "E:\\Projects\\VoidBot".to_string(), - upstream_remote: "origin".to_string(), - upstream_branch: "main".to_string(), - desired_revision: "abc123".to_string(), - deployed_revision: "old123".to_string(), - artifact_strategy: "source-archive-from-upstream-main".to_string(), - rollout_strategy: "restart-after-verified-build".to_string(), - state_migration_authority: "daemon-owned-command".to_string(), - zero_downtime_capability: "restart-required".to_string(), - status: "tracked".to_string(), - observed_at: "2026-06-04T00:00:02Z".to_string(), - repository_full_name: "GameCult/VoidBot".to_string(), - upstream_ref: "refs/heads/main".to_string(), - release_authority_id: "release:GameCult/VoidBot:refs/heads/main:abc123".to_string(), - release_authority_envelope_sha256: "authority-sha".to_string(), - release_authority_status: "authorized".to_string(), - requires_bifrost_authority: true, - observed_upstream_revision: "abc123".to_string(), - minimum_source_revision: None, - }; - let artifact = IdunnDeploymentArtifactRecord { - artifact_id: "artifact:voidbot:main".to_string(), - daemon_id: "voidbot".to_string(), - source_revision: "abc123".to_string(), - source_branch: "main".to_string(), - source_remote: "origin".to_string(), - artifact_kind: "source-archive-from-upstream-main".to_string(), - artifact_uri: "built-by-deploy-command".to_string(), - sha256: "pending-deploy-command".to_string(), - built_at: "2026-06-04T00:00:02Z".to_string(), - release_authority_id: release_target.release_authority_id.clone(), - release_authority_envelope_sha256: release_target - .release_authority_envelope_sha256 - .clone(), - }; - let migration_plan = IdunnStateMigrationPlanRecord { - plan_id: "migration:voidbot:main".to_string(), - daemon_id: "voidbot".to_string(), - from_schema_version: "deployed-state".to_string(), - to_schema_version: "target-revision-state".to_string(), - authority: "daemon-owned-migrator".to_string(), - command: "voidbot migrate-state".to_string(), - strategy: "backup-then-daemon-migrator".to_string(), - backup_required: true, - zero_downtime_required: false, - status: "planned".to_string(), - planned_at: "2026-06-04T00:00:02Z".to_string(), - }; - let rollout_plan = IdunnRolloutPlanRecord { - plan_id: "rollout:voidbot:main".to_string(), - daemon_id: "voidbot".to_string(), - desired_revision: "abc123".to_string(), - deployed_revision: "old123".to_string(), - strategy: "restart-after-verified-build".to_string(), - phases: vec![ - "fetch upstream main".to_string(), - "verify health".to_string(), - ], - migration_plan_id: migration_plan.plan_id.clone(), - artifact_id: artifact.artifact_id.clone(), - status: "planned".to_string(), - planned_at: "2026-06-04T00:00:02Z".to_string(), - }; - let release_payload = rmp_serde::to_vec(&release_target)?; - assert_eq!(&release_payload[..3], &[0xdc, 0, 22]); - let mut pre_floor_payload = release_payload.clone(); - assert_eq!(pre_floor_payload.pop(), Some(0xc0)); - pre_floor_payload[2] = 21; - assert!( - rmp_serde::from_slice::(&pre_floor_payload).is_err(), - "release-target v3 must not decode a pre-floor positional body" - ); - node.put(&release_target.target_id, &release_target)?; - node.put(&artifact.artifact_id, &artifact)?; - node.put(&migration_plan.plan_id, &migration_plan)?; - node.put(&rollout_plan.plan_id, &rollout_plan)?; - let runtime_check = IdunnRuntimeTransportCheckRecord { - check_id: "idunn-runtime-rudp-loopback".to_string(), - runtime_id: "idunn-daemon".to_string(), - transport: "cultnet.transport.rudp.v0".to_string(), - state: "available".to_string(), - detail: "loopback acknowledged".to_string(), - observed_at: "2026-06-04T00:00:02Z".to_string(), - }; - node.put(&runtime_check.check_id, &runtime_check)?; - - let reloaded = CultMesh::create_node( - &store_path, - OdinDocuments, - CultMeshNodeOptions { - runtime_id: "idunn-test-reloaded".to_string(), - pull_on_start: true, - }, - )?; - - assert_eq!