diff --git a/.gitignore b/.gitignore deleted file mode 100644 index 70c0dde..0000000 --- a/.gitignore +++ /dev/null @@ -1,12 +0,0 @@ -node_modules/ -scratch/ -bin/ -obj/ -target/ -*.log -*.pid -artifacts/ -**/artifacts/ - -# Agent scratch. Reached 50MB of tarballs and lockfile snapshots once. -.codex-tmp/ diff --git a/AGENTS.md b/AGENTS.md deleted file mode 100644 index c52f9d6..0000000 --- a/AGENTS.md +++ /dev/null @@ -1,89 +0,0 @@ -# Odin Instructions - -## Project Purpose - -Odin is the all-seer and rendezvous organ for the CultMesh Verse: discovery, -schema awareness, translation routes, and interface aggregation. Every other -GameCult target is observed *through* Odin, which is why its availability is -load-bearing for the estate rather than for itself. - -Estate-wide doctrine — the Prime Directive, Code Is A Liability, the Loud -Rebuild Contract, Odin-class architecture, the CultCache/CultNet/CultMesh -substrate rules — lives in `F:\Projects\CLAUDE.md` and `~/.claude/CLAUDE.md` and -is loaded automatically. It is not repeated here. - -## Canonical State - -- `docs/architecture.md` — the source-grounded architecture note. -- `docs/transport-shortcut-inventory.md` — a **dated ledger**. Entries are left - as written and corrected by dated notes on top, never rewritten. Follow that - convention for anything else recording history here. -- `notes/` — compact re-entry packets. Read the newest before touching - deployment. -- `state/map.yaml` — the current deployment and admission map. This is the one - file that goes stale fastest; verify it against the host before trusting it. -- `personas/gjallar.persona_state.cc` — Gjallar's Persona state, in the portable - `gamecult.persona_state.v0` shape. - -## Important Paths - -Relative to the repository root. - -- Daemon: `crates/odin-daemon` -- Shared records and documents: `crates/odin-core` -- Deployment recipe Idunn seals and builds from: `deployment/idunn/recipe.toml` -- Operator binding (lives on the host, not here): - `/etc/gamecult/idunn/bindings/odin.toml` - -## Build And Deploy Target - -Odin runs on Linux under Idunn on `yggdrasil`. This workstation is Windows and -is where the shell is, not where the artifact runs: **a local compile is not -evidence about the Linux release.** Build on the target or through the deploy -path's own builder, and say which one you used. - -```bash -git archive HEAD | ssh ygg 'sudo rm -rf /srv/build/odin && sudo mkdir -p /srv/build/odin && sudo tar -x -C /srv/build/odin && sudo chown -R gamecultadmin:gamecultadmin /srv/build/odin' -ssh ygg 'sudo docker run --rm -v /srv/build/odin:/w -v /etc/machine-id:/etc/machine-id:ro -v /srv/build/cargo-registry:/usr/local/cargo/registry -v /srv/build/cargo-git:/usr/local/cargo/git -w /w rust:1.95-bookworm cargo test -p odin-core -p odin-daemon' -``` - -`/etc/machine-id` **must** be mounted or every identity-enrolling test fails -with `Linux machine-id is unavailable` — a wall of failures that looks like -broken code and is a missing mount. - -Scope test runs to the crates you are changing. Muninn's crates live in -`GameCult/Muninn` now, not in this workspace. - -## Session Bootstrap And Re-entry Protocol - -On fresh session load, before touching deployment: - -1. Read the newest file in `notes/`. -2. Read `state/map.yaml`, then **verify it on the host** — it describes a live - system and is the first thing to rot. -3. `git log --oneline -5` and `git status --short --branch`. - -The host is authoritative for every question of the form "is X running", "is X -admitted", "what release is live". Two commands answer most of them: - -```bash -ssh ygg 'systemctl list-units --all "idunn-odin-*" --state=active' -ssh ygg 'sudo /usr/local/bin/idunn status --state-store /var/lib/gamecult/idunn/control.cc' -``` - -## Operating Discipline - -- **Never conclude from a partial listing.** `systemctl list-units | head` sorts - alphabetically and will hide the one active unit among dozens of failed ones. - Enumerate completely or state that the answer is unknown. -- **A unit can be `active` and own no process.** `odin.service` in - `/etc/systemd/system/` is exactly that: active, `MainPID 0`, owning nothing. - It has misled at least two separate readings. Check `-p MainPID` before - believing a status line. -- **Read the journal with `sudo journalctl -q`.** Unprivileged `journalctl` shows - only your own messages and returns a false zero on `Started idunn-odin` - counts. -- Verify changing facts against the host or source, never against a document — - including the documents in this repository. -- Redeploying Odin is not routine. Read `notes/` first; the failure mode is - documented and it is not obvious. diff --git a/CLAUDE.md b/CLAUDE.md deleted file mode 100644 index 51a22c5..0000000 --- a/CLAUDE.md +++ /dev/null @@ -1,3 +0,0 @@ -Repository doctrine for this project lives in AGENTS.md. - -@AGENTS.md diff --git a/Cargo.lock b/Cargo.lock deleted file mode 100644 index b4c03b4..0000000 --- a/Cargo.lock +++ /dev/null @@ -1,1430 +0,0 @@ -# This file is automatically @generated by Cargo. -# It is not intended for manual editing. -version = 4 - -[[package]] -name = "aead" -version = "0.5.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0" -dependencies = [ - "crypto-common", - "generic-array", -] - -[[package]] -name = "aes" -version = "0.8.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0" -dependencies = [ - "cfg-if", - "cipher", - "cpufeatures", -] - -[[package]] -name = "aes-gcm" -version = "0.10.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1" -dependencies = [ - "aead", - "aes", - "cipher", - "ctr", - "ghash", - "subtle", -] - -[[package]] -name = "android_system_properties" -version = "0.1.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311" -dependencies = [ - "libc", -] - -[[package]] -name = "anyhow" -version = "1.0.102" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c" - -[[package]] -name = "autocfg" -version = "1.5.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53" - -[[package]] -name = "base64" -version = "0.22.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6" - -[[package]] -name = "base64ct" -version = "1.8.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06" - -[[package]] -name = "bitflags" -version = "2.12.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "84d7ced0ae9557296835c32bf1b1e02b44c746701f898460fb000d7eaa84f00a" - -[[package]] -name = "block-buffer" -version = "0.10.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71" -dependencies = [ - "generic-array", -] - -[[package]] -name = "bumpalo" -version = "3.20.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649" - -[[package]] -name = "cc" -version = "1.2.63" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "556e016178bb5662a08681bbe0f00f8e17631781a4dfc8c45e466e4b185ec27f" -dependencies = [ - "find-msvc-tools", - "shlex", -] - -[[package]] -name = "cfg-if" -version = "1.0.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" - -[[package]] -name = "chrono" -version = "0.4.44" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0" -dependencies = [ - "iana-time-zone", - "js-sys", - "num-traits", - "serde", - "wasm-bindgen", - "windows-link", -] - -[[package]] -name = "cipher" -version = "0.4.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad" -dependencies = [ - "crypto-common", - "inout", -] - -[[package]] -name = "const-oid" -version = "0.9.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8" - -[[package]] -name = "core-foundation-sys" -version = "0.8.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b" - -[[package]] -name = "cpufeatures" -version = "0.2.17" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280" -dependencies = [ - "libc", -] - -[[package]] -name = "crypto-common" -version = "0.1.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a" -dependencies = [ - "generic-array", - "rand_core 0.6.4", - "typenum", -] - -[[package]] -name = "ctr" -version = "0.9.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835" -dependencies = [ - "cipher", -] - -[[package]] -name = "cultcache-rs" -version = "0.2.0" -source = "git+https://github.com/GameCult/CultLib.git?rev=3bf1c0cea53e0092187fa2e59a75ba1571947ffe#3bf1c0cea53e0092187fa2e59a75ba1571947ffe" -dependencies = [ - "anyhow", - "chrono", - "cultcache-rs-derive", - "fs2", - "redb", - "rmp-serde", - "serde", - "serde_bytes", - "serde_json", - "uuid", - "windows-sys 0.59.0", -] - -[[package]] -name = "cultcache-rs-derive" -version = "0.1.0" -source = "git+https://github.com/GameCult/CultLib.git?rev=3bf1c0cea53e0092187fa2e59a75ba1571947ffe#3bf1c0cea53e0092187fa2e59a75ba1571947ffe" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "cultmesh-rs" -version = "0.1.0" -source = "git+https://github.com/GameCult/CultLib.git?rev=3bf1c0cea53e0092187fa2e59a75ba1571947ffe#3bf1c0cea53e0092187fa2e59a75ba1571947ffe" -dependencies = [ - "anyhow", - "cultcache-rs", - "cultnet-rs", - "serde", -] - -[[package]] -name = "cultnet-rs" -version = "0.1.0" -source = "git+https://github.com/GameCult/CultLib.git?rev=3bf1c0cea53e0092187fa2e59a75ba1571947ffe#3bf1c0cea53e0092187fa2e59a75ba1571947ffe" -dependencies = [ - "aes-gcm", - "anyhow", - "base64", - "chrono", - "cultcache-rs", - "ed25519-dalek", - "hmac", - "rand", - "rmp-serde", - "rmpv", - "serde", - "serde_bytes", - "serde_json", - "sha2", - "socket2", - "uuid", - "windows-sys 0.61.2", - "zeroize", -] - -[[package]] -name = "curve25519-dalek" -version = "4.1.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be" -dependencies = [ - "cfg-if", - "cpufeatures", - "curve25519-dalek-derive", - "digest", - "fiat-crypto", - "rustc_version", - "subtle", - "zeroize", -] - -[[package]] -name = "curve25519-dalek-derive" -version = "0.1.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "der" -version = "0.7.10" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb" -dependencies = [ - "const-oid", - "zeroize", -] - -[[package]] -name = "diff" -version = "0.1.13" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "56254986775e3233ffa9c4d7d3faaf6d36a2c09d30b20687e9f88bc8bafc16c8" - -[[package]] -name = "digest" -version = "0.10.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292" -dependencies = [ - "block-buffer", - "crypto-common", - "subtle", -] - -[[package]] -name = "ed25519" -version = "2.2.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53" -dependencies = [ - "pkcs8", - "signature", -] - -[[package]] -name = "ed25519-dalek" -version = "2.2.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9" -dependencies = [ - "curve25519-dalek", - "ed25519", - "serde", - "sha2", - "subtle", - "zeroize", -] - -[[package]] -name = "equivalent" -version = "1.0.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f" - -[[package]] -name = "errno" -version = "0.3.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" -dependencies = [ - "libc", - "windows-sys 0.61.2", -] - -[[package]] -name = "fastrand" -version = "2.4.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6" - -[[package]] -name = "fiat-crypto" -version = "0.2.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d" - -[[package]] -name = "find-msvc-tools" -version = "0.1.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582" - -[[package]] -name = "foldhash" -version = "0.1.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2" - -[[package]] -name = "fs2" -version = "0.4.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9564fc758e15025b46aa6643b1b77d047d1a56a1aea6e01002ac0c7026876213" -dependencies = [ - "libc", - "winapi", -] - -[[package]] -name = "futures-core" -version = "0.3.32" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d" - -[[package]] -name = "futures-task" -version = "0.3.32" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393" - -[[package]] -name = "futures-util" -version = "0.3.32" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6" -dependencies = [ - "futures-core", - "futures-task", - "pin-project-lite", - "slab", -] - -[[package]] -name = "generic-array" -version = "0.14.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a" -dependencies = [ - "typenum", - "version_check", -] - -[[package]] -name = "getrandom" -version = "0.2.17" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0" -dependencies = [ - "cfg-if", - "libc", - "wasi", -] - -[[package]] -name = "getrandom" -version = "0.3.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd" -dependencies = [ - "cfg-if", - "libc", - "r-efi 5.3.0", - "wasip2", -] - -[[package]] -name = "getrandom" -version = "0.4.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555" -dependencies = [ - "cfg-if", - "libc", - "r-efi 6.0.0", - "wasip2", - "wasip3", -] - -[[package]] -name = "ghash" -version = "0.5.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1" -dependencies = [ - "opaque-debug", - "polyval", -] - -[[package]] -name = "hashbrown" -version = "0.15.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1" -dependencies = [ - "foldhash", -] - -[[package]] -name = "hashbrown" -version = "0.17.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a" - -[[package]] -name = "heck" -version = "0.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea" - -[[package]] -name = "hmac" -version = "0.12.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e" -dependencies = [ - "digest", -] - -[[package]] -name = "iana-time-zone" -version = "0.1.65" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470" -dependencies = [ - "android_system_properties", - "core-foundation-sys", - "iana-time-zone-haiku", - "js-sys", - "log", - "wasm-bindgen", - "windows-core", -] - -[[package]] -name = "iana-time-zone-haiku" -version = "0.1.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f" -dependencies = [ - "cc", -] - -[[package]] -name = "id-arena" -version = "2.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954" - -[[package]] -name = "indexmap" -version = "2.14.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9" -dependencies = [ - "equivalent", - "hashbrown 0.17.1", - "serde", - "serde_core", -] - -[[package]] -name = "inout" -version = "0.1.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01" -dependencies = [ - "generic-array", -] - -[[package]] -name = "itoa" -version = "1.0.18" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682" - -[[package]] -name = "js-sys" -version = "0.3.99" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "142bc4740e452c1e57ade0cbc129f139c9093e354346f0872ef985f4f5cf5f11" -dependencies = [ - "cfg-if", - "futures-util", - "once_cell", - "wasm-bindgen", -] - -[[package]] -name = "leb128fmt" -version = "0.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2" - -[[package]] -name = "libc" -version = "0.2.186" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66" - -[[package]] -name = "linux-raw-sys" -version = "0.12.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53" - -[[package]] -name = "log" -version = "0.4.31" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "113b30b4cd05f7c06868fdb2854f66a7b9fece9a48425351cd532e810d74024f" - -[[package]] -name = "memchr" -version = "2.8.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6b947ae49db0d222b1dbc6b113ce7248a3fc3a6ca21b696717bfc000ba4484d8" - -[[package]] -name = "num-traits" -version = "0.2.19" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841" -dependencies = [ - "autocfg", -] - -[[package]] -name = "odin-core" -version = "0.1.0" -dependencies = [ - "anyhow", - "cultcache-rs", - "cultmesh-rs", - "cultnet-rs", - "pretty_assertions", - "serde", - "serde_json", - "tempfile", -] - -[[package]] -name = "odin-daemon" -version = "0.1.0" -dependencies = [ - "anyhow", - "chrono", - "cultcache-rs", - "cultmesh-rs", - "cultnet-rs", - "fs2", - "rmp-serde", - "serde", - "signal-hook", - "tempfile", -] - -[[package]] -name = "once_cell" -version = "1.21.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50" - -[[package]] -name = "opaque-debug" -version = "0.3.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381" - -[[package]] -name = "pin-project-lite" -version = "0.2.17" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd" - -[[package]] -name = "pkcs8" -version = "0.10.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7" -dependencies = [ - "der", - "spki", -] - -[[package]] -name = "polyval" -version = "0.6.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25" -dependencies = [ - "cfg-if", - "cpufeatures", - "opaque-debug", - "universal-hash", -] - -[[package]] -name = "ppv-lite86" -version = "0.2.21" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9" -dependencies = [ - "zerocopy", -] - -[[package]] -name = "pretty_assertions" -version = "1.4.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3ae130e2f271fbc2ac3a40fb1d07180839cdbbe443c7a27e1e3c13c5cac0116d" -dependencies = [ - "diff", - "yansi", -] - -[[package]] -name = "prettyplease" -version = "0.2.37" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b" -dependencies = [ - "proc-macro2", - "syn", -] - -[[package]] -name = "proc-macro2" -version = "1.0.106" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934" -dependencies = [ - "unicode-ident", -] - -[[package]] -name = "quote" -version = "1.0.45" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924" -dependencies = [ - "proc-macro2", -] - -[[package]] -name = "r-efi" -version = "5.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f" - -[[package]] -name = "r-efi" -version = "6.0.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf" - -[[package]] -name = "rand" -version = "0.9.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea" -dependencies = [ - "rand_chacha", - "rand_core 0.9.5", -] - -[[package]] -name = "rand_chacha" -version = "0.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb" -dependencies = [ - "ppv-lite86", - "rand_core 0.9.5", -] - -[[package]] -name = "rand_core" -version = "0.6.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c" -dependencies = [ - "getrandom 0.2.17", -] - -[[package]] -name = "rand_core" -version = "0.9.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c" -dependencies = [ - "getrandom 0.3.4", -] - -[[package]] -name = "redb" -version = "4.2.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "de6c3b63e007e90ce536ec2ae4690826136a20ec8dbbbb400daef1bb999d2e36" -dependencies = [ - "libc", -] - -[[package]] -name = "rmp" -version = "0.8.15" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4ba8be72d372b2c9b35542551678538b562e7cf86c3315773cae48dfbfe7790c" -dependencies = [ - "num-traits", -] - -[[package]] -name = "rmp-serde" -version = "1.3.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "72f81bee8c8ef9b577d1681a70ebbc962c232461e397b22c208c43c04b67a155" -dependencies = [ - "rmp", - "serde", -] - -[[package]] -name = "rmpv" -version = "1.3.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7a4e1d4b9b938a26d2996af33229f0ca0956c652c1375067f0b45291c1df8417" -dependencies = [ - "rmp", - "serde", - "serde_bytes", -] - -[[package]] -name = "rustc_version" -version = "0.4.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92" -dependencies = [ - "semver", -] - -[[package]] -name = "rustix" -version = "1.1.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190" -dependencies = [ - "bitflags", - "errno", - "libc", - "linux-raw-sys", - "windows-sys 0.61.2", -] - -[[package]] -name = "rustversion" -version = "1.0.22" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d" - -[[package]] -name = "semver" -version = "1.0.28" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd" - -[[package]] -name = "serde" -version = "1.0.228" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e" -dependencies = [ - "serde_core", - "serde_derive", -] - -[[package]] -name = "serde_bytes" -version = "0.11.19" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a5d440709e79d88e51ac01c4b72fc6cb7314017bb7da9eeff678aa94c10e3ea8" -dependencies = [ - "serde", - "serde_core", -] - -[[package]] -name = "serde_core" -version = "1.0.228" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad" -dependencies = [ - "serde_derive", -] - -[[package]] -name = "serde_derive" -version = "1.0.228" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "serde_json" -version = "1.0.150" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9" -dependencies = [ - "itoa", - "memchr", - "serde", - "serde_core", - "zmij", -] - -[[package]] -name = "sha2" -version = "0.10.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283" -dependencies = [ - "cfg-if", - "cpufeatures", - "digest", -] - -[[package]] -name = "shlex" -version = "2.0.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba" - -[[package]] -name = "signal-hook" -version = "0.3.18" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d881a16cf4426aa584979d30bd82cb33429027e42122b169753d6ef1085ed6e2" -dependencies = [ - "libc", - "signal-hook-registry", -] - -[[package]] -name = "signal-hook-registry" -version = "1.4.8" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b" -dependencies = [ - "errno", - "libc", -] - -[[package]] -name = "signature" -version = "2.2.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de" -dependencies = [ - "rand_core 0.6.4", -] - -[[package]] -name = "slab" -version = "0.4.12" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5" - -[[package]] -name = "socket2" -version = "0.5.10" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678" -dependencies = [ - "libc", - "windows-sys 0.52.0", -] - -[[package]] -name = "spki" -version = "0.7.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d" -dependencies = [ - "base64ct", - "der", -] - -[[package]] -name = "subtle" -version = "2.6.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292" - -[[package]] -name = "syn" -version = "2.0.117" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99" -dependencies = [ - "proc-macro2", - "quote", - "unicode-ident", -] - -[[package]] -name = "tempfile" -version = "3.27.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" -dependencies = [ - "fastrand", - "getrandom 0.4.2", - "once_cell", - "rustix", - "windows-sys 0.61.2", -] - -[[package]] -name = "typenum" -version = "1.20.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20" - -[[package]] -name = "unicode-ident" -version = "1.0.24" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75" - -[[package]] -name = "unicode-xid" -version = "0.2.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853" - -[[package]] -name = "universal-hash" -version = "0.5.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea" -dependencies = [ - "crypto-common", - "subtle", -] - -[[package]] -name = "uuid" -version = "1.23.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d258b83ceec21034727ecee8c382cfa6c3e133699b0742c64571814fb420c9f7" -dependencies = [ - "getrandom 0.4.2", - "js-sys", - "wasm-bindgen", -] - -[[package]] -name = "version_check" -version = "0.9.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a" - -[[package]] -name = "wasi" -version = "0.11.1+wasi-snapshot-preview1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b" - -[[package]] -name = "wasip2" -version = "1.0.3+wasi-0.2.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6" -dependencies = [ - "wit-bindgen 0.57.1", -] - -[[package]] -name = "wasip3" -version = "0.4.0+wasi-0.3.0-rc-2026-01-06" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5" -dependencies = [ - "wit-bindgen 0.51.0", -] - -[[package]] -name = "wasm-bindgen" -version = "0.2.122" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3ed04576f974d2b2fba0f38c51dbc5518011e38c36bf1143164be765528fd409" -dependencies = [ - "cfg-if", - "once_cell", - "rustversion", - "wasm-bindgen-macro", - "wasm-bindgen-shared", -] - -[[package]] -name = "wasm-bindgen-macro" -version = "0.2.122" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "916151b09da36bd82f6615cbf3a419e2f0ba23a03c6160e8e92eb6bd4aa1dec6" -dependencies = [ - "quote", - "wasm-bindgen-macro-support", -] - -[[package]] -name = "wasm-bindgen-macro-support" -version = "0.2.122" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "299047362ccbfce148b67ab7e73349f77748e00c8296f9542adfad2ad82c5c5e" -dependencies = [ - "bumpalo", - "proc-macro2", - "quote", - "syn", - "wasm-bindgen-shared", -] - -[[package]] -name = "wasm-bindgen-shared" -version = "0.2.122" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9a929b2c61f11ba3e9bc35b50c1f25cb38e0e892c0c231ae2b8cf78d5dad4437" -dependencies = [ - "unicode-ident", -] - -[[package]] -name = "wasm-encoder" -version = "0.244.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319" -dependencies = [ - "leb128fmt", - "wasmparser", -] - -[[package]] -name = "wasm-metadata" -version = "0.244.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909" -dependencies = [ - "anyhow", - "indexmap", - "wasm-encoder", - "wasmparser", -] - -[[package]] -name = "wasmparser" -version = "0.244.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe" -dependencies = [ - "bitflags", - "hashbrown 0.15.5", - "indexmap", - "semver", -] - -[[package]] -name = "winapi" -version = "0.3.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419" -dependencies = [ - "winapi-i686-pc-windows-gnu", - "winapi-x86_64-pc-windows-gnu", -] - -[[package]] -name = "winapi-i686-pc-windows-gnu" -version = "0.4.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6" - -[[package]] -name = "winapi-x86_64-pc-windows-gnu" -version = "0.4.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f" - -[[package]] -name = "windows-core" -version = "0.62.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb" -dependencies = [ - "windows-implement", - "windows-interface", - "windows-link", - "windows-result", - "windows-strings", -] - -[[package]] -name = "windows-implement" -version = "0.60.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "windows-interface" -version = "0.59.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "windows-link" -version = "0.2.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5" - -[[package]] -name = "windows-result" -version = "0.4.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5" -dependencies = [ - "windows-link", -] - -[[package]] -name = "windows-strings" -version = "0.5.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091" -dependencies = [ - "windows-link", -] - -[[package]] -name = "windows-sys" -version = "0.52.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d" -dependencies = [ - "windows-targets", -] - -[[package]] -name = "windows-sys" -version = "0.59.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b" -dependencies = [ - "windows-targets", -] - -[[package]] -name = "windows-sys" -version = "0.61.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc" -dependencies = [ - "windows-link", -] - -[[package]] -name = "windows-targets" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973" -dependencies = [ - "windows_aarch64_gnullvm", - "windows_aarch64_msvc", - "windows_i686_gnu", - "windows_i686_gnullvm", - "windows_i686_msvc", - "windows_x86_64_gnu", - "windows_x86_64_gnullvm", - "windows_x86_64_msvc", -] - -[[package]] -name = "windows_aarch64_gnullvm" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3" - -[[package]] -name = "windows_aarch64_msvc" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469" - -[[package]] -name = "windows_i686_gnu" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b" - -[[package]] -name = "windows_i686_gnullvm" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66" - -[[package]] -name = "windows_i686_msvc" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66" - -[[package]] -name = "windows_x86_64_gnu" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78" - -[[package]] -name = "windows_x86_64_gnullvm" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d" - -[[package]] -name = "windows_x86_64_msvc" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec" - -[[package]] -name = "wit-bindgen" -version = "0.51.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5" -dependencies = [ - "wit-bindgen-rust-macro", -] - -[[package]] -name = "wit-bindgen" -version = "0.57.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e" - -[[package]] -name = "wit-bindgen-core" -version = "0.51.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc" -dependencies = [ - "anyhow", - "heck", - "wit-parser", -] - -[[package]] -name = "wit-bindgen-rust" -version = "0.51.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21" -dependencies = [ - "anyhow", - "heck", - "indexmap", - "prettyplease", - "syn", - "wasm-metadata", - "wit-bindgen-core", - "wit-component", -] - -[[package]] -name = "wit-bindgen-rust-macro" -version = "0.51.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a" -dependencies = [ - "anyhow", - "prettyplease", - "proc-macro2", - "quote", - "syn", - "wit-bindgen-core", - "wit-bindgen-rust", -] - -[[package]] -name = "wit-component" -version = "0.244.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2" -dependencies = [ - "anyhow", - "bitflags", - "indexmap", - "log", - "serde", - "serde_derive", - "serde_json", - "wasm-encoder", - "wasm-metadata", - "wasmparser", - "wit-parser", -] - -[[package]] -name = "wit-parser" -version = "0.244.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736" -dependencies = [ - "anyhow", - "id-arena", - "indexmap", - "log", - "semver", - "serde", - "serde_derive", - "serde_json", - "unicode-xid", - "wasmparser", -] - -[[package]] -name = "yansi" -version = "1.0.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049" - -[[package]] -name = "zerocopy" -version = "0.8.50" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3b065d4f0e55f82fae73202e189638116a87c55ab6b8e6c2721e13dd9d854ad1" -dependencies = [ - "zerocopy-derive", -] - -[[package]] -name = "zerocopy-derive" -version = "0.8.50" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0b631b19d36a892ab55420c92dbc83ccd79274f25be714855d3074aa71cab639" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "zeroize" -version = "1.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e" - -[[package]] -name = "zmij" -version = "1.0.21" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa" diff --git a/Cargo.toml b/Cargo.toml index 898e89a..d8427e5 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,11 +1,37 @@ -[workspace] -members = [ - "crates/odin-core", - "crates/odin-daemon", -] -resolver = "3" +[package] +name = "idunn-daemon" +version = "0.1.0" +edition.workspace = true +license.workspace = true +publish.workspace = true -[workspace.package] -edition = "2024" -license = "MIT" -publish = false +[[bin]] +name = "idunn" +path = "src/main.rs" + +[[bin]] +name = "idunn-provision" +path = "src/bin/idunn-provision.rs" + +[lib] +name = "idunn_daemon" +path = "src/lib.rs" + +[dependencies] +anyhow = "1" +cultmesh-rs = { path = "../../vendor/cultmesh-rs" } +cultcache-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "c13b6ba07e99f2535b455da74d07d88c308731f5", package = "cultcache-rs" } +cultnet-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "c13b6ba07e99f2535b455da74d07d88c308731f5", package = "cultnet-rs" } +rmp-serde = "1.3" +sha2 = "0.10" +chrono = "0.4" +serde = { version = "1", features = ["derive"] } +ed25519-dalek = "2.2" +toml = "0.8" +uuid = { version = "1", features = ["v4"] } + +[dev-dependencies] +tempfile = "3" + +[target.'cfg(unix)'.dependencies] +libc = "0.2" diff --git a/LICENSE b/LICENSE deleted file mode 100644 index b3fa4fd..0000000 --- a/LICENSE +++ /dev/null @@ -1,21 +0,0 @@ -MIT License - -Copyright (c) 2026 GameCult - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. diff --git a/README.md b/README.md deleted file mode 100644 index 1d295f4..0000000 --- a/README.md +++ /dev/null @@ -1,133 +0,0 @@ -# Odin - -Odin is the GameCult all-seer: the central CultMesh node every Verse can use to discover the other Verses, inspect schema catalogs, and find translation paths between local realities. - -It is not the renderer. It is not Eve. It is not a Starfire utility script wearing a bigger coat. Odin owns discovery, schema awareness, translation planning, and accepted operator surfaces. Eve clients and Gjallar lower Odin's published CultUI surface into whatever body they have. - -Odin is also the compliance witness for the GameCult service architecture: -durable service state in CultCache `.cc`, local Verse visibility through -CultMesh, meaningful presentation as Eve GUI/TUI DSL, and renderers as lowerers -only. - -## Rust Spine - -The target Odin body is Rust-first: ingest through narrow ports, normalize into -typed Odin records, persist through CultCache `.cc`, expose through CultMesh / -CultNet document registries over the shared RUDP transport, and lower -interface state through Eve/CultUI. - -The first Rust core lives in `crates/odin-core` and already separates typed -documents, ingest ports, normalization, and repository persistence so unit tests -can use mocked inputs and pipeline smokes can prove typed handoff without -booting the whole daemon. Gjallar is not part of that Rust record spine: it is -the Yggdrasil-resident C# composition daemon in `F:\Projects\Gjallar`. It -consumes Odin's accepted provider snapshot and publishes one tiled -`gjallar.overview` Eve surface for GUI, TUI, and agent lowerers. - -## Typed access discovery - -Odin persists only document schemas it has registered. That is a deliberate -typed-store boundary, not a license to accept anonymous blobs and hope later -code understands them. The live Yggdrasil body at -`ba76a7239a7bb40aa1774df7d93b9388dc27b222`, using CultLib -`75c180782aeba7cfd22d6412877397708a4ed28f`, registers Heimdall's provider, -command-boundary, Eve-plugin, and transport-profile documents plus -Ghostlight's public catalog envelope. Provider daemons own those documents; -Odin owns typed catalog acceptance, ordered durable persistence, and exact -retrieval. Sensitive auth commands and claims travel directly between the -consuming app and Heimdall, never through Odin. - -Ghostlight publishes a `ghostlight.schema_catalog.v1` envelope containing only -the state contracts named by its public provider surface. Odin registers that -envelope so it can persist and return the provider-owned catalog; it does not -register every private Ghostlight receipt, transition, or simulation schema. - -## Typed access discovery - -Odin persists only document schemas it has registered. That is a deliberate -typed-store boundary, not a license to accept anonymous blobs and hope later -code understands them. The live Yggdrasil body at -`b4f9a2e95f0b41cebdeddc49223781d1d3c7b42a` registers Heimdall's provider, -command-boundary, Eve-plugin, and transport-profile documents. Heimdall owns -their contents; Odin owns catalog acceptance and exact retrieval. Sensitive -auth commands and claims travel directly between the consuming app and -Heimdall, never through Odin. - -## Gjallar - -Gjallar is the herald composition daemon that runs beside Odin and Idunn on -Yggdrasil. Odin sees the Verses and accepts provider surfaces. Gjallar consumes -that accepted snapshot and publishes one multi-scale tiled Eve surface. Eve -clients—including EveCanvas—own graphical and TUI lowering. - -Local package surfaces: - -- Organ contract: `docs/gjallar.md` -- Branding Persona state: `personas/gjallar.persona_state.cc` -- Runtime source: `F:\Projects\Gjallar` -- Avatar asset: `assets/personas/gjallar-avatar.png` -- Pixel avatar: `assets/personas/gjallar-avatar-pixel-256.png` - -## Idunn - -Idunn (`GameCult/Idunn`) owns deployment and daemon survival for every GameCult -target, Odin included: it builds from the target's recipe, activates and -restarts the admitted incarnation, and holds the deployment and lifecycle -brakes. Odin owns none of that. Odin does discovery, schema awareness, -rendezvous, and interface aggregation, and it reads Idunn's topology projection -to learn which incarnations exist. Agents do not deploy daemons directly: they -configure the target's recipe and binding and let Idunn run the transaction. - -Local package surfaces: - -- Deployment recipe: `deployment/idunn/recipe.toml` -- Operator binding: `/etc/gamecult/idunn/bindings/odin.toml` on the host, not in - this repository -- Live deployment and admission map: `state/map.yaml` -- Idunn's contract, brakes, and runbooks: the `GameCult/Idunn` repository - -## Authority Map - -- Owner: Odin owns the network-wide Verse registry, schema catalog index, translation map, and accepted provider catalog/proxy surfaces. -- Inputs: CultMesh/CultNet peer announcements, schema catalog responses, daemon - health/provider publications over `cultnet.transport.rudp.v0`, Idunn's - read-only topology projection, and provider-owned Eve/CultUI surfaces. -- Outputs: CultCache-backed Odin state, CultMesh documents, and CultNet - schema/catalog messages. Browser, GUI, TUI, and framebuffer renderers lower - those documents outside Odin instead of asking Odin to host web surfaces. -- Derived state: Gjallar's aggregate surface is derived from Odin/provider state; Eve clients derive pixels from that aggregate. -- Forbidden writers: renderers do not probe the network or decide Verse truth; individual projects do not maintain private incompatible discovery ledgers once Odin can see them. -- Shared paths: human dashboards, worker schedulers, Verse bootstrap code, and compact TUI views consume the same registry and schema catalog. -- Not Odin's: process lifecycle, restart, deployment, and daemon survival belong to Idunn. - -## Runtime Body - -Odin runs as `odin-daemon` under Idunn on Yggdrasil, built from -`deployment/idunn/recipe.toml`. There is no local start script. The daemon: - -- reads Idunn's read-only projection to learn which incarnations of which - targets exist; -- admits provider presences over RUDP for those incarnations and persists them - through CultMesh/CultCache; -- publishes signed runtime-topology correlation records; -- answers CultNet/RUDP snapshot and document requests on its route. - -Odin's native document catalog is addressed by CultMesh URI. Concrete RUDP -bootstrap is configured behind CultMesh URI resolution by the operator or by -Odin/Idunn deployment state: - -```text -cultmesh://odin/rendezvous/provider-catalog -``` - -That URI accepts typed document publication and schema/catalog requests through -the shared CultMesh runtime. Consumers that need Odin's accepted surface can -still request the current CultNet snapshot after CultMesh resolves the transport. - -Browser and deck lowerers consume Odin's CultMesh state through their own -lowering process. Odin does not host browser-deck surfaces or publish deck URLs -as discovery seed material. - -Provider advertisements and CultNet/RUDP transport profiles are the discovery -path. External host probes, product health checks, port probes, and renderer -bridges are debug or lowering surfaces outside Odin only. diff --git a/assets/personas/gjallar-avatar-pixel-256.png b/assets/personas/gjallar-avatar-pixel-256.png deleted file mode 100644 index 9dd3340..0000000 Binary files a/assets/personas/gjallar-avatar-pixel-256.png and /dev/null differ diff --git a/assets/personas/gjallar-avatar.png b/assets/personas/gjallar-avatar.png deleted file mode 100644 index 7779bf3..0000000 Binary files a/assets/personas/gjallar-avatar.png and /dev/null differ diff --git a/assets/personas/sleipnir-avatar.png b/assets/personas/sleipnir-avatar.png deleted file mode 100644 index c7e0221..0000000 Binary files a/assets/personas/sleipnir-avatar.png and /dev/null differ diff --git a/crates/odin-core/Cargo.toml b/crates/odin-core/Cargo.toml deleted file mode 100644 index 76d2955..0000000 --- a/crates/odin-core/Cargo.toml +++ /dev/null @@ -1,22 +0,0 @@ -[package] -name = "odin-core" -version = "0.1.0" -edition.workspace = true -license.workspace = true -publish.workspace = true - -[lib] -name = "odin_core" -path = "src/lib.rs" - -[dependencies] -anyhow = "1" -cultcache-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "3bf1c0cea53e0092187fa2e59a75ba1571947ffe", package = "cultcache-rs" } -cultmesh-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "3bf1c0cea53e0092187fa2e59a75ba1571947ffe", package = "cultmesh-rs" } -cultnet-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "3bf1c0cea53e0092187fa2e59a75ba1571947ffe", package = "cultnet-rs" } -serde_json = "1" -serde = { version = "1", features = ["derive"] } - -[dev-dependencies] -pretty_assertions = "1.4" -tempfile = "3" diff --git a/crates/odin-core/src/discovery.rs b/crates/odin-core/src/discovery.rs deleted file mode 100644 index f5c5bef..0000000 --- a/crates/odin-core/src/discovery.rs +++ /dev/null @@ -1,280 +0,0 @@ -use crate::EveProviderAdvertisementRecord; -use cultmesh_rs::CultMeshNode; -use serde_json::Value; - -#[derive(Clone, Debug, Default, PartialEq, Eq)] -pub struct OdinEndpointQuery<'a> { - pub schema: Option<&'a str>, - pub transport_contains: Option<&'a str>, - pub host_hint: Option<&'a str>, - pub device_filter: Option<&'a str>, -} - -#[derive(Clone, Debug, PartialEq, Eq)] -pub struct OdinEndpointMatch { - pub address: String, - pub schema: Option, - pub transport: Option, - pub stream_id: Option, -} - -pub fn discover_provider_endpoints( - node: &CultMeshNode, - query: OdinEndpointQuery<'_>, -) -> Vec { - let mut matches = Vec::new(); - for provider in node - .cache() - .get_all::() - .ok() - .into_iter() - .flatten() - { - collect_provider_endpoint_matches(&provider.value, &query, &mut matches); - } - dedupe_endpoint_matches(matches) -} - -fn collect_provider_endpoint_matches( - value: &Value, - query: &OdinEndpointQuery<'_>, - matches: &mut Vec, -) { - if query - .host_hint - .is_some_and(|hint| !provider_matches_host_hint(value, hint)) - { - return; - } - collect_endpoint_matches_from_provider_value(value, query, matches); -} - -fn collect_endpoint_matches_from_provider_value( - value: &Value, - query: &OdinEndpointQuery<'_>, - matches: &mut Vec, -) { - if let Some(streams) = value - .get("inputStreams") - .or_else(|| value.get("input_streams")) - .and_then(|streams| streams.as_array()) - { - for stream in streams { - if let Some(endpoint_match) = endpoint_match_from_entry(stream, query, true) { - matches.push(endpoint_match); - } - } - } - for collection_name in ["endpoints", "routes"] { - if let Some(entries) = value - .get(collection_name) - .and_then(|entries| entries.as_array()) - { - for entry in entries { - if let Some(endpoint_match) = endpoint_match_from_entry(entry, query, false) { - matches.push(endpoint_match); - } - } - } - } -} - -fn endpoint_match_from_entry( - entry: &Value, - query: &OdinEndpointQuery<'_>, - allow_device_filter: bool, -) -> Option { - let schema = entry - .get("schema") - .or_else(|| entry.get("schemaId")) - .or_else(|| entry.get("schema_id")) - .and_then(|value| value.as_str()); - if let Some(wanted_schema) = query.schema - && schema != Some(wanted_schema) - { - return None; - } - let transport = entry.get("transport").and_then(|value| value.as_str()); - if let Some(wanted_transport) = query.transport_contains - && !transport - .unwrap_or_default() - .to_ascii_lowercase() - .contains(&wanted_transport.to_ascii_lowercase()) - { - return None; - } - if let Some(filter) = query.device_filter - && allow_device_filter - && !input_stream_matches_filter(entry, filter) - { - return None; - } - let address = entry.get("address").and_then(|value| value.as_str())?; - if !endpoint_looks_like_socket(address) { - return None; - } - Some(OdinEndpointMatch { - address: address.to_string(), - schema: schema.map(ToString::to_string), - transport: transport.map(ToString::to_string), - stream_id: entry - .get("streamId") - .or_else(|| entry.get("stream_id")) - .and_then(|value| value.as_str()) - .map(ToString::to_string), - }) -} - -fn input_stream_matches_filter(stream: &Value, filter: &str) -> bool { - stream - .get("streamId") - .or_else(|| stream.get("stream_id")) - .and_then(|value| value.as_str()) - .is_some_and(|stream_id| stream_id.contains(filter)) - || stream - .get("devices") - .and_then(|value| value.as_array()) - .is_some_and(|devices| { - devices.iter().any(|device| { - device - .get("deviceId") - .or_else(|| device.get("device_id")) - .and_then(|value| value.as_str()) - == Some(filter) - || device - .get("deviceKind") - .or_else(|| device.get("device_kind")) - .and_then(|value| value.as_str()) - == Some(filter) - }) - }) -} - -fn provider_matches_host_hint(value: &Value, host_hint: &str) -> bool { - let normalized = host_hint - .trim() - .trim_end_matches(".local") - .to_ascii_lowercase(); - if normalized.is_empty() { - return true; - } - let explicit_identity = [ - "providerId", - "provider_id", - "id", - "verseId", - "verse_id", - "hostId", - "host_id", - "runtimeId", - "runtime_id", - "locatedService", - "located_service", - "cultMeshAddress", - "cult_mesh_address", - ] - .into_iter() - .filter_map(|field| value.get(field).and_then(|value| value.as_str())); - explicit_identity - .map(normalized_host_fragment) - .any(|identity| identity == normalized || identity.contains(&normalized)) -} - -fn normalized_host_fragment(value: &str) -> String { - value.trim().trim_end_matches(".local").to_ascii_lowercase() -} - -fn endpoint_looks_like_socket(endpoint: &str) -> bool { - let Some((host, port)) = endpoint.rsplit_once(':') else { - return false; - }; - !host.trim().is_empty() - && port - .parse::() - .is_ok_and(|parsed_port| parsed_port != 0) -} - -fn dedupe_endpoint_matches(mut matches: Vec) -> Vec { - matches.sort_by(|left, right| { - ( - &left.address, - &left.schema, - &left.transport, - &left.stream_id, - ) - .cmp(&( - &right.address, - &right.schema, - &right.transport, - &right.stream_id, - )) - }); - matches.dedup(); - matches -} - -#[cfg(test)] -mod tests { - use super::*; - use serde_json::json; - - #[test] - fn host_hint_matches_explicit_provider_identity_not_nested_mentions() { - let starfire_provider = json!({ - "providerId": "muninn.telemetry.starfire", - "verseId": "starfire.local", - "inputStreams": [{ - "address": "198.51.100.66:17888", - "schema": "muninn.hid_controller_state.v1", - "transport": "cultnet.transport.rudp.v0", - "streamId": "raven:xbox-raven:hid-controller-state", - "devices": [{ - "deviceId": "xbox-raven", - "deviceKind": "xinput-controller" - }] - }] - }); - - let mut matches = Vec::new(); - collect_provider_endpoint_matches( - &starfire_provider, - &OdinEndpointQuery { - schema: Some("muninn.hid_controller_state.v1"), - transport_contains: Some("rudp"), - host_hint: Some("raven"), - device_filter: Some("xbox-raven"), - }, - &mut matches, - ); - - assert!(matches.is_empty()); - } - - #[test] - fn host_hint_matches_normalized_provider_catalog_identity() { - let starfire_provider = json!({ - "id": "muninn.telemetry.starfire", - "locatedService": "asgard.starfire.muninn", - "routes": [{ - "address": "198.51.100.66:17888", - "schema": "muninn.hid_controller_state.v1", - "transport": "cultnet.transport.rudp.v0" - }] - }); - - let mut matches = Vec::new(); - collect_provider_endpoint_matches( - &starfire_provider, - &OdinEndpointQuery { - schema: Some("muninn.hid_controller_state.v1"), - transport_contains: Some("rudp"), - host_hint: Some("starfire"), - device_filter: Some("nav-windows-psnav-0"), - }, - &mut matches, - ); - - assert_eq!(matches.len(), 1); - assert_eq!(matches[0].address, "198.51.100.66:17888"); - } -} diff --git a/crates/odin-core/src/documents.rs b/crates/odin-core/src/documents.rs deleted file mode 100644 index 811685c..0000000 --- a/crates/odin-core/src/documents.rs +++ /dev/null @@ -1,1014 +0,0 @@ -use cultcache_rs::DatabaseEntry; -use serde_json::Value; - -pub const ODIN_SNAPSHOT_SCHEMA: &str = "odin.snapshot.v1"; -pub const ODIN_VERSE_SCHEMA: &str = "odin.verse.v1"; -pub const ODIN_SERVICE_SCHEMA: &str = "odin.service.v1"; -pub const ODIN_INTERFACE_SCHEMA: &str = "odin.interface.v1"; -pub const ODIN_OBSERVATION_STREAM_SCHEMA: &str = "odin.observation_stream.v1"; -pub const ODIN_TRANSLATION_ROUTE_SCHEMA: &str = "odin.translation_route.v1"; -pub const EVE_SURFACE_STATE_SCHEMA: &str = "gamecult.eve.surface_state.v1"; -pub const EVE_INTERFACE_BINDING_SCHEMA: &str = "gamecult.eve.interface_binding.v1"; -pub const EVE_PROVIDER_ADVERTISEMENT_SCHEMA: &str = "gamecult.eve.provider_advertisement.v1"; -pub const VOIDBOT_SWARM_STATE_SNAPSHOT_SCHEMA: &str = "voidbot.swarm_state_snapshot.v1"; -pub const MUNINN_TELEMETRY_SURFACE_SCHEMA: &str = "muninn.telemetry_surface.v1"; -pub const MUNINN_CAPTURE_STREAM_SCHEMA: &str = "muninn.capture_stream.v1"; -pub const MUNINN_CAPTURE_STREAM_COMMAND_SCHEMA: &str = "muninn.capture_stream_command.v1"; -pub const MUNINN_MEDIA_VIDEO_ACCESS_UNIT_SCHEMA: &str = "muninn.media_video_access_unit.v1"; -pub const MUNINN_MEDIA_VIDEO_PARITY_SHARD_SCHEMA: &str = "muninn.media_video_parity_shard.v2"; -pub const MUNINN_MEDIA_AUDIO_PACKET_SCHEMA: &str = "muninn.media_audio_packet.v1"; -pub const MUNINN_MEDIA_RECEIVER_FEEDBACK_SCHEMA: &str = "muninn.media_receiver_feedback.v1"; -pub const MUNINN_OBS_STREAM_CATALOG_SCHEMA: &str = "muninn.obs_stream_catalog.v1"; -pub const MUNINN_MOVE_MARKER_CANDIDATE_SCHEMA: &str = "muninn.move_marker_candidate.v1"; -pub const MUNINN_MOVE_CONTROLLER_STATE_SCHEMA: &str = "muninn.move_controller_state.v1"; -pub const MUNINN_HID_CONTROLLER_STATE_SCHEMA: &str = "muninn.hid_controller_state.v1"; -pub const MUNINN_MOVE_IDENTITY_SCHEMA: &str = "muninn.move_identity.v1"; -pub const MUNINN_MOVE_LIGHT_COMMAND_SCHEMA: &str = "muninn.move_light_command.v1"; -pub const MUNINN_MOVE_HUE_PROGRAM_SCHEMA: &str = "muninn.move_hue_program.v1"; -pub const MUNINN_MOVE_TRACKER_HEALTH_SCHEMA: &str = "muninn.move_tracker_health.v1"; -pub const MUNINN_MOVE_EVIDENCE_TRANSPORT_HEALTH_SCHEMA: &str = - "muninn.move_evidence_transport_health.v1"; -pub const MUNINN_QUEST_ACCESS_SCHEMA: &str = "muninn.quest_access.v1"; -pub const MUNINN_COMMAND_BOUNDARY_SCHEMA: &str = "muninn.command_boundary.v1"; -pub const MUNINN_TRANSPORT_PROFILE_SCHEMA: &str = "muninn.transport_profile.v1"; -pub const SLEIPNIR_INPUT_MAPPING_SCHEMA: &str = "sleipnir.input_mapping.v1"; - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache(type = "odin.snapshot", schema = "odin.snapshot.v1")] -pub struct OdinSnapshotRecord { - #[cultcache(key = 0)] - pub snapshot_id: String, - #[cultcache(key = 1)] - pub observed_at: String, - #[cultcache(key = 2)] - pub verse_count: u32, - #[cultcache(key = 3)] - pub service_count: u32, - #[cultcache(key = 4)] - pub interface_count: u32, - #[cultcache(key = 5)] - pub observation_stream_count: u32, - #[cultcache(key = 6)] - pub source: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache(type = "odin.verse", schema = "odin.verse.v1")] -pub struct OdinVerseRecord { - #[cultcache(key = 0)] - pub verse_id: String, - #[cultcache(key = 1)] - pub name: String, - #[cultcache(key = 2)] - pub role: String, - #[cultcache(key = 3)] - pub status: String, - #[cultcache(key = 4)] - pub capabilities: Vec, - #[cultcache(key = 5)] - pub observed_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache(type = "odin.service", schema = "odin.service.v1")] -pub struct OdinServiceRecord { - #[cultcache(key = 0)] - pub service_id: String, - #[cultcache(key = 1)] - pub verse_id: String, - #[cultcache(key = 2)] - pub name: String, - #[cultcache(key = 3)] - pub state: String, - #[cultcache(key = 4)] - pub detail: String, - #[cultcache(key = 5)] - pub authority: String, - #[cultcache(key = 6)] - pub observed_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache(type = "odin.interface", schema = "odin.interface.v1")] -pub struct OdinInterfaceRecord { - #[cultcache(key = 0)] - pub provider_id: String, - #[cultcache(key = 1)] - pub title: String, - #[cultcache(key = 2)] - pub state: String, - #[cultcache(key = 3)] - pub source: String, - #[cultcache(key = 4)] - pub version: Option, - #[cultcache(key = 5)] - pub updated_at: Option, - #[cultcache(key = 6)] - pub observed_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "odin.observation_stream", - schema = "odin.observation_stream.v1" -)] -pub struct OdinObservationStreamRecord { - #[cultcache(key = 0)] - pub stream_key: String, - #[cultcache(key = 1)] - pub device_id: String, - #[cultcache(key = 2)] - pub stream_id: String, - #[cultcache(key = 3)] - pub kind: String, - #[cultcache(key = 4)] - pub state: String, - #[cultcache(key = 5)] - pub detail: String, - #[cultcache(key = 6)] - pub owner: String, - #[cultcache(key = 7)] - pub observed_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache(type = "odin.translation_route", schema = "odin.translation_route.v1")] -pub struct OdinTranslationRouteRecord { - #[cultcache(key = 0)] - pub route_id: String, - #[cultcache(key = 1)] - pub source_schema: String, - #[cultcache(key = 2)] - pub target_schema: String, - #[cultcache(key = 3)] - pub translation_kind: String, - #[cultcache(key = 4)] - pub owner: String, - #[cultcache(key = 5)] - pub version: String, - #[cultcache(key = 6)] - pub notes: String, -} - -#[derive(Clone, Debug, PartialEq, DatabaseEntry)] -#[cultcache( - type = "gamecult.eve.surface_state", - schema = "gamecult.eve.surface_state.v1" -)] -pub struct EveSurfaceStateRecord { - #[cultcache(key = 0)] - pub provider_id: String, - #[cultcache(key = 1)] - pub title: String, - #[cultcache(key = 2)] - pub version: i64, - #[cultcache(key = 3)] - pub updated_at: String, - #[cultcache(key = 4)] - pub surface: Value, -} - -#[derive(Clone, Debug, PartialEq, DatabaseEntry)] -#[cultcache( - type = "gamecult.eve.interface_binding", - schema = "gamecult.eve.interface_binding.v1" -)] -pub struct EveInterfaceBindingCompatRecord { - #[cultcache(key = 0)] - pub value: Value, -} - -#[derive(Clone, Debug, PartialEq, DatabaseEntry)] -#[cultcache( - type = "gamecult.eve.provider_advertisement", - schema = "gamecult.eve.provider_advertisement.v1" -)] -pub struct EveProviderAdvertisementRecord { - #[cultcache(key = 0)] - pub value: Value, -} - -#[derive(Clone, Debug, PartialEq, DatabaseEntry)] -#[cultcache( - type = "voidbot.swarm_state_snapshot", - schema = "voidbot.swarm_state_snapshot.v1" -)] -pub struct VoidBotSwarmStateSnapshotCompatRecord { - #[cultcache(key = 0)] - pub value: Value, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache(type = "muninn.capture_stream", schema = "muninn.capture_stream.v1")] -pub struct MuninnCaptureStreamRecord { - #[cultcache(key = 0)] - pub stream_id: String, - #[cultcache(key = 1)] - pub host_id: String, - #[cultcache(key = 2)] - pub state: String, - #[cultcache(key = 3)] - pub video_source: String, - #[cultcache(key = 4)] - pub audio_source: String, - #[cultcache(key = 5)] - pub transport: String, - #[cultcache(key = 6)] - pub targets: Vec, - #[cultcache(key = 7)] - pub command_witness: String, - #[cultcache(key = 8)] - pub supervisor_pid: Option, - #[cultcache(key = 9)] - pub mux_pid: Option, - #[cultcache(key = 10)] - pub restart_count: u32, - #[cultcache(key = 11)] - pub detail: String, - #[cultcache(key = 12)] - pub updated_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "muninn.capture_stream_command", - schema = "muninn.capture_stream_command.v1" -)] -pub struct MuninnCaptureStreamCommandRecord { - #[cultcache(key = 0)] - pub command_id: String, - #[cultcache(key = 1)] - pub host_id: String, - #[cultcache(key = 2)] - pub stream_id: String, - #[cultcache(key = 3)] - pub state: String, - #[cultcache(key = 4)] - pub action: String, - #[cultcache(key = 5)] - pub target_host: String, - #[cultcache(key = 6)] - pub port: u16, - #[cultcache(key = 7)] - pub obs_target_host: Option, - #[cultcache(key = 8)] - pub obs_port: u16, - #[cultcache(key = 9)] - pub media_transport: String, - #[cultcache(key = 10)] - pub media_packet_bytes: u32, - #[cultcache(key = 11)] - pub requested_by: String, - #[cultcache(key = 12)] - pub detail: String, - #[cultcache(key = 13)] - pub updated_at: String, - #[cultcache(key = 14, default)] - pub rudp_video_bitrate_kbps: u32, - #[cultcache(key = 15, default)] - pub rudp_latency_budget_ms: u32, - #[cultcache(key = 16, default)] - pub video_source_id: String, - #[cultcache(key = 17, default)] - pub audio_source_id: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "muninn.media_video_access_unit", - schema = "muninn.media_video_access_unit.v1" -)] -pub struct MuninnMediaVideoAccessUnitRecord { - #[cultcache(key = 0)] - pub stream_id: String, - #[cultcache(key = 1)] - pub session_id: String, - #[cultcache(key = 2)] - pub frame_id: u64, - #[cultcache(key = 3)] - pub codec: String, - #[cultcache(key = 4)] - pub pts_ticks: i64, - #[cultcache(key = 5)] - pub duration_ticks: u32, - #[cultcache(key = 6)] - pub timebase_num: u32, - #[cultcache(key = 7)] - pub timebase_den: u32, - #[cultcache(key = 8)] - pub keyframe: bool, - #[cultcache(key = 9)] - pub dependency_frame_id: Option, - #[cultcache(key = 10)] - pub deadline_ticks: i64, - #[cultcache(key = 11)] - pub chunk_index: u16, - #[cultcache(key = 12)] - pub chunk_count: u16, - #[cultcache(key = 13)] - pub payload: Vec, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "muninn.media_video_parity_shard", - schema = "muninn.media_video_parity_shard.v2" -)] -pub struct MuninnMediaVideoParityShardRecord { - #[cultcache(key = 0)] - pub stream_id: String, - #[cultcache(key = 1)] - pub session_id: String, - #[cultcache(key = 2)] - pub frame_id: u64, - #[cultcache(key = 3)] - pub codec: String, - #[cultcache(key = 4)] - pub pts_ticks: i64, - #[cultcache(key = 5)] - pub duration_ticks: u32, - #[cultcache(key = 6)] - pub timebase_num: u32, - #[cultcache(key = 7)] - pub timebase_den: u32, - #[cultcache(key = 8)] - pub keyframe: bool, - #[cultcache(key = 9)] - pub dependency_frame_id: Option, - #[cultcache(key = 10)] - pub deadline_ticks: i64, - #[cultcache(key = 11)] - pub chunk_count: u16, - #[cultcache(key = 12)] - pub parity_index: u16, - #[cultcache(key = 13)] - pub parity_count: u16, - #[cultcache(key = 14)] - pub chunk_payload_bytes: u32, - #[cultcache(key = 15)] - pub last_chunk_payload_bytes: u32, - #[cultcache(key = 16)] - pub payload: Vec, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "muninn.media_audio_packet", - schema = "muninn.media_audio_packet.v1" -)] -pub struct MuninnMediaAudioPacketRecord { - #[cultcache(key = 0)] - pub stream_id: String, - #[cultcache(key = 1)] - pub session_id: String, - #[cultcache(key = 2)] - pub packet_id: u64, - #[cultcache(key = 3)] - pub codec: String, - #[cultcache(key = 4)] - pub pts_ticks: i64, - #[cultcache(key = 5)] - pub duration_ticks: u32, - #[cultcache(key = 6)] - pub timebase_num: u32, - #[cultcache(key = 7)] - pub timebase_den: u32, - #[cultcache(key = 8)] - pub deadline_ticks: i64, - #[cultcache(key = 9)] - pub payload: Vec, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "muninn.media_receiver_feedback", - schema = "muninn.media_receiver_feedback.v1" -)] -pub struct MuninnMediaReceiverFeedbackRecord { - #[cultcache(key = 0)] - pub stream_id: String, - #[cultcache(key = 1)] - pub session_id: String, - #[cultcache(key = 2)] - pub receiver_id: String, - #[cultcache(key = 3)] - pub highest_decodable_frame_id: Option, - #[cultcache(key = 4)] - pub missing_frame_ids: Vec, - #[cultcache(key = 5)] - pub late_frame_ids: Vec, - #[cultcache(key = 6)] - pub requested_keyframe: bool, - #[cultcache(key = 7)] - pub jitter_us: i64, - #[cultcache(key = 8)] - pub decode_queue_us: i64, - #[cultcache(key = 9)] - pub observed_at: String, - #[cultcache(key = 10, default)] - pub missing_video_chunk_keys: Vec, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "muninn.telemetry_surface", - schema = "muninn.telemetry_surface.v1" -)] -pub struct MuninnTelemetrySurfaceRecord { - #[cultcache(key = 0)] - pub surface_id: String, - #[cultcache(key = 1)] - pub host_id: String, - #[cultcache(key = 2)] - pub state: String, - #[cultcache(key = 3)] - pub available_sources: Vec, - #[cultcache(key = 4)] - pub stream_affordances: Vec, - #[cultcache(key = 5)] - pub active_streams: Vec, - #[cultcache(key = 6)] - pub activation_authority: String, - #[cultcache(key = 7)] - pub detail: String, - #[cultcache(key = 8)] - pub updated_at: String, - #[cultcache(key = 9, default)] - pub primary_stream_id: String, - #[cultcache(key = 10, default)] - pub primary_stream_label: String, - #[cultcache(key = 11, default)] - pub command_rudp_target: String, - #[cultcache(key = 12, default)] - pub media_target_host: String, - #[cultcache(key = 13, default)] - pub media_port: u16, - #[cultcache(key = 14, default)] - pub media_packet_bytes: u32, - #[cultcache(key = 15, default)] - pub rudp_video_bitrate_kbps: u32, - #[cultcache(key = 16, default)] - pub rudp_latency_budget_ms: u32, - #[cultcache(key = 17, default)] - pub video_source_ids: Vec, - #[cultcache(key = 18, default)] - pub video_source_labels: Vec, - #[cultcache(key = 19, default)] - pub audio_source_ids: Vec, - #[cultcache(key = 20, default)] - pub audio_source_labels: Vec, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "muninn.obs_stream_catalog", - schema = "muninn.obs_stream_catalog.v1" -)] -pub struct MuninnObsStreamCatalogRecord { - #[cultcache(key = 0)] - pub catalog_id: String, - #[cultcache(key = 1)] - pub host_id: String, - #[cultcache(key = 2)] - pub stream_ids: Vec, - #[cultcache(key = 3)] - pub labels: Vec, - #[cultcache(key = 4)] - pub urls: Vec, - #[cultcache(key = 5)] - pub states: Vec, - #[cultcache(key = 6)] - pub updated_at: String, - #[cultcache(key = 7, default)] - pub command_rudp_target: String, - #[cultcache(key = 8, default)] - pub media_target_host: String, - #[cultcache(key = 9, default)] - pub media_port: u16, - #[cultcache(key = 10, default)] - pub media_packet_bytes: u32, - #[cultcache(key = 11, default)] - pub rudp_video_bitrate_kbps: u32, - #[cultcache(key = 12, default)] - pub rudp_latency_budget_ms: u32, - #[cultcache(key = 13, default)] - pub video_source_ids: Vec, - #[cultcache(key = 14, default)] - pub video_source_labels: Vec, - #[cultcache(key = 15, default)] - pub audio_source_ids: Vec, - #[cultcache(key = 16, default)] - pub audio_source_labels: Vec, -} - -#[derive(Clone, Debug, PartialEq, DatabaseEntry)] -#[cultcache( - type = "muninn.move_marker_candidate", - schema = "muninn.move_marker_candidate.v1" -)] -pub struct MuninnMoveMarkerCandidateRecord { - #[cultcache(key = 0)] - pub stream_id: String, - #[cultcache(key = 1)] - pub host_id: String, - #[cultcache(key = 2)] - pub camera_id: String, - #[cultcache(key = 3)] - pub frame_sequence: u64, - #[cultcache(key = 4)] - pub source_id_hash: u64, - #[cultcache(key = 5)] - pub tile_x: u32, - #[cultcache(key = 6)] - pub tile_y: u32, - #[cultcache(key = 7)] - pub center_x_px: f32, - #[cultcache(key = 8)] - pub center_y_px: f32, - #[cultcache(key = 9)] - pub radius_px: f32, - #[cultcache(key = 10)] - pub area_px: u32, - #[cultcache(key = 11)] - pub mean_luma: f32, - #[cultcache(key = 12)] - pub peak_luma: u32, - #[cultcache(key = 13)] - pub score: f32, - #[cultcache(key = 14)] - pub observed_at: String, - #[cultcache(key = 15, default)] - pub move_id: String, -} - -#[derive(Clone, Debug, PartialEq, DatabaseEntry)] -#[cultcache( - type = "muninn.move_controller_state", - schema = "muninn.move_controller_state.v1" -)] -pub struct MuninnMoveControllerStateRecord { - #[cultcache(key = 0)] - pub stream_id: String, - #[cultcache(key = 1)] - pub host_id: String, - #[cultcache(key = 2)] - pub move_id: String, - #[cultcache(key = 3)] - pub sequence: u64, - #[cultcache(key = 4)] - pub source_timestamp_ns: i64, - #[cultcache(key = 5)] - pub accelerometer_xyz: Vec, - #[cultcache(key = 6)] - pub gyroscope_xyz: Vec, - #[cultcache(key = 7)] - pub magnetometer_xyz: Vec, - #[cultcache(key = 8)] - pub trigger_value: f32, - #[cultcache(key = 9)] - pub buttons: Vec, - #[cultcache(key = 10)] - pub battery01: f32, - #[cultcache(key = 11)] - pub observed_at: String, - #[cultcache(key = 12, default)] - pub source_path: String, -} - -#[derive(Clone, Debug, PartialEq, DatabaseEntry)] -#[cultcache( - type = "muninn.hid_controller_state", - schema = "muninn.hid_controller_state.v1" -)] -pub struct MuninnHidControllerStateRecord { - #[cultcache(key = 0)] - pub stream_id: String, - #[cultcache(key = 1)] - pub host_id: String, - #[cultcache(key = 2)] - pub device_id: String, - #[cultcache(key = 3)] - pub device_kind: String, - #[cultcache(key = 4)] - pub sequence: u64, - #[cultcache(key = 5)] - pub source_timestamp_ns: i64, - #[cultcache(key = 6)] - pub axes: Vec, - #[cultcache(key = 7)] - pub buttons: Vec, - #[cultcache(key = 8)] - pub battery01: f32, - #[cultcache(key = 9)] - pub observed_at: String, - #[cultcache(key = 10)] - pub source_path: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache(type = "muninn.move_identity", schema = "muninn.move_identity.v1")] -pub struct MuninnMoveIdentityRecord { - #[cultcache(key = 0)] - pub identity_id: String, - #[cultcache(key = 1)] - pub host_id: String, - #[cultcache(key = 2)] - pub move_id: String, - #[cultcache(key = 3)] - pub source_path: String, - #[cultcache(key = 4)] - pub bluetooth_host_address: String, - #[cultcache(key = 5)] - pub state: String, - #[cultcache(key = 6)] - pub detail: String, - #[cultcache(key = 7)] - pub observed_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "muninn.move_light_command", - schema = "muninn.move_light_command.v1" -)] -pub struct MuninnMoveLightCommandRecord { - #[cultcache(key = 0)] - pub command_id: String, - #[cultcache(key = 1)] - pub host_id: String, - #[cultcache(key = 2)] - pub move_id: String, - #[cultcache(key = 3)] - pub hidraw_path: String, - #[cultcache(key = 4)] - pub colors: Vec, - #[cultcache(key = 5)] - pub durations_ms: Vec, - #[cultcache(key = 6)] - pub repeat_count: u32, - #[cultcache(key = 7)] - pub authority: String, - #[cultcache(key = 8)] - pub state: String, - #[cultcache(key = 9)] - pub detail: String, - #[cultcache(key = 10)] - pub updated_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "muninn.move_hue_program", - schema = "muninn.move_hue_program.v1" -)] -pub struct MuninnMoveHueProgramRecord { - #[cultcache(key = 0)] - pub program_id: String, - #[cultcache(key = 1)] - pub host_id: String, - #[cultcache(key = 2)] - pub mode: String, - #[cultcache(key = 3)] - pub cycle_ms: u64, - #[cultcache(key = 4)] - pub epoch_ns: i64, - #[cultcache(key = 5)] - pub hold_at_ns: i64, - #[cultcache(key = 6)] - pub requested_by: String, - #[cultcache(key = 7)] - pub updated_at: String, - #[cultcache(key = 8, default)] - pub order_mode: String, - #[cultcache(key = 9, default)] - pub transition_percent: u8, - #[cultcache(key = 10, default)] - pub transition_percent_explicit: bool, -} - -#[derive(Clone, Debug, PartialEq, DatabaseEntry)] -#[cultcache( - type = "muninn.move_tracker_health", - schema = "muninn.move_tracker_health.v1" -)] -pub struct MuninnMoveTrackerHealthRecord { - #[cultcache(key = 0)] - pub health_id: String, - #[cultcache(key = 1)] - pub host_id: String, - #[cultcache(key = 2)] - pub camera_id: String, - #[cultcache(key = 3)] - pub camera_index: i32, - #[cultcache(key = 4)] - pub state: String, - #[cultcache(key = 5)] - pub camera_name: String, - #[cultcache(key = 6)] - pub camera_api: String, - #[cultcache(key = 7)] - pub width: u32, - #[cultcache(key = 8)] - pub height: u32, - #[cultcache(key = 9)] - pub exposure: f32, - #[cultcache(key = 10)] - pub calibrated_controller_count: u32, - #[cultcache(key = 11)] - pub update_count: u64, - #[cultcache(key = 12)] - pub observation_count: u64, - #[cultcache(key = 13)] - pub latest_observation_count: u32, - #[cultcache(key = 14)] - pub last_observation_at: String, - #[cultcache(key = 15)] - pub detail: String, - #[cultcache(key = 16)] - pub updated_at: String, - #[cultcache(key = 17, default)] - pub image_mean_rgb: Vec, - #[cultcache(key = 18, default)] - pub image_peak_rgb: Vec, - #[cultcache(key = 19, default)] - pub color_evidence_move_ids: Vec, - #[cultcache(key = 20, default)] - pub color_evidence_pixel_counts: Vec, - #[cultcache(key = 21, default)] - pub rejected_stale_count: u64, - #[cultcache(key = 22, default)] - pub rejected_radius_count: u64, - #[cultcache(key = 23, default)] - pub rejected_bounds_count: u64, - #[cultcache(key = 24, default)] - pub rejected_continuity_count: u64, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache( - type = "muninn.move_evidence_transport_health", - schema = "muninn.move_evidence_transport_health.v1" -)] -pub struct MuninnMoveEvidenceTransportHealthRecord { - #[cultcache(key = 0)] - pub health_id: String, - #[cultcache(key = 1)] - pub host_id: String, - #[cultcache(key = 2)] - pub stream_id: String, - #[cultcache(key = 3)] - pub produced_frames: u64, - #[cultcache(key = 4)] - pub local_ring_admissions: u64, - #[cultcache(key = 5)] - pub remote_handoffs: u64, - #[cultcache(key = 6)] - pub remote_sends: u64, - #[cultcache(key = 7)] - pub updated_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] -#[cultcache(type = "muninn.quest_access", schema = "muninn.quest_access.v1")] -pub struct MuninnQuestAccessRecord { - #[cultcache(key = 0)] - pub access_id: String, - #[cultcache(key = 1)] - pub host_id: String, - #[cultcache(key = 2)] - pub serial: String, - #[cultcache(key = 3)] - pub connection_state: String, - #[cultcache(key = 4)] - pub product: String, - #[cultcache(key = 5)] - pub model: String, - #[cultcache(key = 6)] - pub device: String, - #[cultcache(key = 7)] - pub transport_id: String, - #[cultcache(key = 8)] - pub input_stream_id: String, - #[cultcache(key = 9)] - pub pose_stream_id: String, - #[cultcache(key = 10)] - pub video_input_stream_id: String, - #[cultcache(key = 11)] - pub video_input_transport: String, - #[cultcache(key = 12)] - pub state: String, - #[cultcache(key = 13)] - pub detail: String, - #[cultcache(key = 14)] - pub observed_at: String, -} - -#[derive(Clone, Debug, PartialEq, DatabaseEntry)] -#[cultcache( - type = "muninn.command_boundary", - schema = "muninn.command_boundary.v1" -)] -pub struct MuninnCommandBoundaryCompatRecord { - #[cultcache(key = 0)] - pub value: Value, -} - -#[derive(Clone, Debug, PartialEq, DatabaseEntry)] -#[cultcache( - type = "muninn.transport_profile", - schema = "muninn.transport_profile.v1" -)] -pub struct MuninnTransportProfileCompatRecord { - #[cultcache(key = 0)] - pub value: Value, -} - -#[derive(Clone, Debug, PartialEq, DatabaseEntry)] -#[cultcache(type = "sleipnir.input_mapping", schema = "sleipnir.input_mapping.v1")] -pub struct SleipnirInputMappingRecord { - #[cultcache(key = 0)] - pub provider_id: String, - #[cultcache(key = 1)] - pub enabled: bool, - #[cultcache(key = 2)] - pub device_filter: String, - #[cultcache(key = 3)] - pub stream_id: String, - #[cultcache(key = 4)] - pub presentation: String, - #[cultcache(key = 5)] - pub axis_map: Value, - #[cultcache(key = 6)] - pub button_map: Value, - #[cultcache(key = 7)] - pub pending_learn: Value, - #[cultcache(key = 8)] - pub updated_at: String, - #[cultcache(key = 9)] - pub source: String, -} - -cultmesh_rs::cultmesh_documents!(OdinDocuments { - OdinSnapshotRecord => ODIN_SNAPSHOT_SCHEMA, - OdinVerseRecord => ODIN_VERSE_SCHEMA, - OdinServiceRecord => ODIN_SERVICE_SCHEMA, - OdinInterfaceRecord => ODIN_INTERFACE_SCHEMA, - OdinObservationStreamRecord => ODIN_OBSERVATION_STREAM_SCHEMA, - OdinTranslationRouteRecord => ODIN_TRANSLATION_ROUTE_SCHEMA, - EveSurfaceStateRecord => EVE_SURFACE_STATE_SCHEMA, - EveInterfaceBindingCompatRecord => EVE_INTERFACE_BINDING_SCHEMA, - EveProviderAdvertisementRecord => EVE_PROVIDER_ADVERTISEMENT_SCHEMA, - VoidBotSwarmStateSnapshotCompatRecord => VOIDBOT_SWARM_STATE_SNAPSHOT_SCHEMA, - MuninnTelemetrySurfaceRecord => MUNINN_TELEMETRY_SURFACE_SCHEMA, - MuninnCaptureStreamRecord => MUNINN_CAPTURE_STREAM_SCHEMA, - MuninnCaptureStreamCommandRecord => MUNINN_CAPTURE_STREAM_COMMAND_SCHEMA, - MuninnMediaVideoAccessUnitRecord => MUNINN_MEDIA_VIDEO_ACCESS_UNIT_SCHEMA, - MuninnMediaVideoParityShardRecord => MUNINN_MEDIA_VIDEO_PARITY_SHARD_SCHEMA, - MuninnMediaAudioPacketRecord => MUNINN_MEDIA_AUDIO_PACKET_SCHEMA, - MuninnMediaReceiverFeedbackRecord => MUNINN_MEDIA_RECEIVER_FEEDBACK_SCHEMA, - MuninnObsStreamCatalogRecord => MUNINN_OBS_STREAM_CATALOG_SCHEMA, - MuninnMoveMarkerCandidateRecord => MUNINN_MOVE_MARKER_CANDIDATE_SCHEMA, - MuninnMoveControllerStateRecord => MUNINN_MOVE_CONTROLLER_STATE_SCHEMA, - MuninnHidControllerStateRecord => MUNINN_HID_CONTROLLER_STATE_SCHEMA, - MuninnMoveIdentityRecord => MUNINN_MOVE_IDENTITY_SCHEMA, - MuninnMoveLightCommandRecord => MUNINN_MOVE_LIGHT_COMMAND_SCHEMA, - MuninnMoveHueProgramRecord => MUNINN_MOVE_HUE_PROGRAM_SCHEMA, - MuninnMoveTrackerHealthRecord => MUNINN_MOVE_TRACKER_HEALTH_SCHEMA, - MuninnMoveEvidenceTransportHealthRecord => MUNINN_MOVE_EVIDENCE_TRANSPORT_HEALTH_SCHEMA, - MuninnQuestAccessRecord => MUNINN_QUEST_ACCESS_SCHEMA, - MuninnCommandBoundaryCompatRecord => MUNINN_COMMAND_BOUNDARY_SCHEMA, - MuninnTransportProfileCompatRecord => MUNINN_TRANSPORT_PROFILE_SCHEMA, - SleipnirInputMappingRecord => SLEIPNIR_INPUT_MAPPING_SCHEMA, -}); - -#[derive(Clone, Debug, Default, PartialEq, Eq)] -pub struct OdinRecords { - pub snapshot: Option, - pub verses: Vec, - pub services: Vec, - pub interfaces: Vec, - pub observation_streams: Vec, - pub translation_routes: Vec, -} - -#[cfg(test)] -mod tests { - use super::*; - use anyhow::Result; - use cultmesh_rs::{CultMesh, CultMeshNodeOptions}; - - #[test] - fn muninn_media_documents_round_trip_through_cultmesh() -> Result<()> { - let temp = tempfile::tempdir()?; - let store_path = temp.path().join("muninn-media.cc"); - let mut node = CultMesh::create_node( - &store_path, - OdinDocuments, - CultMeshNodeOptions { - runtime_id: "muninn-media-test".to_string(), - pull_on_start: true, - }, - )?; - - let video = MuninnMediaVideoAccessUnitRecord { - stream_id: "muninn.raven.av.rudp".to_string(), - session_id: "session-1".to_string(), - frame_id: 42, - codec: "h264".to_string(), - pts_ticks: 126_000, - duration_ticks: 3_000, - timebase_num: 1, - timebase_den: 90_000, - keyframe: true, - dependency_frame_id: None, - deadline_ticks: 127_800, - chunk_index: 0, - chunk_count: 1, - payload: vec![0, 0, 0, 1, 0x65], - }; - let audio = MuninnMediaAudioPacketRecord { - stream_id: video.stream_id.clone(), - session_id: video.session_id.clone(), - packet_id: 7, - codec: "opus".to_string(), - pts_ticks: 67_200, - duration_ticks: 960, - timebase_num: 1, - timebase_den: 48_000, - deadline_ticks: 68_160, - payload: vec![0xf8, 0xff, 0xfe], - }; - let feedback = MuninnMediaReceiverFeedbackRecord { - stream_id: video.stream_id.clone(), - session_id: video.session_id.clone(), - receiver_id: "starfire.obs".to_string(), - highest_decodable_frame_id: Some(41), - missing_frame_ids: vec![42], - late_frame_ids: vec![40], - requested_keyframe: true, - jitter_us: 750, - decode_queue_us: 2_000, - observed_at: "2026-06-18T00:00:00Z".to_string(), - missing_video_chunk_keys: vec!["42:2".to_string()], - }; - - node.put("video:42:0", &video)?; - node.put("audio:7", &audio)?; - node.put("feedback:starfire.obs", &feedback)?; - - assert_eq!( - node.documents() - .binding("muninn.media_video_access_unit") - .and_then(|binding| binding.payload_schema_version.clone()) - .as_deref(), - Some(MUNINN_MEDIA_VIDEO_ACCESS_UNIT_SCHEMA) - ); - assert_eq!( - node.documents() - .binding("muninn.media_audio_packet") - .and_then(|binding| binding.payload_schema_version.clone()) - .as_deref(), - Some(MUNINN_MEDIA_AUDIO_PACKET_SCHEMA) - ); - assert_eq!( - node.documents() - .binding("muninn.media_receiver_feedback") - .and_then(|binding| binding.payload_schema_version.clone()) - .as_deref(), - Some(MUNINN_MEDIA_RECEIVER_FEEDBACK_SCHEMA) - ); - - let reloaded = CultMesh::create_node( - &store_path, - OdinDocuments, - CultMeshNodeOptions { - runtime_id: "muninn-media-test-reloaded".to_string(), - pull_on_start: true, - }, - )?; - assert_eq!( - reloaded - .get_required::("video:42:0")? - .payload, - vec![0, 0, 0, 1, 0x65] - ); - assert_eq!( - reloaded - .get_required::("audio:7")? - .codec, - "opus" - ); - assert!( - reloaded - .get_required::("feedback:starfire.obs")? - .requested_keyframe - ); - assert_eq!( - reloaded - .get_required::("feedback:starfire.obs")? - .missing_video_chunk_keys, - vec!["42:2".to_string()] - ); - Ok(()) - } -} diff --git a/crates/odin-core/src/lib.rs b/crates/odin-core/src/lib.rs deleted file mode 100644 index 3c7cb49..0000000 --- a/crates/odin-core/src/lib.rs +++ /dev/null @@ -1,11 +0,0 @@ -pub mod discovery; -pub mod documents; -pub mod pipeline; -pub mod ports; -pub mod repository; - -pub use discovery::*; -pub use documents::*; -pub use pipeline::*; -pub use ports::*; -pub use repository::*; diff --git a/crates/odin-core/src/pipeline.rs b/crates/odin-core/src/pipeline.rs deleted file mode 100644 index 6635d15..0000000 --- a/crates/odin-core/src/pipeline.rs +++ /dev/null @@ -1,260 +0,0 @@ -use crate::documents::{ - OdinInterfaceRecord, OdinObservationStreamRecord, OdinRecords, OdinServiceRecord, - OdinSnapshotRecord, OdinTranslationRouteRecord, OdinVerseRecord, -}; -use crate::ports::{ - Clock, InterfaceIngest, ObservationStreamIngest, OdinInputBatch, ServiceIngest, - TranslationRouteIngest, VerseIngest, -}; -use anyhow::Result; - -pub struct OdinIngestPipeline { - verses: V, - services: S, - interfaces: I, - streams: O, - translations: T, - clock: C, -} - -impl OdinIngestPipeline -where - V: VerseIngest, - S: ServiceIngest, - I: InterfaceIngest, - O: ObservationStreamIngest, - T: TranslationRouteIngest, - C: Clock, -{ - pub fn new( - verses: V, - services: S, - interfaces: I, - streams: O, - translations: T, - clock: C, - ) -> Self { - Self { - verses, - services, - interfaces, - streams, - translations, - clock, - } - } - - pub fn collect(&self) -> Result { - Ok(OdinInputBatch { - observed_at: self.clock.now(), - source: "odin.rust.ingest".to_string(), - verses: self.verses.observe_verses()?, - services: self.services.observe_services()?, - interfaces: self.interfaces.observe_interfaces()?, - observation_streams: self.streams.observe_streams()?, - translation_routes: self.translations.observe_translation_routes()?, - }) - } -} - -pub fn normalize_odin_records(input: OdinInputBatch) -> OdinRecords { - let verses = input - .verses - .into_iter() - .map(|entry| OdinVerseRecord { - verse_id: entry.verse_id, - name: entry.name, - role: entry.role, - status: entry.status, - capabilities: entry.capabilities, - observed_at: input.observed_at.clone(), - }) - .collect::>(); - - let services = input - .services - .into_iter() - .map(|entry| OdinServiceRecord { - service_id: entry.service_id, - verse_id: entry.verse_id, - name: entry.name, - state: entry.state, - detail: entry.detail, - authority: entry.authority, - observed_at: input.observed_at.clone(), - }) - .collect::>(); - - let interfaces = input - .interfaces - .into_iter() - .map(|entry| OdinInterfaceRecord { - provider_id: entry.provider_id, - title: entry.title, - state: entry.state, - source: entry.source, - version: entry.version, - updated_at: entry.updated_at, - observed_at: input.observed_at.clone(), - }) - .collect::>(); - - let observation_streams = input - .observation_streams - .into_iter() - .map(|entry| { - let stream_key = format!("{}:{}:{}", entry.device_id, entry.stream_id, entry.kind); - OdinObservationStreamRecord { - stream_key, - device_id: entry.device_id, - stream_id: entry.stream_id, - kind: entry.kind, - state: entry.state, - detail: entry.detail, - owner: entry.owner, - observed_at: input.observed_at.clone(), - } - }) - .collect::>(); - - let translation_routes = input - .translation_routes - .into_iter() - .map(|entry| { - let route_id = format!("{}=>{}", entry.source_schema, entry.target_schema); - OdinTranslationRouteRecord { - route_id, - source_schema: entry.source_schema, - target_schema: entry.target_schema, - translation_kind: entry.translation_kind, - owner: entry.owner, - version: entry.version, - notes: entry.notes, - } - }) - .collect::>(); - - let snapshot = OdinSnapshotRecord { - snapshot_id: "latest".to_string(), - observed_at: input.observed_at, - verse_count: verses.len() as u32, - service_count: services.len() as u32, - interface_count: interfaces.len() as u32, - observation_stream_count: observation_streams.len() as u32, - source: input.source, - }; - - OdinRecords { - snapshot: Some(snapshot), - verses, - services, - interfaces, - observation_streams, - translation_routes, - } -} - -#[cfg(test)] -mod tests { - use super::*; - use crate::ports::{ - FixedClock, InterfaceObservation, ObservationStreamObservation, ServiceObservation, - TranslationRouteObservation, VerseObservation, - }; - use anyhow::Result; - use pretty_assertions::assert_eq; - - #[derive(Clone, Debug, Default)] - struct MockIngest; - - impl VerseIngest for MockIngest { - fn observe_verses(&self) -> Result> { - Ok(vec![VerseObservation { - verse_id: "starfire.local".to_string(), - name: "Starfire".to_string(), - role: "coordinator".to_string(), - status: "active".to_string(), - capabilities: vec!["cultmesh".to_string()], - }]) - } - } - - impl ServiceIngest for MockIngest { - fn observe_services(&self) -> Result> { - Ok(vec![ServiceObservation { - service_id: "odin".to_string(), - verse_id: "starfire.local".to_string(), - name: "Odin".to_string(), - state: "active".to_string(), - detail: "typed state".to_string(), - authority: "odin".to_string(), - }]) - } - } - - impl InterfaceIngest for MockIngest { - fn observe_interfaces(&self) -> Result> { - Ok(vec![InterfaceObservation { - provider_id: "odin.allseer".to_string(), - title: "Odin".to_string(), - state: "active".to_string(), - source: "cultmesh".to_string(), - version: Some("1".to_string()), - updated_at: None, - }]) - } - } - - impl ObservationStreamIngest for MockIngest { - fn observe_streams(&self) -> Result> { - Ok(vec![ObservationStreamObservation { - device_id: "periwinkle".to_string(), - stream_id: "motion".to_string(), - kind: "sensor".to_string(), - state: "active".to_string(), - detail: "fresh".to_string(), - owner: "mimir".to_string(), - }]) - } - } - - impl TranslationRouteIngest for MockIngest { - fn observe_translation_routes(&self) -> Result> { - Ok(vec![TranslationRouteObservation { - source_schema: "mimir.eve_sensor_observation.v1".to_string(), - target_schema: "odin.observation_stream.v1".to_string(), - translation_kind: "projection".to_string(), - owner: "odin".to_string(), - version: "v1".to_string(), - notes: "dashboard projection".to_string(), - }]) - } - } - - #[test] - fn pipeline_collects_from_injected_ports() -> Result<()> { - let pipeline = OdinIngestPipeline::new( - MockIngest, - MockIngest, - MockIngest, - MockIngest, - MockIngest, - FixedClock::new("2026-06-03T00:00:00Z"), - ); - - let records = normalize_odin_records(pipeline.collect()?); - - assert_eq!(records.snapshot.unwrap().service_count, 1); - assert_eq!(records.verses[0].verse_id, "starfire.local"); - assert_eq!(records.services[0].authority, "odin"); - assert_eq!( - records.observation_streams[0].stream_key, - "periwinkle:motion:sensor" - ); - assert_eq!( - records.translation_routes[0].route_id, - "mimir.eve_sensor_observation.v1=>odin.observation_stream.v1" - ); - Ok(()) - } -} diff --git a/crates/odin-core/src/ports.rs b/crates/odin-core/src/ports.rs deleted file mode 100644 index 33a1feb..0000000 --- a/crates/odin-core/src/ports.rs +++ /dev/null @@ -1,102 +0,0 @@ -use anyhow::Result; - -#[derive(Clone, Debug, PartialEq, Eq)] -pub struct VerseObservation { - pub verse_id: String, - pub name: String, - pub role: String, - pub status: String, - pub capabilities: Vec, -} - -#[derive(Clone, Debug, PartialEq, Eq)] -pub struct ServiceObservation { - pub service_id: String, - pub verse_id: String, - pub name: String, - pub state: String, - pub detail: String, - pub authority: String, -} - -#[derive(Clone, Debug, PartialEq, Eq)] -pub struct InterfaceObservation { - pub provider_id: String, - pub title: String, - pub state: String, - pub source: String, - pub version: Option, - pub updated_at: Option, -} - -#[derive(Clone, Debug, PartialEq, Eq)] -pub struct ObservationStreamObservation { - pub device_id: String, - pub stream_id: String, - pub kind: String, - pub state: String, - pub detail: String, - pub owner: String, -} - -#[derive(Clone, Debug, PartialEq, Eq)] -pub struct TranslationRouteObservation { - pub source_schema: String, - pub target_schema: String, - pub translation_kind: String, - pub owner: String, - pub version: String, - pub notes: String, -} - -#[derive(Clone, Debug, Default, PartialEq, Eq)] -pub struct OdinInputBatch { - pub observed_at: String, - pub source: String, - pub verses: Vec, - pub services: Vec, - pub interfaces: Vec, - pub observation_streams: Vec, - pub translation_routes: Vec, -} - -pub trait VerseIngest { - fn observe_verses(&self) -> Result>; -} - -pub trait ServiceIngest { - fn observe_services(&self) -> Result>; -} - -pub trait InterfaceIngest { - fn observe_interfaces(&self) -> Result>; -} - -pub trait ObservationStreamIngest { - fn observe_streams(&self) -> Result>; -} - -pub trait TranslationRouteIngest { - fn observe_translation_routes(&self) -> Result>; -} - -pub trait Clock { - fn now(&self) -> String; -} - -#[derive(Clone, Debug, PartialEq, Eq)] -pub struct FixedClock { - now: String, -} - -impl FixedClock { - pub fn new(now: impl Into) -> Self { - Self { now: now.into() } - } -} - -impl Clock for FixedClock { - fn now(&self) -> String { - self.now.clone() - } -} diff --git a/crates/odin-core/src/repository.rs b/crates/odin-core/src/repository.rs deleted file mode 100644 index 334e8b0..0000000 --- a/crates/odin-core/src/repository.rs +++ /dev/null @@ -1,185 +0,0 @@ -use crate::documents::{ - OdinDocuments, OdinRecords, OdinServiceRecord, OdinSnapshotRecord, OdinVerseRecord, -}; -use anyhow::Result; -use cultmesh_rs::{CultMesh, CultMeshNode, CultMeshNodeOptions}; -use std::path::Path; - -pub trait OdinRepository { - fn persist_records(&mut self, records: &OdinRecords) -> Result<()>; -} - -pub struct CultMeshOdinRepository { - node: CultMeshNode, -} - -impl CultMeshOdinRepository { - pub fn open(store_path: impl AsRef, runtime_id: impl Into) -> Result { - let node = CultMesh::create_node( - store_path, - OdinDocuments, - CultMeshNodeOptions { - runtime_id: runtime_id.into(), - pull_on_start: true, - }, - )?; - Ok(Self { node }) - } - - pub fn get_snapshot(&self) -> Result { - self.node.get_required::("latest") - } - - pub fn get_service(&self, service_id: &str) -> Result> { - self.node.get::(service_id) - } - - pub fn get_verse(&self, verse_id: &str) -> Result> { - self.node.get::(verse_id) - } - - pub fn document_binding_version(&self, document_type: &str) -> Option { - self.node - .documents() - .binding(document_type) - .and_then(|binding| binding.payload_schema_version.clone()) - } -} - -impl OdinRepository for CultMeshOdinRepository { - fn persist_records(&mut self, records: &OdinRecords) -> Result<()> { - if let Some(snapshot) = &records.snapshot { - self.node.put("latest", snapshot)?; - } - for verse in &records.verses { - self.node.put(&verse.verse_id, verse)?; - } - for service in &records.services { - self.node.put(&service.service_id, service)?; - } - for interface in &records.interfaces { - self.node.put(&interface.provider_id, interface)?; - } - for stream in &records.observation_streams { - self.node.put(&stream.stream_key, stream)?; - } - for route in &records.translation_routes { - self.node.put(&route.route_id, route)?; - } - Ok(()) - } -} - -#[derive(Default)] -pub struct InMemoryOdinRepository { - pub records: OdinRecords, -} - -impl OdinRepository for InMemoryOdinRepository { - fn persist_records(&mut self, records: &OdinRecords) -> Result<()> { - self.records = records.clone(); - Ok(()) - } -} - -pub fn persist_pipeline_records( - repository: &mut impl OdinRepository, - records: OdinRecords, -) -> Result { - repository.persist_records(&records)?; - Ok(records) -} - -#[cfg(test)] -mod tests { - use super::*; - use crate::documents::ODIN_SERVICE_SCHEMA; - use crate::pipeline::normalize_odin_records; - use crate::ports::{ - InterfaceObservation, ObservationStreamObservation, OdinInputBatch, ServiceObservation, - TranslationRouteObservation, VerseObservation, - }; - use pretty_assertions::assert_eq; - - fn sample_records() -> OdinRecords { - normalize_odin_records(OdinInputBatch { - observed_at: "2026-06-03T00:00:00Z".to_string(), - source: "unit-test".to_string(), - verses: vec![VerseObservation { - verse_id: "starfire.local".to_string(), - name: "Starfire".to_string(), - role: "coordinator".to_string(), - status: "active".to_string(), - capabilities: vec!["cultmesh".to_string()], - }], - services: vec![ServiceObservation { - service_id: "odin".to_string(), - verse_id: "starfire.local".to_string(), - name: "Odin".to_string(), - state: "active".to_string(), - detail: "persisted".to_string(), - authority: "odin".to_string(), - }], - interfaces: vec![InterfaceObservation { - provider_id: "odin.allseer".to_string(), - title: "Odin".to_string(), - state: "active".to_string(), - source: "cultmesh".to_string(), - version: Some("1".to_string()), - updated_at: None, - }], - observation_streams: vec![ObservationStreamObservation { - device_id: "periwinkle".to_string(), - stream_id: "camera".to_string(), - kind: "media".to_string(), - state: "active".to_string(), - detail: "fresh".to_string(), - owner: "mimir".to_string(), - }], - translation_routes: vec![TranslationRouteObservation { - source_schema: "source.v1".to_string(), - target_schema: "target.v1".to_string(), - translation_kind: "projection".to_string(), - owner: "odin".to_string(), - version: "v1".to_string(), - notes: "test".to_string(), - }], - }) - } - - #[test] - fn memory_repository_supports_fast_unit_tests() -> Result<()> { - let records = sample_records(); - let mut repository = InMemoryOdinRepository::default(); - - repository.persist_records(&records)?; - - assert_eq!(repository.records.services[0].service_id, "odin"); - Ok(()) - } - - #[test] - fn cultmesh_repository_round_trips_typed_records() -> Result<()> { - let temp = tempfile::tempdir()?; - let store_path = temp.path().join("odin.cc"); - let records = sample_records(); - - let mut repository = CultMeshOdinRepository::open(&store_path, "odin-test")?; - repository.persist_records(&records)?; - assert_eq!( - repository - .document_binding_version("odin.service") - .as_deref(), - Some(ODIN_SERVICE_SCHEMA) - ); - - let reloaded = CultMeshOdinRepository::open(&store_path, "odin-test-reloaded")?; - assert_eq!(reloaded.get_snapshot()?.service_count, 1); - assert_eq!(reloaded.get_service("odin")?.unwrap().detail, "persisted"); - assert_eq!( - reloaded.get_verse("starfire.local")?.unwrap().capabilities, - vec!