( - reloaded - .documents() - .binding("idunn.desired_daemon") - .and_then(|binding| binding.payload_schema_version.clone()) - .as_deref(), - Some(IDUNN_DESIRED_DAEMON_SCHEMA) - ); - assert_eq!( - reloaded - .documents() - .binding("idunn.swarm_surgery_plan") - .and_then(|binding| binding.payload_schema_version.clone()) - .as_deref(), - Some(IDUNN_SWARM_SURGERY_PLAN_SCHEMA) - ); - assert_eq!( - reloaded - .documents() - .binding("idunn.daemon_surgery_plan") - .and_then(|binding| binding.payload_schema_version.clone()) - .as_deref(), - Some(IDUNN_DAEMON_SURGERY_PLAN_SCHEMA) - ); - assert_eq!( - reloaded - .documents() - .binding("idunn.daemon_transport_profile") - .and_then(|binding| binding.payload_schema_version.clone()) - .as_deref(), - Some(IDUNN_DAEMON_TRANSPORT_PROFILE_SCHEMA) - ); - assert_eq!( - reloaded - .documents() - .binding("idunn.command_boundary") - .and_then(|binding| binding.payload_schema_version.clone()) - .as_deref(), - Some(IDUNN_COMMAND_BOUNDARY_SCHEMA) - ); - assert_eq!( - reloaded - .documents() - .binding("idunn.release_target") - .and_then(|binding| binding.payload_schema_version.clone()) - .as_deref(), - Some(IDUNN_RELEASE_TARGET_SCHEMA) - ); - assert_eq!( - reloaded - .documents() - .binding("idunn.deployment_artifact") - .and_then(|binding| binding.payload_schema_version.clone()) - .as_deref(), - Some(IDUNN_DEPLOYMENT_ARTIFACT_SCHEMA) - ); - assert_eq!( - reloaded - .documents() - .binding("idunn.state_migration_plan") - .and_then(|binding| binding.payload_schema_version.clone()) - .as_deref(), - Some(IDUNN_STATE_MIGRATION_PLAN_SCHEMA) - ); - assert_eq!( - reloaded - .documents() - .binding("idunn.rollout_plan") - .and_then(|binding| binding.payload_schema_version.clone()) - .as_deref(), - Some(IDUNN_ROLLOUT_PLAN_SCHEMA) - ); - let reloaded_desired = - reloaded.get_required::(&desired.daemon_id)?; - assert_eq!(reloaded_desired.transport_profile_id, "transport:voidbot"); - assert_eq!( - reloaded_desired.command_boundary_id, - "command-boundary:voidbot" - ); - assert_eq!( - reloaded - .get_required::(&plan.decision.decision_id)? - .action, - "restart" - ); - assert_eq!( - reloaded - .get_required::(&swarm_surgery_plan.plan_id)? - .next_target, - "starfire-muninn" - ); - assert_eq!( - reloaded - .get_required::(&surgery_plan.plan_id)? - .cut_line, - "daemon health must be published over CultNet/RUDP" - ); - assert_eq!( - reloaded - .get_required::(&transport_profile.profile_id)? - .target_transport, - "cultnet.transport.rudp.v0" - ); - assert_eq!( - reloaded - .get_required::(&command_boundary.boundary_id)? - .health_authority, - "daemon-published-rudp-health" - ); - assert_eq!( - reloaded - .get_required::(&runtime_check.check_id)? - .state, - "available" - ); - assert_eq!( - reloaded - .get_required::(&release_target.target_id)? - .upstream_branch, - "main" - ); - assert_eq!( - reloaded - .get_required::(&rollout_plan.plan_id)? - .migration_plan_id, - "migration:voidbot:main" - ); - assert_eq!( - reloaded - .get_required::(&request.request_id)? - .command, - "npm start" - ); - Ok(()) - } -} diff --git a/crates/odin-core/src/lib.rs b/crates/odin-core/src/lib.rs index 5133002..3c7cb49 100644 --- a/crates/odin-core/src/lib.rs +++ b/crates/odin-core/src/lib.rs @@ -1,13 +1,11 @@ pub mod discovery; pub mod documents; -pub mod idunn; pub mod pipeline; pub mod ports; pub mod repository; pub use discovery::*; pub use documents::*; -pub use idunn::*; pub use pipeline::*; pub use ports::*; pub use repository::*;