["cultmesh".to_string()] - ); - Ok(()) - } -} diff --git a/crates/odin-daemon/Cargo.toml b/crates/odin-daemon/Cargo.toml deleted file mode 100644 index a5707d5..0000000 --- a/crates/odin-daemon/Cargo.toml +++ /dev/null @@ -1,24 +0,0 @@ -[package] -name = "odin-daemon" -version = "0.1.0" -edition.workspace = true -license.workspace = true -publish.workspace = true - -[lib] -name = "odin_daemon" -path = "src/lib.rs" - -[dependencies] -signal-hook = "0.3" -anyhow = "1" -chrono = "0.4" -cultcache-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "3bf1c0cea53e0092187fa2e59a75ba1571947ffe", package = "cultcache-rs" } -cultmesh-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "3bf1c0cea53e0092187fa2e59a75ba1571947ffe", package = "cultmesh-rs" } -cultnet-rs = { git = "https://github.com/GameCult/CultLib.git", rev = "3bf1c0cea53e0092187fa2e59a75ba1571947ffe", package = "cultnet-rs" } -fs2 = "0.4" -rmp-serde = "1.3" -serde = "1" - -[dev-dependencies] -tempfile = "3" diff --git a/crates/odin-daemon/src/lib.rs b/crates/odin-daemon/src/lib.rs deleted file mode 100644 index 7c2f115..0000000 --- a/crates/odin-daemon/src/lib.rs +++ /dev/null @@ -1,2904 +0,0 @@ -//! Deterministic Odin authority for runtime-topology correlation. -//! -//! This library owns no listener or lifecycle loop. Callers provide Idunn's -//! read-only projection, a trusted receive time with any service-owned -//! presence, and narrow clock/store/signer implementations. - -use std::collections::BTreeMap; -use std::path::{Path, PathBuf}; -use std::time::{SystemTime, UNIX_EPOCH}; - -use anyhow::{Context, Result, bail, ensure}; -use chrono::{DateTime, SecondsFormat, Utc}; -use cultcache_rs::{ - CultCacheEnvelope, CultCacheExpectedEnvelope, DatabaseEntry, SingleFileMessagePackBackingStore, -}; -use cultnet_rs::{ - GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA, GAMECULT_RUNTIME_PRESENCE_HEALTH_SIGNING_PURPOSE, - GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA, GameCultRuntimePresenceHealthRecord, - GameCultServiceTrustAnchorRecord, IDUNN_EXPECTED_INCARNATION_SCHEMA, - IDUNN_PROCESS_WRITE_LEASE_SCHEMA, IDUNN_RUNTIME_ACTIVATION_SCHEMA, IdunnExpectedDependency, - IdunnExpectedIncarnationRecord, IdunnProcessWriteLeaseRecord, IdunnRuntimeActivationPurpose, - IdunnRuntimeActivationRecord, IdunnServiceIdentity, ODIN_RUNTIME_TOPOLOGY_CORRELATION_SCHEMA, - OdinRuntimeDependencyEvidence, OdinRuntimeTopologyCorrelationPurpose, - OdinRuntimeTopologyCorrelationRecord, OdinTopologyAuthenticationContext, - OdinTopologyDisagreement, OdinTopologyIdentity, RuntimePresenceAuthenticationContext, - ServiceIdentitySignature, ServiceIdentitySigner, ServiceIdentityTrustAnchor, - authenticate_odin_runtime_topology_correlation, authenticate_runtime_presence_claim, - correlate_runtime_presence_claim, verify_runtime_authority, verify_service_identity_signature, - verify_service_identity_signature_with_public_key, -}; - -const CAS_ATTEMPTS: usize = 8; - -/// Odin's durable high-water mark for one target's correlation sequence. -/// -/// The correlation's `publisher_sequence` must strictly increase for as long as -/// Idunn remembers this target, because Idunn refuses a sequence it has already -/// seen -- that refusal is what stops an old signed correlation being replayed -/// at it. -/// -/// Deriving the next value from the stored correlation alone cannot uphold -/// that: withdrawing a correlation takes the counter with it, and the next one -/// starts at 1 again. Idunn then refuses every correlation until the count -/// climbs past the old mark, and since the refusal is what withdraws the -/// correlation, it never gets the chance -- a deadlock that tightens with every -/// attempt. Worse, while the count is low, a replayed correlation from before -/// the withdrawal outranks the genuine one, which is precisely the attack the -/// check exists to prevent. -/// -/// So the mark lives in its own record, which withdrawal does not remove. -const TOPOLOGY_PUBLISHER_WATERMARK_TYPE: &str = "odin.topology_publisher_watermark"; -const TOPOLOGY_PUBLISHER_WATERMARK_SCHEMA: &str = "odin.topology_publisher_watermark.v1"; - -#[derive(Clone, Copy, Debug)] -pub struct AuthenticationPolicy { - pub presence_maximum_age_millis: u64, - pub presence_maximum_future_skew_millis: u64, - pub correlation_maximum_age_millis: u64, - pub correlation_maximum_future_skew_millis: u64, -} - -impl Default for AuthenticationPolicy { - fn default() -> Self { - Self { - presence_maximum_age_millis: 30_000, - presence_maximum_future_skew_millis: 5_000, - correlation_maximum_age_millis: 30_000, - correlation_maximum_future_skew_millis: 5_000, - } - } -} - -pub trait Clock { - fn now_unix_millis(&self) -> Result; -} - -#[derive(Clone, Copy, Debug, Default)] -pub struct SystemClock; - -impl Clock for SystemClock { - fn now_unix_millis(&self) -> Result { - Ok(SystemTime::now() - .duration_since(UNIX_EPOCH) - .context("system clock predates the Unix epoch")? - .as_millis() - .try_into() - .context("system clock does not fit the topology timestamp")?) - } -} - -/// One exact Idunn-owned projection. The service anchor is provider lookup -/// material selected by Expected; it is not runtime observation. -#[derive(Clone, Debug, PartialEq, Eq)] -pub struct IdunnRuntimeProjection { - pub expected: IdunnExpectedIncarnationRecord, - pub provider_anchor: Option, - pub activation: Option, - pub current_lease: Option, -} - -impl IdunnRuntimeProjection { - pub fn validate(&self) -> Result<()> { - self.expected.validate()?; - if let Some(anchor) = &self.provider_anchor { - anchor.validate()?; - } - if let Some(activation) = &self.activation { - activation.validate()?; - } - if let Some(lease) = &self.current_lease { - lease.validate()?; - } - Ok(()) - } -} - -/// One incarnation of one target: the unit every projection, presence, and -/// correlation record is keyed by. -/// -/// A target has more than one incarnation while it is being replaced: the -/// admitted incumbent and the sealed candidate coexist, and both are real. -/// Keying by target alone made the projection a single slot the two fought -/// over, and whichever Idunn wrote last decided who the other one was. The -/// Expected digest is the identity; the target is a namespace. -#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord)] -pub struct IncarnationRef { - pub target: String, - pub expected_sha256: String, -} - -impl IncarnationRef { - pub fn new(target: impl Into, expected_sha256: impl Into) -> Self { - Self { - target: target.into(), - expected_sha256: expected_sha256.into(), - } - } - - pub fn of(expected: &IdunnExpectedIncarnationRecord) -> Result { - Ok(Self::new( - expected.target.clone(), - expected.canonical_sha256()?, - )) - } - - /// The CultCache key under which this incarnation's records are stored, in - /// Idunn's projection and in Odin's own store alike. - pub fn key(&self) -> String { - incarnation_key(&self.target, &self.expected_sha256) - } - - /// Inverse of [`IncarnationRef::key`]; `None` for a key of another shape. - pub fn parse_key(key: &str) -> Option { - let (target, expected_sha256) = key.split_once('@')?; - if target.is_empty() || !expected_sha256.starts_with("sha256-") { - return None; - } - Some(Self::new(target, expected_sha256)) - } -} - -pub fn incarnation_key(target: &str, expected_sha256: &str) -> String { - format!("{target}@{expected_sha256}") -} - -pub trait IdunnProjectionSource { - /// Every incarnation Idunn currently projects for one target. - fn projections(&self, target: &str) -> Result>; - - /// One exact incarnation, or `None` when Idunn projects nothing for it. - fn projection(&self, incarnation: &IncarnationRef) -> Result> { - for projection in self.projections(&incarnation.target)? { - if projection.expected.canonical_sha256()? == incarnation.expected_sha256 { - return Ok(Some(projection)); - } - } - Ok(None) - } -} - -/// Read-only adapter for the atomic projection file published by Idunn. -pub struct CultCacheIdunnProjectionSource { - path: PathBuf, -} - -impl CultCacheIdunnProjectionSource { - pub fn new(path: impl Into) -> Self { - Self { path: path.into() } - } - - pub fn path(&self) -> &Path { - &self.path - } -} - -impl IdunnProjectionSource for CultCacheIdunnProjectionSource { - fn projections(&self, target: &str) -> Result> { - let Some(entries) = self.entries()? else { - return Ok(Vec::new()); - }; - let anchor = provider_anchor(&entries, target)?; - // A record keyed by anything but its own incarnation key is not this - // contract's. That includes the target-keyed single slot the previous - // projection used; an Idunn still writing that shape projects nothing - // this reader will act on, rather than something it will misread. - let mut projections = Vec::new(); - for envelope in &entries { - if envelope.r#type != IdunnExpectedIncarnationRecord::TYPE { - continue; - } - let Some(incarnation) = IncarnationRef::parse_key(&envelope.key) else { - continue; - }; - if incarnation.target != target { - continue; - } - projections.push(assemble_projection( - &entries, - anchor.clone(), - envelope, - &incarnation, - )?); - } - projections.sort_by_key(|projection| projection.expected.incarnation_id.clone()); - Ok(projections) - } - - /// Only the named incarnation's own records are decoded: an undecodable - /// record under another incarnation's key is that incarnation's fault, and - /// never makes this one unreadable. - fn projection(&self, incarnation: &IncarnationRef) -> Result> { - let Some(entries) = self.entries()? else { - return Ok(None); - }; - let Some(envelope) = unique_envelope( - &entries, - IdunnExpectedIncarnationRecord::TYPE, - &incarnation.key(), - )? - else { - return Ok(None); - }; - let anchor = provider_anchor(&entries, &incarnation.target)?; - assemble_projection(&entries, anchor, envelope, incarnation).map(Some) - } -} - -impl CultCacheIdunnProjectionSource { - fn entries(&self) -> Result>> { - if !self.path.is_file() { - return Ok(None); - } - SingleFileMessagePackBackingStore::new(&self.path) - .pull_all_read_only_snapshot() - .map(Some) - .map_err(|error| { - // The store's decode step reports its failures as text, so an - // I/O error in the chain here is from opening or reading the - // file and from nothing the file said. - if error.chain().any(|cause| cause.is::()) { - error.context(ProjectionUnreadable) - } else { - error - } - }) - } -} - -/// The projection file could not be opened or read. Marks the read step only: -/// a failure while decoding or validating what was read never carries it, -/// whatever it wraps. -#[derive(Debug)] -pub struct ProjectionUnreadable; - -impl std::fmt::Display for ProjectionUnreadable { - fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { - formatter.write_str("Idunn's projection file could not be read") - } -} - -impl std::error::Error for ProjectionUnreadable {} - -fn provider_anchor( - entries: &[CultCacheEnvelope], - target: &str, -) -> Result> { - unique_envelope( - entries, - GameCultServiceTrustAnchorRecord::TYPE, - &runtime_presence_anchor_id(target), - )? - .map(|envelope| { - ensure_schema(envelope, GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA)?; - decode_canonical(&envelope.payload, "provider trust anchor") - }) - .transpose() -} - -fn assemble_projection( - entries: &[CultCacheEnvelope], - provider_anchor: Option, - expected_envelope: &CultCacheEnvelope, - incarnation: &IncarnationRef, -) -> Result { - ensure_schema(expected_envelope, IDUNN_EXPECTED_INCARNATION_SCHEMA)?; - let expected = IdunnExpectedIncarnationRecord::decode_canonical(&expected_envelope.payload)?; - ensure!( - IncarnationRef::of(&expected)? == *incarnation, - "Expected projection key is substituted" - ); - let key = incarnation.key(); - let activation = unique_envelope(entries, IdunnRuntimeActivationRecord::TYPE, &key)? - .map(|envelope| { - ensure_schema(envelope, IDUNN_RUNTIME_ACTIVATION_SCHEMA)?; - IdunnRuntimeActivationRecord::decode_canonical(&envelope.payload) - }) - .transpose()?; - let current_lease = unique_envelope(entries, IdunnProcessWriteLeaseRecord::TYPE, &key)? - .map(|envelope| { - ensure_schema(envelope, IDUNN_PROCESS_WRITE_LEASE_SCHEMA)?; - IdunnProcessWriteLeaseRecord::decode_canonical(&envelope.payload) - }) - .transpose()?; - let projection = IdunnRuntimeProjection { - expected, - provider_anchor, - activation, - current_lease, - }; - projection - .validate() - .context(PresenceAuthorityRefused("Idunn's projection is invalid"))?; - Ok(projection) -} - -pub trait OdinCorrelationSigner { - fn identity_id(&self) -> &str; - fn public_key(&self) -> &[u8]; - fn sign_correlation(&self, unsigned_payload: &[u8]) -> Result>; -} - -impl OdinCorrelationSigner for ServiceIdentitySigner { - fn identity_id(&self) -> &str { - &self.entry().identity_id - } - - fn public_key(&self) -> &[u8] { - &self.entry().public_key - } - - fn sign_correlation(&self, unsigned_payload: &[u8]) -> Result> { - Ok(self - .sign::(unsigned_payload) - .signature) - } -} - -impl OdinCorrelationSigner for &T { - fn identity_id(&self) -> &str { - (*self).identity_id() - } - - fn public_key(&self) -> &[u8] { - (*self).public_key() - } - - fn sign_correlation(&self, unsigned_payload: &[u8]) -> Result> { - (*self).sign_correlation(unsigned_payload) - } -} - -#[derive(Clone, Debug, PartialEq, Eq)] -pub struct AdmittedPresence { - pub canonical_bytes: Vec, - pub trusted_received_at_unix_millis: u64, - pub stored_at: String, -} - -impl AdmittedPresence { - fn new(canonical_bytes: Vec, trusted_received_at_unix_millis: u64) -> Result { - Ok(Self { - canonical_bytes, - trusted_received_at_unix_millis, - stored_at: rfc3339_millis(trusted_received_at_unix_millis)?, - }) - } -} - -#[derive(Clone, Debug, PartialEq, Eq)] -pub struct StoredCorrelation { - pub canonical_bytes: Vec, - pub stored_at: String, -} - -#[derive(Clone, Debug, PartialEq, Eq)] -pub struct OdinStoreQuery { - pub incarnation: IncarnationRef, - pub provider_signer_identity_id: String, - pub dependencies: Vec, -} - -#[derive(Clone, Debug, PartialEq, Eq)] -pub struct OdinStoreSnapshot { - pub query: OdinStoreQuery, - pub presence: Option, - pub correlation: Option, - pub dependency_correlations: BTreeMap>, -} - -pub trait OdinTopologyStore { - fn read(&self, query: OdinStoreQuery) -> Result; - - fn compare_exchange( - &self, - observed: &OdinStoreSnapshot, - replacement_presence: Option<&AdmittedPresence>, - replacement_correlation: &StoredCorrelation, - ) -> Result; - - fn withdraw_correlation(&self, incarnation: &IncarnationRef) -> Result<()>; - - /// Claim the next correlation sequence for this target, never returning a - /// value already used. `prior` is the sequence of the currently stored - /// correlation, or 0 when there is none. - /// - /// The mark is advanced before the correlation that uses it is published, - /// so a crash in between leaves it ahead. That is the safe direction: - /// sequences may skip, they may never repeat. - fn reserve_publisher_sequence(&self, target: &str, prior: u64) -> Result; -} - -/// Odin's durable replay and correlation store. It persists existing CultNet -/// documents directly instead of inventing a parallel admission schema. -pub struct CultCacheOdinTopologyStore { - path: PathBuf, -} - -impl CultCacheOdinTopologyStore { - pub fn new(path: impl Into) -> Self { - Self { path: path.into() } - } - - pub fn path(&self) -> &Path { - &self.path - } - - /// Remove every correlation not keyed by an incarnation. Those were written - /// by the previous, target-keyed Odin; nothing reads them under this - /// contract, and left in place `stored_snapshot` would serve them to the - /// Verse as current. Presence records are kept whatever their key: the - /// self publisher sequence is continued from them. - pub fn retire_legacy_correlations(&self) -> Result { - for _ in 0..CAS_ATTEMPTS { - if !self.path.is_file() { - return Ok(0); - } - let entries = - SingleFileMessagePackBackingStore::new(&self.path).pull_all_read_only_snapshot()?; - let retained = entries - .iter() - .filter(|entry| { - !(entry.r#type == OdinRuntimeTopologyCorrelationRecord::TYPE - && IncarnationRef::parse_key(&entry.key).is_none()) - }) - .cloned() - .collect::>(); - let removed = entries.len() - retained.len(); - if removed == 0 { - return Ok(0); - } - if SingleFileMessagePackBackingStore::new(&self.path) - .compare_exchange_snapshot(&entries, &retained)? - { - return Ok(removed); - } - } - bail!("Odin topology store changed repeatedly while retiring legacy correlations") - } -} - -impl OdinTopologyStore for CultCacheOdinTopologyStore { - fn read(&self, mut query: OdinStoreQuery) -> Result { - query.dependencies.sort(); - query.dependencies.dedup(); - let entries = if self.path.is_file() { - SingleFileMessagePackBackingStore::new(&self.path).pull_all_read_only_snapshot()? - } else { - Vec::new() - }; - let presence_key = - presence_store_key(&query.incarnation, &query.provider_signer_identity_id); - let presence = unique_envelope( - &entries, - GameCultRuntimePresenceHealthRecord::TYPE, - &presence_key, - )? - .map(decode_presence_envelope) - .transpose()?; - let correlation = unique_envelope( - &entries, - OdinRuntimeTopologyCorrelationRecord::TYPE, - &query.incarnation.key(), - )? - .map(decode_correlation_envelope) - .transpose()?; - let mut dependency_correlations = BTreeMap::new(); - for dependency in &query.dependencies { - let current = unique_envelope( - &entries, - OdinRuntimeTopologyCorrelationRecord::TYPE, - &dependency.key(), - )? - .map(decode_correlation_envelope) - .transpose()?; - dependency_correlations.insert(dependency.clone(), current); - } - Ok(OdinStoreSnapshot { - query, - presence, - correlation, - dependency_correlations, - }) - } - - fn compare_exchange( - &self, - observed: &OdinStoreSnapshot, - replacement_presence: Option<&AdmittedPresence>, - replacement_correlation: &StoredCorrelation, - ) -> Result { - let presence_key = presence_store_key( - &observed.query.incarnation, - &observed.query.provider_signer_identity_id, - ); - let correlation_key = observed.query.incarnation.key(); - let mut conditions = BTreeMap::new(); - insert_condition( - &mut conditions, - CultCacheExpectedEnvelope { - key: presence_key.clone(), - r#type: GameCultRuntimePresenceHealthRecord::TYPE.into(), - current: observed - .presence - .as_ref() - .map(|presence| presence_envelope(&presence_key, presence)), - }, - )?; - insert_condition( - &mut conditions, - CultCacheExpectedEnvelope { - key: correlation_key.clone(), - r#type: OdinRuntimeTopologyCorrelationRecord::TYPE.into(), - current: observed - .correlation - .as_ref() - .map(|correlation| correlation_envelope(&correlation_key, correlation)), - }, - )?; - for (dependency, correlation) in &observed.dependency_correlations { - let key = dependency.key(); - insert_condition( - &mut conditions, - CultCacheExpectedEnvelope { - key: key.clone(), - r#type: OdinRuntimeTopologyCorrelationRecord::TYPE.into(), - current: correlation - .as_ref() - .map(|correlation| correlation_envelope(&key, correlation)), - }, - )?; - } - let mut replacements = vec![correlation_envelope( - &correlation_key, - replacement_correlation, - )]; - if let Some(presence) = replacement_presence { - replacements.push(presence_envelope(&presence_key, presence)); - } - if let Some(parent) = self.path.parent() { - std::fs::create_dir_all(parent)?; - } - SingleFileMessagePackBackingStore::new(&self.path) - .compare_exchange(&conditions.into_values().collect::>(), &replacements) - } - - fn withdraw_correlation(&self, incarnation: &IncarnationRef) -> Result<()> { - let key = incarnation.key(); - for _ in 0..CAS_ATTEMPTS { - if !self.path.is_file() { - return Ok(()); - } - let entries = - SingleFileMessagePackBackingStore::new(&self.path).pull_all_read_only_snapshot()?; - let current = - unique_envelope(&entries, OdinRuntimeTopologyCorrelationRecord::TYPE, &key)?; - let Some(current) = current else { - return Ok(()); - }; - let replacement = entries - .iter() - .filter(|entry| *entry != current) - .cloned() - .collect::>(); - if SingleFileMessagePackBackingStore::new(&self.path) - .compare_exchange_snapshot(&entries, &replacement)? - { - return Ok(()); - } - } - bail!("Odin topology store changed repeatedly while withdrawing correlation") - } - - fn reserve_publisher_sequence(&self, target: &str, prior: u64) -> Result { - for _ in 0..CAS_ATTEMPTS { - let entries = if self.path.is_file() { - SingleFileMessagePackBackingStore::new(&self.path).pull_all_read_only_snapshot()? - } else { - Vec::new() - }; - let current = unique_envelope(&entries, TOPOLOGY_PUBLISHER_WATERMARK_TYPE, target)?; - let stored = current - .map(|envelope| decode_publisher_watermark(target, &envelope.payload)) - .transpose()? - .unwrap_or(0); - // The stored correlation can be ahead of the mark on the first pass - // after this record was introduced, so take whichever is higher. - let next = stored - .max(prior) - .checked_add(1) - .context("Odin topology publisher sequence exhausted")?; - let replacement = publisher_watermark_envelope(target, next, &Utc::now().to_rfc3339())?; - if let Some(parent) = self.path.parent() { - std::fs::create_dir_all(parent)?; - } - if SingleFileMessagePackBackingStore::new(&self.path).compare_exchange( - &[CultCacheExpectedEnvelope { - key: target.into(), - r#type: TOPOLOGY_PUBLISHER_WATERMARK_TYPE.into(), - current: current.cloned(), - }], - &[replacement], - )? { - return Ok(next); - } - } - bail!("Odin topology store changed repeatedly while reserving a publisher sequence") - } -} - -fn publisher_watermark_envelope( - target: &str, - sequence: u64, - stored_at: &str, -) -> Result { - Ok(CultCacheEnvelope { - key: target.into(), - r#type: TOPOLOGY_PUBLISHER_WATERMARK_TYPE.into(), - payload: rmp_serde::to_vec(&(TOPOLOGY_PUBLISHER_WATERMARK_SCHEMA, target, sequence))?, - stored_at: stored_at.to_owned(), - schema_id: Some(TOPOLOGY_PUBLISHER_WATERMARK_SCHEMA.into()), - }) -} - -fn decode_publisher_watermark(target: &str, payload: &[u8]) -> Result { - let (schema, stored_target, sequence): (String, String, u64) = - rmp_serde::from_slice(payload).context("decoding Odin topology publisher watermark")?; - ensure!( - schema == TOPOLOGY_PUBLISHER_WATERMARK_SCHEMA && stored_target == target, - "Odin topology publisher watermark names another target or schema" - ); - Ok(sequence) -} - -/// Odin's own runtime presence cannot be admitted under the authority Idunn -/// projects: the authority cannot be established, or the claim, or the stored -/// presence of the same activation, does not authenticate under it. Marks the -/// failure for the serving loop; see `survive` in the daemon. -#[derive(Debug)] -pub struct PresenceAuthorityRefused(pub &'static str); - -impl std::fmt::Display for PresenceAuthorityRefused { - fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { - formatter.write_str(self.0) - } -} - -impl std::error::Error for PresenceAuthorityRefused {} - -pub struct OdinTopologyAuthority { - projections: P, - store: S, - signer: K, - clock: C, - idunn_anchor: ServiceIdentityTrustAnchor, - policy: AuthenticationPolicy, -} - -impl OdinTopologyAuthority -where - P: IdunnProjectionSource, - S: OdinTopologyStore, - K: OdinCorrelationSigner, - C: Clock, -{ - pub fn new( - projections: P, - store: S, - signer: K, - clock: C, - idunn_anchor: ServiceIdentityTrustAnchor, - policy: AuthenticationPolicy, - ) -> Self { - Self { - projections, - store, - signer, - clock, - idunn_anchor, - policy, - } - } - - /// Correlate one incarnation's Expected with any previously admitted raw - /// observation. With no admitted observation this can only produce - /// Expected, never Present. An incarnation Idunn no longer projects has its - /// correlation withdrawn; its presence history stays. - pub fn refresh(&self, incarnation: &IncarnationRef) -> Result>> { - let Some(projection) = self.projections.projection(incarnation)? else { - self.store.withdraw_correlation(incarnation)?; - return Ok(None); - }; - self.reconcile(projection, None).map(Some) - } - - /// Authenticate and monotonically admit one exact provider-owned presence. - /// - /// The presence names the Expected it was issued under, and that selects - /// the incarnation it is evidence about. A presence for an incarnation - /// Idunn does not project is refused; it is never matched against another - /// incarnation of the same target. - pub fn admit_presence( - &self, - target: &str, - canonical_presence: &[u8], - trusted_received_at_unix_millis: u64, - ) -> Result> { - let claimed = decode_presence(canonical_presence)?; - ensure!( - claimed.target == target, - "runtime presence names another target than its document key" - ); - let incarnation = IncarnationRef::new(target, claimed.expected_projection_sha256.clone()); - let projection = self - .projections - .projection(&incarnation)? - .context("runtime presence has no current Expected projection for its incarnation")?; - self.reconcile( - projection, - Some((canonical_presence, trusted_received_at_unix_millis)), - ) - } - - /// Return the exact signed bytes admitted by Odin for transport. - pub fn current_signed_correlation( - &self, - incarnation: &IncarnationRef, - ) -> Result>> { - self.refresh(incarnation) - } - - fn reconcile( - &self, - projection: IdunnRuntimeProjection, - incoming: Option<(&[u8], u64)>, - ) -> Result> { - projection.validate()?; - let now = self.clock.now_unix_millis()?; - let (authority, projection_disagreements) = - classify_runtime_authority(&projection, &self.idunn_anchor, now) - .context(PresenceAuthorityRefused( - "the projected runtime authority cannot be verified", - ))?; - // A host whose clock has not reached the anchor's binding (booting - // before time sync) cannot yet tell whether the anchor is good. That is - // not a refusal of the authority, so it must not end Odin: it retries. - if authority.is_none() - && incoming.is_some() - && only_clock_precedes_anchor(&projection, &projection_disagreements, now) - { - bail!("the clock ({now}) precedes the provider trust anchor's binding; retrying"); - } - let (lease_sha256, lease_disagreement) = classify_current_lease(&projection)?; - let query = OdinStoreQuery { - incarnation: IncarnationRef::of(&projection.expected)?, - provider_signer_identity_id: projection.expected.expected_signer_identity_id.clone(), - dependencies: managed_dependency_incarnations(&projection.expected.dependencies), - }; - - for _ in 0..CAS_ATTEMPTS { - let observed = self.store.read(query.clone())?; - let admitted = self.select_presence(&observed, incoming, authority.as_ref())?; - let dependencies = - self.dependency_evidence(&projection.expected.dependencies, &observed, now)?; - let (presence, mut disagreements, replacement_presence) = match admitted { - SelectedPresence::None => (None, projection_disagreements.clone(), None), - SelectedPresence::Stale(stored) => { - let record = decode_presence(&stored.canonical_bytes)?; - let mut disagreements = projection_disagreements.clone(); - disagreements.push(OdinTopologyDisagreement { - code: "stored-presence-not-current".into(), - expected: projection - .activation - .as_ref() - .map(IdunnRuntimeActivationRecord::canonical_sha256) - .transpose()?, - observed: Some(record.activation_witness_sha256), - }); - (None, disagreements, None) - } - SelectedPresence::Current { - correlation, - replacement, - } => { - let mut disagreements = projection_disagreements.clone(); - disagreements.extend_from_slice(correlation.disagreements()); - (Some(correlation), disagreements, replacement) - } - }; - if let Some(disagreement) = &lease_disagreement { - disagreements.push(disagreement.clone()); - } - if presence.is_none() { - disagreements.push(OdinTopologyDisagreement { - code: "signed-presence-missing".into(), - expected: Some("dual-authenticated-runtime-presence".into()), - observed: None, - }); - disagreements.extend(projection.expected.capabilities.iter().enumerate().map( - |(index, capability)| OdinTopologyDisagreement { - code: format!("expected-capability-{index:03}-missing"), - expected: Some(format!( - "{}/{}/{} capacity>={}", - capability.capability, - capability.schema, - capability.compatibility, - capability.minimum_capacity - )), - observed: None, - }, - )); - } - - let observed_write_lease = if let Some(presence) = &presence { - correlate_write_lease( - &projection.expected, - lease_sha256.as_deref(), - presence.claim().record().write_lease_sha256.as_deref(), - &presence.claim().record().state, - &mut disagreements, - ) - } else { - None - }; - disagreements.sort_by(|left, right| left.code.cmp(&right.code)); - - let prior = observed - .correlation - .as_ref() - .map(|stored| decode_correlation(&stored.canonical_bytes)) - .transpose()?; - let presence_record = presence.as_ref().map(|value| value.claim().record()); - let ready = presence_record.is_some_and(|record| record.state == "active") - && disagreements.is_empty() - && dependencies - .iter() - .all(|dependency| dependency_permits_ready(&dependency.kind, dependency.ready)); - let mut correlation = OdinRuntimeTopologyCorrelationRecord { - schema_version: ODIN_RUNTIME_TOPOLOGY_CORRELATION_SCHEMA.into(), - target: projection.expected.target.clone(), - expected_projection_sha256: projection.expected.canonical_sha256()?, - expected: true, - current_activation_sha256: projection - .activation - .as_ref() - .map(IdunnRuntimeActivationRecord::canonical_sha256) - .transpose()?, - signed_presence_sha256: presence - .as_ref() - .map(|value| value.claim().signed_presence_sha256().into()), - observed_presence_state: presence_record.map(|record| record.state.clone()), - observed_presence_publisher_sequence: presence_record - .map(|record| record.publisher_sequence), - observed_write_lease_sha256: observed_write_lease, - observed_capabilities: presence_record - .map_or_else(Vec::new, |record| record.capabilities.clone()), - runtime_id: projection.expected.runtime_id.clone(), - runtime_instance_id: projection - .activation - .as_ref() - .map(|activation| activation.runtime_instance_id.clone()), - present: presence.is_some(), - ready, - dependencies, - disagreements, - signer_identity_id: self.signer.identity_id().into(), - // Placeholder. A sequence is only reserved once the facts are - // known to have changed, below; same_correlation_facts compares - // against the prior's sequence regardless of what sits here. - publisher_sequence: prior.as_ref().map_or(0, |record| record.publisher_sequence), - observed_at_unix_millis: now, - signature_algorithm: "ed25519".into(), - signature: Vec::new(), - }; - if let Some(prior) = &prior - && same_correlation_facts(prior, &correlation) - { - return Ok(observed - .correlation - .context("decoded prior correlation disappeared")? - .canonical_bytes); - } - // Reserved only after the dedupe: a refresh that observes nothing - // new must not burn a sequence or fsync the store. Reserved from a - // mark that survives withdrawal, not derived from the stored - // correlation, so a withdrawn correlation does not take the count - // with it. See TOPOLOGY_PUBLISHER_WATERMARK_SCHEMA. - correlation.publisher_sequence = self.store.reserve_publisher_sequence( - &observed.query.incarnation.target, - prior.as_ref().map_or(0, |record| record.publisher_sequence), - )?; - correlation.signature = self - .signer - .sign_correlation(&correlation.unsigned_signature_payload()?)?; - let canonical = correlation.canonical_bytes()?; - correlation.validate_against_expected(&projection.expected, lease_sha256.as_deref())?; - let (signed, unsigned) = - OdinRuntimeTopologyCorrelationRecord::decode_canonical_signed_payload(&canonical)?; - verify_service_identity_signature_with_public_key::< - OdinTopologyIdentity, - OdinRuntimeTopologyCorrelationPurpose, - >( - self.signer.public_key(), - &unsigned, - &ServiceIdentitySignature { - identity_id: signed.signer_identity_id, - signature: signed.signature, - }, - )?; - if let Some(authority) = &authority { - authenticate_odin_runtime_topology_correlation( - &canonical, - authority, - lease_sha256.as_deref(), - self.signer.public_key(), - OdinTopologyAuthenticationContext { - trusted_received_at_unix_millis: now, - maximum_age_millis: self.policy.correlation_maximum_age_millis, - maximum_future_skew_millis: self - .policy - .correlation_maximum_future_skew_millis, - }, - )?; - } - let stored_correlation = StoredCorrelation { - canonical_bytes: canonical.clone(), - stored_at: rfc3339_millis(now)?, - }; - if self.store.compare_exchange( - &observed, - replacement_presence.as_ref(), - &stored_correlation, - )? { - return Ok(canonical); - } - } - bail!("Odin topology store changed repeatedly during correlation") - } - - fn select_presence( - &self, - observed: &OdinStoreSnapshot, - incoming: Option<(&[u8], u64)>, - authority: Option<&cultnet_rs::VerifiedRuntimeAuthority>, - ) -> Result { - let Some(authority) = authority else { - if incoming.is_some() { - return Err(PresenceAuthorityRefused( - "runtime presence has no exact current activation and provider anchor", - ) - .into()); - } - return Ok(observed - .presence - .as_ref() - .map_or(SelectedPresence::None, |stored| { - SelectedPresence::Stale(stored.clone()) - })); - }; - let selected = if let Some((bytes, received_at)) = incoming { - if let Some(stored_presence) = observed - .presence - .as_ref() - .filter(|stored| stored.canonical_bytes == bytes) - { - let stored_claim = authenticate_runtime_presence_claim( - &stored_presence.canonical_bytes, - authority, - self.presence_context(stored_presence.trusted_received_at_unix_millis), - )?; - return Ok(SelectedPresence::Current { - correlation: correlate_runtime_presence_claim(stored_claim, authority)?, - replacement: None, - }); - } - let claim = authenticate_runtime_presence_claim( - bytes, - authority, - self.presence_context(received_at), - ) - .context(PresenceAuthorityRefused( - "runtime presence does not authenticate under the projected authority", - ))?; - // Publisher sequence orders the claims of one publisher: the - // activation whose key signs them. Each activation counts from its - // own start, so the stored presence constrains the claim only when - // it was issued under this authority's activation. One left by an - // earlier activation (on 2026-09-29 every StreamPixels restart was - // refused against its predecessor's count) is another publisher's - // count and is superseded whatever its sequence. A stored presence - // that names this activation is this publisher's, and it must - // authenticate at the time Odin received it; failing to is an - // error, never a reason to forget its sequence. - // - // The two ways a stored presence can fail to be the same - // publisher's are decided differently on purpose. One that cannot - // be decoded names no activation, so it cannot be this - // publisher's: it is treated as another publisher's and the claim - // supersedes it (fail-open; the store's own read refuses such a - // record earlier still). One that decodes and names this - // activation is this publisher's own count: if it no longer - // authenticates, the count is unknowable and the claim is - // refused (fail-closed). - let same_publisher = match observed.presence.as_ref() { - Some(stored) - if decode_presence(&stored.canonical_bytes).is_ok_and(|record| { - record.activation_witness_sha256 == authority.activation_sha256() - }) => - { - Some( - authenticate_runtime_presence_claim( - &stored.canonical_bytes, - authority, - self.presence_context(stored.trusted_received_at_unix_millis), - ) - .context(PresenceAuthorityRefused( - "stored presence of the current activation no longer authenticates", - ))?, - ) - } - _ => None, - }; - if let Some(stored) = &same_publisher { - let stored_sequence = stored.record().publisher_sequence; - if claim.record().publisher_sequence < stored_sequence { - bail!("runtime presence publisher sequence was reordered"); - } - if claim.record().publisher_sequence == stored_sequence { - bail!("runtime presence publisher sequence was reused with different bytes"); - } - } - let replacement = AdmittedPresence::new(bytes.to_vec(), received_at)?; - Some((claim, Some(replacement))) - } else if let Some(stored) = &observed.presence { - match authenticate_runtime_presence_claim( - &stored.canonical_bytes, - authority, - self.presence_context(stored.trusted_received_at_unix_millis), - ) { - Ok(claim) => Some((claim, None)), - Err(error) => { - // A stored presence that no longer authenticates is a - // disagreement about that one incarnation, never a reason - // for the rendezvous to stop. On 2026-09-11 a provider's - // continuity restart left its previous presence in this - // store; treating that as tampering took Odin down, and - // every restart read the same record and died again. - let prior_matches_current = - observed.correlation.as_ref().is_some_and(|value| { - decode_correlation(&value.canonical_bytes).is_ok_and(|record| { - record.expected_projection_sha256 == authority.expected_sha256() - && record.current_activation_sha256.as_deref() - == Some(authority.activation_sha256()) - }) - }); - if prior_matches_current { - eprintln!( - "Odin holds a presence for Expected {} that no longer authenticates under the authority its correlation named; recorded as stale: {error:#}", - authority.expected_sha256() - ); - } - return Ok(SelectedPresence::Stale(stored.clone())); - } - } - } else { - None - }; - match selected { - Some((claim, replacement)) => Ok(SelectedPresence::Current { - correlation: correlate_runtime_presence_claim(claim, authority)?, - replacement, - }), - None => Ok(SelectedPresence::None), - } - } - - fn dependency_evidence( - &self, - requirements: &[IdunnExpectedDependency], - observed: &OdinStoreSnapshot, - now: u64, - ) -> Result> { - requirements - .iter() - .map(|requirement| { - let mut evidence = OdinRuntimeDependencyEvidence { - kind: requirement.kind.clone(), - capability: requirement.capability.clone(), - schema: requirement.schema.clone(), - compatibility: requirement.compatibility.clone(), - provider_id: requirement.provider_id.clone(), - provider_authority: requirement.provider_authority.clone(), - provider_expected_projection_sha256: requirement - .provider_expected_projection_sha256 - .clone(), - provider_endpoint: requirement.provider_endpoint.clone(), - observed_capacity: None, - provider_evidence_sha256: None, - ready: false, - }; - let Some(provider_id) = requirement.provider_id.as_deref() else { - return Ok(evidence); - }; - if requirement.provider_authority.as_deref() != Some("managed-incarnation") { - return Ok(evidence); - } - let Some(provider_expected_sha256) = - requirement.provider_expected_projection_sha256.as_deref() - else { - return Ok(evidence); - }; - let provider_incarnation = - IncarnationRef::new(provider_id, provider_expected_sha256); - let Some(provider_projection) = - self.projections.projection(&provider_incarnation)? - else { - return Ok(evidence); - }; - provider_projection.validate()?; - if let Some(endpoint) = requirement.provider_endpoint.as_deref() - && provider_projection - .expected - .route - .as_ref() - .map(|route| route.stable_endpoint.as_str()) - != Some(endpoint) - { - return Ok(evidence); - } - let (provider_authority, authority_disagreements) = - classify_runtime_authority(&provider_projection, &self.idunn_anchor, now)?; - let Some(provider_authority) = provider_authority else { - return Ok(evidence); - }; - if !authority_disagreements.is_empty() { - return Ok(evidence); - } - let Some(stored) = observed - .dependency_correlations - .get(&provider_incarnation) - .and_then(Option::as_ref) - else { - return Ok(evidence); - }; - let (current_lease_sha256, _) = classify_current_lease(&provider_projection)?; - let Ok(authenticated) = authenticate_odin_runtime_topology_correlation( - &stored.canonical_bytes, - &provider_authority, - current_lease_sha256.as_deref(), - self.signer.public_key(), - OdinTopologyAuthenticationContext { - trusted_received_at_unix_millis: now, - maximum_age_millis: self.policy.correlation_maximum_age_millis, - maximum_future_skew_millis: self - .policy - .correlation_maximum_future_skew_millis, - }, - ) else { - return Ok(evidence); - }; - let provider = authenticated.record(); - let capacity = provider - .observed_capabilities - .iter() - .find(|capability| { - capability.capability == requirement.capability - && capability.schema == requirement.schema - && capability.compatibility == requirement.compatibility - }) - .map(|capability| capability.capacity); - evidence.observed_capacity = capacity; - evidence.provider_evidence_sha256 = Some(provider.canonical_sha256()?); - evidence.ready = provider.ready - && capacity.is_some_and(|capacity| capacity >= requirement.minimum_capacity); - Ok(evidence) - }) - .collect() - } - - fn presence_context( - &self, - trusted_received_at_unix_millis: u64, - ) -> RuntimePresenceAuthenticationContext { - RuntimePresenceAuthenticationContext { - trusted_received_at_unix_millis, - maximum_age_millis: self.policy.presence_maximum_age_millis, - maximum_future_skew_millis: self.policy.presence_maximum_future_skew_millis, - } - } -} - -enum SelectedPresence { - None, - Stale(AdmittedPresence), - Current { - correlation: cultnet_rs::RuntimePresenceCorrelation, - replacement: Option, - }, -} - -fn correlate_write_lease( - expected: &IdunnExpectedIncarnationRecord, - current: Option<&str>, - observed: Option<&str>, - presence_state: &str, - disagreements: &mut Vec, -) -> Option { - if presence_state == "warming" && observed.is_none() { - return None; - } - if expected.write_lease_required && current.is_some() && current == observed { - return observed.map(str::to_string); - } - if expected.write_lease_required { - disagreements.push(OdinTopologyDisagreement { - code: "write-lease".into(), - expected: Some( - current - .unwrap_or("current-idunn-process-write-lease") - .into(), - ), - observed: observed.map(str::to_string), - }); - } else if observed.is_some() { - disagreements.push(OdinTopologyDisagreement { - code: "unexpected-write-lease".into(), - expected: None, - observed: observed.map(str::to_string), - }); - } - None -} - -fn same_correlation_facts( - prior: &OdinRuntimeTopologyCorrelationRecord, - next: &OdinRuntimeTopologyCorrelationRecord, -) -> bool { - let mut normalized = next.clone(); - normalized.publisher_sequence = prior.publisher_sequence; - normalized.observed_at_unix_millis = prior.observed_at_unix_millis; - normalized.signature = prior.signature.clone(); - &normalized == prior -} - -fn managed_dependency_incarnations( - requirements: &[IdunnExpectedDependency], -) -> Vec { - requirements - .iter() - .filter(|dependency| { - dependency.provider_authority.as_deref() == Some("managed-incarnation") - }) - .filter_map(|dependency| { - Some(IncarnationRef::new( - dependency.provider_id.clone()?, - dependency.provider_expected_projection_sha256.clone()?, - )) - }) - .collect() -} - -/// Whether one dependency lets its dependent be Ready. An optional dependency -/// never blocks. An external-operator-binding provider is one Idunn admitted -/// from the operator's binding: Odin has no incarnation to observe and so can -/// never sign evidence for it, and its own evidence stays `ready: false`. The -/// dependent checks that provider itself at use, so Odin does not gate on it. -fn dependency_permits_ready(kind: &str, ready: bool) -> bool { - matches!(kind, "optional" | "external-operator-binding") || ready -} - -const PROVIDER_ANCHOR_TIME_CODE: &str = "provider-trust-anchor-time"; - -fn classify_runtime_authority( - projection: &IdunnRuntimeProjection, - idunn_anchor: &ServiceIdentityTrustAnchor, - now: u64, -) -> Result<( - Option, - Vec, -)> { - let expected = &projection.expected; - let expected_sha256 = expected.canonical_sha256()?; - let mut disagreements = Vec::new(); - match &projection.provider_anchor { - None => disagreements.push(OdinTopologyDisagreement { - code: "provider-trust-anchor-missing".into(), - expected: Some(expected.expected_signer_identity_id.clone()), - observed: None, - }), - Some(anchor) => { - push_disagreement( - &mut disagreements, - "provider-trust-anchor-id", - Some(runtime_presence_anchor_id(&expected.target)), - Some(anchor.trust_anchor_id.clone()), - ); - push_disagreement( - &mut disagreements, - "provider-service-id", - Some(expected.target.clone()), - Some(anchor.service_id.clone()), - ); - push_disagreement( - &mut disagreements, - "provider-runtime-id", - Some(expected.runtime_id.clone()), - Some(anchor.runtime_id.clone()), - ); - push_disagreement( - &mut disagreements, - "provider-signer-identity", - Some(expected.expected_signer_identity_id.clone()), - Some(anchor.signer_identity_id.clone()), - ); - push_disagreement( - &mut disagreements, - "provider-signing-purpose", - Some(GAMECULT_RUNTIME_PRESENCE_HEALTH_SIGNING_PURPOSE.into()), - Some(anchor.signing_purpose.clone()), - ); - push_disagreement( - &mut disagreements, - "provider-signed-schema", - Some(GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA.into()), - Some(anchor.signed_schema.clone()), - ); - if anchor.bound_at_unix_millis > now - || anchor - .expires_at_unix_millis - .is_some_and(|expires_at| now >= expires_at) - { - disagreements.push(OdinTopologyDisagreement { - code: PROVIDER_ANCHOR_TIME_CODE.into(), - expected: Some(format!("current-at:{now}")), - observed: Some(format!( - "bound:{};expires:{}", - anchor.bound_at_unix_millis, - anchor - .expires_at_unix_millis - .map_or_else(|| "none".into(), |value| value.to_string()) - )), - }); - } - } - } - match &projection.activation { - None => disagreements.push(OdinTopologyDisagreement { - code: "current-activation-missing".into(), - expected: Some(expected_sha256.clone()), - observed: None, - }), - Some(activation) => { - if activation.idunn_signer_identity_id != idunn_anchor.identity_id { - disagreements.push(OdinTopologyDisagreement { - code: "activation-idunn-signer".into(), - expected: Some(idunn_anchor.identity_id.clone()), - observed: Some(activation.idunn_signer_identity_id.clone()), - }); - } else { - verify_service_identity_signature::< - IdunnServiceIdentity, - IdunnRuntimeActivationPurpose, - >( - idunn_anchor, - &activation.unsigned_signature_payload()?, - &ServiceIdentitySignature { - identity_id: activation.idunn_signer_identity_id.clone(), - signature: activation.signature.clone(), - }, - ) - .context("verifying projected Idunn runtime activation")?; - } - push_disagreement( - &mut disagreements, - "activation-expected-projection", - Some(expected_sha256.clone()), - Some(activation.expected_projection_sha256.clone()), - ); - push_disagreement( - &mut disagreements, - "activation-runtime-id", - Some(expected.runtime_id.clone()), - Some(activation.runtime_id.clone()), - ); - } - } - disagreements.sort_by(|left, right| left.code.cmp(&right.code)); - let authority = if disagreements.is_empty() { - let anchor = projection.provider_anchor.as_ref().unwrap(); - let activation = projection.activation.as_ref().unwrap(); - Some(verify_runtime_authority( - expected, - activation, - idunn_anchor, - &anchor.signer_public_key, - )?) - } else { - None - }; - Ok((authority, disagreements)) -} - -/// The projected provider anchor is not yet bound at `now` and nothing else -/// disagrees, so a later reading of the same projection would verify. -fn only_clock_precedes_anchor( - projection: &IdunnRuntimeProjection, - disagreements: &[OdinTopologyDisagreement], - now: u64, -) -> bool { - projection.provider_anchor.as_ref().is_some_and(|anchor| { - anchor.bound_at_unix_millis > now - && !anchor - .expires_at_unix_millis - .is_some_and(|expires_at| now >= expires_at) - }) && disagreements - .iter() - .all(|disagreement| disagreement.code == PROVIDER_ANCHOR_TIME_CODE) -} - -fn classify_current_lease( - projection: &IdunnRuntimeProjection, -) -> Result<(Option, Option)> { - let Some(lease) = &projection.current_lease else { - return Ok((None, None)); - }; - let lease_sha256 = lease.canonical_sha256()?; - let activation = projection.activation.as_ref(); - let binds = activation - .map(|activation| lease_binds(&projection.expected, activation, lease)) - .transpose()? - .unwrap_or(false); - if projection.expected.write_lease_required && binds { - return Ok((Some(lease_sha256), None)); - } - let expected_activation = activation - .map(IdunnRuntimeActivationRecord::canonical_sha256) - .transpose()? - .unwrap_or_else(|| "none".into()); - Ok(( - None, - Some(OdinTopologyDisagreement { - code: "projected-write-lease".into(), - expected: Some(format!( - "expected:{};activation:{expected_activation}", - projection.expected.canonical_sha256()? - )), - observed: Some(lease_sha256), - }), - )) -} - -fn lease_binds( - expected: &IdunnExpectedIncarnationRecord, - activation: &IdunnRuntimeActivationRecord, - lease: &IdunnProcessWriteLeaseRecord, -) -> Result { - Ok(lease.target == expected.target - && lease.expected_projection_sha256 == expected.canonical_sha256()? - && lease.plan_id == expected.plan_id - && lease.incarnation_id == expected.incarnation_id - && lease.sealed_release_id == expected.sealed_release_id - && lease.activation_witness_sha256 == activation.canonical_sha256()? - && Some(lease.state_schema_generation.as_str()) - == expected.state_schema_generation.as_deref() - && Some(lease.state_contract_sha256.as_str()) == expected.state_contract_sha256.as_deref() - && lease.runtime_id == expected.runtime_id - && lease.runtime_instance_id == activation.runtime_instance_id) -} - -fn push_disagreement( - disagreements: &mut Vec, - code: &str, - expected: Option, - observed: Option, -) { - if expected != observed { - disagreements.push(OdinTopologyDisagreement { - code: code.into(), - expected, - observed, - }); - } -} - -fn runtime_presence_anchor_id(target: &str) -> String { - format!("root/{target}/runtime-presence") -} - -fn presence_store_key(incarnation: &IncarnationRef, signer_identity_id: &str) -> String { - format!("{}/{signer_identity_id}", incarnation.key()) -} - -fn unique_envelope<'a>( - entries: &'a [CultCacheEnvelope], - record_type: &str, - key: &str, -) -> Result> { - let mut matches = entries - .iter() - .filter(|entry| entry.r#type == record_type && entry.key == key); - let current = matches.next(); - ensure!(matches.next().is_none(), "CultCache identity is ambiguous"); - Ok(current) -} - -fn ensure_schema(envelope: &CultCacheEnvelope, schema: &str) -> Result<()> { - ensure!( - envelope.schema_id.as_deref() == Some(schema), - "CultCache envelope schema is substituted" - ); - Ok(()) -} - -fn decode_canonical(bytes: &[u8], label: &str) -> Result -where - T: serde::de::DeserializeOwned + serde::Serialize, -{ - let value = rmp_serde::from_slice(bytes).with_context(|| format!("decoding {label}"))?; - ensure!( - rmp_serde::to_vec(&value)? == bytes, - "{label} is not canonical positional MessagePack" - ); - Ok(value) -} - -fn decode_presence(bytes: &[u8]) -> Result { - let record: GameCultRuntimePresenceHealthRecord = decode_canonical(bytes, "runtime presence")?; - record.validate()?; - Ok(record) -} - -fn decode_correlation(bytes: &[u8]) -> Result { - Ok(OdinRuntimeTopologyCorrelationRecord::decode_canonical_signed_payload(bytes)?.0) -} - -fn decode_presence_envelope(envelope: &CultCacheEnvelope) -> Result { - ensure_schema(envelope, GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA)?; - decode_presence(&envelope.payload)?; - Ok(AdmittedPresence { - canonical_bytes: envelope.payload.clone(), - trusted_received_at_unix_millis: parse_rfc3339_millis(&envelope.stored_at)?, - stored_at: envelope.stored_at.clone(), - }) -} - -fn decode_correlation_envelope(envelope: &CultCacheEnvelope) -> Result { - ensure_schema(envelope, ODIN_RUNTIME_TOPOLOGY_CORRELATION_SCHEMA)?; - let record = decode_correlation(&envelope.payload)?; - ensure!( - incarnation_key(&record.target, &record.expected_projection_sha256) == envelope.key, - "stored correlation incarnation is substituted" - ); - ensure!( - parse_rfc3339_millis(&envelope.stored_at)? == record.observed_at_unix_millis, - "stored correlation receipt time is substituted" - ); - Ok(StoredCorrelation { - canonical_bytes: envelope.payload.clone(), - stored_at: envelope.stored_at.clone(), - }) -} - -fn presence_envelope(key: &str, presence: &AdmittedPresence) -> CultCacheEnvelope { - CultCacheEnvelope { - key: key.into(), - r#type: GameCultRuntimePresenceHealthRecord::TYPE.into(), - payload: presence.canonical_bytes.clone(), - stored_at: presence.stored_at.clone(), - schema_id: Some(GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA.into()), - } -} - -fn correlation_envelope(target: &str, correlation: &StoredCorrelation) -> CultCacheEnvelope { - CultCacheEnvelope { - key: target.into(), - r#type: OdinRuntimeTopologyCorrelationRecord::TYPE.into(), - payload: correlation.canonical_bytes.clone(), - stored_at: correlation.stored_at.clone(), - schema_id: Some(ODIN_RUNTIME_TOPOLOGY_CORRELATION_SCHEMA.into()), - } -} - -fn insert_condition( - conditions: &mut BTreeMap<(String, String), CultCacheExpectedEnvelope>, - condition: CultCacheExpectedEnvelope, -) -> Result<()> { - let identity = (condition.r#type.clone(), condition.key.clone()); - if let Some(current) = conditions.get(&identity) { - ensure!( - current.current == condition.current, - "store read set is incoherent" - ); - } else { - conditions.insert(identity, condition); - } - Ok(()) -} - -fn rfc3339_millis(value: u64) -> Result { - let value: i64 = value - .try_into() - .context("timestamp exceeds RFC3339 range")?; - Ok(DateTime::::from_timestamp_millis(value) - .context("timestamp exceeds RFC3339 range")? - .to_rfc3339_opts(SecondsFormat::Millis, true)) -} - -fn parse_rfc3339_millis(value: &str) -> Result { - DateTime::parse_from_rfc3339(value)? - .timestamp_millis() - .try_into() - .context("CultCache timestamp predates Unix epoch") -} - -#[cfg(test)] -mod tests { - use std::path::PathBuf; - - use cultnet_rs::{ - GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA, GameCultProviderHealthIdentity, - GameCultRuntimeCapability, GameCultRuntimePresenceHealthPurpose, IdunnExpectedCapability, - IdunnExpectedRoute, IdunnRuntimeActivationLaunch, IdunnRuntimeActivationSigner, - IdunnServiceIdentity, enroll_service_identity_at, - }; - use tempfile::TempDir; - - use super::*; - - const NOW: u64 = 1_000_000; - - /// Dev-only probe: decode a captured Idunn projection file and print what - /// Odin's authority classifier sees for one target. Run against a snapshot - /// taken from the host when Odin rejects its own presence: - /// - /// ```text - /// ODIN_PROBE_PROJECTION=/path/topology.cc \ - /// ODIN_PROBE_IDUNN_ANCHOR=/path/idunn-anchor.cc \ - /// cargo test -p odin-daemon projection_authority_probe -- --ignored --nocapture - /// ``` - #[test] - #[ignore = "reads host files named by ODIN_PROBE_* environment variables"] - fn projection_authority_probe() -> Result<()> { - let projection_path = std::env::var("ODIN_PROBE_PROJECTION")?; - let anchor_path = std::env::var("ODIN_PROBE_IDUNN_ANCHOR")?; - let target = std::env::var("ODIN_PROBE_TARGET").unwrap_or_else(|_| "odin".into()); - let entries = - SingleFileMessagePackBackingStore::new(&anchor_path).pull_all_read_only_snapshot()?; - let [envelope] = entries.as_slice() else { - bail!("anchor store must contain exactly one document"); - }; - let idunn_anchor: ServiceIdentityTrustAnchor = rmp_serde::from_slice(&envelope.payload)?; - let now = SystemTime::now().duration_since(UNIX_EPOCH)?.as_millis() as u64; - let all = SingleFileMessagePackBackingStore::new(&projection_path) - .pull_all_read_only_snapshot()?; - println!("== envelopes in {projection_path}"); - for envelope in &all { - println!( - " type={} key={} schema={:?} stored_at={}", - envelope.r#type, envelope.key, envelope.schema_id, envelope.stored_at - ); - } - let projections = - CultCacheIdunnProjectionSource::new(&projection_path).projections(&target)?; - if projections.is_empty() { - println!("== no incarnation-keyed projection for {target}"); - return Ok(()); - } - for projection in projections { - println!( - "== projection for {target} incarnation {}", - IncarnationRef::of(&projection.expected)?.key() - ); - println!( - " expected sha {}", - projection.expected.canonical_sha256()? - ); - println!( - " expected incarnation {}", - projection.expected.incarnation_id - ); - println!( - " activation {:?} instance={:?} expected_sha={:?}", - projection - .activation - .as_ref() - .map(|a| a.canonical_sha256()) - .transpose()?, - projection - .activation - .as_ref() - .map(|a| a.runtime_instance_id.clone()), - projection - .activation - .as_ref() - .map(|a| a.expected_projection_sha256.clone()), - ); - println!( - " lease {:?}", - projection - .current_lease - .as_ref() - .map(|l| l.canonical_sha256()) - .transpose()? - ); - println!( - " provider anchor {:?} bound={:?} expires={:?}", - projection - .provider_anchor - .as_ref() - .map(|a| a.trust_anchor_id.clone()), - projection - .provider_anchor - .as_ref() - .map(|a| a.bound_at_unix_millis), - projection - .provider_anchor - .as_ref() - .map(|a| a.expires_at_unix_millis), - ); - let (authority, disagreements) = - classify_runtime_authority(&projection, &idunn_anchor, now)?; - println!("== authority present: {}", authority.is_some()); - for disagreement in &disagreements { - println!( - " DISAGREEMENT {} expected={:?} observed={:?}", - disagreement.code, disagreement.expected, disagreement.observed - ); - } - let (lease_sha256, lease_disagreement) = classify_current_lease(&projection)?; - println!( - "== lease binds: {:?} disagreement={:?}", - lease_sha256, - lease_disagreement.map(|d| d.code) - ); - } - Ok(()) - } - - /// The rebuild's negative check. A target being replaced has two live - /// incarnations, and Idunn publishes the candidate's Expected beside the - /// incumbent's. That publication must be unable to touch what the incumbent - /// is: its presence stays admitted under its own incarnation, the - /// candidate's presence is admitted under the candidate's, and neither - /// correlation describes the other. - #[test] - fn a_candidate_expected_beside_the_incumbent_cannot_reject_its_presence() -> Result<()> { - let world = TestWorld::new()?; - let incumbent = world.service("odin", Vec::new(), true)?; - let engine = world.engine(NOW); - let incumbent_presence = incumbent.signed_presence(1, |_| {})?; - let ready = decode_signed(&engine.admit_presence("odin", &incumbent_presence, NOW)?)?; - assert!(ready.present && ready.ready); - - // Idunn seals a candidate: same target, new incarnation, no activation - // or lease yet. This is exactly the write that used to kill the - // incumbent. - let mut candidate = incumbent.projection.clone(); - candidate.expected.plan_id = digest('9'); - candidate.expected.incarnation_id = "odin/generation-2".into(); - candidate.expected.validate()?; - candidate.activation = None; - candidate.current_lease = None; - world.publish_projection(&candidate)?; - let candidate_incarnation = IncarnationRef::of(&candidate.expected)?; - assert_ne!(incumbent.incarnation()?, candidate_incarnation); - assert_eq!( - CultCacheIdunnProjectionSource::new(&world.projection_path) - .projections("odin")? - .len(), - 2 - ); - - // The incumbent's next heartbeat is admitted exactly as before. - let heartbeat = incumbent.signed_presence(2, |_| {})?; - let still_ready = - decode_signed(&engine.admit_presence("odin", &heartbeat, NOW + 5_000)?)?; - assert!(still_ready.present && still_ready.ready); - assert_eq!( - still_ready.expected_projection_sha256, - incumbent.incarnation()?.expected_sha256 - ); - - // The candidate is Expected-only under its own key, and a refresh of - // it does not disturb the incumbent's correlation. - let candidate_only = decode_signed(&engine.refresh(&candidate_incarnation)?.unwrap())?; - assert!(candidate_only.expected && !candidate_only.present); - assert_eq!( - candidate_only.expected_projection_sha256, - candidate_incarnation.expected_sha256 - ); - let incumbent_again = decode_signed( - &engine - .current_signed_correlation(&incumbent.incarnation()?)? - .unwrap(), - )?; - assert!(incumbent_again.present && incumbent_again.ready); - Ok(()) - } - - /// A projection written by an Idunn that still keys records by target is - /// not this contract, and must project nothing rather than something the - /// reader half-understands. - #[test] - fn target_keyed_legacy_records_project_nothing() -> Result<()> { - let world = TestWorld::new()?; - let service = world.service("ghostlight", Vec::new(), false)?; - let store = SingleFileMessagePackBackingStore::new(&world.projection_path); - let current = store.pull_all_read_only_snapshot()?; - let legacy: Vec<_> = current - .iter() - .map(|envelope| { - let mut envelope = envelope.clone(); - if IncarnationRef::parse_key(&envelope.key).is_some() { - envelope.key = "ghostlight".into(); - } - envelope - }) - .collect(); - ensure!(store.compare_exchange_snapshot(¤t, &legacy)?); - let source = CultCacheIdunnProjectionSource::new(&world.projection_path); - assert!(source.projections("ghostlight")?.is_empty()); - assert!(source.projection(&service.incarnation()?)?.is_none()); - Ok(()) - } - - /// An Expected that will not decode is its own incarnation's fault: another - /// incarnation, even of the same target, is still read exactly. - #[test] - fn an_undecodable_expected_does_not_hide_its_sibling_incarnations() -> Result<()> { - let world = TestWorld::new()?; - let service = world.service("ghostlight", Vec::new(), false)?; - let store = SingleFileMessagePackBackingStore::new(&world.projection_path); - let current = store.pull_all_read_only_snapshot()?; - let mut with_ghost = current.clone(); - with_ghost.push(CultCacheEnvelope { - key: IncarnationRef::new("ghostlight", digest('a')).key(), - r#type: IdunnExpectedIncarnationRecord::TYPE.into(), - payload: vec![0xc1, 0x00], - stored_at: rfc3339_millis(NOW - 1_000)?, - schema_id: Some(IDUNN_EXPECTED_INCARNATION_SCHEMA.into()), - }); - ensure!(store.compare_exchange_snapshot(¤t, &with_ghost)?); - let source = CultCacheIdunnProjectionSource::new(&world.projection_path); - assert!(source.projection(&service.incarnation()?)?.is_some()); - assert!( - source - .projection(&IncarnationRef::new("ghostlight", digest('a'))) - .is_err(), - "the ghost itself is refused" - ); - Ok(()) - } - - /// A store the target-keyed Odin wrote holds correlations under bare - /// target keys. They are retired; presence history under any key stays. - #[test] - fn legacy_target_keyed_correlations_are_retired_and_presence_is_kept() -> Result<()> { - let world = TestWorld::new()?; - let service = world.service("ghostlight", Vec::new(), false)?; - let presence = service.signed_presence(1, |_| {})?; - let engine = world.engine(NOW); - let correlation = engine.admit_presence("ghostlight", &presence, NOW)?; - let store = SingleFileMessagePackBackingStore::new(&world.topology_path); - let current = store.pull_all_read_only_snapshot()?; - let mut with_legacy = current.clone(); - with_legacy.push(CultCacheEnvelope { - key: "ghostlight".into(), - r#type: OdinRuntimeTopologyCorrelationRecord::TYPE.into(), - payload: correlation, - stored_at: rfc3339_millis(NOW - 1_000)?, - schema_id: Some(ODIN_RUNTIME_TOPOLOGY_CORRELATION_SCHEMA.into()), - }); - with_legacy.push(CultCacheEnvelope { - key: "ghostlight/legacy-signer".into(), - r#type: GameCultRuntimePresenceHealthRecord::TYPE.into(), - payload: presence.clone(), - stored_at: rfc3339_millis(NOW - 1_000)?, - schema_id: Some(GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA.into()), - }); - ensure!(store.compare_exchange_snapshot(¤t, &with_legacy)?); - - let odin_store = CultCacheOdinTopologyStore::new(&world.topology_path); - assert_eq!(odin_store.retire_legacy_correlations()?, 1); - assert_eq!(odin_store.retire_legacy_correlations()?, 0); - let after = store.pull_all_read_only_snapshot()?; - assert!(after.iter().all(|entry| { - entry.r#type != OdinRuntimeTopologyCorrelationRecord::TYPE - || IncarnationRef::parse_key(&entry.key).is_some() - })); - assert!( - after - .iter() - .any(|entry| entry.key == "ghostlight/legacy-signer") - ); - assert!( - engine - .current_signed_correlation(&service.incarnation()?)? - .is_some() - ); - Ok(()) - } - - #[test] - fn withdrawing_a_correlation_does_not_reset_its_publisher_sequence() -> Result<()> { - let temp = TempDir::new()?; - let store = CultCacheOdinTopologyStore::new(temp.path().join("topology.cc")); - - assert_eq!(store.reserve_publisher_sequence("heimdall", 0)?, 1); - assert_eq!(store.reserve_publisher_sequence("heimdall", 1)?, 2); - - // Idunn remembers the highest sequence it has admitted for a target and - // refuses anything at or below it. If withdrawal took the count with - // it, the next correlation would start at 1, be refused as a replay, - // and be withdrawn again -- a deadlock that also lets a genuine replay - // of the old sequence 2 outrank the fresh one. - store.withdraw_correlation(&IncarnationRef::new("heimdall", digest('1')))?; - assert_eq!(store.reserve_publisher_sequence("heimdall", 0)?, 3); - - // Each target counts on its own. - assert_eq!(store.reserve_publisher_sequence("repixelizer", 0)?, 1); - assert_eq!(store.reserve_publisher_sequence("heimdall", 0)?, 4); - - // A stored correlation ahead of the mark wins, which is what carries a - // store written before the mark existed onto the new scheme. - assert_eq!(store.reserve_publisher_sequence("heimdall", 99)?, 100); - Ok(()) - } - - #[derive(Clone, Copy)] - struct FixedClock(u64); - - impl Clock for FixedClock { - fn now_unix_millis(&self) -> Result { - Ok(self.0) - } - } - - struct TestService { - projection: IdunnRuntimeProjection, - provider_signer: ServiceIdentitySigner, - activation_signer: IdunnRuntimeActivationSigner, - } - - impl TestService { - fn incarnation(&self) -> Result { - IncarnationRef::of(&self.projection.expected) - } - - fn signed_presence(&self, sequence: u64, edit: F) -> Result> - where - F: FnOnce(&mut GameCultRuntimePresenceHealthRecord), - { - let expected = &self.projection.expected; - let activation = self.projection.activation.as_ref().unwrap(); - let mut record = GameCultRuntimePresenceHealthRecord { - schema_version: GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA.into(), - target: expected.target.clone(), - expected_projection_sha256: expected.canonical_sha256()?, - plan_id: expected.plan_id.clone(), - incarnation_id: expected.incarnation_id.clone(), - sealed_release_id: expected.sealed_release_id.clone(), - activation_witness_sha256: activation.canonical_sha256()?, - state_schema_generation: expected.state_schema_generation.clone(), - state_contract_sha256: expected.state_contract_sha256.clone(), - runtime_id: expected.runtime_id.clone(), - runtime_instance_id: activation.runtime_instance_id.clone(), - bound_endpoint: expected - .route - .as_ref() - .map(|route| route.candidate_endpoint.clone()), - capabilities: expected - .capabilities - .iter() - .map(|capability| GameCultRuntimeCapability { - capability: capability.capability.clone(), - schema: capability.schema.clone(), - compatibility: capability.compatibility.clone(), - capacity: capability.minimum_capacity, - }) - .collect(), - health_contract: expected.health_contract.clone(), - state: "active".into(), - detail: "ready".into(), - write_lease_sha256: self - .projection - .current_lease - .as_ref() - .map(IdunnProcessWriteLeaseRecord::canonical_sha256) - .transpose()?, - signer_identity_id: self.provider_signer.entry().identity_id.clone(), - publisher_sequence: sequence, - observed_at_unix_millis: NOW - 10, - signature_algorithm: "ed25519".into(), - signature: Vec::new(), - activation_signer_identity_id: activation.activation_signer_identity_id.clone(), - activation_signature: Vec::new(), - }; - edit(&mut record); - let proof_payload = record.canonical_proof_payload()?; - record.signature = self - .provider_signer - .sign::(&proof_payload) - .signature; - record.activation_signature = self.activation_signer.sign_presence_proof(&record)?; - record.validate()?; - Ok(rmp_serde::to_vec(&record)?) - } - } - - struct TestWorld { - _temp: TempDir, - projection_path: PathBuf, - topology_path: PathBuf, - identity_root: PathBuf, - idunn_signer: ServiceIdentitySigner, - idunn_anchor: ServiceIdentityTrustAnchor, - odin_signer: ServiceIdentitySigner, - } - - impl TestWorld { - fn new() -> Result { - let temp = tempfile::tempdir()?; - let identity_root = temp.path().join("identities"); - let idunn_signer = enroll_service_identity_at::( - &identity_root.join("idunn.cc"), - )?; - let idunn_anchor = idunn_signer.trust_anchor()?; - let odin_signer = - enroll_service_identity_at::(&identity_root.join("odin.cc"))?; - Ok(Self { - projection_path: temp.path().join("idunn-projection.cc"), - topology_path: temp.path().join("odin-topology.cc"), - identity_root, - idunn_signer, - idunn_anchor, - odin_signer, - _temp: temp, - }) - } - - fn service( - &self, - target: &str, - dependencies: Vec, - stateful: bool, - ) -> Result { - let provider_signer = enroll_service_identity_at::( - &self.identity_root.join(format!("{target}-provider.cc")), - )?; - let expected = IdunnExpectedIncarnationRecord { - schema_version: IDUNN_EXPECTED_INCARNATION_SCHEMA.into(), - target: target.into(), - plan_id: digest('1'), - incarnation_id: format!("{target}/generation-1"), - sealed_release_id: digest('2'), - source_repository: format!("github.com/GameCult/{target}"), - source_revision: "3".repeat(40), - recipe_sha256: digest('4'), - runtime_id: format!("{target}-runtime"), - expected_signer_identity_id: provider_signer.entry().identity_id.clone(), - health_contract: format!("{target}.runtime-health.v1"), - artifact_sha256: digest('5'), - state_schema_generation: stateful.then(|| "state-v1".into()), - state_contract_sha256: stateful.then(|| digest('6')), - write_lease_required: stateful, - route: Some(IdunnExpectedRoute { - route_id: format!("{target}-route"), - transport: "tcp".into(), - stable_endpoint: format!("tcp://{target}.internal:1000"), - candidate_endpoint: format!("tcp://127.0.0.1:{}", target.len() + 10_000), - }), - capabilities: vec![IdunnExpectedCapability { - capability: "data".into(), - schema: "data.v1".into(), - compatibility: "v1".into(), - minimum_capacity: 1, - }], - dependencies, - }; - expected.validate()?; - let launch = IdunnRuntimeActivationLaunch::issue( - &expected, - digest('7'), - NOW - 20, - &self.idunn_signer, - )?; - let activation = launch.activation().clone(); - let mut credential = Vec::new(); - let emitted = launch.write_credential(&mut credential)?; - ensure!( - emitted == activation, - "activation launch changed while emitted" - ); - let activation_signer = - IdunnRuntimeActivationSigner::from_credential_reader(credential.as_slice())?; - let provider_anchor = GameCultServiceTrustAnchorRecord { - schema_version: GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA.into(), - trust_anchor_id: runtime_presence_anchor_id(target), - service_id: target.into(), - runtime_id: expected.runtime_id.clone(), - signer_identity_id: provider_signer.entry().identity_id.clone(), - signer_public_key: provider_signer.entry().public_key.clone(), - signature_algorithm: "ed25519".into(), - signing_purpose: GAMECULT_RUNTIME_PRESENCE_HEALTH_SIGNING_PURPOSE.into(), - signed_schema: GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA.into(), - binding_authority: "root".into(), - bound_at_unix_millis: NOW - 100, - expires_at_unix_millis: None, - private_state_exposed: false, - }; - let current_lease = if stateful { - Some(IdunnProcessWriteLeaseRecord { - schema_version: IDUNN_PROCESS_WRITE_LEASE_SCHEMA.into(), - target: target.into(), - expected_projection_sha256: expected.canonical_sha256()?, - plan_id: expected.plan_id.clone(), - incarnation_id: expected.incarnation_id.clone(), - sealed_release_id: expected.sealed_release_id.clone(), - activation_witness_sha256: activation.canonical_sha256()?, - state_schema_generation: expected.state_schema_generation.clone().unwrap(), - state_contract_sha256: expected.state_contract_sha256.clone().unwrap(), - runtime_id: expected.runtime_id.clone(), - runtime_instance_id: activation.runtime_instance_id.clone(), - warming_presence_sha256: digest('8'), - lease_epoch: 1, - issued_at_unix_millis: NOW - 5, - }) - } else { - None - }; - let projection = IdunnRuntimeProjection { - expected, - provider_anchor: Some(provider_anchor), - activation: Some(activation), - current_lease, - }; - projection.validate()?; - self.publish_projection(&projection)?; - Ok(TestService { - projection, - provider_signer, - activation_signer, - }) - } - - /// Remove one incarnation's records, leaving every other incarnation - /// of the same target and the target's anchor in place. - fn withdraw_projection(&self, incarnation: &IncarnationRef) -> Result<()> { - let store = SingleFileMessagePackBackingStore::new(&self.projection_path); - let current = store.pull_all_read_only_snapshot()?; - let key = incarnation.key(); - let next: Vec<_> = current - .iter() - .filter(|envelope| envelope.key != key) - .cloned() - .collect(); - ensure!( - store.compare_exchange_snapshot(¤t, &next)?, - "test projection CAS failed" - ); - Ok(()) - } - - fn publish_projection(&self, projection: &IdunnRuntimeProjection) -> Result<()> { - let store = SingleFileMessagePackBackingStore::new(&self.projection_path); - let current = if self.projection_path.is_file() { - store.pull_all_read_only_snapshot()? - } else { - Vec::new() - }; - let anchor_key = runtime_presence_anchor_id(&projection.expected.target); - let incarnation_key = IncarnationRef::of(&projection.expected)?.key(); - let mut next: Vec<_> = current - .iter() - .filter(|envelope| { - envelope.key != incarnation_key - && !(envelope.r#type == GameCultServiceTrustAnchorRecord::TYPE - && envelope.key == anchor_key) - }) - .cloned() - .collect(); - next.push(CultCacheEnvelope { - key: incarnation_key.clone(), - r#type: IdunnExpectedIncarnationRecord::TYPE.into(), - payload: projection.expected.canonical_bytes()?, - stored_at: rfc3339_millis(NOW - 30)?, - schema_id: Some(IDUNN_EXPECTED_INCARNATION_SCHEMA.into()), - }); - if let Some(anchor) = &projection.provider_anchor { - next.push(CultCacheEnvelope { - key: anchor_key, - r#type: GameCultServiceTrustAnchorRecord::TYPE.into(), - payload: rmp_serde::to_vec(anchor)?, - stored_at: rfc3339_millis(anchor.bound_at_unix_millis)?, - schema_id: Some(GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA.into()), - }); - } - if let Some(activation) = &projection.activation { - next.push(CultCacheEnvelope { - key: incarnation_key.clone(), - r#type: IdunnRuntimeActivationRecord::TYPE.into(), - payload: activation.canonical_bytes()?, - stored_at: rfc3339_millis(activation.issued_at_unix_millis)?, - schema_id: Some(IDUNN_RUNTIME_ACTIVATION_SCHEMA.into()), - }); - } - if let Some(lease) = &projection.current_lease { - next.push(CultCacheEnvelope { - key: incarnation_key.clone(), - r#type: IdunnProcessWriteLeaseRecord::TYPE.into(), - payload: lease.canonical_bytes()?, - stored_at: rfc3339_millis(lease.issued_at_unix_millis)?, - schema_id: Some(IDUNN_PROCESS_WRITE_LEASE_SCHEMA.into()), - }); - } - ensure!( - store.compare_exchange_snapshot(¤t, &next)?, - "test projection CAS failed" - ); - Ok(()) - } - - fn engine( - &self, - now: u64, - ) -> OdinTopologyAuthority< - CultCacheIdunnProjectionSource, - CultCacheOdinTopologyStore, - &ServiceIdentitySigner, - FixedClock, - > { - OdinTopologyAuthority::new( - CultCacheIdunnProjectionSource::new(&self.projection_path), - CultCacheOdinTopologyStore::new(&self.topology_path), - &self.odin_signer, - FixedClock(now), - self.idunn_anchor.clone(), - AuthenticationPolicy::default(), - ) - } - - fn replace_provider_generation(&self, service: &mut TestService) -> Result<()> { - self.withdraw_projection(&service.incarnation()?)?; - service.projection.expected.plan_id = digest('9'); - service.projection.expected.incarnation_id = - format!("{}/generation-2", service.projection.expected.target); - service.projection.expected.validate()?; - let launch = IdunnRuntimeActivationLaunch::issue( - &service.projection.expected, - digest('a'), - NOW + 10, - &self.idunn_signer, - )?; - service.projection.activation = Some(launch.activation().clone()); - service.projection.current_lease = None; - self.publish_projection(&service.projection) - } - - /// A continuity restart: the same Expected, a new activation and a new - /// activation key, as Idunn issues when it relaunches the installed body. - fn restart_activation(&self, service: &mut TestService, issued_at: u64) -> Result<()> { - let launch = IdunnRuntimeActivationLaunch::issue( - &service.projection.expected, - digest('b'), - issued_at, - &self.idunn_signer, - )?; - let activation = launch.activation().clone(); - let mut credential = Vec::new(); - launch.write_credential(&mut credential)?; - service.activation_signer = - IdunnRuntimeActivationSigner::from_credential_reader(credential.as_slice())?; - service.projection.activation = Some(activation); - self.publish_projection(&service.projection) - } - } - - fn digest(byte: char) -> String { - format!("sha256-{}", byte.to_string().repeat(64)) - } - - fn decode_signed(bytes: &[u8]) -> Result { - Ok(OdinRuntimeTopologyCorrelationRecord::decode_canonical_signed_payload(bytes)?.0) - } - - #[test] - fn partial_or_mismatched_projection_remains_signed_expected_only() -> Result<()> { - let world = TestWorld::new()?; - let mut service = world.service("ghostlight", Vec::new(), false)?; - service.projection.activation = None; - let anchor = service.projection.provider_anchor.as_mut().unwrap(); - anchor.trust_anchor_id = "root/other/runtime-presence".into(); - anchor.service_id = "other".into(); - world.publish_projection(&service.projection)?; - - let bytes = world.engine(NOW).refresh(&service.incarnation()?)?.unwrap(); - let record = decode_signed(&bytes)?; - assert!(record.expected); - assert!(!record.present); - assert!(!record.ready); - assert!(record.signed_presence_sha256.is_none()); - let codes: Vec<_> = record - .disagreements - .iter() - .map(|value| value.code.as_str()) - .collect(); - assert!(codes.contains(&"current-activation-missing")); - assert!(codes.contains(&"provider-service-id")); - assert!(codes.contains(&"provider-trust-anchor-id")); - assert!(codes.contains(&"signed-presence-missing")); - Ok(()) - } - - #[test] - fn authenticated_disagreement_is_present_but_not_ready() -> Result<()> { - let world = TestWorld::new()?; - let service = world.service("ghostlight", Vec::new(), false)?; - let presence = service.signed_presence(1, |record| { - record.health_contract = "ghostlight.other-health.v1".into(); - })?; - - let record = decode_signed(&world.engine(NOW).admit_presence( - "ghostlight", - &presence, - NOW, - )?)?; - assert!(record.present); - assert!(!record.ready); - assert!( - record - .disagreements - .iter() - .any(|value| value.code == "health-contract") - ); - Ok(()) - } - - #[test] - fn exact_active_presence_and_current_lease_are_ready() -> Result<()> { - let world = TestWorld::new()?; - let service = world.service("ghostlight", Vec::new(), true)?; - let presence = service.signed_presence(1, |_| {})?; - - let record = decode_signed(&world.engine(NOW).admit_presence( - "ghostlight", - &presence, - NOW, - )?)?; - assert!(record.present); - assert!(record.ready); - assert_eq!( - record.observed_write_lease_sha256, - service - .projection - .current_lease - .as_ref() - .map(IdunnProcessWriteLeaseRecord::canonical_sha256) - .transpose()? - ); - Ok(()) - } - - #[test] - fn stale_projected_lease_is_visible_while_candidate_warming_is_present() -> Result<()> { - let world = TestWorld::new()?; - let mut service = world.service("ghostlight", Vec::new(), true)?; - let stale = service.projection.current_lease.as_mut().unwrap(); - stale.expected_projection_sha256 = digest('a'); - stale.plan_id = digest('b'); - stale.incarnation_id = "ghostlight/incumbent".into(); - stale.sealed_release_id = digest('c'); - stale.activation_witness_sha256 = digest('d'); - stale.runtime_instance_id = digest('e'); - world.publish_projection(&service.projection)?; - let warming = service.signed_presence(1, |record| { - record.state = "warming".into(); - record.detail = "starting".into(); - record.write_lease_sha256 = None; - })?; - - let record = decode_signed(&world.engine(NOW).admit_presence( - "ghostlight", - &warming, - NOW, - )?)?; - assert!(record.present); - assert!(!record.ready); - assert_eq!(record.observed_presence_state.as_deref(), Some("warming")); - assert!(record.observed_write_lease_sha256.is_none()); - assert!( - record - .disagreements - .iter() - .any(|value| value.code == "projected-write-lease") - ); - Ok(()) - } - - #[test] - fn provider_sequence_admission_is_monotonic_and_exact_retry_is_idempotent() -> Result<()> { - let world = TestWorld::new()?; - let service = world.service("ghostlight", Vec::new(), false)?; - let sequence_two = service.signed_presence(2, |_| {})?; - let engine = world.engine(NOW); - - let first = engine.admit_presence("ghostlight", &sequence_two, NOW)?; - let duplicate = engine.admit_presence("ghostlight", &sequence_two, NOW + 60_000)?; - assert_eq!(duplicate, first); - assert_eq!( - engine.current_signed_correlation(&service.incarnation()?)?, - Some(first) - ); - - let lower = service.signed_presence(1, |_| {})?; - assert!(engine.admit_presence("ghostlight", &lower, NOW).is_err()); - let reused = service.signed_presence(2, |record| record.detail = "different".into())?; - assert!(engine.admit_presence("ghostlight", &reused, NOW).is_err()); - - let entries = SingleFileMessagePackBackingStore::new(&world.topology_path) - .pull_all_read_only_snapshot()?; - let stored = unique_envelope( - &entries, - GameCultRuntimePresenceHealthRecord::TYPE, - &presence_store_key( - &service.incarnation()?, - &service.projection.expected.expected_signer_identity_id, - ), - )? - .unwrap(); - assert_eq!(stored.payload, sequence_two); - assert_eq!(parse_rfc3339_millis(&stored.stored_at)?, NOW); - Ok(()) - } - - /// Idunn relaunches at this time; the previous activation's presence was - /// received at `NOW`, beyond the skew window, as on yggdrasil 2026-09-29. - const RESTART: u64 = NOW + 10_000; - - fn stored_presence_payload(world: &TestWorld, service: &TestService) -> Result> { - let entries = SingleFileMessagePackBackingStore::new(&world.topology_path) - .pull_all_read_only_snapshot()?; - Ok(unique_envelope( - &entries, - GameCultRuntimePresenceHealthRecord::TYPE, - &presence_store_key( - &service.incarnation()?, - &service.projection.expected.expected_signer_identity_id, - ), - )? - .context("no stored presence")? - .payload - .clone()) - } - - #[test] - fn a_restarted_activation_counts_its_publisher_sequence_from_one() -> Result<()> { - let world = TestWorld::new()?; - let mut service = world.service("ghostlight", Vec::new(), false)?; - world.engine(NOW).admit_presence( - "ghostlight", - &service.signed_presence(5, |_| {})?, - NOW, - )?; - - world.restart_activation(&mut service, RESTART)?; - let restarted = service.signed_presence(1, |record| { - record.observed_at_unix_millis = RESTART + 10; - })?; - let record = decode_signed(&world.engine(RESTART + 20).admit_presence( - "ghostlight", - &restarted, - RESTART + 20, - )?)?; - assert!(record.present); - assert!(record.ready); - assert_eq!(stored_presence_payload(&world, &service)?, restarted); - Ok(()) - } - - #[test] - fn the_stored_presence_is_reauthenticated_at_its_own_received_time() -> Result<()> { - let world = TestWorld::new()?; - let service = world.service("ghostlight", Vec::new(), false)?; - let admitted = service.signed_presence(5, |_| {})?; - world - .engine(NOW) - .admit_presence("ghostlight", &admitted, NOW)?; - - // Forty seconds on, the stored presence is far outside the skew window - // of the incoming time, but it is the same activation's own count and - // must still be judged as of when Odin received it. - let later = NOW + 40_000; - let lower = service.signed_presence(4, |record| { - record.observed_at_unix_millis = later - 10; - })?; - let error = world - .engine(later) - .admit_presence("ghostlight", &lower, later) - .unwrap_err(); - assert!( - format!("{error:#}").contains("reordered"), - "refused for the wrong reason: {error:#}" - ); - assert_eq!(stored_presence_payload(&world, &service)?, admitted); - Ok(()) - } - - #[test] - fn a_stale_stored_presence_never_blocks_a_current_claim() -> Result<()> { - let world = TestWorld::new()?; - let mut service = world.service("ghostlight", Vec::new(), false)?; - world.engine(NOW).admit_presence( - "ghostlight", - &service.signed_presence(3, |_| {})?, - NOW, - )?; - - world.restart_activation(&mut service, RESTART)?; - let before = decode_signed( - &world - .engine(RESTART + 20) - .refresh(&service.incarnation()?)? - .unwrap(), - )?; - assert!(!before.present); - assert!( - before - .disagreements - .iter() - .any(|value| value.code == "stored-presence-not-current") - ); - - // The same sequence the stale presence carried is neither a reorder - // nor a reuse: it is another publisher's count. - let current = service.signed_presence(3, |record| { - record.observed_at_unix_millis = RESTART + 10; - })?; - let record = decode_signed(&world.engine(RESTART + 20).admit_presence( - "ghostlight", - ¤t, - RESTART + 20, - )?)?; - assert!(record.present); - assert!(record.ready); - assert_eq!(stored_presence_payload(&world, &service)?, current); - Ok(()) - } - - #[test] - fn a_claim_that_does_not_authenticate_under_the_current_activation_is_refused() -> Result<()> { - let world = TestWorld::new()?; - let mut service = world.service("ghostlight", Vec::new(), false)?; - let admitted = service.signed_presence(1, |_| {})?; - world - .engine(NOW) - .admit_presence("ghostlight", &admitted, NOW)?; - // Signed by the activation Idunn is about to replace, with a fresh - // observation time and a higher sequence than anything stored. - let superseded = service.signed_presence(9, |record| { - record.observed_at_unix_millis = RESTART + 10; - })?; - - world.restart_activation(&mut service, RESTART)?; - assert!( - world - .engine(RESTART + 20) - .admit_presence("ghostlight", &superseded, RESTART + 20) - .is_err() - ); - assert_eq!(stored_presence_payload(&world, &service)?, admitted); - Ok(()) - } - - fn is_refused(error: &anyhow::Error) -> bool { - error.downcast_ref::().is_some() - } - - /// A host whose clock has not reached the anchor's binding (booting before - /// time sync) is retried, not refused: the same claim lands once the clock - /// catches up. The anchor is bound at NOW - 100. - #[test] - fn a_clock_before_the_anchors_binding_is_retried_not_refused() -> Result<()> { - let world = TestWorld::new()?; - let service = world.service("ghostlight", Vec::new(), false)?; - let claim = service.signed_presence(1, |_| {})?; - let error = world - .engine(NOW - 200) - .admit_presence("ghostlight", &claim, NOW - 200) - .unwrap_err(); - assert!(!is_refused(&error), "{error:#}"); - world - .engine(NOW) - .admit_presence("ghostlight", &claim, NOW)?; - Ok(()) - } - - /// The clock exemption is only for the binding time. An anchor that has - /// expired, or one that also disagrees with Expected, is a refusal. - #[test] - fn only_a_clock_before_the_binding_is_exempt_from_refusal() -> Result<()> { - let world = TestWorld::new()?; - let mut service = world.service("ghostlight", Vec::new(), false)?; - let claim = service.signed_presence(1, |_| {})?; - - service.projection.provider_anchor.as_mut().unwrap().expires_at_unix_millis = - Some(NOW - 50); - world.publish_projection(&service.projection)?; - let error = world - .engine(NOW) - .admit_presence("ghostlight", &claim, NOW) - .unwrap_err(); - assert!(is_refused(&error), "expired: {error:#}"); - - service.projection.provider_anchor.as_mut().unwrap().expires_at_unix_millis = None; - service.projection.provider_anchor.as_mut().unwrap().runtime_id = "other-runtime".into(); - world.publish_projection(&service.projection)?; - let error = world - .engine(NOW - 200) - .admit_presence("ghostlight", &claim, NOW - 200) - .unwrap_err(); - assert!(is_refused(&error), "early and mismatched: {error:#}"); - Ok(()) - } - - /// The clock exemption belongs to a claim being admitted. A refresh has no - /// claim to refuse: with the clock before the binding it still writes the - /// incarnation's correlation, carrying the time disagreement, and neither - /// fails nor is refused. - #[test] - fn a_refresh_before_the_anchors_binding_records_the_time_disagreement() -> Result<()> { - let world = TestWorld::new()?; - let service = world.service("ghostlight", Vec::new(), false)?; - let signed = world - .engine(NOW - 200) - .refresh(&service.incarnation()?)? - .expect("Idunn projects the incarnation"); - let correlation = decode_signed(&signed)?; - assert!( - correlation - .disagreements - .iter() - .any(|disagreement| disagreement.code == PROVIDER_ANCHOR_TIME_CODE), - "{:?}", - correlation.disagreements - ); - assert!(!correlation.ready); - Ok(()) - } - - fn snapshot_with_stored_presence( - service: &TestService, - stored: AdmittedPresence, - ) -> Result { - Ok(OdinStoreSnapshot { - query: OdinStoreQuery { - incarnation: service.incarnation()?, - provider_signer_identity_id: service - .projection - .expected - .expected_signer_identity_id - .clone(), - dependencies: Vec::new(), - }, - presence: Some(stored), - correlation: None, - dependency_correlations: BTreeMap::new(), - }) - } - - /// A stored presence that names the current activation but no longer - /// authenticates at its own received time is an error, not "another - /// publisher": the claim must not slip past that publisher's sequence. - #[test] - fn a_same_activation_stored_presence_that_no_longer_authenticates_is_an_error() -> Result<()> { - let world = TestWorld::new()?; - let service = world.service("ghostlight", Vec::new(), false)?; - let later = NOW + 3_600_000; - let engine = world.engine(later); - let (authority, _) = - classify_runtime_authority(&service.projection, &world.idunn_anchor, later)?; - // Observed at NOW but received an hour later: outside the skew window - // at its own received time. - let stored = AdmittedPresence::new(service.signed_presence(5, |_| {})?, later)?; - let snapshot = snapshot_with_stored_presence(&service, stored)?; - let claim = service.signed_presence(6, |record| { - record.observed_at_unix_millis = later - 10; - })?; - - let error = engine - .select_presence(&snapshot, Some((&claim, later)), authority.as_ref()) - .err() - .context("a same-activation presence that fails authentication was ignored")?; - assert!( - format!("{error:#}").contains("no longer authenticates"), - "refused for the wrong reason: {error:#}" - ); - Ok(()) - } - - /// A stored presence that cannot be decoded names no activation, so it is - /// another publisher's and a fresh claim supersedes it. - #[test] - fn an_undecodable_stored_presence_is_another_publisher_and_is_superseded() -> Result<()> { - let world = TestWorld::new()?; - let service = world.service("ghostlight", Vec::new(), false)?; - let engine = world.engine(NOW); - let (authority, _) = - classify_runtime_authority(&service.projection, &world.idunn_anchor, NOW)?; - let stored = AdmittedPresence::new(vec![0xc1], NOW)?; - let snapshot = snapshot_with_stored_presence(&service, stored)?; - let claim = service.signed_presence(1, |_| {})?; - - let selected = - engine.select_presence(&snapshot, Some((&claim, NOW)), authority.as_ref())?; - assert!(matches!( - selected, - SelectedPresence::Current { - replacement: Some(_), - .. - } - )); - Ok(()) - } - - #[test] - fn a_refresh_that_observes_nothing_new_does_not_burn_a_publisher_sequence() -> Result<()> { - let world = TestWorld::new()?; - let service = world.service("ghostlight", Vec::new(), false)?; - let engine = world.engine(NOW); - - let first = decode_signed(&engine.admit_presence( - "ghostlight", - &service.signed_presence(1, |_| {})?, - NOW, - )?)?; - assert_eq!(first.publisher_sequence, 1); - - // Odin refreshes on a timer. Reserving before the dedupe made every - // idle tick advance the mark and fsync the store, so the sequence Idunn - // sees would jump by however long Odin had been idle rather than by the - // number of observations that actually changed. - for _ in 0..3 { - let idle = decode_signed(&engine.refresh(&service.incarnation()?)?.unwrap())?; - assert_eq!(idle.publisher_sequence, 1); - } - - let second = decode_signed(&engine.admit_presence( - "ghostlight", - &service.signed_presence(2, |_| {})?, - NOW + 1, - )?)?; - assert_eq!(second.publisher_sequence, 2); - Ok(()) - } - - #[test] - fn restart_rehydrates_exact_bytes_without_retimestamping() -> Result<()> { - let world = TestWorld::new()?; - let service = world.service("ghostlight", Vec::new(), false)?; - let presence = service.signed_presence(1, |_| {})?; - let first = world - .engine(NOW) - .admit_presence("ghostlight", &presence, NOW)?; - - let after_restart = world - .engine(NOW + 100) - .refresh(&service.incarnation()?)? - .unwrap(); - assert_eq!(after_restart, first); - assert_eq!(decode_signed(&after_restart)?.observed_at_unix_millis, NOW); - Ok(()) - } - - #[test] - fn withdrawn_expected_removes_current_correlation_but_preserves_presence_history() -> Result<()> - { - let world = TestWorld::new()?; - let service = world.service("ghostlight", Vec::new(), false)?; - let presence = service.signed_presence(1, |_| {})?; - let engine = world.engine(NOW); - engine.admit_presence("ghostlight", &presence, NOW)?; - assert!( - engine - .current_signed_correlation(&service.incarnation()?)? - .is_some() - ); - - std::fs::remove_file(&world.projection_path)?; - assert!( - engine - .current_signed_correlation(&service.incarnation()?)? - .is_none() - ); - - let entries = SingleFileMessagePackBackingStore::new(&world.topology_path) - .pull_all_read_only_snapshot()?; - assert!(entries.iter().any(|entry| { - entry.r#type == GameCultRuntimePresenceHealthRecord::TYPE && entry.payload == presence - })); - assert!(!entries.iter().any(|entry| { - entry.r#type == OdinRuntimeTopologyCorrelationRecord::TYPE - && entry.key.starts_with("ghostlight@") - })); - Ok(()) - } - - #[test] - fn dependencies_consume_only_exact_current_admitted_correlations() -> Result<()> { - let world = TestWorld::new()?; - let mut provider = world.service("provider", Vec::new(), false)?; - let provider_expected_sha256 = provider.projection.expected.canonical_sha256()?; - let provider_endpoint = provider - .projection - .expected - .route - .as_ref() - .unwrap() - .stable_endpoint - .clone(); - let requirement = IdunnExpectedDependency { - kind: "required".into(), - capability: "data".into(), - schema: "data.v1".into(), - compatibility: "v1".into(), - minimum_capacity: 1, - startup: "before-promotion".into(), - provider_id: Some("provider".into()), - provider_authority: Some("managed-incarnation".into()), - provider_expected_projection_sha256: Some(provider_expected_sha256), - provider_endpoint: Some(provider_endpoint), - }; - let consumer = world.service("consumer", vec![requirement], false)?; - let provider_presence = provider.signed_presence(1, |_| {})?; - let consumer_presence = consumer.signed_presence(1, |_| {})?; - let engine = world.engine(NOW); - - engine.admit_presence("provider", &provider_presence, NOW)?; - let ready = decode_signed(&engine.admit_presence("consumer", &consumer_presence, NOW)?)?; - assert!(ready.ready); - assert!(ready.dependencies[0].ready); - assert!(ready.dependencies[0].provider_evidence_sha256.is_some()); - - world.replace_provider_generation(&mut provider)?; - let no_longer_exact = decode_signed(&engine.refresh(&consumer.incarnation()?)?.unwrap())?; - assert!(no_longer_exact.present); - assert!(!no_longer_exact.ready); - assert!(!no_longer_exact.dependencies[0].ready); - assert!( - no_longer_exact.dependencies[0] - .provider_evidence_sha256 - .is_none() - ); - Ok(()) - } - - #[test] - fn only_managed_dependencies_without_evidence_block_readiness() { - assert!(!dependency_permits_ready("required", false)); - assert!(!dependency_permits_ready("shared-infrastructure", false)); - assert!(!dependency_permits_ready("private", false)); - assert!(dependency_permits_ready("required", true)); - assert!(dependency_permits_ready("optional", false)); - assert!(dependency_permits_ready("external-operator-binding", false)); - } -} diff --git a/crates/odin-daemon/src/main.rs b/crates/odin-daemon/src/main.rs deleted file mode 100644 index d7d5c39..0000000 --- a/crates/odin-daemon/src/main.rs +++ /dev/null @@ -1,2915 +0,0 @@ -use std::cell::RefCell; -use std::collections::{BTreeMap, BTreeSet, VecDeque}; -use std::fs::{File, OpenOptions}; -use std::net::{SocketAddr, UdpSocket}; -use std::os::fd::{FromRawFd, RawFd}; -use std::path::{Path, PathBuf}; -use std::rc::Rc; -use std::sync::Arc; -use std::sync::atomic::{AtomicBool, Ordering}; -use std::thread; -use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH}; - -use anyhow::{Context, Result, bail, ensure}; -use chrono::{DateTime, Utc}; -use cultcache_rs::{ - CultCacheEnvelope, CultCacheExpectedEnvelope, DatabaseEntry, SingleFileMessagePackBackingStore, -}; -use cultmesh_rs::{ - CultMeshRudpDocumentServer, CultMeshRudpDocumentServerOptions, CultMeshRudpPollOutcome, - CultMeshRudpRawDocumentReceipt, CultMeshRudpRawDocumentSink, CultMeshRudpSnapshotQuery, - CultMeshRudpSnapshotSource, CultMeshSystemClock, -}; -use cultnet_rs::{ - CultNetRawDocumentRecord, CultNetRawPayloadEncoding, GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA, - GameCultProviderHealthIdentity, GameCultRuntimeCapability, - GameCultRuntimePresenceHealthPurpose, GameCultRuntimePresenceHealthRecord, - IDUNN_EXPECTED_INCARNATION_SCHEMA, IDUNN_PROCESS_WRITE_LEASE_SCHEMA, - IDUNN_RUNTIME_ACTIVATION_CREDENTIAL_NAME, IDUNN_RUNTIME_ACTIVATION_SCHEMA, - IdunnExpectedIncarnationRecord, IdunnProcessWriteLeaseRecord, IdunnRuntimeActivationRecord, - IdunnRuntimeActivationSigner, IdunnServiceIdentity, - OdinRuntimeTopologyCorrelationRecord, OdinTopologyIdentity, ServiceIdentityProfile, - ServiceIdentitySigner, ServiceIdentityTrustAnchor, derive_service_identity_id, - open_service_identity_credential_reader, verify_runtime_authority, -}; -use fs2::FileExt; -use odin_daemon::{ - AuthenticationPolicy, CultCacheIdunnProjectionSource, CultCacheOdinTopologyStore, - IdunnProjectionSource, IncarnationRef, OdinTopologyAuthority, PresenceAuthorityRefused, - ProjectionUnreadable, SystemClock, -}; - -const TARGET: &str = "odin"; -const HEALTH_CONTRACT: &str = "odin.runtime-health.v1"; -const RENDEZVOUS_CAPABILITY: &str = "odin.verse-rendezvous"; -const RENDEZVOUS_SCHEMA: &str = "odin.verse-topology.v1"; -const RENDEZVOUS_COMPATIBILITY: &str = "v1"; -const STATE_SCHEMA_GENERATION: &str = "odin-v2"; -// rmp-serde SHA-256 of deployment/idunn/recipe.toml's exact [state] value. -const STATE_CONTRACT_SHA256: &str = - "sha256-4f2f2dcd931d16f6b02bf295f41227b867aa982765661d55fa9f29fb2db7e449"; - -const RUNTIME_BUNDLE_ENVIRONMENT: &str = "GAMECULT_IDUNN_RUNTIME_BUNDLE"; -const CANDIDATE_BIND_ENVIRONMENT: &str = "GAMECULT_IDUNN_CANDIDATE_BIND"; -const PROCESS_WRITE_LEASE_ENVIRONMENT: &str = "GAMECULT_IDUNN_PROCESS_WRITE_LEASE"; -const TOPOLOGY_IDENTITY_ENVIRONMENT: &str = "ODIN_TOPOLOGY_IDENTITY"; -const SYSTEMD_LISTEN_PID_ENVIRONMENT: &str = "LISTEN_PID"; -const SYSTEMD_LISTEN_FDS_ENVIRONMENT: &str = "LISTEN_FDS"; -const SYSTEMD_LISTEN_FDNAMES_ENVIRONMENT: &str = "LISTEN_FDNAMES"; -const ACTIVATION_SIGNER_FD_NAME: &str = IDUNN_RUNTIME_ACTIVATION_CREDENTIAL_NAME; -const PROVIDER_SIGNER_FD_NAME: &str = "gamecult-runtime-presence-identity"; -const SYSTEMD_LISTEN_FDS_START: RawFd = 3; - -// Long enough for Idunn to warm, fence the incumbent, and grant the lease. A -// candidate that never hears back is cleaned up by Idunn's own abort; this -// only bounds how long it sits idle first. -const BOOTSTRAP_LEASE_TIMEOUT: Duration = Duration::from_secs(300); -// How long the UDP socket may fail every poll before that is a dead socket -// rather than a hiccup. Odin then ends and Idunn restarts it. -const POLL_FAILURE_LIMIT: Duration = Duration::from_secs(30); -const POLL_FAILURE_BACKOFF: Duration = Duration::from_millis(100); -const HEARTBEAT_INTERVAL: Duration = Duration::from_secs(5); -const PROJECTION_REFRESH_INTERVAL: Duration = Duration::from_millis(250); -const IDLE_POLL_INTERVAL: Duration = Duration::from_millis(2); -const MAX_RECENT_WARMING_PROOFS: usize = 64; -const WARMING_PROOF_LIFETIME_MILLIS: u64 = 60_000; -const CAS_ATTEMPTS: usize = 8; - -type TopologyAuthority = OdinTopologyAuthority< - CultCacheIdunnProjectionSource, - CultCacheOdinTopologyStore, - ServiceIdentitySigner, - SystemClock, ->; - -/// Relative path of Odin's durable store inside the state root. The recipe's -/// `topology` state slot in `deployment/idunn/recipe.toml` is the authority for -/// this name; Idunn owns where the root itself lives and hardens it, so the -/// daemon is told the root and never the file. -const TOPOLOGY_SLOT: &str = "topology.cc"; - -#[derive(Clone, Debug)] -struct Options { - store: PathBuf, - idunn_projection: PathBuf, - idunn_anchor: PathBuf, -} - -struct RuntimeAuthority { - expected: IdunnExpectedIncarnationRecord, - expected_sha256: String, - activation: IdunnRuntimeActivationRecord, - activation_sha256: String, - activation_signer: IdunnRuntimeActivationSigner, - provider_signer: ServiceIdentitySigner, -} - -struct ProcessWriteLeaseGuard { - _lock: File, - record: IdunnProcessWriteLeaseRecord, - sha256: String, -} - -struct RuntimeState { - options: Options, - candidate: SocketAddr, - authority_material: RuntimeAuthority, - idunn_anchor: Option, - topology_signer: Option>, - topology: Option, - write_lease: Option, - write_lease_path: PathBuf, - recent_warming_proofs: VecDeque<(String, u64)>, - publisher_sequence: u64, - log_gate: RefCell, -} - -#[derive(Clone)] -struct SinkHandle(Rc>); - -#[derive(Clone)] -struct SnapshotHandle(Rc>); - -impl CultMeshRudpRawDocumentSink for SinkHandle { - fn accept_raw_document(&mut self, receipt: CultMeshRudpRawDocumentReceipt) -> Result<()> { - self.0.borrow_mut().accept_raw_document(receipt) - } -} - -impl CultMeshRudpSnapshotSource for SnapshotHandle { - fn raw_snapshot( - &mut self, - query: &CultMeshRudpSnapshotQuery, - ) -> Result> { - self.0.borrow_mut().raw_snapshot(query) - } -} - -impl RuntimeState { - fn open(options: Options, candidate: SocketAddr) -> Result { - let authority_material = load_runtime_authority(Path::new(&required_environment( - RUNTIME_BUNDLE_ENVIRONMENT, - )?))?; - require_expected_contract(&authority_material.expected, candidate)?; - - let idunn_anchor = read_trust_anchor::(&options.idunn_anchor)?; - let projection_source = CultCacheIdunnProjectionSource::new(&options.idunn_projection); - // This process is one exact incarnation, named by the Expected digest - // in its immutable runtime bundle. The projection may carry other - // incarnations of `odin` at the same time -- the one being replaced, - // or the candidate replacing this one -- and none of them is this - // process's business here. Only its own incarnation is looked up. - // - // The projected activation is deliberately not compared. Idunn - // publishes an activation only after it has observed the process that - // owns it, so at this moment the projection has none for this launch - // yet. The bundle's own activation is verified against the Idunn anchor - // below, and the write lease -- the thing that actually authorises - // writing state -- is checked against the live projection before Odin - // writes anything. - let projection = projection_source - .projection(&self_incarnation(&authority_material))? - .context("Idunn projection has no Expected for this Odin incarnation")?; - let provider_anchor = projection - .provider_anchor - .as_ref() - .context("Idunn projection has no Odin runtime-presence trust anchor")?; - ensure!( - provider_anchor.signer_identity_id - == authority_material.provider_signer.entry().identity_id - && provider_anchor.signer_public_key - == authority_material.provider_signer.entry().public_key, - "Odin provider signer differs from Idunn's projected trust anchor" - ); - verify_runtime_authority( - &authority_material.expected, - &authority_material.activation, - &idunn_anchor, - &provider_anchor.signer_public_key, - )?; - - let topology_identity_path = - PathBuf::from(required_environment(TOPOLOGY_IDENTITY_ENVIRONMENT)?); - let topology_signer = open_service_identity_credential_reader::( - File::open(&topology_identity_path).with_context(|| { - format!( - "opening Odin topology identity credential {}", - topology_identity_path.display() - ) - })?, - )?; - let store_sequence = prior_self_publisher_sequence( - &options.store, - authority_material - .provider_signer - .entry() - .identity_id - .as_str(), - )?; - - Ok(Self { - options, - candidate, - authority_material, - idunn_anchor: Some(idunn_anchor), - topology_signer: Some(topology_signer), - topology: None, - write_lease: None, - write_lease_path: PathBuf::from(required_environment(PROCESS_WRITE_LEASE_ENVIRONMENT)?), - recent_warming_proofs: VecDeque::new(), - publisher_sequence: store_sequence, - log_gate: RefCell::default(), - }) - } - - fn activated(&self) -> bool { - self.topology.is_some() && self.write_lease.is_some() - } - - fn try_activate(&mut self) -> Result { - if self.activated() { - return Ok(true); - } - let Some(lease) = acquire_process_write_lease( - &self.write_lease_path, - &self.authority_material, - &self.recent_warming_proofs, - )? - else { - return Ok(false); - }; - let Some(projected) = CultCacheIdunnProjectionSource::new(&self.options.idunn_projection) - .projection(&self_incarnation(&self.authority_material))? - else { - return Ok(false); - }; - if projected.current_lease.as_ref() != Some(&lease.record) { - return Ok(false); - } - let signer = self - .topology_signer - .take() - .context("Odin topology signer was already consumed")?; - let idunn_anchor = self - .idunn_anchor - .take() - .context("Idunn trust anchor was already consumed")?; - self.write_lease = Some(lease); - self.topology = Some(OdinTopologyAuthority::new( - CultCacheIdunnProjectionSource::new(&self.options.idunn_projection), - CultCacheOdinTopologyStore::new(&self.options.store), - signer, - SystemClock, - idunn_anchor, - AuthenticationPolicy::default(), - )); - Ok(true) - } - - fn accept_raw_document(&mut self, receipt: CultMeshRudpRawDocumentReceipt) -> Result<()> { - ensure!( - self.activated(), - "Odin does not admit or persist provider documents before its process-write lease" - ); - validate_raw_document_shape(&receipt.document)?; - if receipt.document.schema_id == GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA { - return self - .admit_presence_document(&receipt.document, receipt.received_at_unix_millis); - } - persist_generic_document(&self.options.store, &receipt.document) - } - - /// The one admission path for a runtime-presence document, whether a - /// provider delivered it over RUDP or Odin signed it for itself. - fn admit_presence_document( - &self, - document: &CultNetRawDocumentRecord, - received_at_unix_millis: u64, - ) -> Result<()> { - let presence = decode_presence(&document.payload)?; - ensure!( - document.record_key == presence.target, - "runtime-presence document key differs from its signed target" - ); - self.topology - .as_ref() - .context("Odin topology authority is absent")? - .admit_presence(&presence.target, &document.payload, received_at_unix_millis)?; - Ok(()) - } - - fn raw_snapshot( - &mut self, - query: &CultMeshRudpSnapshotQuery, - ) -> Result> { - validate_snapshot_filters(query)?; - if exact_self_presence_query(query) { - let (state, detail) = if self.activated() { - self.require_current_write_lease()?; - ("active", format!("route-observation:{}", query.message_id)) - } else { - ("warming", format!("idunn-warming:{}", query.message_id)) - }; - return Ok(vec![self.signed_presence_document(state, &detail)?]); - } - ensure!( - self.activated(), - "Odin catalog is unavailable until Idunn grants its process-write lease" - ); - self.require_current_write_lease()?; - self.stored_snapshot(query) - } - - fn signed_presence_document( - &mut self, - state: &str, - detail: &str, - ) -> Result { - let now = unix_millis()?; - self.publisher_sequence = self - .publisher_sequence - .checked_add(1) - .context("Odin runtime-presence publisher sequence exhausted")?; - let expected = &self.authority_material.expected; - let activation = &self.authority_material.activation; - let source_runtime_id = expected.runtime_id.clone(); - let mut record = GameCultRuntimePresenceHealthRecord { - schema_version: GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA.into(), - target: expected.target.clone(), - expected_projection_sha256: self.authority_material.expected_sha256.clone(), - plan_id: expected.plan_id.clone(), - incarnation_id: expected.incarnation_id.clone(), - sealed_release_id: expected.sealed_release_id.clone(), - activation_witness_sha256: self.authority_material.activation_sha256.clone(), - state_schema_generation: expected.state_schema_generation.clone(), - state_contract_sha256: expected.state_contract_sha256.clone(), - runtime_id: expected.runtime_id.clone(), - runtime_instance_id: activation.runtime_instance_id.clone(), - bound_endpoint: Some(format!("rudp://{}", self.candidate)), - capabilities: expected - .capabilities - .iter() - .map(|capability| GameCultRuntimeCapability { - capability: capability.capability.clone(), - schema: capability.schema.clone(), - compatibility: capability.compatibility.clone(), - capacity: capability.minimum_capacity, - }) - .collect(), - health_contract: expected.health_contract.clone(), - state: state.into(), - detail: detail.into(), - write_lease_sha256: self.write_lease.as_ref().map(|lease| lease.sha256.clone()), - signer_identity_id: self - .authority_material - .provider_signer - .entry() - .identity_id - .clone(), - publisher_sequence: self.publisher_sequence, - observed_at_unix_millis: now, - signature_algorithm: "ed25519".into(), - signature: Vec::new(), - activation_signer_identity_id: activation.activation_signer_identity_id.clone(), - activation_signature: Vec::new(), - }; - ensure!( - (state == "warming" && record.write_lease_sha256.is_none()) - || (state == "active" && record.write_lease_sha256.is_some()), - "Odin presence state does not match its process-write authority" - ); - let proof_payload = record.canonical_proof_payload()?; - record.signature = self - .authority_material - .provider_signer - .sign::(&proof_payload) - .signature; - record.activation_signature = self - .authority_material - .activation_signer - .sign_presence_proof(&record)?; - record.validate()?; - let payload = rmp_serde::to_vec(&record)?; - ensure!( - rmp_serde::from_slice::(&payload)? == record, - "Odin runtime presence is not canonical MessagePack" - ); - if state == "warming" { - remember_recent_warming_proof( - &mut self.recent_warming_proofs, - record.canonical_sha256()?, - now, - ); - } - Ok(CultNetRawDocumentRecord { - schema_id: GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA.into(), - record_key: TARGET.into(), - stored_at: rfc3339_millis(now)?, - payload_encoding: CultNetRawPayloadEncoding::Messagepack, - payload, - source_runtime_id: Some(source_runtime_id), - source_agent_id: Some(record.signer_identity_id), - source_role: Some("runtime-presence-health-publisher".into()), - tags: Some(vec!["cultnet.transport.rudp.v0".into()]), - }) - } - - /// Odin is the store, so its own heartbeat is admitted into the store - /// directly. It never crosses RUDP to itself, and so never takes one of the - /// server's bounded session slots from the providers it serves: a table - /// full of lingering publisher sessions cannot make Odin miss its own - /// liveness. - fn publish_self_presence(&mut self, detail: &str) -> Result<()> { - self.require_current_write_lease()?; - self.require_own_projection()?; - let document = self.signed_presence_document("active", detail)?; - self.admit_presence_document(&document, unix_millis()?) - } - - /// Idunn's projection of this process's own incarnation. A failure to - /// establish it that is not a failed file read -- undecodable, ambiguous, - /// substituted, or with no Expected for this incarnation -- is a failure of - /// Odin's own authority, so it is marked for the temporary fatal rule in - /// `survive`. A failed file read is not (see `own_projection_failure`), nor - /// are failures about other incarnations: they are read, logged and skipped - /// where they are met. - fn require_own_projection(&self) -> Result<()> { - let path = &self.options.idunn_projection; - match CultCacheIdunnProjectionSource::new(path) - .projection(&self_incarnation(&self.authority_material)) - { - Err(error) => Err(own_projection_failure(error)), - // No file is an I/O condition (Idunn replaces it atomically, so it - // is briefly or wrongly unreadable), not a projection that - // disowns Odin. - Ok(None) if !path.is_file() => Err(anyhow::Error::new(std::io::Error::from( - std::io::ErrorKind::NotFound, - )) - .context(format!("Idunn's projection {} is absent", path.display()))), - Ok(None) => Err(PresenceAuthorityRefused( - "Idunn projects no Expected for Odin's own incarnation", - ) - .into()), - Ok(Some(_)) => Ok(()), - } - } - - fn require_current_write_lease(&self) -> Result<()> { - let held = self - .write_lease - .as_ref() - .context("Odin has no process-write lease")?; - // A lease Odin cannot read is a lease Odin cannot show it still holds. - let current = read_process_write_lease(&self.write_lease_path) - .map_err(|error| { - WriteLeaseLost(format!("Odin process-write lease is unreadable: {error:#}")) - })? - .ok_or_else(|| WriteLeaseLost("Odin process-write lease was withdrawn".into()))?; - if current != held.record || current.canonical_sha256()? != held.sha256 { - return Err( - WriteLeaseLost("Odin process-write lease changed after admission".into()).into(), - ); - } - Ok(()) - } - - fn refresh_all_correlations(&mut self) -> Result<()> { - self.require_current_write_lease()?; - let topology = self - .topology - .as_ref() - .context("Odin topology authority is absent")?; - let mut incarnations = incarnation_keys( - &self.options.idunn_projection, - IdunnExpectedIncarnationRecord::TYPE, - )?; - incarnations.extend(incarnation_keys( - &self.options.store, - OdinRuntimeTopologyCorrelationRecord::TYPE, - )?); - // Each incarnation is refreshed on its own: one whose records cannot be - // read is that incarnation's failure, and never stops the others. - for incarnation in incarnations { - if let Err(error) = topology.refresh(&incarnation) { - self.log_repeating( - &format!("refresh of incarnation {}", incarnation.key()), - format!("failed; the rest are unaffected: {error:#}"), - ); - } - } - Ok(()) - } - - /// The catalog serves what is stored, one record at a time: a record that - /// does not decode, or whose projection cannot be read, is skipped and - /// logged, and is never a reason to refuse every other record. Odin's - /// correlations are not part of the catalog: Idunn reads them from the - /// store file, and a target has one per incarnation, so keying them by - /// target would collide for the whole deploy window. - fn stored_snapshot( - &self, - query: &CultMeshRudpSnapshotQuery, - ) -> Result> { - let entries = if self.options.store.is_file() { - SingleFileMessagePackBackingStore::new(&self.options.store) - .pull_all_read_only_snapshot()? - } else { - Vec::new() - }; - let projections = CultCacheIdunnProjectionSource::new(&self.options.idunn_projection); - let mut selected = BTreeMap::new(); - for envelope in &entries { - let document = match self.public_document(&projections, envelope) { - Ok(Some(document)) => document, - Ok(None) => continue, - Err(error) => { - self.log_repeating( - &format!("catalog skips {} {}", envelope.r#type, envelope.key), - format!("{error:#}"), - ); - continue; - } - }; - if !query_allows(query, &document) { - continue; - } - let identity = (document.schema_id.clone(), document.record_key.clone()); - ensure!( - selected.insert(identity, document).is_none(), - "Odin catalog contains duplicate public document identities" - ); - } - Ok(selected.into_values().collect()) - } - - /// One stored record as the Verse sees it; `None` when it is not public. - fn public_document( - &self, - projections: &CultCacheIdunnProjectionSource, - envelope: &CultCacheEnvelope, - ) -> Result> { - let Some(schema_id) = envelope.schema_id.clone() else { - return Ok(None); - }; - if envelope.r#type != GameCultRuntimePresenceHealthRecord::TYPE { - return Ok(is_peer_document_type(&envelope.r#type).then(|| { - CultNetRawDocumentRecord { - schema_id, - record_key: envelope.key.clone(), - stored_at: envelope.stored_at.clone(), - payload_encoding: CultNetRawPayloadEncoding::Messagepack, - payload: envelope.payload.clone(), - source_runtime_id: None, - source_agent_id: None, - source_role: None, - tags: None, - } - })); - } - let presence = decode_presence(&envelope.payload)?; - let Some(projection) = projections.projection(&IncarnationRef::new( - presence.target.clone(), - presence.expected_projection_sha256.clone(), - ))? - else { - return Ok(None); - }; - if projection.expected.expected_signer_identity_id != presence.signer_identity_id - || projection - .activation - .as_ref() - .map(IdunnRuntimeActivationRecord::canonical_sha256) - .transpose()? - .as_deref() - != Some(presence.activation_witness_sha256.as_str()) - || projection - .activation - .as_ref() - .map(|activation| activation.runtime_instance_id.as_str()) - != Some(presence.runtime_instance_id.as_str()) - { - return Ok(None); - } - Ok(Some(CultNetRawDocumentRecord { - schema_id, - record_key: presence.target.clone(), - stored_at: envelope.stored_at.clone(), - payload_encoding: CultNetRawPayloadEncoding::Messagepack, - payload: envelope.payload.clone(), - source_runtime_id: Some(presence.runtime_id), - source_agent_id: Some(presence.signer_identity_id), - source_role: Some("runtime-presence-health-publisher".into()), - tags: Some(vec!["odin-observed".into()]), - })) - } - - /// Log a line that a persistent fault would otherwise repeat on every pass: - /// once per subject per minute, or as soon as its message changes. - fn log_repeating(&self, subject: &str, message: String) { - if let Some(repeats) = self - .log_gate - .borrow_mut() - .admit(subject, &message, Instant::now()) - { - if repeats == 0 { - eprintln!("Odin {subject}: {message}"); - } else { - eprintln!("Odin {subject}: {message} ({repeats} repeats suppressed)"); - } - } - } -} - -/// A failure to read Odin's own projection. Only a failure of the file read -/// itself (marked `ProjectionUnreadable` where the file is read: permission -/// denied, not found, interrupted) says nothing about what Idunn published and -/// is retried. Anything the reader decoded or validated and did not accept is a -/// failure of Odin's own authority, marked for the fatal rule in `survive`, -/// whatever error it wraps. -fn own_projection_failure(error: anyhow::Error) -> anyhow::Error { - if error.downcast_ref::().is_some() { - return error; - } - error.context(PresenceAuthorityRefused( - "Odin's own projected authority cannot be read", - )) -} - -/// Once-per-interval admission for repeating log lines, keyed by subject. -#[derive(Default)] -struct LogGate { - seen: BTreeMap, - suppressed_total: u64, -} - -struct LoggedLine { - at: Instant, - message: String, - suppressed: u64, -} - -const REPEATED_LOG_INTERVAL: Duration = Duration::from_secs(60); -const MAX_LOG_SUBJECTS: usize = 1024; - -impl LogGate { - /// `Some(repeats suppressed since the last line)` when the line is to be - /// written, `None` when it repeats one written less than the interval ago. - fn admit(&mut self, subject: &str, message: &str, now: Instant) -> Option { - if let Some(line) = self.seen.get_mut(subject) - && line.message == message - && now.saturating_duration_since(line.at) < REPEATED_LOG_INTERVAL - { - line.suppressed += 1; - self.suppressed_total += 1; - return None; - } - let repeats = self.seen.remove(subject).map_or(0, |line| line.suppressed); - if self.seen.len() >= MAX_LOG_SUBJECTS { - self.seen - .retain(|_, line| now.saturating_duration_since(line.at) < REPEATED_LOG_INTERVAL); - if self.seen.len() >= MAX_LOG_SUBJECTS { - self.seen.clear(); - } - } - self.seen.insert( - subject.to_owned(), - LoggedLine { - at: now, - message: message.to_owned(), - suppressed: 0, - }, - ); - Some(repeats) - } -} - -fn main() -> Result<()> { - let options = parse_options(std::env::args().skip(1))?; - let candidate: SocketAddr = required_environment(CANDIDATE_BIND_ENVIRONMENT)? - .parse() - .context("parsing Idunn candidate bind")?; - ensure!( - candidate.ip().is_loopback() && candidate.port() != 0, - "Odin candidate bind must be one fixed loopback socket" - ); - let socket = UdpSocket::bind(candidate) - .with_context(|| format!("binding Odin CultNet RUDP candidate {candidate}"))?; - let state = Rc::new(RefCell::new(RuntimeState::open(options, candidate)?)); - let mut server = CultMeshRudpDocumentServer::new( - socket, - SinkHandle(state.clone()), - SnapshotHandle(state.clone()), - CultMeshSystemClock::default(), - CultMeshRudpDocumentServerOptions::default(), - )?; - - // Idunn runs this process as PID 1 of its own PID namespace, and a - // namespace init ignores every signal it has not caught. Without this, - // a stop is a ninety-second wait for SIGKILL, which is what fencing the - // incumbent during a deployment costs its candidate. - let stopping = Arc::new(AtomicBool::new(false)); - for signal in [signal_hook::consts::SIGTERM, signal_hook::consts::SIGINT] { - signal_hook::flag::register(signal, Arc::clone(&stopping)) - .context("registering Odin's stop signal handler")?; - } - - let bootstrap_started = Instant::now(); - let mut poll_failing_since = None; - while !state.borrow_mut().try_activate()? { - if stopping.load(Ordering::Relaxed) { - eprintln!("Odin stopping before activation on request"); - return Ok(()); - } - let progressed = poll_server(&mut server, &mut poll_failing_since)?; - ensure!( - bootstrap_started.elapsed() < BOOTSTRAP_LEASE_TIMEOUT, - "timed out waiting for Idunn to admit Odin's exact Warming proof and grant its lease" - ); - if !progressed { - thread::sleep(IDLE_POLL_INTERVAL); - } - } - - // Correlations the previous, target-keyed Odin left in this store are not - // this contract's and would otherwise be served to the Verse as current. - // Presence history is kept: the self publisher sequence continues from it. - CultCacheOdinTopologyStore::new(&state.borrow().options.store).retire_legacy_correlations()?; - // Once serving, only losing the write lease ends Odin (see `survive`). - let mut timers = ServingTimers::default(); - loop { - if stopping.load(Ordering::Relaxed) { - eprintln!("Odin stopping on request"); - return Ok(()); - } - if !serving_pass(&state, &mut server, &mut timers)? { - thread::sleep(IDLE_POLL_INTERVAL); - } - } -} - -/// A timer that has never fired is due, so the first pass refreshes and -/// publishes. -#[derive(Default)] -struct ServingTimers { - last_heartbeat: Option, - last_projection_refresh: Option, - poll_failing_since: Option, -} - -type OdinServer = CultMeshRudpDocumentServer; - -/// One turn of the serving loop: serve a datagram, refresh the topology, and -/// publish Odin's own presence when each is due. Returns whether the poll made -/// progress. It fails only for `WriteLeaseLost` or a dead socket. -fn serving_pass( - state: &Rc>, - server: &mut OdinServer, - timers: &mut ServingTimers, -) -> Result { - let progressed = poll_server(server, &mut timers.poll_failing_since)?; - if is_due(timers.last_projection_refresh, PROJECTION_REFRESH_INTERVAL) { - let refreshed = state.borrow_mut().refresh_all_correlations(); - survive(&state.borrow(), "projection refresh", refreshed)?; - timers.last_projection_refresh = Some(Instant::now()); - } - if is_due(timers.last_heartbeat, HEARTBEAT_INTERVAL) { - let published = state.borrow_mut().publish_self_presence("ready"); - survive(&state.borrow(), "self-presence publication", published)?; - timers.last_heartbeat = Some(Instant::now()); - } - Ok(progressed) -} - -fn is_due(last: Option, interval: Duration) -> bool { - last.is_none_or(|last| last.elapsed() >= interval) -} - -/// Odin held its process-write lease and no longer does: another incarnation -/// has been granted the state, or Idunn withdrew the grant. Serving on would be -/// a second writer, so this is the one serving-loop condition that ends Odin. -#[derive(Debug)] -struct WriteLeaseLost(String); - -impl std::fmt::Display for WriteLeaseLost { - fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { - formatter.write_str(&self.0) - } -} - -impl std::error::Error for WriteLeaseLost {} - -/// The serving loop's failure policy. Odin's liveness is Odin's own: a failed -/// refresh, publication or read is logged and retried on the next pass, never -/// allowed to end the daemon. Only `WriteLeaseLost`, wherever in the error chain -/// it sits, is returned -- and, as a named temporary rule, so is -/// `PresenceAuthorityRefused`: a failure to establish Odin's OWN authority -/// (`require_own_projection`), or a self-presence that authority will never -/// admit (no verifiable authority, a signer that does not match the anchor, a -/// stored presence of this activation that no longer authenticates) -/// leaves a frozen presence that goes stale, and a stale Odin presence makes -/// `dependency_evidence` flip every dependent to not-Ready. Ending Odin lets -/// Idunn replace it. A host clock that has not yet reached the anchor's binding -/// is not such a failure (`reconcile`): it is retried. Deleted when Idunn -/// proves Odin by its own route challenge -/// (Idunn audit cut A3, operator question Q-O5). -fn survive(state: &RuntimeState, what: &str, result: Result) -> Result> { - match result { - Ok(value) => Ok(Some(value)), - Err(error) - if error.downcast_ref::().is_some() - || error.downcast_ref::().is_some() => - { - Err(error) - } - Err(error) => { - state.log_repeating(what, format!("failed; retrying on the next pass: {error:#}")); - Ok(None) - } - } -} - -fn poll_server(server: &mut OdinServer, failing_since: &mut Option) -> Result { - settle_poll(server.poll_once(), failing_since, Instant::now()) -} - -/// A failed poll is logged and retried. The socket failing every poll for -/// `POLL_FAILURE_LIMIT` is a dead socket, not a transient one; only then does -/// Odin end, so Idunn restarts it. Any successful poll clears the failure run. -fn settle_poll( - result: Result, - failing_since: &mut Option, - now: Instant, -) -> Result { - match result { - Ok(outcome) => { - *failing_since = None; - Ok(progress_of(outcome)) - } - Err(error) => { - let since = *failing_since.get_or_insert(now); - ensure!( - now.duration_since(since) < POLL_FAILURE_LIMIT, - "Odin's RUDP socket has failed every poll for {POLL_FAILURE_LIMIT:?}: {error:#}" - ); - eprintln!("Odin RUDP poll failed; retrying: {error:#}"); - thread::sleep(POLL_FAILURE_BACKOFF); - Ok(false) - } - } -} - -/// An application rejection ends only the offending peer's session, which the -/// server has already done. It is logged and never ends Odin. -fn progress_of(outcome: CultMeshRudpPollOutcome) -> bool { - match outcome { - CultMeshRudpPollOutcome::Idle => false, - CultMeshRudpPollOutcome::Handled => true, - CultMeshRudpPollOutcome::ApplicationRejected(rejection) => { - eprintln!( - "Odin rejected CultMesh RUDP application message {:?} {} from {:?}: {}", - rejection.operation, rejection.message_id, rejection.session, rejection.reason - ); - true - } - } -} - -fn parse_options(args: impl Iterator) -> Result { - let mut args = args.peekable(); - let mut values = BTreeMap::new(); - while let Some(name) = args.next() { - let name = name - .strip_prefix("--") - .with_context(|| format!("expected --option, got {name:?}"))?; - ensure!( - matches!(name, "state-root" | "idunn-projection" | "idunn-anchor"), - "unsupported Odin option --{name}" - ); - let value = args - .next() - .with_context(|| format!("missing value for --{name}"))?; - ensure!( - values - .insert(name.to_owned(), PathBuf::from(value)) - .is_none(), - "duplicate Odin option --{name}" - ); - } - let take = |name: &str| -> Result { - let path = values - .get(name) - .cloned() - .with_context(|| format!("--{name} is required"))?; - ensure!(path.is_absolute(), "--{name} must be an absolute path"); - Ok(path) - }; - let options = Options { - store: take("state-root")?.join(TOPOLOGY_SLOT), - idunn_projection: take("idunn-projection")?, - idunn_anchor: take("idunn-anchor")?, - }; - ensure!( - options.store != options.idunn_projection - && options.store != options.idunn_anchor - && options.idunn_projection != options.idunn_anchor, - "Odin state root, Idunn projection, and Idunn anchor paths must be distinct" - ); - Ok(options) -} - -fn load_runtime_authority(bundle: &Path) -> Result { - ensure!(bundle.is_absolute(), "Idunn runtime bundle is not absolute"); - let (expected_key, expected_payload) = read_single_runtime_record( - &bundle.join("expected.cc"), - IdunnExpectedIncarnationRecord::TYPE, - IDUNN_EXPECTED_INCARNATION_SCHEMA, - )?; - let expected = IdunnExpectedIncarnationRecord::decode_canonical(&expected_payload)?; - ensure!( - expected_key == expected.target, - "Expected key is substituted" - ); - let (activation_key, activation_payload) = read_single_runtime_record( - &bundle.join("activation.cc"), - IdunnRuntimeActivationRecord::TYPE, - IDUNN_RUNTIME_ACTIVATION_SCHEMA, - )?; - let activation = IdunnRuntimeActivationRecord::decode_canonical(&activation_payload)?; - ensure!( - activation_key == expected.target, - "activation key is substituted" - ); - let expected_sha256 = expected.canonical_sha256()?; - ensure!( - activation.expected_projection_sha256 == expected_sha256 - && activation.runtime_id == expected.runtime_id, - "activation does not bind Odin's Expected projection" - ); - let (activation_credential, provider_identity) = take_runtime_signer_descriptors()?; - let activation_signer = - IdunnRuntimeActivationSigner::from_credential_reader(activation_credential)?; - ensure!( - activation_signer.identity_id() == activation.activation_signer_identity_id - && activation_signer.public_key() == activation.activation_signer_public_key, - "activation credential does not belong to Odin's activation" - ); - let provider_signer = open_service_identity_credential_reader::( - provider_identity, - )?; - ensure!( - provider_signer.entry().identity_id == expected.expected_signer_identity_id, - "provider credential is not the signer selected by Expected" - ); - Ok(RuntimeAuthority { - expected, - expected_sha256, - activation_sha256: activation.canonical_sha256()?, - activation, - activation_signer, - provider_signer, - }) -} - -fn require_expected_contract( - expected: &IdunnExpectedIncarnationRecord, - bind: SocketAddr, -) -> Result<()> { - ensure!( - expected.target == TARGET - && expected.health_contract == HEALTH_CONTRACT - && expected.state_schema_generation.as_deref() == Some(STATE_SCHEMA_GENERATION) - && expected.state_contract_sha256.as_deref() == Some(STATE_CONTRACT_SHA256) - && expected.write_lease_required, - "Odin Expected projection differs from its compiled runtime/state contract" - ); - let route = expected - .route - .as_ref() - .context("Odin Expected projection has no admitted route")?; - ensure!( - route.transport == "rudp" && route.candidate_endpoint == format!("rudp://{bind}"), - "Odin candidate bind differs from Expected" - ); - let capability = expected - .capabilities - .iter() - .find(|capability| { - capability.capability == RENDEZVOUS_CAPABILITY - && capability.schema == RENDEZVOUS_SCHEMA - && capability.compatibility == RENDEZVOUS_COMPATIBILITY - }) - .context("Odin Expected projection omits its rendezvous capability")?; - ensure!( - capability.minimum_capacity > 0 && expected.capabilities.len() == 1, - "Odin Expected capability set differs from its compiled contract" - ); - ensure!( - expected.dependencies.is_empty(), - "Odin bootstrap cannot depend on a managed daemon" - ); - Ok(()) -} - -fn read_single_runtime_record( - path: &Path, - expected_type: &str, - expected_schema: &str, -) -> Result<(String, Vec)> { - let entries = SingleFileMessagePackBackingStore::new(path).pull_all_read_only_snapshot()?; - let [envelope] = entries.as_slice() else { - bail!("runtime authority store must contain exactly one record"); - }; - ensure!( - envelope.r#type == expected_type && envelope.schema_id.as_deref() == Some(expected_schema), - "runtime authority store has the wrong typed envelope" - ); - Ok((envelope.key.clone(), envelope.payload.clone())) -} - -fn take_runtime_signer_descriptors() -> Result<(File, File)> { - let pid = required_environment(SYSTEMD_LISTEN_PID_ENVIRONMENT)?; - let count = required_environment(SYSTEMD_LISTEN_FDS_ENVIRONMENT)?; - let names = required_environment(SYSTEMD_LISTEN_FDNAMES_ENVIRONMENT)?; - // LISTEN_PID cannot be compared to our own pid here. Idunn launches Odin - // with PrivatePIDs=yes -- the private PID namespace is part of the - // isolation it proves between a candidate and the incumbent -- and systemd - // sets LISTEN_PID to the pid it knows, which is in the *outer* namespace. - // Inside, /proc/self/status reports only the namespace-local pid, so the - // value is not merely different, it names something this process cannot - // observe. Requiring equality made every candidate exit immediately. - // - // The protocol check exists so a child does not mistake inherited - // LISTEN_FDS for its own. What replaces it here is stronger than a pid - // comparison: the exact descriptor count and name order below, and then the - // content itself, which must verify against the trust anchor Idunn - // published. Descriptors that were not Idunn's fail that verification. - ensure!(!pid.is_empty(), "systemd passed no listener pid"); - ensure!(count == "2", "Odin requires exactly two signer descriptors"); - ensure!( - names == format!("{ACTIVATION_SIGNER_FD_NAME}:{PROVIDER_SIGNER_FD_NAME}"), - "systemd signer descriptor names or order differ from Idunn's contract" - ); - // SAFETY: the exact systemd LISTEN_* contract above assigns sole ownership - // of descriptors 3 and 4 to this process, and this is the first FD consumer. - let activation = unsafe { File::from_raw_fd(SYSTEMD_LISTEN_FDS_START) }; - // SAFETY: descriptor 4 is distinct and covered by the same exact contract. - let provider = unsafe { File::from_raw_fd(SYSTEMD_LISTEN_FDS_START + 1) }; - Ok((activation, provider)) -} - -fn read_trust_anchor(path: &Path) -> Result { - let entries = SingleFileMessagePackBackingStore::new(path).pull_all_read_only_snapshot()?; - let [envelope] = entries.as_slice() else { - bail!("service trust-anchor store must contain exactly one document"); - }; - ensure!( - envelope.r#type == P::TRUST_ANCHOR_TYPE - && envelope.key == P::TRUST_ANCHOR_KEY - && envelope.schema_id.as_deref() == Some(P::TRUST_ANCHOR_SCHEMA), - "service trust anchor belongs to another identity profile" - ); - let anchor: ServiceIdentityTrustAnchor = rmp_serde::from_slice(&envelope.payload)?; - ensure!( - rmp_serde::to_vec(&anchor)? == envelope.payload - && anchor.schema_version == P::TRUST_ANCHOR_SCHEMA - && derive_service_identity_id::

(&anchor.public_key)? == anchor.identity_id, - "service trust anchor is noncanonical or self-inconsistent" - ); - Ok(anchor) -} - -/// The one incarnation this process is: its bundle's Expected digest. -fn self_incarnation(authority: &RuntimeAuthority) -> IncarnationRef { - IncarnationRef::new(TARGET, authority.expected_sha256.clone()) -} - -fn acquire_process_write_lease( - path: &Path, - authority: &RuntimeAuthority, - recent_warming: &VecDeque<(String, u64)>, -) -> Result> { - let Some(observed) = read_process_write_lease(path)? else { - return Ok(None); - }; - let now = unix_millis()?; - let warming_is_ours = - recent_warming_proof(recent_warming, &observed.warming_presence_sha256, now); - let exact_incarnation = observed.target == authority.expected.target - && observed.expected_projection_sha256 == authority.expected_sha256 - && observed.plan_id == authority.expected.plan_id - && observed.incarnation_id == authority.expected.incarnation_id - && observed.sealed_release_id == authority.expected.sealed_release_id - && observed.activation_witness_sha256 == authority.activation_sha256 - && Some(observed.state_schema_generation.as_str()) - == authority.expected.state_schema_generation.as_deref() - && Some(observed.state_contract_sha256.as_str()) - == authority.expected.state_contract_sha256.as_deref() - && observed.runtime_id == authority.expected.runtime_id - && observed.runtime_instance_id == authority.activation.runtime_instance_id; - if !warming_is_ours || !exact_incarnation { - return Ok(None); - } - let lock_path = sibling_lock_path(path)?; - let lock = OpenOptions::new() - .read(true) - .open(&lock_path) - .with_context(|| format!("opening process-write-lease lock {}", lock_path.display()))?; - FileExt::lock_shared(&lock)?; - let current = read_process_write_lease(path)? - .context("process-write lease disappeared while acquiring its lifetime lock")?; - ensure!( - current == observed, - "process-write lease changed while acquiring its lifetime lock" - ); - Ok(Some(ProcessWriteLeaseGuard { - _lock: lock, - sha256: current.canonical_sha256()?, - record: current, - })) -} - -fn remember_recent_warming_proof( - recent_warming: &mut VecDeque<(String, u64)>, - sha256: String, - now: u64, -) { - while recent_warming - .front() - .is_some_and(|(_, issued)| now.saturating_sub(*issued) > WARMING_PROOF_LIFETIME_MILLIS) - { - recent_warming.pop_front(); - } - recent_warming.push_back((sha256, now)); - while recent_warming.len() > MAX_RECENT_WARMING_PROOFS { - recent_warming.pop_front(); - } -} - -fn recent_warming_proof( - recent_warming: &VecDeque<(String, u64)>, - expected_sha256: &str, - now: u64, -) -> bool { - recent_warming.iter().any(|(sha256, issued)| { - sha256 == expected_sha256 && now.saturating_sub(*issued) <= WARMING_PROOF_LIFETIME_MILLIS - }) -} - -fn read_process_write_lease(path: &Path) -> Result> { - if !path.is_file() { - return Ok(None); - } - let entries = SingleFileMessagePackBackingStore::new(path).pull_all_read_only_snapshot()?; - let [envelope] = entries.as_slice() else { - ensure!(entries.is_empty(), "process-write-lease store is ambiguous"); - return Ok(None); - }; - ensure!( - envelope.r#type == IdunnProcessWriteLeaseRecord::TYPE - && envelope.schema_id.as_deref() == Some(IDUNN_PROCESS_WRITE_LEASE_SCHEMA), - "process-write-lease store has the wrong typed envelope" - ); - let lease = IdunnProcessWriteLeaseRecord::decode_canonical(&envelope.payload)?; - ensure!( - envelope.key == lease.target, - "process-write-lease key differs from its target" - ); - Ok(Some(lease)) -} - -/// The highest publisher sequence Odin's own signer has stored, so the next -/// presence continues from it. Only presences keyed under Odin's own target are -/// read, and one that does not decode is skipped: a bad record can lower the -/// count it carried, and can never stop Odin starting. -fn prior_self_publisher_sequence(path: &Path, signer_identity_id: &str) -> Result { - if !path.is_file() { - return Ok(0); - } - Ok(SingleFileMessagePackBackingStore::new(path) - .pull_all_read_only_snapshot()? - .into_iter() - .filter(|entry| { - entry.r#type == GameCultRuntimePresenceHealthRecord::TYPE - && entry.key.starts_with(TARGET) - }) - .filter_map(|entry| match decode_presence(&entry.payload) { - Ok(presence) => Some(presence), - Err(error) => { - eprintln!( - "Odin startup skipped its stored presence {}: {error:#}", - entry.key - ); - None - } - }) - .filter(|presence| { - presence.target == TARGET && presence.signer_identity_id == signer_identity_id - }) - .map(|presence| presence.publisher_sequence) - .max() - .unwrap_or(0)) -} - -/// The document namespaces providers publish to the rendezvous. A provider's -/// document is stored and served back only under one of these; Odin's own -/// records (correlations, the publisher watermark, every `odin.*` type) and -/// Idunn's projected authority live in namespaces no provider can name, so a -/// peer cannot write them and the catalog cannot serve them. -/// -/// The list is evidence, not a guess: each entry is a namespace some GameCult -/// source publishes to Odin's catalog connection, and the publisher is named -/// here so the next edit can check it. Add a namespace only with its publisher. -/// ghostlight Ghostlight, `ghostlight.schema_catalog.v1` -/// (schema: CultLib `packages/cultcache-ts/src/swarm-documents.ts`) -/// heimdall Heimdall `src/odin-publication.ts` via `src/verse-state.ts`, -/// `heimdall.command_boundary.v1` -/// muninn Muninn `crates/muninn-contracts/src/records.rs`, -/// `muninn.obs_stream_catalog.v1` -/// sleipnir Sleipnir, `sleipnir.input_mapping.v1` -/// (schema: CultLib `packages/cultcache-ts/src/swarm-documents.ts`) -/// gamecult.eve Eve providers (Heimdall `src/odin-publication.ts`, Muninn, -/// AetheriaEve): `provider_advertisement`, `surface`, -/// `surface_state`, `plugin_advertisement` -/// gamecult.model Epiphany `epiphany-core/src/atlas/transport.rs`, -/// `gamecult.model.atlas_publication.v0` -/// gamecult.aetheria AetheriaEve `Aetheria.State.Daemon/Program.cs`, -/// `gamecult.aetheria.asset_manifest.v1` -const PEER_DOCUMENT_NAMESPACES: &[&str] = &[ - "ghostlight", - "heimdall", - "muninn", - "sleipnir", - "gamecult.eve", - "gamecult.model", - "gamecult.aetheria", -]; - -/// Whole document types published under no dotted namespace: Muninn's media -/// stream advertisement and Ratatoskr/Muninn's request for it (`gamecult.media` -/// is their prefix, `_stream_advertisement` and `_stream_request` are not a -/// segment of it). Publisher: Muninn `crates/muninn-daemon/src/main.rs` -/// (`GAMECULT_MEDIA_STREAM_ADVERTISEMENT_SCHEMA`, `GAMECULT_MEDIA_STREAM_REQUEST_SCHEMA`). -const PEER_DOCUMENT_TYPES: &[&str] = &[ - "gamecult.media_stream_advertisement", - "gamecult.media_stream_request", -]; - -fn is_peer_document_type(document_type: &str) -> bool { - PEER_DOCUMENT_TYPES.contains(&document_type) - || PEER_DOCUMENT_NAMESPACES.iter().any(|namespace| { - document_type - .strip_prefix(namespace) - .is_some_and(|rest| rest.starts_with('.')) - }) -} - -fn persist_generic_document(path: &Path, document: &CultNetRawDocumentRecord) -> Result<()> { - let document_type = document_type_for_schema(&document.schema_id)?; - ensure!( - is_peer_document_type(&document_type), - "Odin accepts no {document_type} document from a provider" - ); - let replacement = CultCacheEnvelope { - key: document.record_key.clone(), - r#type: document_type.clone(), - payload: document.payload.clone(), - stored_at: document.stored_at.clone(), - schema_id: Some(document.schema_id.clone()), - }; - let store = SingleFileMessagePackBackingStore::new(path); - for _ in 0..CAS_ATTEMPTS { - let entries = if path.is_file() { - store.pull_all_read_only_snapshot()? - } else { - Vec::new() - }; - let mut matches = entries - .iter() - .filter(|entry| entry.r#type == document_type && entry.key == document.record_key); - let current = matches.next().cloned(); - ensure!( - matches.next().is_none(), - "generic CultCache identity is ambiguous" - ); - if current.as_ref() == Some(&replacement) { - return Ok(()); - } - if store.compare_exchange( - &[CultCacheExpectedEnvelope { - key: document.record_key.clone(), - r#type: document_type.clone(), - current, - }], - &[replacement.clone()], - )? { - return Ok(()); - } - } - bail!("Odin catalog changed repeatedly while persisting a provider document") -} - -fn document_type_for_schema(schema_id: &str) -> Result { - ensure!( - !schema_id.is_empty() && schema_id.trim() == schema_id, - "provider schema id is empty or padded" - ); - let Some((prefix, version)) = schema_id.rsplit_once(".v") else { - bail!("provider schema id has no explicit version suffix"); - }; - ensure!( - !prefix.is_empty() - && !version.is_empty() - && version.chars().all(|value| value.is_ascii_digit()), - "provider schema id has an invalid version suffix" - ); - Ok(prefix.into()) -} - -fn validate_raw_document_shape(document: &CultNetRawDocumentRecord) -> Result<()> { - ensure!( - document.payload_encoding == CultNetRawPayloadEncoding::Messagepack - && !document.record_key.is_empty() - && document.record_key.trim() == document.record_key - && !document.payload.is_empty(), - "raw provider document has an invalid key, encoding, or payload" - ); - document_type_for_schema(&document.schema_id)?; - DateTime::parse_from_rfc3339(&document.stored_at) - .context("raw provider document has an invalid stored_at")?; - Ok(()) -} - -fn decode_presence(payload: &[u8]) -> Result { - let presence: GameCultRuntimePresenceHealthRecord = rmp_serde::from_slice(payload)?; - ensure!( - rmp_serde::to_vec(&presence)? == payload, - "runtime presence is not canonical MessagePack" - ); - presence.validate()?; - Ok(presence) -} - -/// Every incarnation Idunn currently projects, of every target, and every -/// incarnation Odin holds a correlation for, projected or not (the latter are -/// refreshed so their correlations are withdrawn). Only the keys are read: -/// decoding a record is the refresh of that one incarnation, so a record that -/// will not decode cannot make the list unreadable. -/// -/// Records keyed by anything but an incarnation key are not this contract's and -/// are skipped, not refused: a projection written by an older Idunn projects -/// nothing this daemon acts on, and a correlation written by the previous, -/// target-keyed Odin is retired at activation (`retire_legacy_correlations`). -fn incarnation_keys(path: &Path, record_type: &str) -> Result> { - if !path.is_file() { - return Ok(BTreeSet::new()); - } - Ok(SingleFileMessagePackBackingStore::new(path) - .pull_all_read_only_snapshot()? - .into_iter() - .filter(|entry| entry.r#type == record_type) - .filter_map(|entry| IncarnationRef::parse_key(&entry.key)) - .collect()) -} - -fn validate_snapshot_filters(query: &CultMeshRudpSnapshotQuery) -> Result<()> { - ensure!( - !query.message_id.is_empty() && query.message_id.trim() == query.message_id, - "snapshot message id is empty or padded" - ); - for (label, values) in [ - ("schema", query.schema_ids.as_ref()), - ("record key", query.record_keys.as_ref()), - ] { - if let Some(values) = values { - ensure!(!values.is_empty(), "snapshot {label} filter is empty"); - let unique = values.iter().collect::>(); - ensure!( - unique.len() == values.len() - && values - .iter() - .all(|value| !value.is_empty() && value.trim() == value), - "snapshot {label} filter is duplicated, empty, or padded" - ); - } - } - Ok(()) -} - -fn exact_self_presence_query(query: &CultMeshRudpSnapshotQuery) -> bool { - query.schema_ids.as_deref() == Some(&[GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA.to_owned()]) - && query.record_keys.as_deref() == Some(&[TARGET.to_owned()]) -} - -fn query_allows(query: &CultMeshRudpSnapshotQuery, document: &CultNetRawDocumentRecord) -> bool { - query - .schema_ids - .as_ref() - .is_none_or(|values| values.contains(&document.schema_id)) - && query - .record_keys - .as_ref() - .is_none_or(|values| values.contains(&document.record_key)) -} - -fn sibling_lock_path(path: &Path) -> Result { - let mut name = path - .file_name() - .context("CultCache authority path has no filename")? - .to_os_string(); - name.push(".lock"); - Ok(path.with_file_name(name)) -} - -fn required_environment(name: &str) -> Result { - std::env::var(name) - .ok() - .filter(|value| !value.is_empty() && value.trim() == value) - .with_context(|| format!("{name} is required for an Idunn-managed Odin")) -} - -fn unix_millis() -> Result { - SystemTime::now() - .duration_since(UNIX_EPOCH) - .context("system clock predates Unix epoch")? - .as_millis() - .try_into() - .context("Unix time exceeds u64") -} - -fn rfc3339_millis(value: u64) -> Result { - let millis: i64 = value - .try_into() - .context("timestamp exceeds RFC3339 range")?; - Ok(DateTime::::from_timestamp_millis(millis) - .context("timestamp exceeds RFC3339 range")? - .to_rfc3339()) -} - -#[cfg(test)] -mod tests { - use cultnet_rs::{ - CultNetMessage, CultNetRudpReliableSendStatus, CultNetRudpSocketTransportConnection, - CultNetRudpSocketTransportOptions, CultNetWireContract, - GAMECULT_RUNTIME_PRESENCE_HEALTH_SIGNING_PURPOSE, GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA, - GameCultServiceTrustAnchorRecord, IdunnExpectedCapability, IdunnExpectedRoute, - IdunnRuntimeActivationLaunch, ODIN_RUNTIME_TOPOLOGY_CORRELATION_SCHEMA, - encode_cultnet_message_to_vec, enroll_service_identity_at, - }; - - use super::*; - - #[test] - fn options_are_exact_and_absolute() { - let parsed = parse_options( - [ - "--state-root", - "/var/lib/gamecult/odin-v2", - "--idunn-projection", - "/var/lib/gamecult/idunn-projection/topology.cc", - "--idunn-anchor", - "/etc/gamecult/idunn/idunn-public-anchor.cc", - ] - .into_iter() - .map(str::to_owned), - ) - .unwrap(); - assert_eq!( - parsed.store, - Path::new("/var/lib/gamecult/odin-v2/topology.cc") - ); - // The store path is derived from the slot, never supplied: naming it - // directly would let a binding place Odin's state outside the root - // Idunn hardened. - assert!( - parse_options( - [ - "--store", - "/var/lib/gamecult/odin-v2/topology.cc", - "--idunn-projection", - "/p", - "--idunn-anchor", - "/a" - ] - .into_iter() - .map(str::to_owned) - ) - .is_err() - ); - assert!( - parse_options( - [ - "--state-root", - "relative", - "--idunn-projection", - "/p", - "--idunn-anchor", - "/a" - ] - .into_iter() - .map(str::to_owned) - ) - .is_err() - ); - } - - #[test] - fn schema_to_document_type_is_versioned_and_deterministic() { - assert_eq!( - document_type_for_schema("heimdall.command_boundary.v1").unwrap(), - "heimdall.command_boundary" - ); - for value in ["heimdall.command_boundary", "heimdall.v", ".v1", " x.v1"] { - assert!(document_type_for_schema(value).is_err()); - } - } - - #[test] - fn only_exact_singleton_self_presence_query_is_a_route_challenge() { - let exact = CultMeshRudpSnapshotQuery { - session: cultmesh_rs::CultMeshRudpSessionKey { - remote_addr: "127.0.0.1:1".parse().unwrap(), - connection_id: 7, - }, - message_id: "challenge".into(), - requested_at_unix_millis: 1, - schema_ids: Some(vec![GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA.into()]), - record_keys: Some(vec![TARGET.into()]), - }; - assert!(exact_self_presence_query(&exact)); - let mut broad = exact.clone(); - broad.record_keys = None; - assert!(!exact_self_presence_query(&broad)); - } - - #[test] - fn first_odin_accepts_only_recent_provider_owned_warming_proofs() { - let mut proofs = VecDeque::new(); - remember_recent_warming_proof(&mut proofs, "warming-one".into(), 100); - assert!(recent_warming_proof( - &proofs, - "warming-one", - 100 + WARMING_PROOF_LIFETIME_MILLIS, - )); - assert!(!recent_warming_proof( - &proofs, - "warming-one", - 101 + WARMING_PROOF_LIFETIME_MILLIS, - )); - assert!(!recent_warming_proof(&proofs, "foreign-proof", 100)); - - for index in 0..=MAX_RECENT_WARMING_PROOFS { - remember_recent_warming_proof(&mut proofs, format!("warming-{index}"), 200); - } - assert_eq!(proofs.len(), MAX_RECENT_WARMING_PROOFS); - assert_eq!(proofs.back().unwrap().0, "warming-64"); - assert!(!proofs.iter().any(|(proof, _)| proof == "warming-one")); - } - - // ---- serving-loop liveness ------------------------------------------- - - fn digest(byte: char) -> String { - format!("sha256-{}", byte.to_string().repeat(64)) - } - - /// Odin as Idunn admits it: a real activation, provider anchor, write - /// lease and projection on disk, `try_activate` run for real, and the - /// production RUDP server bound to the candidate socket the Expected names. - struct OdinWorld { - _temp: tempfile::TempDir, - state: Rc>, - server: OdinServer, - timers: ServingTimers, - store: PathBuf, - lease_path: PathBuf, - provider_identity_id: String, - lease: IdunnProcessWriteLeaseRecord, - } - - fn write_single_record(path: &Path, envelope: CultCacheEnvelope) -> Result<()> { - let store = SingleFileMessagePackBackingStore::new(path); - let current = if path.is_file() { - store.pull_all_read_only_snapshot()? - } else { - Vec::new() - }; - ensure!( - store.compare_exchange_snapshot(¤t, &[envelope])?, - "test store CAS failed" - ); - Ok(()) - } - - fn lease_envelope(lease: &IdunnProcessWriteLeaseRecord) -> Result { - Ok(CultCacheEnvelope { - key: lease.target.clone(), - r#type: IdunnProcessWriteLeaseRecord::TYPE.into(), - payload: lease.canonical_bytes()?, - stored_at: rfc3339_millis(lease.issued_at_unix_millis)?, - schema_id: Some(IDUNN_PROCESS_WRITE_LEASE_SCHEMA.into()), - }) - } - - fn activated_odin() -> Result { - activated_odin_serving(CultMeshRudpDocumentServerOptions::default()) - } - - /// The same world with the production server bound under `options`. - fn activated_odin_serving(options: CultMeshRudpDocumentServerOptions) -> Result { - let temp = tempfile::tempdir()?; - let root = temp.path(); - let socket = UdpSocket::bind("127.0.0.1:0")?; - let candidate = socket.local_addr()?; - let now = unix_millis()?; - let idunn_signer = - enroll_service_identity_at::(&root.join("idunn.cc"))?; - let idunn_anchor = idunn_signer.trust_anchor()?; - let odin_signer = - enroll_service_identity_at::(&root.join("odin-topology.cc"))?; - let provider_signer = enroll_service_identity_at::( - &root.join("odin-provider.cc"), - )?; - let expected = IdunnExpectedIncarnationRecord { - schema_version: IDUNN_EXPECTED_INCARNATION_SCHEMA.into(), - target: TARGET.into(), - plan_id: digest('1'), - incarnation_id: "odin/generation-1".into(), - sealed_release_id: digest('2'), - source_repository: "github.com/GameCult/Odin".into(), - source_revision: "3".repeat(40), - recipe_sha256: digest('4'), - runtime_id: "odin-runtime".into(), - expected_signer_identity_id: provider_signer.entry().identity_id.clone(), - health_contract: HEALTH_CONTRACT.into(), - artifact_sha256: digest('5'), - state_schema_generation: Some(STATE_SCHEMA_GENERATION.into()), - state_contract_sha256: Some(STATE_CONTRACT_SHA256.into()), - write_lease_required: true, - route: Some(IdunnExpectedRoute { - route_id: "odin-route".into(), - transport: "rudp".into(), - stable_endpoint: "rudp://odin.internal:1000".into(), - candidate_endpoint: format!("rudp://{candidate}"), - }), - capabilities: vec![IdunnExpectedCapability { - capability: RENDEZVOUS_CAPABILITY.into(), - schema: RENDEZVOUS_SCHEMA.into(), - compatibility: RENDEZVOUS_COMPATIBILITY.into(), - minimum_capacity: 1, - }], - dependencies: Vec::new(), - }; - expected.validate()?; - require_expected_contract(&expected, candidate)?; - let launch = - IdunnRuntimeActivationLaunch::issue(&expected, digest('7'), now - 20, &idunn_signer)?; - let activation = launch.activation().clone(); - let mut credential = Vec::new(); - launch.write_credential(&mut credential)?; - let activation_signer = - IdunnRuntimeActivationSigner::from_credential_reader(credential.as_slice())?; - let provider_anchor = GameCultServiceTrustAnchorRecord { - schema_version: GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA.into(), - trust_anchor_id: format!("root/{TARGET}/runtime-presence"), - service_id: TARGET.into(), - runtime_id: expected.runtime_id.clone(), - signer_identity_id: provider_signer.entry().identity_id.clone(), - signer_public_key: provider_signer.entry().public_key.clone(), - signature_algorithm: "ed25519".into(), - signing_purpose: GAMECULT_RUNTIME_PRESENCE_HEALTH_SIGNING_PURPOSE.into(), - signed_schema: GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA.into(), - binding_authority: "root".into(), - bound_at_unix_millis: now - 100, - expires_at_unix_millis: None, - private_state_exposed: false, - }; - let provider_identity_id = provider_signer.entry().identity_id.clone(); - let expected_sha256 = expected.canonical_sha256()?; - let authority_material = RuntimeAuthority { - activation_sha256: activation.canonical_sha256()?, - expected_sha256: expected_sha256.clone(), - expected: expected.clone(), - activation: activation.clone(), - activation_signer, - provider_signer, - }; - let store = root.join(TOPOLOGY_SLOT); - let projection_path = root.join("idunn-projection.cc"); - let lease_path = root.join("process-write-lease.cc"); - let mut runtime = RuntimeState { - options: Options { - store: store.clone(), - idunn_projection: projection_path.clone(), - idunn_anchor: root.join("unused-idunn-anchor.cc"), - }, - candidate, - authority_material, - idunn_anchor: Some(idunn_anchor), - topology_signer: Some(odin_signer), - topology: None, - write_lease: None, - write_lease_path: lease_path.clone(), - recent_warming_proofs: VecDeque::new(), - publisher_sequence: 0, - log_gate: RefCell::default(), - }; - - // The lease names the Warming presence Odin signed for Idunn's probe. - let warming = runtime.signed_presence_document("warming", "test warming")?; - let lease = IdunnProcessWriteLeaseRecord { - schema_version: IDUNN_PROCESS_WRITE_LEASE_SCHEMA.into(), - target: TARGET.into(), - expected_projection_sha256: expected_sha256, - plan_id: expected.plan_id.clone(), - incarnation_id: expected.incarnation_id.clone(), - sealed_release_id: expected.sealed_release_id.clone(), - activation_witness_sha256: activation.canonical_sha256()?, - state_schema_generation: STATE_SCHEMA_GENERATION.into(), - state_contract_sha256: STATE_CONTRACT_SHA256.into(), - runtime_id: expected.runtime_id.clone(), - runtime_instance_id: activation.runtime_instance_id.clone(), - warming_presence_sha256: decode_presence(&warming.payload)?.canonical_sha256()?, - lease_epoch: 1, - issued_at_unix_millis: now - 5, - }; - write_single_record(&lease_path, lease_envelope(&lease)?)?; - File::create(sibling_lock_path(&lease_path)?)?; - - let incarnation_key = IncarnationRef::of(&expected)?.key(); - let mut projected_lease = lease_envelope(&lease)?; - projected_lease.key = incarnation_key.clone(); - let projection = vec![ - CultCacheEnvelope { - key: incarnation_key.clone(), - r#type: IdunnExpectedIncarnationRecord::TYPE.into(), - payload: expected.canonical_bytes()?, - stored_at: rfc3339_millis(now - 30)?, - schema_id: Some(IDUNN_EXPECTED_INCARNATION_SCHEMA.into()), - }, - CultCacheEnvelope { - key: provider_anchor.trust_anchor_id.clone(), - r#type: GameCultServiceTrustAnchorRecord::TYPE.into(), - payload: rmp_serde::to_vec(&provider_anchor)?, - stored_at: rfc3339_millis(provider_anchor.bound_at_unix_millis)?, - schema_id: Some(GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA.into()), - }, - CultCacheEnvelope { - key: incarnation_key, - r#type: IdunnRuntimeActivationRecord::TYPE.into(), - payload: activation.canonical_bytes()?, - stored_at: rfc3339_millis(activation.issued_at_unix_millis)?, - schema_id: Some(IDUNN_RUNTIME_ACTIVATION_SCHEMA.into()), - }, - projected_lease, - ]; - ensure!( - SingleFileMessagePackBackingStore::new(&projection_path) - .compare_exchange_snapshot(&[], &projection)?, - "test projection CAS failed" - ); - - ensure!( - runtime.try_activate()?, - "Odin did not activate in the fixture" - ); - let state = Rc::new(RefCell::new(runtime)); - let server = CultMeshRudpDocumentServer::new( - socket, - SinkHandle(state.clone()), - SnapshotHandle(state.clone()), - CultMeshSystemClock::default(), - options, - )?; - Ok(OdinWorld { - _temp: temp, - state, - server, - timers: ServingTimers::default(), - store, - lease_path, - provider_identity_id, - lease, - }) - } - - impl OdinWorld { - fn pass(&mut self) -> Result { - serving_pass(&self.state, &mut self.server, &mut self.timers) - } - - /// Replace the lease under Odin with a later epoch. Odin holds a shared - /// lock on the lease's lifetime lock, which is what stops Idunn from - /// writing the lease under it; the test swaps the file underneath. - fn swap_lease(&self) -> Result<()> { - let mut replaced = self.lease.clone(); - replaced.lease_epoch += 1; - let scratch = self.lease_path.with_file_name("replacement-lease.cc"); - write_single_record(&scratch, lease_envelope(&replaced)?)?; - std::fs::copy(&scratch, &self.lease_path)?; - Ok(()) - } - - /// Add records to Idunn's projection as Idunn would publish them. - fn append_projection(&self, added: Vec) -> Result<()> { - self.tamper_projection(|mut entries| { - entries.extend(added); - entries - }) - } - - /// Rewrite Odin's own store as `change` sees it, in one exchange. - fn tamper_store( - &self, - change: impl FnOnce(Vec) -> Vec, - ) -> Result<()> { - let store = SingleFileMessagePackBackingStore::new(&self.store); - let current = store.pull_all_read_only_snapshot()?; - let next = change(current.clone()); - ensure!( - store.compare_exchange_snapshot(¤t, &next)?, - "test store CAS failed" - ); - Ok(()) - } - - /// Rewrite Idunn's projection as `change` sees it, in one exchange. - fn tamper_projection( - &self, - change: impl FnOnce(Vec) -> Vec, - ) -> Result<()> { - let path = self.state.borrow().options.idunn_projection.clone(); - let store = SingleFileMessagePackBackingStore::new(path); - let current = store.pull_all_read_only_snapshot()?; - let next = change(current.clone()); - ensure!( - store.compare_exchange_snapshot(¤t, &next)?, - "test projection CAS failed" - ); - Ok(()) - } - - /// The whole catalog, as a Verse peer reading it would get it. - fn catalog(&self) -> Result> { - self.state.borrow_mut().raw_snapshot(&CultMeshRudpSnapshotQuery { - session: cultmesh_rs::CultMeshRudpSessionKey { - remote_addr: "127.0.0.1:1".parse()?, - connection_id: 7, - }, - message_id: "catalog".into(), - requested_at_unix_millis: 1, - schema_ids: None, - record_keys: None, - }) - } - - fn stored_keys(&self, record_type: &str) -> Result> { - Ok(SingleFileMessagePackBackingStore::new(&self.store) - .pull_all_read_only_snapshot()? - .into_iter() - .filter(|entry| entry.r#type == record_type) - .map(|entry| entry.key) - .collect()) - } - - /// Odin's own publisher sequence as it is durably stored. - fn stored_sequence(&self) -> Result { - prior_self_publisher_sequence(&self.store, &self.provider_identity_id) - } - - /// Run a peer on its own thread while Odin polls its socket, and nothing - /// else. The timed work of a pass (refresh and heartbeat, both fsync-heavy) - /// would leave the peers waiting past their connect deadline on a loaded - /// host; the tests take the timed passes themselves afterwards. - fn serve_while( - &mut self, - peer: impl FnOnce() -> T + Send + 'static, - ) -> Result { - let peer = thread::spawn(peer); - while !peer.is_finished() { - if !poll_server(&mut self.server, &mut self.timers.poll_failing_since)? { - thread::sleep(IDLE_POLL_INTERVAL); - } - } - Ok(peer.join().expect("peer thread panicked")) - } - } - - const PEER_CONNECTION_BASE: u32 = 0x7000_0000; - - /// A publisher the way Ghostlight and CodexConnector behave: connect, - /// optionally put one message, never Disconnect. - fn lingering_peer( - target: SocketAddr, - connection_id: u32, - message: Option, - ) -> Result<()> { - let socket = UdpSocket::bind("127.0.0.1:0")?; - socket.set_read_timeout(Some(Duration::from_millis(100)))?; - let mut transport = CultNetRudpSocketTransportConnection::new( - CultNetRudpSocketTransportOptions::client("test-peer", socket, target, connection_id), - )?; - transport.connect(Vec::new())?; - let deadline = Instant::now() + Duration::from_secs(2); - while !transport.connected() { - let _ = transport.receive_once()?; - transport.poll_resends()?; - ensure!(Instant::now() < deadline, "timed out connecting"); - } - if let Some(message) = message { - let receipt = transport.send_reliable( - "schema", - encode_cultnet_message_to_vec(&message, CultNetWireContract::CultNetSchemaV0)?, - )?; - let deadline = Instant::now() + Duration::from_millis(1500); - while transport.reliable_send_status(&receipt) == CultNetRudpReliableSendStatus::Pending - && Instant::now() < deadline - { - let _ = transport.receive_once()?; - transport.poll_resends()?; - } - } - Ok(()) - } - - /// Soul's 70-lingering-session probe: with the server's session table - /// full of publishers that never Disconnect, Odin's own heartbeat still - /// lands. The table is Odin's own production server bound to the candidate - /// socket, so a self-publication that went over RUDP would find it full. - #[test] - fn self_presence_lands_while_lingering_publishers_hold_every_session() -> Result<()> { - // Sessions do not idle out in this world. The property is that the - // heartbeat lands while the table is full, and the fsync-bound passes - // it takes can outlast the default 30 s idle timeout on a saturated - // disk (Yggdrasil, 2026-09-30: the first pass alone took 20 s, and - // 20 of the 64 sessions had expired by the last assertion), which - // ends the sessions the test is holding rather than testing anything. - let mut odin = activated_odin_serving(CultMeshRudpDocumentServerOptions { - session_idle_timeout: Duration::from_secs(3600), - ..CultMeshRudpDocumentServerOptions::default() - })?; - let target = odin.server.local_addr()?; - // Peers arrive until 64 are admitted, then one more is refused. A peer - // that times out under load is retried as a new one: the property is a - // full table, not that no packet is ever late. Refused peers wait out - // their whole connect deadline, so only one is tried. - let (admitted, overflow_admitted) = odin.serve_while(move || { - let (mut admitted, mut next) = (0, 0); - while admitted < 64 && next < 96 { - match lingering_peer(target, PEER_CONNECTION_BASE + next, None) { - Ok(()) => admitted += 1, - Err(error) => eprintln!("peer {next} was not admitted: {error:#}"), - } - next += 1; - } - let overflow = lingering_peer(target, PEER_CONNECTION_BASE + next, None).is_ok(); - (admitted, overflow) - })?; - assert_eq!(admitted, 64, "the default session table is 64 wide"); - assert!(!overflow_admitted, "the 65th publisher is refused"); - assert_eq!(odin.server.session_count(), 64, "the table is full"); - - // The first timed pass, with the table already full, publishes once. - odin.pass()?; - let before = odin.stored_sequence()?; - for _ in 0..5 { - odin.timers.last_heartbeat = None; - odin.pass()?; - } - assert_eq!( - odin.stored_sequence()?, - before + 5, - "each heartbeat is admitted into Odin's store" - ); - assert_eq!(odin.server.session_count(), 64); - Ok(()) - } - - /// A publication or refresh that fails is logged and retried; it never - /// ends Odin, and the next attempt lands once the fault clears. - #[test] - fn a_failed_self_publication_or_refresh_does_not_end_odin() -> Result<()> { - let mut odin = activated_odin()?; - odin.pass()?; - assert!(odin.stored_sequence()? > 0, "the first pass publishes"); - - std::fs::write(&odin.store, b"not a cultcache store")?; - assert!( - odin.state - .borrow_mut() - .publish_self_presence("probe") - .is_err(), - "the injected fault must actually fail the publication" - ); - odin.timers = ServingTimers::default(); - odin.pass()?; - let suppressed = |odin: &OdinWorld| odin.state.borrow().log_gate.borrow().suppressed_total; - assert_eq!(suppressed(&odin), 0, "each distinct failure is logged"); - - // The same faults on later passes are counted, not printed again. - for repeat in 1..=3 { - odin.timers = ServingTimers::default(); - odin.pass()?; - assert!( - suppressed(&odin) >= repeat, - "pass {repeat} repeated a logged failure" - ); - } - - std::fs::remove_file(&odin.store)?; - odin.timers = ServingTimers::default(); - odin.pass()?; - assert!( - odin.stored_sequence()? > 0, - "the publication after the fault clears lands" - ); - Ok(()) - } - - /// Losing the write lease is the one condition that ends the serving loop. - #[test] - fn losing_the_write_lease_ends_odin() -> Result<()> { - let mut odin = activated_odin()?; - odin.pass()?; - - odin.swap_lease()?; - odin.timers = ServingTimers::default(); - let error = odin.pass().unwrap_err(); - assert!( - error.downcast_ref::().is_some(), - "{error:#}" - ); - - std::fs::remove_file(&odin.lease_path)?; - odin.timers = ServingTimers::default(); - let error = odin.pass().unwrap_err(); - assert!( - error.downcast_ref::().is_some(), - "{error:#}" - ); - Ok(()) - } - - /// The heartbeat and the refresh each check the lease themselves: with only - /// one of them due, a swapped lease still ends Odin. - #[test] - fn each_timer_checks_the_write_lease_itself() -> Result<()> { - for heartbeat_due in [true, false] { - let mut odin = activated_odin()?; - odin.pass()?; - odin.swap_lease()?; - odin.timers = ServingTimers::default(); - if heartbeat_due { - odin.timers.last_projection_refresh = Some(Instant::now()); - } else { - odin.timers.last_heartbeat = Some(Instant::now()); - } - let error = odin.pass().unwrap_err(); - assert!( - error.downcast_ref::().is_some(), - "heartbeat_due={heartbeat_due}: {error:#}" - ); - } - Ok(()) - } - - /// A lease Odin cannot read is a lease it cannot show it still holds, so - /// it is lost, not a transient fault to retry. - #[test] - fn an_unreadable_write_lease_ends_odin() -> Result<()> { - let mut odin = activated_odin()?; - odin.pass()?; - std::fs::write(&odin.lease_path, b"not a cultcache store")?; - odin.timers = ServingTimers::default(); - let error = odin.pass().unwrap_err(); - assert!( - error.downcast_ref::().is_some(), - "{error:#}" - ); - Ok(()) - } - - /// Soul's ghost probe: one Expected that will not decode is that - /// incarnation's own failure. The other incarnations still refresh, and - /// the catalog still serves. - #[test] - fn one_undecodable_incarnation_leaves_the_others_and_the_catalog_readable() -> Result<()> { - let mut odin = activated_odin()?; - let mut candidate = odin.state.borrow().authority_material.expected.clone(); - candidate.target = "sibling".into(); - candidate.validate()?; - let candidate_key = IncarnationRef::of(&candidate)?.key(); - // "aaghost" sorts before "odin", so a refresh that stops at its first - // failure never reaches the good incarnations. - let ghost_key = IncarnationRef::new("aaghost", digest('a')).key(); - odin.append_projection(vec![ - CultCacheEnvelope { - key: ghost_key, - r#type: IdunnExpectedIncarnationRecord::TYPE.into(), - payload: vec![0xc1, 0x00], - stored_at: rfc3339_millis(unix_millis()?)?, - schema_id: Some(IDUNN_EXPECTED_INCARNATION_SCHEMA.into()), - }, - CultCacheEnvelope { - key: candidate_key.clone(), - r#type: IdunnExpectedIncarnationRecord::TYPE.into(), - payload: candidate.canonical_bytes()?, - stored_at: rfc3339_millis(unix_millis()?)?, - schema_id: Some(IDUNN_EXPECTED_INCARNATION_SCHEMA.into()), - }, - ])?; - assert!( - !odin - .stored_keys(OdinRuntimeTopologyCorrelationRecord::TYPE)? - .contains(&candidate_key) - ); - - // A catalog read serves what is stored; refreshing is the timer's. - odin.catalog()?; - assert!( - !odin - .stored_keys(OdinRuntimeTopologyCorrelationRecord::TYPE)? - .contains(&candidate_key), - "a read does not refresh" - ); - - odin.pass()?; - assert!( - odin.stored_keys(OdinRuntimeTopologyCorrelationRecord::TYPE)? - .contains(&candidate_key), - "the good incarnation was refreshed past the ghost" - ); - - // The catalog serves past the ghost; correlations are not part of it. - let catalog = odin.catalog()?; - assert_eq!( - documents_of(&catalog, GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA), - 1 - ); - Ok(()) - } - - fn assert_refused(error: &anyhow::Error) { - assert!( - error.downcast_ref::().is_some(), - "{error:#}" - ); - } - - /// Temporary rule (see `survive`): a self-presence Odin's authority will - /// never admit ends Odin. With no current activation Idunn projects, there - /// is no verifiable authority. - #[test] - fn a_projection_without_authority_ends_odin() -> Result<()> { - let mut odin = activated_odin()?; - odin.pass()?; - odin.tamper_projection(|entries| { - entries - .into_iter() - .filter(|entry| entry.r#type != IdunnRuntimeActivationRecord::TYPE) - .collect() - })?; - odin.timers = ServingTimers::default(); - assert_refused(&odin.pass().unwrap_err()); - Ok(()) - } - - /// Idunn's activation of Odin carries a signature Idunn's anchor does not - /// verify: the authority cannot be verified. - #[test] - fn an_activation_that_does_not_verify_ends_odin() -> Result<()> { - let mut odin = activated_odin()?; - odin.pass()?; - odin.tamper_projection(|entries| { - entries - .into_iter() - .map(|mut entry| { - if entry.r#type == IdunnRuntimeActivationRecord::TYPE { - let mut activation = - IdunnRuntimeActivationRecord::decode_canonical(&entry.payload) - .unwrap(); - activation.signature[0] ^= 1; - entry.payload = activation.canonical_bytes().unwrap(); - } - entry - }) - .collect() - })?; - odin.timers = ServingTimers::default(); - assert_refused(&odin.pass().unwrap_err()); - Ok(()) - } - - /// The projected provider anchor names Odin's signer identity but carries - /// a key that identity does not derive from: the authority cannot verify. - #[test] - fn a_signer_that_does_not_match_the_anchor_ends_odin() -> Result<()> { - let mut odin = activated_odin()?; - odin.pass()?; - odin.tamper_projection(|entries| { - entries - .into_iter() - .map(|mut entry| { - if entry.r#type == GameCultServiceTrustAnchorRecord::TYPE { - let mut anchor: GameCultServiceTrustAnchorRecord = - rmp_serde::from_slice(&entry.payload).unwrap(); - anchor.signer_public_key = vec![7; 32]; - entry.payload = rmp_serde::to_vec(&anchor).unwrap(); - } - entry - }) - .collect() - })?; - odin.timers = ServingTimers::default(); - assert_refused(&odin.pass().unwrap_err()); - - // The other way round: the authority is sound, but the key Odin signs - // with is not the Expected signer. - let mut odin = activated_odin()?; - odin.pass()?; - let other = odin._temp.path().join("other-provider.cc"); - odin.state.borrow_mut().authority_material.provider_signer = - enroll_service_identity_at::(&other)?; - odin.timers = ServingTimers::default(); - assert_refused(&odin.pass().unwrap_err()); - Ok(()) - } - - /// A stored presence of Odin's own activation that no longer authenticates - /// makes its publisher sequence unknowable; the claim is refused, closed. - #[test] - fn a_stored_presence_that_no_longer_authenticates_ends_odin() -> Result<()> { - let mut odin = activated_odin()?; - odin.pass()?; - // Received two minutes after it was observed: outside the trusted window. - let late = rfc3339_millis(unix_millis()? + 120_000)?; - odin.tamper_store(|entries| { - entries - .into_iter() - .map(|mut entry| { - if entry.r#type == GameCultRuntimePresenceHealthRecord::TYPE { - entry.stored_at = late.clone(); - } - entry - }) - .collect() - })?; - odin.timers = ServingTimers::default(); - assert_refused(&odin.pass().unwrap_err()); - Ok(()) - } - - fn generic_document() -> Result { - Ok(CultCacheEnvelope { - key: "doc-1".into(), - r#type: "ghostlight.doc".into(), - payload: vec![1], - stored_at: rfc3339_millis(unix_millis()?)?, - schema_id: Some("ghostlight.doc.v1".into()), - }) - } - - fn documents_of(documents: &[CultNetRawDocumentRecord], schema: &str) -> usize { - documents - .iter() - .filter(|document| document.schema_id == schema) - .count() - } - - /// A candidate incarnation of Odin, as Idunn projects it beside the - /// incumbent for the whole deploy window. - fn project_candidate_incarnation(odin: &OdinWorld) -> Result { - let mut candidate = odin.state.borrow().authority_material.expected.clone(); - candidate.incarnation_id = "odin/generation-2".into(); - candidate.sealed_release_id = digest('9'); - candidate.validate()?; - let incarnation = IncarnationRef::of(&candidate)?; - odin.append_projection(vec![CultCacheEnvelope { - key: incarnation.key(), - r#type: IdunnExpectedIncarnationRecord::TYPE.into(), - payload: candidate.canonical_bytes()?, - stored_at: rfc3339_millis(unix_millis()?)?, - schema_id: Some(IDUNN_EXPECTED_INCARNATION_SCHEMA.into()), - }])?; - Ok(incarnation) - } - - /// Idunn projects the incumbent and the candidate of a target for the whole - /// deploy window, and Odin writes a correlation for each. The catalog does - /// not serve correlations, so two of one target cannot collide in it, and - /// the presence queries every consumer makes are unaffected. - #[test] - fn two_incarnations_of_one_target_leave_the_catalog_readable() -> Result<()> { - let mut odin = activated_odin()?; - odin.pass()?; - let candidate = project_candidate_incarnation(&odin)?; - odin.timers = ServingTimers::default(); - odin.pass()?; - - // Idunn reads the correlations from the store, one per incarnation. - let keys = odin.stored_keys(OdinRuntimeTopologyCorrelationRecord::TYPE)?; - assert_eq!(keys.len(), 2, "{keys:?}"); - assert!(keys.contains(&candidate.key())); - - let catalog = odin.catalog()?; - assert_eq!( - documents_of(&catalog, ODIN_RUNTIME_TOPOLOGY_CORRELATION_SCHEMA), - 0 - ); - assert_eq!( - documents_of(&catalog, GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA), - 1 - ); - let presence_only = odin - .state - .borrow_mut() - .raw_snapshot(&CultMeshRudpSnapshotQuery { - session: cultmesh_rs::CultMeshRudpSessionKey { - remote_addr: "127.0.0.1:1".parse()?, - connection_id: 7, - }, - message_id: "presence-only".into(), - requested_at_unix_millis: 1, - schema_ids: Some(vec![GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA.into()]), - record_keys: None, - })?; - assert_eq!(presence_only.len(), 1); - Ok(()) - } - - /// One record that does not decode is skipped where it is met: the catalog - /// still serves everything else, and startup still finds Odin's sequence. - #[test] - fn records_that_do_not_decode_never_stop_the_catalog_or_startup() -> Result<()> { - let mut odin = activated_odin()?; - odin.pass()?; - let before = odin.stored_sequence()?; - assert!(before > 0); - let stamp = rfc3339_millis(unix_millis()?)?; - let own_signer = odin.provider_identity_id.clone(); - odin.tamper_store(|mut entries| { - for key in [ - "ghost".to_owned(), - format!("{TARGET}@{}/{own_signer}", digest('c')), - ] { - entries.push(CultCacheEnvelope { - key, - r#type: GameCultRuntimePresenceHealthRecord::TYPE.into(), - payload: vec![0xc1], - stored_at: stamp.clone(), - schema_id: Some(GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA.into()), - }); - } - entries.push(generic_document().unwrap()); - entries - })?; - - let catalog = odin.catalog()?; - assert_eq!( - documents_of(&catalog, GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA), - 1, - "Odin's own presence is served" - ); - assert_eq!(documents_of(&catalog, "ghostlight.doc.v1"), 1); - assert_eq!( - prior_self_publisher_sequence(&odin.store, &odin.provider_identity_id)?, - before, - "the undecodable presences do not change the sequence Odin continues from" - ); - Ok(()) - } - - /// A presence whose incarnation's projection cannot be read is skipped as - /// that record's failure; the rest of the catalog is still served. - #[test] - fn a_presence_whose_projection_cannot_be_read_is_skipped_not_fatal() -> Result<()> { - let mut odin = activated_odin()?; - odin.pass()?; - odin.tamper_store(|mut entries| { - entries.push(generic_document().unwrap()); - entries - })?; - odin.tamper_projection(|entries| { - entries - .into_iter() - .map(|mut entry| { - if entry.r#type == GameCultServiceTrustAnchorRecord::TYPE { - entry.payload = vec![0xc1]; - } - entry - }) - .collect() - })?; - let catalog = odin.catalog()?; - assert_eq!(documents_of(&catalog, "ghostlight.doc.v1"), 1); - assert_eq!( - documents_of(&catalog, GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA), - 0, - "the presence whose projection cannot be read is skipped" - ); - Ok(()) - } - - /// Every failure to establish Odin's OWN authority ends Odin (temporary - /// rule, see `survive`), whatever shape the failure takes: an anchor that - /// does not decode or names another schema, an Expected Idunn no longer - /// projects, an activation or lease that does not decode. - #[test] - fn every_failure_to_establish_its_own_authority_ends_odin() -> Result<()> { - type Tamper = fn(CultCacheEnvelope) -> Option; - let cases: [(&str, Tamper); 5] = [ - ("anchor does not decode", |mut entry| { - if entry.r#type == GameCultServiceTrustAnchorRecord::TYPE { - entry.payload = vec![0xc1]; - } - Some(entry) - }), - ("anchor names another schema", |mut entry| { - if entry.r#type == GameCultServiceTrustAnchorRecord::TYPE { - entry.schema_id = Some("gamecult.service_trust_anchor.v99".into()); - } - Some(entry) - }), - ("activation does not decode", |mut entry| { - if entry.r#type == IdunnRuntimeActivationRecord::TYPE { - entry.payload = vec![0xc1]; - } - Some(entry) - }), - ("lease does not decode", |mut entry| { - if entry.r#type == IdunnProcessWriteLeaseRecord::TYPE { - entry.payload = vec![0xc1]; - } - Some(entry) - }), - ("Expected is no longer projected", |entry| { - (entry.r#type != IdunnExpectedIncarnationRecord::TYPE).then_some(entry) - }), - ]; - for (name, tamper) in cases { - let mut odin = activated_odin()?; - odin.pass()?; - let before = odin.stored_sequence()?; - odin.tamper_projection(|entries| entries.into_iter().filter_map(tamper).collect())?; - for _ in 0..3 { - odin.timers = ServingTimers::default(); - let error = odin - .pass() - .expect_err(&format!("{name}: Odin must not serve a frozen presence")); - assert!( - error.downcast_ref::().is_some(), - "{name}: {error:#}" - ); - } - assert_eq!(odin.stored_sequence()?, before, "{name}"); - } - Ok(()) - } - - /// Another target's broken records are that target's fault: Odin keeps - /// serving, and the failing refresh is logged once, not on every pass. - #[test] - fn another_targets_broken_authority_never_ends_odin_and_logs_once() -> Result<()> { - let mut odin = activated_odin()?; - let mut sibling = odin.state.borrow().authority_material.expected.clone(); - sibling.target = "sibling".into(); - sibling.validate()?; - odin.append_projection(vec![ - CultCacheEnvelope { - key: IncarnationRef::of(&sibling)?.key(), - r#type: IdunnExpectedIncarnationRecord::TYPE.into(), - payload: sibling.canonical_bytes()?, - stored_at: rfc3339_millis(unix_millis()?)?, - schema_id: Some(IDUNN_EXPECTED_INCARNATION_SCHEMA.into()), - }, - CultCacheEnvelope { - key: "root/sibling/runtime-presence".into(), - r#type: GameCultServiceTrustAnchorRecord::TYPE.into(), - payload: vec![0xc1], - stored_at: rfc3339_millis(unix_millis()?)?, - schema_id: Some(GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA.into()), - }, - ])?; - let suppressed = |odin: &OdinWorld| odin.state.borrow().log_gate.borrow().suppressed_total; - - odin.pass()?; - assert_eq!(suppressed(&odin), 0, "the first failure is logged"); - for repeat in 1..=3 { - odin.timers = ServingTimers::default(); - odin.pass()?; - assert_eq!(suppressed(&odin), repeat, "a repeat is not logged again"); - } - Ok(()) - } - - #[test] - fn a_repeating_line_is_logged_once_per_interval_or_when_it_changes() { - let mut gate = LogGate::default(); - let start = Instant::now(); - assert_eq!(gate.admit("s", "m", start), Some(0)); - assert_eq!( - gate.admit( - "s", - "m", - start + REPEATED_LOG_INTERVAL - Duration::from_millis(1) - ), - None - ); - // A changed message is a new line, and reports what it swallowed. - let later = start + Duration::from_secs(1); - assert_eq!(gate.admit("s", "other", later), Some(1)); - // Subjects are independent. - assert_eq!(gate.admit("t", "other", later), Some(0)); - // The interval is measured from the last line written. - assert_eq!( - gate.admit("s", "other", later + REPEATED_LOG_INTERVAL), - Some(0) - ); - assert_eq!(gate.suppressed_total, 1); - - for index in 0..=2 * MAX_LOG_SUBJECTS { - gate.admit(&format!("subject-{index}"), "m", later); - } - assert!(gate.seen.len() <= MAX_LOG_SUBJECTS); - } - - /// An application rejection ends only the offending peer's session, and a - /// stray datagram is dropped; neither ends Odin's serving loop. - #[test] - fn an_application_rejection_or_a_stray_packet_does_not_end_odin() -> Result<()> { - let mut odin = activated_odin()?; - let target = odin.server.local_addr()?; - let not_a_presence = CultNetMessage::DocumentPutRaw { - message_id: "rejected".into(), - document: CultNetRawDocumentRecord { - schema_id: GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA.into(), - record_key: "ghostlight".into(), - stored_at: rfc3339_millis(unix_millis()?)?, - payload_encoding: CultNetRawPayloadEncoding::Messagepack, - payload: vec![0xc1], - source_runtime_id: None, - source_agent_id: None, - source_role: None, - tags: None, - }, - }; - odin.serve_while(move || { - lingering_peer(target, PEER_CONNECTION_BASE, Some(not_a_presence)) - })??; - assert_eq!( - odin.server.session_count(), - 0, - "the rejection ended the offending session" - ); - - UdpSocket::bind("127.0.0.1:0")?.send_to(b"junk", target)?; - for _ in 0..50 { - odin.pass()?; - thread::sleep(IDLE_POLL_INTERVAL); - } - assert!(odin.server.packets_dropped() >= 1); - - odin.serve_while(move || lingering_peer(target, PEER_CONNECTION_BASE + 1, None))??; - assert_eq!(odin.server.session_count(), 1, "Odin still admits peers"); - Ok(()) - } - - /// A provider put, as the server hands it to the sink. - fn provider_put( - odin: &OdinWorld, - schema: &str, - key: &str, - payload: Vec, - ) -> Result<()> { - odin.state - .borrow_mut() - .accept_raw_document(CultMeshRudpRawDocumentReceipt { - session: cultmesh_rs::CultMeshRudpSessionKey { - remote_addr: "127.0.0.1:1".parse()?, - connection_id: 7, - }, - message_id: "put".into(), - transport_sequence: 1, - received_at_unix_millis: unix_millis()?, - document: CultNetRawDocumentRecord { - schema_id: schema.into(), - record_key: key.into(), - stored_at: rfc3339_millis(unix_millis()?)?, - payload_encoding: CultNetRawPayloadEncoding::Messagepack, - payload, - source_runtime_id: None, - source_agent_id: None, - source_role: None, - tags: None, - }, - }) - } - - /// Soul's probe P-B: a peer that puts a document of Odin's own kind (the - /// publisher watermark, keyed by Odin's target, holding the largest - /// sequence) would freeze every later heartbeat and survive restarts. Odin - /// accepts only the namespaces providers publish in, so every record Odin - /// or Idunn owns is refused, and presence keeps advancing. - #[test] - fn a_peer_cannot_write_a_record_odin_owns_and_presence_keeps_advancing() -> Result<()> { - let mut odin = activated_odin()?; - odin.pass()?; - let before = odin.stored_sequence()?; - let stored_before = - SingleFileMessagePackBackingStore::new(&odin.store).pull_all_read_only_snapshot()?; - - // Every kind Odin itself stored (its watermark and correlations, found - // rather than named), and the kinds Idunn projects to it. - let mut owned: BTreeSet<(String, String)> = stored_before - .iter() - .filter(|entry| entry.r#type != GameCultRuntimePresenceHealthRecord::TYPE) - .map(|entry| (entry.r#type.clone(), entry.key.clone())) - .collect(); - for kind in [ - IdunnExpectedIncarnationRecord::TYPE, - IdunnRuntimeActivationRecord::TYPE, - IdunnProcessWriteLeaseRecord::TYPE, - GameCultServiceTrustAnchorRecord::TYPE, - "odin.topology_publisher_watermark", - "odin.interface_layout", - ] { - owned.insert((kind.into(), TARGET.into())); - } - assert!( - owned - .iter() - .any(|(kind, _)| kind == OdinRuntimeTopologyCorrelationRecord::TYPE), - "the store holds Odin's own records: {owned:?}" - ); - for (kind, key) in &owned { - let refused = provider_put( - &odin, - &format!("{kind}.v1"), - key, - rmp_serde::to_vec(&(format!("{kind}.v1"), TARGET, u64::MAX))?, - ) - .expect_err(&format!("{kind} must be refused")); - assert!(format!("{refused:#}").contains("accepts no"), "{refused:#}"); - } - assert_eq!( - SingleFileMessagePackBackingStore::new(&odin.store).pull_all_read_only_snapshot()?, - stored_before, - "no refused put touched the store" - ); - - odin.timers = ServingTimers::default(); - odin.pass()?; - assert_eq!( - odin.stored_sequence()?, - before + 1, - "Odin's own presence still advances" - ); - Ok(()) - } - - /// The same rule read the other way: the catalog serves a provider's - /// document and Odin's presence, and nothing else Odin holds. - #[test] - fn the_catalog_serves_provider_documents_and_presence_only() -> Result<()> { - let mut odin = activated_odin()?; - odin.pass()?; - provider_put(&odin, "ghostlight.doc.v1", "doc-1", vec![1])?; - let stored: BTreeSet = - SingleFileMessagePackBackingStore::new(&odin.store) - .pull_all_read_only_snapshot()? - .into_iter() - .map(|entry| entry.r#type) - .collect(); - assert!( - stored.len() >= 4, - "Odin's store holds more than what it serves: {stored:?}" - ); - - let served: BTreeSet = odin - .catalog()? - .into_iter() - .map(|document| document.schema_id) - .collect(); - assert_eq!( - served, - BTreeSet::from([ - GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA.to_owned(), - "ghostlight.doc.v1".to_owned() - ]) - ); - Ok(()) - } - - #[test] - fn provider_namespaces_match_whole_segments() { - for accepted in ["ghostlight.doc", "heimdall.command_boundary", "gamecult.eve.command", "gamecult.media_stream_request"] { - assert!(is_peer_document_type(accepted), "{accepted}"); - } - for refused in [ - "ghostlightx.doc", - "ghostlight", - "gamecult.eve", - "gamecult.runtime_presence_health", - "gamecult.service_trust_anchor", - "odin.topology_publisher_watermark", - "idunn.process_write_lease", - ] { - assert!(!is_peer_document_type(refused), "{refused}"); - } - } - - /// One real schema id per namespace, each taken from its publisher (see - /// `PEER_DOCUMENT_NAMESPACES`): Odin accepts the put and the catalog serves - /// it. Soul's probe P1-A is the media pair, which Muninn and Ratatoskr - /// exchange through Odin. - #[test] - fn every_publisher_schema_is_accepted_and_served() -> Result<()> { - const PUBLISHED: &[&str] = &[ - "ghostlight.schema_catalog.v1", - "heimdall.command_boundary.v1", - "muninn.obs_stream_catalog.v1", - "sleipnir.input_mapping.v1", - "gamecult.eve.provider_advertisement.v1", - "gamecult.eve.surface.v1", - "gamecult.eve.surface_state.v1", - "gamecult.eve.plugin_advertisement.v1", - "gamecult.model.atlas_publication.v0", - "gamecult.aetheria.asset_manifest.v1", - "gamecult.media_stream_advertisement.v1", - "gamecult.media_stream_request.v1", - ]; - let odin = activated_odin()?; - for schema in PUBLISHED { - provider_put(&odin, schema, "key", vec![1])?; - } - let served: BTreeSet = odin - .catalog()? - .into_iter() - .map(|document| document.schema_id) - .collect(); - for schema in PUBLISHED { - assert!(served.contains(*schema), "{schema} is not served"); - } - Ok(()) - } - - /// Namespaces no source publishes to Odin are refused, and a lookalike of - /// the media types is not the media types. - #[test] - fn unpublished_namespaces_are_refused() -> Result<()> { - let odin = activated_odin()?; - for schema in [ - "mimir.doc.v1", - "streampixels.doc.v1", - "vili.doc.v1", - "gamecult.loki.doc.v1", - "gamecult.media.doc.v1", - "gamecult.media_stream_advertisement_x.v1", - ] { - assert!( - provider_put(&odin, schema, "key", vec![1]).is_err(), - "{schema}" - ); - } - Ok(()) - } - - #[test] - fn only_the_write_lease_is_fatal_in_the_serving_loop() -> Result<()> { - let odin = activated_odin()?; - let state = odin.state.borrow(); - assert_eq!(survive(&state, "x", Ok(3))?, Some(3)); - assert_eq!( - survive::<()>(&state, "x", Err(anyhow::anyhow!("io")))?, - None - ); - let lost = anyhow::Error::new(WriteLeaseLost("gone".into())).context("refreshing"); - assert!(survive::<()>(&state, "x", Err(lost)).is_err()); - Ok(()) - } - - /// A failure of the projection file read (permission denied, not found, - /// interrupted) says nothing about what Idunn published: it is retried. A - /// record the reader could not decode or validate is Odin's own authority - /// failing, and stays fatal even when the decoder wraps an I/O error. - #[test] - fn a_projection_read_failure_is_retried_a_decode_failure_is_not() -> Result<()> { - let odin = activated_odin()?; - let state = odin.state.borrow(); - for kind in [ - std::io::ErrorKind::PermissionDenied, - std::io::ErrorKind::NotFound, - std::io::ErrorKind::Interrupted, - ] { - let read = anyhow::Error::new(std::io::Error::from(kind)) - .context("failed to read") - .context(ProjectionUnreadable); - assert_eq!( - survive::<()>(&state, "projection", Err(own_projection_failure(read)))?, - None, - "{kind:?}" - ); - } - let undecodable = anyhow::anyhow!("failed to decode MessagePack: invalid marker"); - assert_refused( - &survive::<()>(&state, "projection", Err(own_projection_failure(undecodable))) - .unwrap_err(), - ); - // A decoder that wraps an I/O error (MessagePack does, for a record - // that ends early) is still a decode failure. - let wrapped = anyhow::Error::new(std::io::Error::from(std::io::ErrorKind::UnexpectedEof)) - .context("failed to decode Expected"); - assert_refused( - &survive::<()>(&state, "projection", Err(own_projection_failure(wrapped))) - .unwrap_err(), - ); - Ok(()) - } - - /// Odin's own Expected record cut short by one byte is undecodable, so - /// Odin ends, though the decoder's error wraps an unexpected end of file. - #[test] - fn a_truncated_own_expected_record_ends_odin() -> Result<()> { - let mut odin = activated_odin()?; - odin.pass()?; - odin.tamper_projection(|mut entries| { - for entry in &mut entries { - if entry.r#type == IdunnExpectedIncarnationRecord::TYPE { - entry.payload.pop(); - } - } - entries - })?; - odin.timers = ServingTimers::default(); - assert_refused(&odin.pass().unwrap_err()); - Ok(()) - } - - /// A projection store cut short on disk is a decode failure of the file's - /// content, not a read failure of the file. - #[test] - fn a_truncated_projection_store_ends_odin() -> Result<()> { - let mut odin = activated_odin()?; - odin.pass()?; - let projection = odin.state.borrow().options.idunn_projection.clone(); - let mut bytes = std::fs::read(&projection)?; - bytes.pop(); - std::fs::write(&projection, bytes)?; - odin.timers = ServingTimers::default(); - assert_refused(&odin.pass().unwrap_err()); - Ok(()) - } - - /// The same rule through the serving loop: with Idunn's projection file - /// gone Odin keeps serving and publishes again once it is back; with a - /// projection that does not decode it ends. - #[test] - fn a_missing_projection_file_is_retried_by_the_serving_loop() -> Result<()> { - let mut odin = activated_odin()?; - odin.pass()?; - let before = odin.stored_sequence()?; - let projection = odin.state.borrow().options.idunn_projection.clone(); - let bytes = std::fs::read(&projection)?; - - std::fs::remove_file(&projection)?; - for _ in 0..3 { - odin.timers = ServingTimers::default(); - odin.pass()?; - } - assert_eq!(odin.stored_sequence()?, before, "nothing is published blind"); - - std::fs::write(&projection, bytes)?; - odin.timers = ServingTimers::default(); - odin.pass()?; - assert!( - odin.stored_sequence()? > before, - "publication resumes once the projection is readable" - ); - - std::fs::write(&projection, b"not a cultcache store")?; - odin.timers = ServingTimers::default(); - assert_refused(&odin.pass().unwrap_err()); - Ok(()) - } - - #[test] - fn a_failing_socket_is_retried_and_ends_odin_only_after_the_failure_limit() { - let start = Instant::now(); - let mut since = None; - let fault = || Err(anyhow::anyhow!("socket fault")); - assert!(!settle_poll(fault(), &mut since, start).unwrap()); - assert_eq!(since, Some(start)); - assert!( - !settle_poll( - fault(), - &mut since, - start + POLL_FAILURE_LIMIT - Duration::from_millis(1) - ) - .unwrap() - ); - // A successful poll ends the run, so the same fault starts a new one. - assert!(settle_poll(Ok(CultMeshRudpPollOutcome::Handled), &mut since, start).unwrap()); - assert_eq!(since, None); - let restart = start + POLL_FAILURE_LIMIT; - assert!(!settle_poll(fault(), &mut since, restart).unwrap()); - assert!(settle_poll(fault(), &mut since, restart + POLL_FAILURE_LIMIT).is_err()); - } -} diff --git a/deployment/idunn/recipe.toml b/deployment/idunn/recipe.toml deleted file mode 100644 index d862de8..0000000 --- a/deployment/idunn/recipe.toml +++ /dev/null @@ -1,74 +0,0 @@ -schema = "gamecult.idunn.target_declaration.v1" -target = "odin" -source_stamp_environment = "ODIN_BUILD_COMMIT" -required_gitlinks = [] - -[[steps]] -id = "test-odin-daemon" -phase = "test" -runner = "rust-build" -required_environment = ["CARGO_HOME", "HOME"] -argv = ["cargo", "test", "--locked", "-p", "odin-daemon"] - -[[steps]] -id = "build-odin-daemon" -phase = "build" -runner = "rust-build" -required_environment = ["CARGO_HOME", "HOME"] -argv = [ - "cargo", - "build", - "--locked", - "--release", - "-p", - "odin-daemon", - "--bin", - "odin-daemon", -] - -[[artifacts]] -id = "odin-daemon" -source_kind = "runner-output" -runner = "rust-build" -source = "target/release/odin-daemon" -destination = "odin-daemon" -executable = true - -[service] -executable_artifact = "odin-daemon" -arguments = [ - { kind = "literal", value = "--state-root" }, - { kind = "binding", name = "state_root" }, - { kind = "literal", value = "--idunn-projection" }, - { kind = "binding", name = "idunn_projection_path" }, - { kind = "literal", value = "--idunn-anchor" }, - { kind = "binding", name = "idunn_anchor_path" }, -] -transport = "rudp" -route_required = true -required_environment = [ - "GAMECULT_IDUNN_CANDIDATE_BIND", - "GAMECULT_IDUNN_PROCESS_WRITE_LEASE", - "GAMECULT_IDUNN_RUNTIME_BUNDLE", - "ODIN_TOPOLOGY_IDENTITY", -] - -[service.health] -contract = "odin.runtime-health.v1" - -[state] -schema_generation = "odin-v2" - -[[state.slots]] -id = "topology" -relative_path = "topology.cc" -kind = "cultcache-file" -schema = "odin.runtime_topology_correlation.v2" -writer = "process-bound-single-writer" -recovery = "preserve" -startup = "create-or-open-after-write-lease" - -[[provides]] -capability = "odin.verse-rendezvous" -schema = "odin.verse-topology.v1" -compatibility = "v1" diff --git a/docs/architecture.md b/docs/architecture.md deleted file mode 100644 index 28080d8..0000000 --- a/docs/architecture.md +++ /dev/null @@ -1,287 +0,0 @@ -# Odin Architecture - -## Objective - -Odin is the central all-seer node for GameCult's CultMesh world: every Verse can discover every other Verse, learn which schemas they speak, and ask for a translation route when their local document shape differs. - -## Current Mechanism - -```text -Eve/CultUI provider surfaces - + provider advertisements - -> Odin observation cycle - -> Verse-owned service records - -> Provider-owned interface records - -> Odin state document - -> CultMesh/CultCache persistence - -> Eve dashboard state - -> Eve, browser, compact TUI, and future renderers -``` - -This first path proves the operator surface and persistent state. It does not yet pretend to be full peer exchange. - -## Rust Target Spine - -The target Odin machine is Rust-first and typed-state-first: - -```text -Verse / host / device / provider inputs - -> ingest ports - -> normalization - -> typed Odin records - -> CultMesh node - -> CultCache .cc persistence - -> CultNet/CultMesh document registry - -> Odin Eve/CultUI deck projection - -> Gjallar Yggdrasil aggregate Eve composition - -> compact display feeds -``` - -The first Rust core lives in `crates/odin-core`: - -- `documents.rs`: typed Odin records and the CultMesh document set. -- `ports.rs`: narrow ingest traits plus clock injection for deterministic tests. -- `pipeline.rs`: collection and normalization from input observations to typed - Odin records. -- `repository.rs`: `OdinRepository` abstraction, in-memory mock repository, and - CultMesh-backed repository. - -The deployed body is `crates/odin-daemon`, built and run by Idunn from -`deployment/idunn/recipe.toml`. `crates/odin-core` holds the typed record spine -that the rest of the machine grows into. - -## Runtime Body - -Odin's executable body is split by ownership: - -- `crates/odin-daemon`: the deployed process. Reads Idunn's read-only topology - projection, admits provider presences over RUDP for the incarnations Idunn - projects, persists them through CultMesh/CultCache, publishes signed - runtime-topology correlation records, and answers CultNet/RUDP snapshot and - document requests. Deployment, restart, and survival of this process are - Idunn's. -- `crates/odin-core`: typed Odin documents, ingest ports, normalization, and - CultMesh/CultCache repository boundaries. - -If a new owner is needed, name the owner and its invariant before adding code. - -The accepted document registry is also the persistence admission boundary. -Unknown schemas may be observed for diagnostics but are not silently persisted -as untyped truth. Heimdall access discovery therefore registers -`gamecult.eve.provider_advertisement.v1`, -`heimdall.command_boundary.v1`, -`gamecult.eve.plugin_advertisement.v1`, and -`heimdall.transport_profile.v1`. Their globally unique record keys prevent one -schema from overwriting another in the shared catalog. Odin returns the -redacted route metadata; it does not proxy private auth operations or own any -claim, completion, token, or app secret. - -Gjallar is the Yggdrasil-resident aggregate compositor for what Odin can show. -Its runtime lives in `/srv/gjallar/current` and consumes Odin's accepted -provider-state snapshot. Gjallar owns enumeration, tiling, and publication of -the typed `gjallar.overview` Eve surface. Eve clients own graphical, terminal, -and framebuffer lowering. Gjallar must not own the underlying registry, probe, -provider truth, client pixels, or translation decisions. - -Idunn (`GameCult/Idunn`) owns deployment and daemon survival, including Odin's. -It builds from each target's recipe, activates and restarts the admitted -incarnation, and holds the deployment and lifecycle brakes. Odin publishes what -it can see and reads Idunn's topology projection; it does not start, restart, -deploy, or health-probe any daemon, and no Odin code path keeps a process alive. -When human action is needed, Idunn uses CultMesh to request a Bifrost-owned -operator notification crossing. Idunn must not own Verse discovery, schema -truth, provider dashboards, identity grants, Discord delivery, owner-DM -delivery, or renderer layout. - -Muninn is the portable local telemetry Verse assembler. Its Rust body lives in -the `GameCult/Muninn` repository and publishes `muninn.telemetry_surface.v1` -through CultMesh/CultCache. Muninn may run on Raven, Nightwing, Starfire, or any future -device body. It names locally accessible telemetry affordances: screen capture, -loopback audio, microphones, cameras, and future sensors. Muninn does not start -expensive capture streams merely because the daemon is alive. The default -`serve` posture publishes an idle typed surface; explicit activation, such as -`muninn activate` for Raven A/V over SRT, is the only path that starts FFmpeg, -WASAPI loopback, video capture, or similar resource-consuming workers. - -Muninn owns local telemetry discovery and stream activation boundaries. It does -not own Mimir's normalized ingest ledger, OBS rendering, Gjallar composition, -Odin discovery truth, or Idunn keepalive policy. Active stream records such as -`muninn.capture_stream.v1` are evidence of requested streams, not permission for -startup to burn capture resources. - -Move optical marker extraction belongs to Muninn because it is sensor stream -exposure, not Mimir fusion or Odin registry truth. The native helper lives at -`crates/muninn-move-tracker`; Muninn may publish per-frame candidates as -`muninn.move_marker_candidate.v1`. USB Move controller facts are -`muninn.move_controller_state.v1` receipts. Those records are not the hot -tracking transport: Muninn bundles marker candidates and controller states into -a CultMesh bytes stream frame with metadata schema -`mimir.muninn_move_evidence_stream_frame.v1`. Mimir consumes that stream into -tracking buffers and later fusion. Odin indexes the schema and projection -surface only. - -Bifrost is the bridge for Persona speech and other public/owner-facing -crossings. When a Persona interpreter decides a Persona speaks, the accepted -side effect is a Bifrost CultMesh command or document that names actor, -authority, target surface, context, policy result, and receipt path. VoidBot -observes Discord, preserves room cognition, moderates, and may provide -compatibility delivery, but it is not the owner of swarm speech transport. -VoidBot's repo search, Discord history search, archive lookup, and source -retrieval are required native CultCache/CultMesh service surfaces. Any remaining -VoidBot-local or MCP-only implementation is migration debt. MCP is the bridge -for external agentic access, not the native path for GameCult agents that -already have CultMesh affordances. - -## Target Mechanism - -```text -Verse announcement - -> CultNet hello and schema catalog exchange - -> Odin registry - -> compatibility and translation index - -> subscriptions / worker routing / dashboard projection -``` - -## Invariants - -- Odin owns the accepted registry of known Verses. -- A Verse owns its own schemas and authority model; Odin indexes and translates, it does not silently rewrite local truth. -- Device clients own sensor and media capture; Mimir owns the normalized ingest ledger; Odin owns the aggregate operator projection. -- Muninn advertises local telemetry affordances cheaply and starts capture only - after an explicit activation request. -- Muninn's live Move evidence is a CultMesh stream frame body; CultCache - Move records are receipts/debug state and must not become Mimir's hot - tracking path. -- Translation paths must name source schema, target schema, lossiness, authority, and version. -- Service presentation flows are CultMesh/Eve/CultUI interface projections. Odin aggregates those projection graphs; it does not replace them with nameplate summaries. -- Renderers lower surfaces only. If a renderer fixes network truth, the machine is split-brained. -- CultCache is the durable state substrate; CultNet is the wire vocabulary; CultMesh is the Verse and peer-consensus layer. -- The Eve surface carries explicit `verse` and `service` nodes plus provider-owned retained interface trees. Compact renderers may derive visual facets from those nodes, but may not invent observation truth. -- Rust organs must accept mocked inputs through narrow traits. Unit tests prove - local invariants; pipeline smokes prove adjacent typed handoff; full daemon - boots are not the only test path. -- JSON is not state authority. It is allowed only for schema publication, - debugging, compatibility export, or external xenos boundaries. - -## Test Surfaces - -Current Rust verification: - -- `pipeline_collects_from_injected_ports`: proves ingest ports and clock injection. -- `memory_repository_supports_fast_unit_tests`: proves repository consumers can test without CultMesh. -- `cultmesh_repository_round_trips_typed_records`: proves typed Odin records - persist through CultMesh/CultCache and reload from `.cc`. - -## Service Architecture Contract - -Odin is the witness for the GameCult service contract: - -```text -durable service state -> CultCache .cc -shared local visibility -> CultMesh -interactive presentation -> Eve GUI/TUI DSL -discovery and aggregation -> Odin -renderer bodies -> Eve clients, browser, compact TUI, native surfaces, overlays -``` - -When Odin sees a service, it should be able to answer: - -- What Verse owns this service? -- Which typed schemas does it publish? -- Where is its durable `.cc` state or CultCache-compatible store? -- Which CultMesh documents or providers make it visible locally? -- Which Eve GUI/TUI surface represents its meaningful presentation and controls? -- Which command boundary accepts, denies, forwards, or reconciles user intent? -- Which fields are stale, predicted, denied, or authoritative? - -This is not a reporting nicety. It is how Odin prevents services from becoming -private little islands with separate websites, dashboards, state formats, and -separate command languages. - -## Service Surface - -Odin's service records come from provider-owned presences and advertisements -received through CultMesh/RUDP, not from host probes. - -Gjallar consumes Odin's accepted CultMesh/Eve state and composes every visible -provider surface into one typed aggregate on Yggdrasil. EveCanvas, browser, and -TUI clients lower that aggregate. If Odin starts deciding tile composition, the -composition owner has leaked upward. If providers tune themselves for one -client instead of emitting clean Eve/CultUI surfaces, provider truth has leaked -downward. - -## Current Interface Surface - -Odin discovers provider advertisements and interface bindings from daemon-owned -CultMesh/CultCache stores plus live CultNet/RUDP announcements. Providers own -their compositions; Odin embeds each provider's `surface.root` as an -`interface` child with provenance, version, status, source witness, and layout -metadata. - -This is the model for future services: if a service publishes an operator interface, ingest the Eve/CultUI composition graph and lower it. Do not collapse it into a service-status tile unless the graph is unavailable and the tile is explicitly a temporary probe. - -The expected provider output is Eve DSL or an equivalent -`gamecult.eve.surface.v1` retained tree. GUI and TUI are lowerings of the same -interactive language; they are not separate dashboard products. Huginn's `.cc` -inspection surface is the current clean example: Huginn inspects CultCache bytes -and emits Eve DSL, while Eve or any other runtime owns presentation. - -Provider advertisements are the promotion path out of probing. Odin's document -registry already accepts `gamecult.eve.provider_advertisement.v1` alongside -`gamecult.eve.interface_binding.v1` and `gamecult.eve.surface_state.v1`. -Daemons should publish advertisements that name service id, Verse id, schema -catalog, `.cc` witnesses, Eve surface keys, command boundaries, nested Verses, -style capabilities, freshness, and redaction policy. Once an advertisement is -available, Odin should prefer it over LAN scans, hardcoded deck URLs, private -layout files, host probes, or web-dashboard scraping. Daemon health and -provider state should publish through `cultnet.transport.rudp.v0`; -product/debug routes are outside-Odin lowerings only and must not become -daemon-owned truth. - -Provider advertisements should also publish semantic CultMesh addresses in this -shape: - -```text -asgard../ -``` - -Examples: - -```text -asgard.starfire.odin/eve/providers -asgard.starfire.bifrost/eve/tui -asgard.starfire.bifrost/eve/gui -asgard.yggdrasil.streampixels/eve/tui -asgard.yggdrasil.streampixels/eve/gui -``` - -The canonical service may omit the current machine when identity should survive -relocation, such as `asgard.bifrost`. Located service addresses name the current -host, such as `asgard.starfire.bifrost` now and -`asgard.yggdrasil.bifrost` after migration. CultNet routes are transport -metadata for resolving those names. Native daemon transport is CultNet over the -shared RUDP profile; renderer URLs belong outside Odin and are not service -identity. - -The canonical contract lives in -`E:\Projects\Eve\docs\provider-advertisement-contract.md`. - -## Observation Surface - -Odin no longer tails Mimir JSONL artifacts for observation truth. Device and -media observations must arrive as provider-owned CultMesh/Odin records or -retained Eve/CultUI surfaces; Odin may project those accepted records, but it -does not scrape artifact logs to synthesize observation streams. - -## First Translation Model - -Odin's translation registry should start as data, not magic: - -- `sourceSchema` -- `targetSchema` -- `translationKind`: `identity`, `projection`, `lossyProjection`, `adapter`, or `unsupported` -- `owner` -- `version` -- `notes` - -No regex tribunals for meaning. Natural-language schema interpretation can be assisted by models later, but accepted translation routes must be inspectable typed state. diff --git a/docs/gjallar.md b/docs/gjallar.md deleted file mode 100644 index 7a1decb..0000000 --- a/docs/gjallar.md +++ /dev/null @@ -1,64 +0,0 @@ -# Gjallar - -Gjallar is the Yggdrasil-resident aggregate compositor for Odin's domain. - -Odin accepts Verse discovery and provider-owned Eve surfaces. Gjallar consumes -that accepted snapshot and publishes one typed `gjallar.overview` composition -containing every currently visible provider surface. EveCanvas, browsers, TUI -clients, and agent readers lower the same aggregate without becoming its owner. - -## Authority Map - -- Owner: Gjallar owns aggregate membership, tiling, marquee placement, layout - intent, visibility, and composition versioning. -- Inputs: Odin's accepted CultMesh/CultNet snapshot, provider-owned surface - graphs, Odin's canonical marquee tape, and display-independent layout hints. -- Outputs: `gjallar.overview`, its CultCache/CultMesh/CultNet publication, and - compact composition/freshness telemetry. -- Derived state: panel weights, ordering, tile layout, unavailable presentation, - and aggregate version are derived from Odin/provider state. -- Forbidden writers: Gjallar does not probe hosts, accept discovery truth, - mutate provider state, open `/dev/fb0` in daemon mode, capture client input, - or decide client pixels. Eve clients do not decide aggregate membership. -- Shared paths: iOS/UIKit, browser, optional TUI/framebuffer, and agent capture - lower the same published overview. -- Deletion line: Nightwing's `gjallar.service`, framebuffer lifecycle target, - and `nightwing-gjallar` Idunn actuator are obsolete authorities and must not - survive Yggdrasil admission. - -## Body - -- Runtime source: `F:\Projects\Gjallar` / `GameCult/Gjallar`. -- Daemon host: Yggdrasil beside `odin.service` and - `idunn-yggdrasil.service`. -- Unit: `gjallar-yggdrasil.service`. -- Runtime mode: `--headless`; no framebuffer, font atlas, or mouse device is - opened. -- Input: Yggdrasil-local Odin accepted snapshot over CultNet/RUDP. -- State: `/var/lib/gamecult/gjallar/gjallar.service.cc`. -- Deployment: immutable source/dependency pins, a digest-pinned .NET SDK image, - and Idunn's root-owned `gjallar` actuator manifest. -- Continuity: systemd restarts the admitted release. Until Gjallar publishes - authenticated C# health, Idunn observes its diagnostic health but does not - restart merely because authenticated publication is missing. - -## Runtime Contract - -```text -provider-owned Eve surfaces - -> Odin accepted discovery/provider snapshot - -> Gjallar aggregation and tiling - -> typed gjallar.overview Eve surface - -> EveCanvas / browser / TUI / agent lowerers -``` - -## Invariants - -- Odin owns discovery and provider acceptance. -- Providers own their surface truth and command consequences. -- Gjallar owns composition, not discovery or pixel rendering. -- Eve clients own rendering and local input capture. -- Missing or invalid provider surfaces become explicit unavailable state or are - omitted; Gjallar never invents replacement truth. -- Daemon health follows accepted-snapshot and aggregate-publication freshness, - not rendered frames. diff --git a/docs/hermodr-extraction-plan.md b/docs/hermodr-extraction-plan.md deleted file mode 100644 index 53d9d07..0000000 --- a/docs/hermodr-extraction-plan.md +++ /dev/null @@ -1,306 +0,0 @@ -# Hermodr Extraction Plan - -## Objective - -Hermodr is the Eve-to-browser lowering bridge. It should resolve providers -through Odin's directory, subscribe to those providers for their state, render -their surfaces to browsers, carry operator intent back to the provider that owns -the consequence, and — new — emit a surface as static bytes for audiences that -are not Verse participants. - -It currently runs its own provider ingress and its own state store instead. This -plan deletes that, moves the daemon into its own repository, and adds static -lowering as a second output mode. - -## What Odin is - -Odin is a rendezvous organ. It tells you what state is available, what schemas -speak it, and where to reach it. It does not tell you what the state is, and it -is not in the data path. - -A provider owns its state and serves it. Odin owns the directory. A consumer -resolves through the directory and then talks to the provider. - -Hermodr's command path already works this way. `findProviderCommandRoute` looks -a route up in the catalog and then publishes the command to the provider's own -advertised endpoint. Erycina's surface says the same thing from the other side: -`discoveryOwner: "Odin"`, while `canonicalSurfaceUri` points at -`cultmesh://asgard.starfire.erycina/eve/operator/surface` — Odin tells you where, -you go ask Erycina. - -## Current mechanism - -Hermodr lives in Odin as Node inside a Rust repository: `src/hermodr-daemon.cjs` -(1,462 lines), `src/hermodr-state-stream.cjs` (32), `test/hermodr-*.test.cjs` -(191), four PowerShell lifecycle scripts, and a persona avatar. Eve holds the -browser-side consumer at `web/hermodr-provider-catalog.mjs`. - -### The intent path is already correct - -`POST /hermodr/commands/eve` is generic across providers. It resolves a -`cultmesh://` target from the body or from the provider catalog, wraps intent as -`gamecult.eve.command.v1`, stamps `publishedBy: "hermodr-browser-lowering"`, -publishes to the provider's advertised route, and returns a receipt. Eve's client -passes `commandSink: publishCommandIntent` into the renderer and refuses any -response that is not a correlated `gamecult.eve.command_receipt.v1` in state -`reconciled`. - -This path is kept unchanged. It is also the reference for what the state path -should look like. - -### The state path is the defect - -`main()` constructs an `OdinLivePublicationSource` — an in-process `Map` with a -read side (`latest`, `watch`, `watchLifecycle`) and a write side (`accept`, -`withdraw`). It opens its own provider-session ingress, bound to its own address -with its own session token, and feeds accepted documents into that private -store. `HermodrStateStreamRegistry` watches the store and pushes lifecycle -events to browsers. - -So providers publish their state directly into Hermodr, and Hermodr decides what -it holds. A surface reaches a browser only if its provider binds to Hermodr, -which makes a required ingress out of something named a bridge. - -The class is called `OdinLivePublicationSource` and lives in `src/odin/`. Odin -does not use it. Neither the coordinator nor any Odin test references it, and -the same is true of `provider-session-ingress.cjs`. This is Hermodr's own state -machinery wearing Odin's name and filed under Odin's shared modules, which is -why it reads as though Odin sanctioned it. - -### The loop does not close - -The command path was added after the fact, on discovering the original bridge -was entirely non-interactive. It was added well, but to one leg only, and the -rest still assumes a viewer. - -Intent leaves correctly, to the provider that owns the consequence. The -consequence returns as newly published provider state — and that reaches the -browser only through Hermodr's private ingress. A provider must therefore -publish twice: once wherever the Verse expects it, and once into Hermodr, so the -operator can see their own action land. - -The core issue is not a missing write path. Intent goes out the right door and -consequence comes back through the wrong one. Deleting the ingress is what -closes the loop: once state arrives by subscription to the provider, a command's -effect returns by the same route as every other change. - -The client already carries the seed of the static case. `publishCommandIntent` -checks `liveHermodr` and, when absent, logs the intent instead of posting it. - -## Invariants - -- A provider owns its state and serves it. Nothing else holds it as truth. -- Odin owns the directory: what exists, what schema, where. Never the data path. -- Hermodr owns the browser edge: session, transport, lowering, relay of intent. - It holds projections with sequence numbers, never truth. -- A lowering runtime cannot make something true by rendering it. -- Static output carries no back-channel and must not pretend otherwise. - -## Authority map - -**Owner.** Each provider owns its own state, its surface document, and its -command routes. Odin owns provider discovery, schema awareness, and route -advertisement. - -**Inputs to Hermodr.** Odin's catalog, to resolve providers and routes. Provider -subscriptions, for state. Browser requests. - -**Outputs.** Lowered surfaces; live state streams; typed -`gamecult.eve.command.v1` documents published to provider routes; receipts; -static artifacts. - -**Derived, not owner.** Everything Hermodr holds about provider state is a -projection carrying a sequence number. Its staleness marks are display facts, -not withdrawal decisions. - -**Forbidden writers.** Hermodr may not accept or withdraw a publication. It may -not bind a provider session. It may not author a command as itself. Odin may not -become a state relay; if a consumer can read state *from* Odin, the directory -has become the data path. - -**Shared paths.** State resolution and command routing must use the same -catalog lookup. Live and static lowering must render from the same surface graph -through the same composition primitive; if they diverge visually, the static -path is wrong, not the graph. - -## Intended change - -1. Delete the ingress and the private store. Hermodr resolves a provider through - the catalog, exactly as the command path already does, and subscribes to that - provider for state. -2. `HermodrStateStreamRegistry` survives untouched. It consumes only - `source.forProvider(id).watchLifecycle(schemaId, recordKey, cb)`, which is - already a narrow port. Replace what sits behind that port with a provider - subscription client and every stream, sequence number, and browser keeps - working. -3. Extract the daemon to `GameCult/Hermodr`. -4. Add static lowering as a library with a CLI entry point. - -## Cut line - -Deleted outright: - -- the `OdinLivePublicationSource` construction and every write into it -- `createProviderSessionIngress`, and the `--provider-session-bind` and - `--provider-session-token` options - -Leaves Odin with Hermodr, because Odin never used it: - -- `src/odin/live-publication-source.cjs` and - `src/odin/provider-session-ingress.cjs`, both referenced only by - `hermodr-daemon.cjs` and `test/hermodr-live-publication.test.cjs`. They are - misfiled Hermodr code, not shared Odin modules. If the subscription client - fully replaces them, they are deleted rather than moved. -- `src/odin/utils.cjs` (68 lines), also Hermodr-only. Copy the handful of - helpers actually used; do not extract a utility library. - -Moved out of Odin, for its own reasons: - -- `src/odin/idunn-rudp.cjs` (324 lines) follows Idunn to `GameCult/Idunn` as a - published health-client contract. Genuinely shared — the coordinator and a - health test use it too — so both consume it from its owner rather than each - carrying a copy. - -Resolved, not copied: - -- `src/odin/documents.cjs` (536 lines) is the only true shared dependency, used - by the coordinator, Hermodr, and two discovery tests. It survives as a decode - contract and must become a published package. Forking it creates two - definitions of one wire format, which is the failure this plan exists to - remove. - -## Subtraction budget - -Hermodr loses its ingress and its state store. Odin loses the Node daemon, four -lifecycle scripts, three misfiled Hermodr modules, and `idunn-rudp.cjs`. One -shared document package appears. Net: a duplicate acceptance authority deleted, -`src/odin/` reduced from fourteen modules to ten, one package added, one -repository added. - -The static lowering library is the only genuinely new surface. It earns its keep -by making public storefronts hostable without a mesh, a runtime, or a daemon — -the difference between a founding creator being able to self-host and not. - -## Build budget - -Node only; no Rust targets change. Odin's crates are untouched. The new -repository is one package with a test target, and static lowering adds a CLI -entry to that same package rather than a second package. - -## Phases - -**Phase 1 — Idunn RUDP client. Done, as a split.** The transport moved to -CultLib as `cultnet-ts`'s `signed-daemon-health`; Idunn now documents its -connection id and schema names; Odin keeps a 65-line adapter that declares that -contract. The whole-file move originally specified was not carried out, for the -reasons below. - -**Phase 2 — Delete the ingress, in place. Done.** `ProviderSubscriptionSource` -replaces the private store behind the existing port, the ingress and its options -are gone, and `src/odin/` is down to twelve modules. Verified by unit tests; -behaviour against a live provider over RUDP remains an operator step. - -**Phase 3 — Publish the document contract. Done.** The 45 definitions are -`cultcache-ts`'s `defineSwarmDocuments`, verified byte-identical to what -`documents.cjs` produced. Odin keeps a 26-line adapter under the name its -consumers already call. `utils.cjs` left with Hermodr, which used one of its six -functions. - -**Phase 4 — Extract. Done.** `GameCult/Hermodr`, MIT, sixteen files. The three -dependencies on Odin were resolved rather than carried: the catalog comes from -CultLib, Idunn's health contract is declared locally over the CultLib transport -with `sourceRuntimeId` `hermodr`, and `parseArgs` is seventeen lines of -`args.cjs`. `src/odin/` is down from fourteen modules to eleven, and Odin's -CommonJS surface from sixteen files to twelve. - -**Phase 5 — Static lowering. Done, in `GameCult/Hermodr`.** A library and CLI -rendering a surface graph to standalone HTML through the same renderEveSurface -the browser uses, under jsdom, with command controls disabled and labelled -because a static page has no back-channel. Runnable without the daemon. - -All five phases are complete. This document stays here as the record of what -left Odin and why; the work now happens in Hermodr. - -## Verification - -Positive: - -- A provider that publishes only to its own advertised address reaches a browser - through Hermodr. This fails today and is the point of the work. -- Live state streams keep their sequence numbers, and stale and reconnected - transitions still fire across a provider restart. -- A browser command still reaches its provider and returns a correlated receipt. -- Static output of a surface renders equivalently to the live lowering of the - same graph. - -Negative, and these are the ones that prove the authority moved: - -- Hermodr cannot be made to accept a provider publication. The code path is - gone, not merely unused. -- Starting Hermodr with the removed ingress options fails loudly rather than - silently ignoring them. -- With Odin stopped, Hermodr cannot resolve providers it has not already - resolved, but existing provider subscriptions keep delivering. If stopping - Odin stops live state, Odin is in the data path and this plan failed. -- Nothing reads state *from* Odin. A consumer able to do so proves the directory - became a relay. -- Two Hermodr instances against the same provider show the same state. -- Static output contains no command controls that appear operable. A dead button - in a static page is a lie about a back-channel that does not exist. - -## Why Phase 1 was split rather than moved - -Reading `idunn-rudp.cjs` before moving it changed the answer. Of its 324 lines, -13 mention Idunn, and most of those are error message strings. The genuinely -Idunn-owned content is two constants: the connection ID `0x1d0d0001` and the -schema name `idunn.signed_daemon_health.v1`. Everything else — Ed25519 signing, -RUDP session management, packet receipt, endpoint parsing, msgpack framing — is -generic CultNet client plumbing. - -Moving the file to Idunn would put 311 lines of transport code into a Rust -repository with no Node packaging, and would give Odin a cross-repo filesystem -dependency on a sibling checkout. The file already resolves CultLib by walking -`__dirname/../../../CultLib`, which works only while Odin sits beside CultLib; -Erycina had the identical bug and it broke the moment that repository moved. -Repeating it deliberately, in the plan whose purpose is removing misplaced -ownership, would be a poor trade. - -It also buys nothing yet. The duplication it prevents does not exist until -Hermodr leaves in Phase 4, because both consumers still live in this repository. - -Three options, in the order I would rank them: - -1. **Generic to CultLib, constants to Idunn.** The transport belongs beside - `cultnet-ts`, which Odin already resolves into and Hermodr will too. Idunn - owns the connection ID and the schema name. This is the real fix, and it - removes the sibling-path bug rather than relocating it. -2. **Defer to Phase 4.** Correct and free. Move it when the duplication actually - threatens, and decide the shape then. -3. **Move it whole to Idunn.** As originally written. Cheapest to type, and it - puts transport code where it does not belong while adding a fragile path. - -Option 1 was chosen and carried out. `idunn-rudp.cjs` fell from 324 lines to 65: -Idunn's three constants and the call shapes Odin's consumers already use. -`packages/cultnet-ts/src/signed-daemon-health.ts` holds the transport, taking -the contract as a parameter. Idunn's -`docs/signed-daemon-health-authority.md` gained the wire-contract table it was -missing — the connection id had existed only in this consumer's code. - -Both the moved module and the adapter dropped the sibling-path assumption on the -way, honouring `CULTLIB_ROOT` instead of walking up three directories from -wherever the file happens to sit. - -Phase 3's remaining decision is unchanged: `documents.cjs` is now the only -genuinely shared dependency left between Odin and a future Hermodr. - -## Open questions for the operator - -1. **`documents.cjs` ownership.** Published from Odin, or promoted into CultLib - beside the other typed contracts? It is a wire format several services share, - which argues for CultLib, but Odin authors it. -2. **Ephemeral view state.** Expanded panels, unsent field contents, optimistic - pending states. Client-side today by omission rather than decision. -3. **Static lowering and identity.** A live surface knows who is viewing; a - static artifact does not. Either static surfaces are public-only, or the - lowering takes an audience parameter and emits per-audience artifacts. - Public-only is smaller and covers the storefront. diff --git a/docs/store-recovery-cut.md b/docs/store-recovery-cut.md deleted file mode 100644 index fca90d5..0000000 --- a/docs/store-recovery-cut.md +++ /dev/null @@ -1,570 +0,0 @@ -# Odin store repair and recovery: cut map - -**Operator rulings, 2026-09-30:** -- **Q-R1:** "You got it". A foreign file under a running Odin is set aside and Odin continues. -- **Q-R2:** "Yep". Keep the previous generation on disk. -- **Q-R3:** "Start empty". Nothing decodable at activation means Odin starts empty. -- **Q-R4:** "Yep, and Idunn needs better reporting capabilities so it can serve as watchdog. I ought to get a message - about this on Discord if it ever happens." - - Stop writing after the third set-aside in 10 minutes, and keep serving. - - **New requirement:** Idunn watchdog reporting that reaches the operator on Discord. It is mapped as its own - campaign and is not an Odin cut. -- **Q-R5:** "That's fine, Odin still runs after all, right?" Yes. Odin keeps serving, and the store condition is - published as its own typed record, not as a degraded presence. -- **Q-R6:** "Approved". Both drills. - -**R1 LANDED: CultLib main `daedfdd6` (2026-09-30).** The merged tree `0e6891b3` was verified on Yggdrasil in every -runtime, including the four-runtime store interop test. That test runs close to its 30 s per-command limit under -load (`cult-cache.test.ts:1407`), so it is fragile: follow-up. Consumer pins still gate their own bumps: Bifrost only -with R3b's TS fsync; Muninn and Idunn with their error-text matches. - -**R1 status (Self, 2026-09-30).** Built on CultLib `hands/cultcache-read-failures` (`c0b56e06`..`b7908668`), then -fix batch 2 (`..2d7a3c78`). Soul's verdict on batch 2 was to hold the merge. Batch 3 is in Hands, fixing: -- **Blocker, F1 (zero-byte stores on Yggdrasil).** - - Two zero-byte stores are live: `/srv/bifrost/persona-feedback/{inbox/observations,outbox/deliveries}.cc`. - - They are pre-created by `touch` in gamecult-ops `install-bifrost-persona-feedback-native-yggdrasil.sh:42,46` - and `bootstrap-bifrost-persona-feedback-yggdrasil.sh:22,29`. - - Bifrost `persona-feedback.mjs serve` and Epiphany `epiphany-swarm` crash-loop on them once their CultLib pins - move past R1. - - **Neither pin may move until the scripts stop pre-creating stores and Self has moved the live files aside.** -- **F4.** Rust errors echo record values through serde's text (`lib.rs:753-758`). The header is echoed without bound. -- **F6.** A dangling symlink reads as absent, and the writer then replaces it. -- **F7.** The same NotFound-only rule in Python's `JsonLinesBackingStore` and in TS `pullAll`'s repair write. -- **M7.** A header-prefix fixture. -Recorded for later cuts: -- **F3 → R2/R3b.** TS, Python and C# decode the whole buffer before reading the header. A truncated newer-format - store (20..n-1 bytes) is "unsupported format" in Rust and a raw decode error elsewhere. -- **F5 → R3.** C# `ReadSnapshot` reads ENOTDIR/EISDIR as an empty store (`FileInfo.Exists`, `CultCache.cs:3439`). - C# `DirectoryMessagePackBackingStore` `File.Exists` (`:409`, `:497`) is the same. This is a live disagreement between - runtimes until R3. -- **F8 → R3b.** Python leaves its staging file behind when a write fails (`stores.py:124-128`). -- **Tooling.** - - `packages/cultcache-rs` has no committed `Cargo.lock`, so the map's `cargo test --locked` cannot run. - - The cultcache-ts interop test needs `CARGO_TARGET_DIR` unset under ygg-verify. -- **Soul on batch 3 (`2d7a3c78..3c9e195b`, gamecult-ops `bca7978`), 2026-09-30: merge both.** Pre-merge batch 4 is in - Hands: fix the README symlink claim (S1), close value echoes in the redb and typed-decode paths (S2) and in the - Python/TS non-string key echo (S3), make the unlock policy coherent (S9), classify encode refusals separately from - `NotReplaced` (S10), and fix a test timeout (S11). The ops branch deletes the guard test (S6) and the dead compose - layout (S5). - - **Open for R3:** writes through a symlinked store path replace the link, so a store behind a link to a mounted - volume moves into the container layer. R3 decides resolve or refuse. - - **Open for R3b:** Python and TS never fsync. After F1 their first create-by-rename is not covered by ext4 - `auto_da_alloc`, so a crash can leave zero bytes, which every post-R1 reader refuses forever. **Bifrost's CultLib - pin moves past R1 only together with R3b's TS fsync.** - - **For W0 (Odin):** classify a write failure through `CultCacheStoreWriteFailed.kind` together with its `io::Error`, - never retry on `NotReplaced` alone (S10). - - Deployed Epiphany is `d2ca6630`, using a vendored cultcache-rs (`ba6a4874`) that reads a missing store as empty. - All Epiphany units have been inactive since 2026-08-22. - - **Done 2026-09-30 20:48 CEST (Self).** gamecult-ops merged at `3fa22aa`. The inbox is setgid 2750. All three - zero-byte stores were renamed in place and moved to `/root/zero-byte-stores-20260930/` on Yggdrasil, with - `manifest.txt` recording owner, mode and mtime. None had gained bytes. All three Bifrost units stayed active, and - persona-feedback logged nothing and did not restart. - - The compose/container lane (the compose file, two deploy scripts, the `.ps1` uploader, two runbooks) is dead: - the live Bifrost units run native `dotnet` and `node`. **Deleted 2026-09-30, operator: "delete the Bifrost lane".** - gamecult-ops `fdb4356`. Its live trigger, the Idunn legacy actuator route `deploy bifrost-persona-feedback`, was - retired in Idunn `7793b5b` and installed on Yggdrasil at 21:50 CEST (sha256 `d95fa08c...`; the previous binary is - at `/root/idunn-yggdrasil.pre-bifrost-retire-20260930`). The manifest and `/srv/bifrost/compose` were moved to - `/srv/retired/retired-2026-09-30/`. All three Bifrost units stayed active. **Follow-up:** persona-feedback has no - Idunn deploy route now. Give it a real Idunn binding. - - Live zero-byte stores to move aside after the ops merge, in Soul's order (setgid on inbox, then rename in place, - then relocate): `observations.cc`, `deliveries.cc`, and a third, `/var/lib/gamecult/epiphany/idunn-provider-health-admission.cc`. -- **Text matches.** gamecult-ops `scripts/idunn/start-idunn-local.ps1:143` matches the same removed text as Muninn - (below). It must change with Idunn's next CultLib bump. -- **Consumer follow-up that must travel with the next Muninn CultLib bump:** - `Muninn scripts/restart-starfire-muninn.ps1:144` matches `*failed to decode MessagePack*` to trigger - `Reset-CorruptMuninnStore`. R1 removes that text, so the reset would stop firing silently. The script must match - the typed `CultCacheStoreUnreadable` kind, or the new wording, in the same change. -- C#'s truncated-store exception (`EndOfStreamException`) is an `IOException`, the same I/O-versus-undecodable - overlap. It goes with R3's C# work. - -Status: cut map, Imagination pass 1 (Opus), 2026-09-30. Nothing has landed. This map owns the means for repairing -and recovering `/var/lib/gamecult/odin/topology.cc`. It follows `docs/write-pattern-cut.md` (Cuts 1-3) and starts -from that campaign's landed head. - -Anchors: -- Odin `hands/odin-write` at `cda2087` (Cuts 1-2 plus two test commits). Q3 B (peer puts fsynced before ACK) is - being finished on that branch now. **Re-anchor every Odin `file:line` below on the head that lands; the line - numbers here are `cda2087`.** -- CultLib `6d0cc963`. `packages/cultcache-rs` is byte-identical to Odin's pin `3bf1c0ce`, so the Rust line numbers - hold at both. -- Idunn `a96ad9d`, Heimdall `e8e2832`, gamecult-ops `runbooks/gamecult-state-backup.md` as of 2026-09-30. - -Operator, 2026-09-30, on the three options Self offered for an undecodable foreign write (degraded but loud, end -Odin, unchanged): **"None of these options involve repair and recovery, which is what ultimately needs to happen."** - -Open: Q-R1 to Q-R6 (section 8). D1 (section 6, O1) is a Self default the operator may overrule. - -## Short answer - -Odin already holds the one thing a repair needs: its in-memory working set, which is authoritative for everything -it owns while it holds the write lease. Today it never uses it for repair. It ends on a decodable foreign write, and -it silently stops persisting on an undecodable one. At activation it has no working set and no second copy, so it -crash-loops. - -The repair has one rule: **a store file that is not what Odin last wrote is set aside, never deleted and never -merged, and Odin writes its working set over it under the lease.** At activation Odin has no working set, so it -falls back to a previous generation kept on disk, and then to an empty store that providers refill. The -correlation sequence gets a time floor, so no rollback can recreate the watermark deadlock. Recovery is published as -a typed record in Odin's own catalog. The mechanism (typed read failures, a set-aside exchange, a retained previous -generation, no staging file left behind by a failed write) belongs to CultLib, because every consumer of the -single-file store has the same gap. - -## 1. Body facts (probed) - -### 1.1 Probe: cultcache-rs single-file store under fault - -The probe was a scratch crate at CultLib `3bf1c0ce`, `scratchpad/odin-recovery-probe` (Imagination session), commit -`b19eba9`, run through the stopgap on Yggdrasil in slot 2. It ran with `--tmpfs /small:size=64k --tmpfs /ro:ro`, -using `trap '' XFSZ; ulimit -f 40` for the file-size case. The log is `scratchpad/odin-recovery-probe.log`. - -| Fault | Result | -|---|---| -| P1: file truncated to half | `compare_exchange_snapshot` and `pull_all` return `Err`, **not** `Ok(false)`. There is no `io::Error` in the chain; the decode error is flattened to text (`lib.rs:720-725`). The message is wrong: "invalid type: string \"cultcache.store.v1\", expected struct CultCacheEnvelope". `store_header` (`lib.rs:317-341`) deserializes the *whole* array to find the header, so a truncated v1 file has no header and falls through to the legacy decoder. The file is unchanged by the failed exchange | -| P2: 12 bytes of garbage appended | `pull_all` returns `Ok`, all 3 records. `compare_exchange_snapshot(expected)` returns **`Ok(true)` and silently drops the tail**. `rmp_serde::from_slice` ignores trailing bytes. C#'s `DeserializeSnapshot` (`CultDocumentMessagePackSerialization.cs:179-215`) never checks for the end either | -| P2b: one byte flipped inside a payload | `pull_all` returns `Ok` (payloads are opaque bytes). `compare_exchange_snapshot` returns **`Ok(false)`**. To Odin, bit rot is a *decodable foreign write* | -| P3: header `cultcache.store.v4...` | `Err` with a distinct message, "not readable; this runtime reads v1 only". It is distinguishable only by its text | -| P4: another handle wrote a valid snapshot | `Ok(false)` | -| P5: `hard_link(topology.cc, topology.cc.displaced..x)`, then an exchange through the store | The link keeps the old bytes exactly, and the store writes the new file. The staging sweep (`remove_abandoned_staging_files`, `lib.rs:2730-2766`) removes a `..tmp` beside it and leaves the displaced name alone | -| read-only filesystem, no store | `pull_all` returns `Ok(0)`. The exchange fails opening the lock: `io::Error` `ReadOnlyFilesystem` (os 30) | -| `RLIMIT_FSIZE` 40 KiB, 200 KB write | `Err` `io::Error` `FileTooLarge` (os 27). The old file is intact and still decodes. **A 40,960 B partial staging file is left behind.** The next attempt sweeps it and leaves a new one | -| 64 KiB tmpfs, 200 KB write (ENOSPC) | `Err` `StorageFull` (os 28). The old file is intact. **A 61,440 B partial staging file is left behind: all of the filesystem's remaining space.** The same holds on every retry | - -What follows from the probe: -- **Decodable is not the same as legitimate.** A flipped payload byte is "decodable and foreign", and appended - garbage is "decodable and ours". The decodable/undecodable split cannot be what decides recovery. One rule has to - cover both: *not what Odin last wrote*. -- **A write that fails for lack of space holds the space it failed on.** `/var/lib/gamecult` is shared by every - service on Yggdrasil. Odin retries once per second (and, under Q3 B, on every put), so it re-takes whatever - another service frees. C# deletes its temp file in a `finally` (`CultCache.cs:3496-3531`); Rust does not - (`write_all_unlocked`, `lib.rs:741-768`). This is a Rust parity defect. -- **The atomic write keeps no previous generation.** `write_all_unlocked` stages, fsyncs, renames over the file and - fsyncs the directory. After the rename, the old inode is gone. The brief's "last good checkpoint kept by the - atomic write" does not exist on disk. The only last-good copy is Odin's in-memory `flushed` snapshot - (`lib.rs:506-510`), and it dies with the process. - -### 1.2 Odin today (`cda2087`) - -| Case | Path | Outcome | -|---|---|---| -| Decodable foreign write while serving | `MemoryOdinTopologyStore::flush` `lib.rs:613-626`: `compare_exchange_snapshot(flushed, current)` returns `false`, so `ForeignStoreWrite`. `survive` `main.rs:879-895` returns it, and Odin ends | Idunn restarts Odin (`control_plane.rs:68-71`: 6 restarts per hour, the wait doubling from 5 s). The new Odin **loads the foreign file as truth**. Odin's own unflushed changes, and every record of Odin's that the foreign file lacks, are lost without a trace. A flipped payload byte (P2b) takes this path | -| Undecodable foreign write while serving | the same exchange returns `Err` (decode). `survive` logs it and retries every second, forever. Nothing is persisted again | **Idunn's crossing breaks too.** `receive` (`Idunn drivers.rs:5005-5030`) reads the same file and propagates the error to `admit_latest_topology` (`control_plane.rs:7903-7907`) and `refresh_admitted_topology` (`:6040`). Every Odin-correlated deployment and refresh fails until the file is readable, which is never | -| Corrupt file at activation | `try_activate` `main.rs:246-297` calls `MemoryOdinTopologyStore::load` `lib.rs:519-538`, which calls `pull_all()?`. `main.rs:762` `while !try_activate()?` exits the process | Crash loop until Idunn's budget is spent. Then Idunn reports once, to its log only (`control_plane.rs:5709-5723`, `report_once` `:4599-4610` is `eprintln`), and stops. The Verse rendezvous is down | -| Disk full or read-only | the exchange returns `Err` (io). `survive` logs and retries every second | Odin serves from memory. Each attempt leaves a partial staging file (1.1). A stop or deploy in this state loses everything unflushed. Nothing typed says so | - -Detection latency for a foreign write: `flush` writes only when dirty (`main.rs:307-314`). Odin's own heartbeat -(`HEARTBEAT_INTERVAL` 5 s, `main.rs:69`) dirties the set, so a foreign write is met at the latest one heartbeat plus -one flush interval (about 6 s) after it happens. No polling read is needed, and Cut 1's rule (no reads while -serving) stands. - -### 1.3 Other sources of truth, and what they can recover - -| Source | Holds | Freshness | Recovers | -|---|---|---|---| -| Odin's working set (W) | everything, including unflushed changes | live | everything, but only while this process lives and holds the lease | -| `flushed` (in memory) | the last snapshot Odin wrote | at most one interval old | nothing more than W; it is the comparison base, not a store | -| previous generation on disk (new, O3 and R3) | the snapshot before the last one this store's owner verified and replaced | one write old | everything except the last write's delta, including publish-once documents, presence history and the watermark | -| nightly backup (`gamecult-state-backup.md`) | `/var/lib/gamecult/odin` whole, shared-lock copy | up to 24 h old, 3 days on Yggdrasil, 14 days plus 8 weekly on Raven | publish-once documents. **Never automatically**: "It never becomes live authority, and nothing restores it automatically"; "restore a store only after stopping its owner" | -| providers republishing | presences (2.7-12 s), Muninn documents (2 s), ads (about 30 s); Heimdall HEAD republishes `heimdall.command_boundary` and its three siblings every 60 s (`Heimdall src/index.ts:19,35-39`, gated on its write lease) | seconds to a minute | every document whose publisher republishes | -| Idunn's projection plus presences | correlations | one refresh pass (250 ms) after the presences return | correlations. They are a projection and never need restoring | -| Idunn's `odin_publisher_sequence_cursor` (`control_plane.rs:1456,1537,6081`) | the highest correlation sequence Idunn admitted, per target | live | nothing directly (Idunn owns it), but it is why the watermark must never roll back | - -Premise correction: `heimdall.command_boundary` is not publish-once at Heimdall HEAD. A `stored_at` of 09-23 -proves only that the publisher's own `stored_at` has not changed, because Odin stores the publisher's -`stored_at` (`persist_generic_document`, `main.rs:1330-1347`). Whether the deployed Heimdall re-puts is -unverified; O3's outstanding-republish list measures it. - -**The watermark is the one record whose loss is not self-healing.** Idunn refuses any correlation sequence at or -below its cursor (`control_plane.rs:1763,1785`). An Odin that starts from an empty store, from the previous -generation, or from a backup restarts a target's count below that cursor. That is the deadlock documented at -`lib.rs:33-49`: Idunn refuses every correlation until the count climbs past the old mark, and the refusal -withdraws the correlation before it can climb. Every recovery source except W has this defect. O1 removes it. - -Other facts the design leans on: -- **Idunn fences before it grants.** `CultCacheWriteLeaseDriver` (`Idunn drivers.rs:4050-4205`): "revocation - follows an exact incumbent stop", and grant is a nonblocking exchange from empty. A second *Odin* cannot hold - the lease while the first is still writing, so a foreign writer seen by a lease-holding Odin is not an Odin. -- **Idunn has a lifecycle brake** (`idunn-provision lifecycle-brake-engage|release|status`, - `provisioning.rs:95-97`; `odin-lifecycle-brake.cc` per `runbooks/odin-yggdrasil.md:29-30`). An engaged brake - denies continuity restarts (`control_plane.rs:5771-5774`, `:6219`). This is the operator's hold for a manual - restore. -- **A non-`active` Odin presence fans out.** `reconcile` sets `ready` only when the presence state is `active` - (`lib.rs:946`), and `dependency_evidence` (`lib.rs:1184ff`) makes every managed dependent of Odin not Ready. - The presence schema allows `degraded` (`cultnet-rs runtime_authority_contracts.rs:193`), but using it would - be a readiness statement about every dependent, not a store report. -- **The catalog serves only peer types and presences** (`public_document`, `main.rs:590-640`). No `odin.*` record - is served today, and neither Odin nor Idunn publishes an Eve surface. F3 in the write map (the unowned - `surface:gamecult.network.status`) is where an Eve lowering belongs. - -## 2. Ends - -1. No single fault, whether a foreign write of any kind, a corrupt file, or a failed write, ends Odin or leaves it - silently unpersisted. Only losing the write lease ends it. -2. A store file that is not what Odin last wrote is preserved byte for byte beside the store and never deleted, - merged or adopted by any automatic path. The owner (Odin under the lease) writes its own state over it. -3. At activation a corrupt store is recovered from the best source on the host (previous generation, then empty), - and never from the backup automatically. -4. No recovery can make a correlation sequence repeat or fall below one Idunn has admitted. -5. Every repair, and every stretch in which Odin is serving without persisting, is typed state that can be - queried through Odin's catalog while it is happening, including when the disk refuses writes. - -Invariants carried over: one writer (the lease, checked immediately before every write); Idunn's lockless -crossing reads a whole `.cc` snapshot at `topology.cc`; the path never becomes absent (Idunn reads an absent file -as an empty snapshot, which withdraws every correlation); no reads of the store while serving; one bad record -never stops Odin. - -## 3. Identity, lifecycle, authority - -| Persistent kind | Named by | Over time | Decided by | -|---|---|---|---| -| store file `topology.cc` | the state root plus `TOPOLOGY_SLOT` | replaced whole by the owner's exchange; never absent once created | Odin under the lease | -| displaced file (new) | `topology.cc.displaced..`, same directory (it must not end in `.tmp`) | created by a set-aside exchange as a hard link to the replaced inode; never modified; never deleted by any program. Travels to Raven with the nightly backup | created by Odin through CultLib; **disposed of only by the operator** | -| previous generation (new, Q-R2) | `topology.cc.previous` | replaced on every *verified* exchange (current == expected) by a hard link to the outgoing inode; **not** rotated by a set-aside exchange, so it always holds a generation that some writer verified before replacing | CultLib mechanism; Odin opts in | -| store condition record (new) | type `odin.store_condition`, schema `odin.store_condition.v1`, key `topology` | one record held in W; rewritten when the condition changes; flushed with the store; served by the catalog | Odin | -| correlation sequence floor (new rule, not a record) | per target, in the existing watermark | next = max(mark + 1, prior + 1, now in unix ms) | Odin | -| backup snapshot | `/var/backups/gamecult-state//` and Raven | nightly; never live authority | the operator restores it, with the lifecycle brake engaged (runbook) | - -## 4. Authority map (the whole campaign) - -- **Owner:** Odin, while it holds the current process-write lease, decides what `topology.cc` holds, when it is - set aside, and what activation recovers from. CultLib owns the mechanism (read classification, set-aside - exchange, previous generation, staging cleanup) and no policy. Idunn owns whether Odin runs (continuity budget, - lifecycle brake, deploys). The operator owns restores from backup and the disposal of displaced files. -- **Inputs:** W; `flushed`; the lease (read immediately before every write); at activation, `topology.cc` and then - `topology.cc.previous`; the clock (the sequence floor). -- **Outputs:** one atomic `topology.cc`; displaced files; `topology.cc.previous`; the `odin.store_condition` record - in the catalog. -- **Derived state:** `topology.cc` is a checkpoint and Idunn's crossing, never an input while serving. The - displaced files are evidence only: nothing reads them automatically. The previous generation is read only by - activation recovery. The condition record is a report and decides nothing. - - `ForeignStoreWrite` **is no longer an owner of Odin's life**. A foreign write becomes a set-aside event. -- **Forbidden writers and deciders:** - - Any path that ends Odin on a store condition. `survive`'s `ForeignStoreWrite` arm (`main.rs:884`) is - deleted; `WriteLeaseLost` stays, and so does the temporary `PresenceAuthorityRefused` rule. - - Any automatic delete of a displaced or previous file. - - Any merge of records from a foreign or displaced file into W. - - Any automatic restore from the backup. - - Idunn writing or repairing `topology.cc`. - - Any second writer of the file inside Odin: activation never writes. It prepares W and `flushed`, and the one - `flush` makes the first write through the same set-aside exchange. -- **Shared paths:** - - The interval flush, the Q3 B per-put flush, the stop flush and the activation-recovery first flush all go - through one primitive, `replace_snapshot_setting_aside`. - - Every path that reserves a correlation sequence goes through the one floored reservation. -- **Deletion line:** `ForeignStoreWrite` (`lib.rs:630-641`) and its `survive` arm are deleted before the set-aside - exchange is wired in. The `Err` escape in `load` (`lib.rs:521`, `pull_all()?`) is replaced by the recovery - ladder, not wrapped. - -## 5. Recovery by case - -| Case | Detected by | Action | Recovered from | Loss bound | Visible as | -|---|---|---|---|---|---| -| **A. Decodable foreign write while serving** (a hand edit, a tool, a restore made against the runbook, or bit rot in a payload per P2b) | the next flush: current != `flushed` | the lease is checked; the file is set aside (hard link); W is written; Odin keeps serving | W | none of Odin's own records. The foreign file's content is preserved, not adopted | condition event `displaced`, reason `mismatch`, with path, sha256, bytes and time | -| **B. Undecodable foreign write while serving** (truncation, garbage, a foreign format, and after R2 trailing bytes too) | the next flush: current does not decode | the same | W | none. Idunn's crossing is unreadable for at most one heartbeat plus one flush (about 6 s), instead of forever | the same, reason `undecodable` | -| **A/B repeated** (a live foreign writer) | a third set-aside inside 10 minutes in one activation | Odin stops writing and keeps serving; puts are not ACKed (Q3 B: ACK means durable); no new displaced files (Q-R4) | W stays in memory | nothing while the process lives | condition `contested`, since when, with the displaced files | -| **C1. Undecodable store at activation** | `load` gets `Undecodable` | W is built from `topology.cc.previous` if it decodes; `flushed` is set to "unreadable", so the first flush sets the corrupt file aside and writes W | the previous generation | the last write's delta: one interval of Odin bookkeeping, or one fsynced put. **A put ACKed as durable can be lost here; say so in Q3 B's record** | event `recovered-previous`, plus an outstanding-republish list: peer records in the previous generation not yet re-put by their publisher, cleared as they arrive | -| **C2. Nothing decodable at activation** | `.previous` absent or undecodable too | start empty (Q-R3); the first flush sets the corrupt file aside | providers republish; correlations re-derive in one pass; the sequence floor holds | every publish-once document; presence history (F4 makes this harmless) | event `started-empty`; outstanding list is `unknown`. The operator's path is the backup, with the lifecycle brake engaged | -| **C3. Unsupported format at activation** (a newer runtime wrote v4, or a downgrade) | `load` gets `UnsupportedFormat` | refuse to activate. The file is untouched and nothing is set aside | the deploy or rollback that caused it; Idunn owns that | none | Idunn's continuity budget and the Odin journal. This is a deployment fault, not a store fault | -| **C4. I/O error reading the store at activation** (EIO, EACCES after a restore with the wrong owner, EISDIR) | `load` gets an `io::Error` | refuse to activate. Nothing is set aside: **only bytes that were read are ever judged** | the operator fixes the host or the mode | none | as C3 | -| **D. Write fails while serving** (ENOSPC, EDQUOT, EFBIG, EROFS, EIO) | the exchange returns an `io::Error` while staging or renaming | nothing is set aside; the staging file is removed (R1); W is kept; retry at the flush interval; puts are not ACKed; Odin keeps serving | W, when the fault clears | nothing, unless Odin is stopped or redeployed before the fault clears (follow-up I-F1) | condition `unpersisted` since T, with the last error kind (`no-space`, `read-only`, `io`) and the dirty-record count, served from memory | -| **D'. Stop while unpersisted** | the stop flush fails | log it and stop, as today (`main.rs:794-799`) | the next activation loads the last good file | the unflushed delta | the final journal line only. I-F1 is the owner fix | - -Rollback safety, for C1, C2 and an operator restore: every source except W carries a watermark below Idunn's -cursor. The floor (O1) makes the next sequence exceed every sequence published before, whatever the store holds. - -## 6. Cuts - -Order: the Rust substrate gaps first (R1), then the watermark floor (O1, independent and small), the set-aside -primitive (R3), Odin's serving repair (O2), activation recovery (O3), parity hardening (R2, R3b), and finally the -runbook and drill (X1). Each cut is its own branch and its own Soul pass. Odin verification: -`cargo test --locked -p odin-daemon` from the Odin root. CultLib Rust: `cd packages/cultcache-rs && cargo test ---locked`. All of it runs on Yggdrasil through the stopgap. **A permission-based test is unproven there (root).** -The injections below avoid permissions: truncation, a directory at the store path (EISDIR), tmpfs size and -read-only options, and `RLIMIT_FSIZE`. - -### R1. cultcache-rs: typed read failures, no staging file left behind, a header that survives truncation (CultLib) - -- **Repo/branch:** CultLib `hands/cultcache-rs-store-faults` from `main`. Depends on nothing. -- **Deletes first:** the flattening `map_err(|error| anyhow!(...))` in `read_all_unlocked` (`lib.rs:720-725`); - `store_header`'s whole-array visitor (`lib.rs:317-341`). -- **Adds:** - - `pub struct CultCacheStoreUnreadable { path, kind: Undecodable | UnsupportedFormat }`, carried in the error - chain of every read of a single-file store whose bytes were read and not accepted, so consumers can - `downcast_ref`. An `io::Error` stays an `io::Error`, and the two never overlap. - - `store_header` reads only the array header and the first string, reusing `read_array_header` and - `read_string` (`lib.rs:2661-2700`). A truncated v1 file then reports as an undecodable v1 file, not as legacy. - - `write_all_unlocked` removes its own staging file on every failure after creating it. This is C# parity with - `CultCache.cs:3525-3530`. -- **Rules that must die under their own mutation:** - - a truncated store is `Undecodable`, and a v4 header is `UnsupportedFormat`; - - an `io::Error` read failure is never classified `Unreadable`; - - after a failed write, the directory holds no `.*.tmp`. -- **Verification:** - - Tests describe behaviour. The staging-cleanup test forces the failure without permissions. One option is a - child process under `RLIMIT_FSIZE` with SIGXFSZ ignored (the probe's method); another is a path whose parent - fills a size-capped tmpfs, if the test runner can mount one. Hands picks one and names it. - - `cargo mutants --in-diff`. -- **Estimate:** about -30 / +70. - -### O1. The correlation sequence has a time floor (Odin) — default D1 - -- **Repo/branch:** Odin `hands/odin-sequence-floor` from the landed `hands/odin-write` head. Depends on nothing - else. -- **Change:** `reserve_publisher_sequence` (`lib.rs:702-723`) returns max(mark + 1, prior + 1, now in unix ms), - and records it as the mark. The doc comment at `lib.rs:33-49` gains the rule: "A mark read from any older copy - of the store is a floor, never the next value; the clock makes every rollback safe." -- **Why a floor and not a read of Idunn's cursor:** it needs no new crossing. It holds for every recovery source, - including the backup, and the host clock is already trusted for presence freshness. -- **Assumption:** the clock does not step back across a rollback by more than the rollback's age. Soul checks that - Idunn accepts a jump: its rule is "strictly above the cursor" (`control_plane.rs:1763,1785`). No test may pin a - gap limit. -- **Verification:** - - Existing tests pinning counts (`withdrawing_a_correlation_does_not_reset_its_publisher_sequence` - `lib.rs:1996-2014`) are restated as order properties. - - New test: a store rolled back to an earlier snapshot, then one refresh, yields a correlation sequence greater - than every sequence published before the rollback. - - New test: two reservations inside one millisecond are strictly increasing. - - The clock must be injectable at the reservation. At least one mutant must be a function of the time (an offset - or a scale), with probe values where it would show. -- **Estimate:** about -5 / +25. - -### R3. The set-aside exchange and the previous generation (CultLib, Rust and C#; TS and Python in R3b) - -- **Repo/branch:** CultLib `hands/cultcache-set-aside` from R1. Q-R2 decides the previous-generation half. -- **Adds, on `SingleFileMessagePackBackingStore`:** - - `replace_snapshot_setting_aside(expected, replacements) -> Result`, with - `SnapshotReplacement::{Exchanged, SetAside { displaced: PathBuf, sha256, bytes, reason: Mismatch | - Undecodable }}`. It makes one exclusive lock hold, in this order: - 1. stage the replacement (write and fsync); - 2. read current; - 3. if current equals expected, rename the staged file over (rotating `.previous` first when enabled); - 4. if the read was an `io::Error`, remove the staging file, return the error and change nothing; - 5. otherwise hard-link current to the displaced name, fsync the directory, rename the staged file over, and - fsync the directory again. - - Staging comes first, so a full disk sets nothing aside. The path is never absent: a link, never a rename. A - set-aside never rotates `.previous`. - - Opt-in previous generation: a constructor option (`retaining_previous_generation`, or Hands' spelling of it) - plus `pull_previous_generation() -> Result>`, read under the shared lock and classified - like any read. Off by default, because existing consumers must not grow files they did not ask for. - - Filesystems without hard links: return an explicit error naming the filesystem. Do not fall back to a - copy-then-rename, which would make the path briefly hold new content while the evidence is still being - written. Windows NTFS links work; the Windows path is **not yet reached** by the Yggdrasil suite and is - recorded as such. - - C# reference: the same operation on `SingleFileBackingStore` (`CultCache.cs:3268ff`), with the same names - across runtimes. -- **Verification (Rust and C#):** - - a mismatch preserves the foreign bytes exactly and writes the replacement; - - an undecodable current is preserved and replaced; - - an I/O read failure (a directory at the path) changes nothing and leaves no staging file; - - a staging failure (size cap) changes nothing and sets nothing aside; - - the path is readable at every instant: a reader thread loops `pull_all_read_only_snapshot` through 1,000 - exchanges and never sees an absent file or an empty snapshot; - - `.previous` rotates only on a verified exchange; - - two set-asides in the same second get distinct names; - - mutation tools: `cargo mutants --in-diff`, and Stryker.NET on the C# diff. -- **R3b (parity, not blocking Odin):** cultcache-ts `single-file-messagepack-backing-store.ts:34` and cultcache-py - `stores.py:83` gain the same operation and option, with a shared fixture test. -- **Estimate:** Rust about +140, C# about +120, R3b about +200. - -### O2. A foreign store file while serving is set aside, not fatal (Odin) - -- **Repo/branch:** Odin `hands/odin-store-repair` from O1, with a CultLib pin bump to R3. Needs Q-R1 and Q-R4. -- **Deletes first:** `ForeignStoreWrite` (`lib.rs:630-641`) and its arm in `survive` (`main.rs:884`). The test - `a_flush_writes_only_changes_and_never_over_a_foreign_file` (`lib.rs:2055-2090`) and the `survive` tests at - `main.rs:2842-2844` and `:3110` pin the old rule: restate them, do not delete them. -- **Changes:** - - `MemoryOdinTopologyStore::flush` (`lib.rs:613-626`) calls `replace_snapshot_setting_aside(flushed, current)`. - On `SetAside` it records a `displaced` event and counts it toward the contested bound. On an I/O failure it - records `unpersisted` and returns the error, which `survive` logs and retries as today. - - `RuntimeState::flush` (`main.rs:307-314`) keeps its lease check immediately before the write. - - The Q3 B per-put path uses this same flush. Hands re-anchors on the Q3 B head. -- **Adds:** - - The `odin.store_condition` record (schema in `odin-core` `documents.rs`), held in W. It carries: - - `generation` and `written_by`, updated inside the flush before the snapshot is taken; - - `unpersisted_since` and `last_write_error`; - - `contested_since`; - - a bounded list of the last 16 recovery events: kind, time, displaced path, sha256 and bytes, source, records - loaded, and the outstanding list (bounded). - - One arm in `public_document` (`main.rs:590-608`) that serves exactly this type. Providers still cannot write - it: `is_peer_document_type` is unchanged. -- **Rules that must die under their own mutation:** - - a flush never leaves the store dirty (the condition record is written inside the flush, not after it); - - a set-aside is preceded by a lease check; - - the third set-aside inside the window stops writing, and the second does not; - - after `contested`, no file is written or created; - - on an I/O failure, nothing is set aside; - - the condition is served while writes fail. -- **Authority map:** as in section 4. The deletion line is the `ForeignStoreWrite` type and arm. -- **Verification (fault injection, each at the file layer, not a log line):** - - T-A: activate, serve, write a different valid snapshot behind Odin. After the next pass the file decodes to - W, the displaced file's bytes equal the foreign bytes, `serving_pass` returned `Ok`, the catalog is unchanged, - and the served condition names the displaced file and its sha256. - - T-A2 (P2b): flip one payload byte behind Odin; the same outcome, reason `mismatch`. - - T-B: truncate the file behind Odin; the same outcome, reason `undecodable`, and - `pull_all_read_only_snapshot` (Idunn's crossing) decodes the file after one pass. - - T-B-latency: with no puts, the set-aside happens within one heartbeat plus one flush interval. - - T-contested: three foreign writes inside the window make exactly two set-asides and a third `contested` - report. After that the file and directory are untouched by further passes, and Odin still serves. - - T-D: replace the store path with a directory (EISDIR, which works as root). Nothing is set aside, no staging - file remains, the condition is `unpersisted` and is served, and a put is not ACKed. Remove the directory, and - the next pass writes W, clears `unpersisted` and ACKs. - - T-lease: the lease withdrawn before a flush that would set aside means no link, no write, and Odin ends - (`WriteLeaseLost`). - - Negative: `rg -n "ForeignStoreWrite" crates` matches nothing; `rg -n "remove_file|remove_dir" crates/odin-daemon/src` - matches nothing new outside tests. - - `cargo mutants --in-diff`. -- **Estimate:** about -40 / +160. - -### O3. Activation recovers a corrupt store (Odin) - -- **Repo/branch:** Odin `hands/odin-store-activation` from O2. Needs Q-R2 and Q-R3. -- **Change:** `MemoryOdinTopologyStore::load` (`lib.rs:519-538`) becomes the recovery ladder: - - | `load` result | Outcome | - |---|---| - | `Ok` | as today | - | absent | empty, as today | - | `Unreadable::Undecodable` | try `pull_previous_generation()`, then empty (Q-R3); `flushed` becomes a sentinel meaning "the file is not a snapshot Odin can compare", so the first flush's exchange sets it aside | - | `Unreadable::UnsupportedFormat` | return the error: refuse | - | `io::Error` | return the error: refuse | - - Activation itself never writes. The first `serving_pass` flush (`main.rs:833-842`, due at once) writes W. That - set-aside is recorded under the activation event and is not counted toward the contested bound. -- **Adds:** the outstanding-republish list. It holds the peer-type records present in the recovered previous - generation, each cleared when its publisher re-puts it. After 10 minutes the remainder is marked "not - republished", which is the live answer to "who is publish-once". For `started-empty` the list is `unknown`. -- **Rules that must die under their own mutation:** - - Unsupported-format and I/O failures never set aside, never fall back, and never start. - - A recovered activation writes before it serves its first catalog snapshot, or it serves the recovered set and - marks the condition before the first write. Hands picks one and states it. -- **Verification:** - - T-C1: a truncated `topology.cc` and a valid `.previous` activate with the previous content. The first pass - writes it and sets the corrupt file aside byte-exact, and the condition is `recovered-previous` with its - outstanding list. Re-putting one listed document clears it. - - T-C2: both undecodable (Q-R3 A) start empty. Both files are preserved, the condition is `started-empty`, and - the next correlation sequence is above the floor. - - T-C3: a v4 header refuses to activate. The file is byte-identical afterwards, and there is no displaced file - and no `.previous` change. - - T-C4: a directory at the store path refuses, as C3. - - T-restart: a recovered Odin stopped and restarted loads its own first write normally, with no second - set-aside. - - `cargo mutants --in-diff`. -- **Estimate:** about -10 / +110. - -### R2. Single-file decoders reject trailing bytes, in every runtime (CultLib) - -- **Repo/branch:** CultLib `hands/cultcache-trailing-bytes`. Independent of Odin; land it before O3 ships so that - an appended file is caught as undecodable, not overwritten silently (P2). -- **Change:** C# `DeserializeSnapshot` (`CultDocumentMessagePackSerialization.cs:179-215`) checks `reader.End`. - Rust `decode_store_snapshot` (`lib.rs:2583ff`) and the legacy path check that the slice is consumed. TS and - Python do the same. **One release**: a runtime that accepts what another rejects is a parity split. -- **Verification:** one shared fixture (a valid store plus one byte) is rejected as undecodable by all four - runtimes, and the valid store is accepted by all four. -- **Estimate:** about +40 plus tests across four runtimes. - -### X1. Runbook and recovery drill (gamecult-ops, then live) - -- **Repo:** gamecult-ops `runbooks/odin-yggdrasil.md` gains a "Store recovery" section: - - how to read `odin.store_condition` from the catalog; - - what displaced and previous files mean, and that disposing of them is the operator's decision; - - the manual restore: engage Odin's lifecycle brake, stop the `idunn-odin-*` unit, set the live file aside with - `ln` (never `rm`), extract the snapshot's `topology.cc` with its owner, mode and `.lock`, release the brake, - and read the condition. The sequence floor makes an old watermark safe. -- **Drill D-1 (off-live, after O3; needs the Q2-style approval, Q-R6):** extract the newest Yggdrasil snapshot's - `topology.cc` into a container on Yggdrasil. Activate a test-harness Odin on it through the existing fixture - authority. Then truncate the copy and activate again with the extracted file as `.previous`. Report the records - per type, the outstanding list and the sequence floor. Delete the copy afterwards. -- **Drill D-2 (live, operator-scheduled, Q-R6), after O3 deploys:** - 1. Record the baseline: catalog types, Idunn correlated targets, route timeouts. - 2. Engage the lifecycle brake and stop Odin. - 3. `ln topology.cc /var/tmp/odin-drill-keep.cc` (the evidence of the evidence), then truncate `topology.cc` in - place to half. - 4. Release the brake and let Idunn restart Odin. - 5. Pass when all of these hold: - - Odin is serving within one restart; - - the condition is `recovered-previous`, with a displaced file whose sha256 equals the truncated file's; - - every Odin-correlated target is Ready again within 60 s; - - there are 0 route-challenge timeouts in the next hour; - - the catalog's type set equals the baseline after 10 minutes, or the outstanding list names every - difference. - 6. Then run D-2b, a foreign write while serving: `ln` the live file aside, then truncate it. It passes when the - condition shows `displaced` within about 6 s and Idunn's correlation reads never fail for longer than that - (the journal). - -## 7. Subtraction ledger (estimate) - -| Cut | Removed | Added | Formats and targets | -|---|---|---|---| -| R1 | about 30 | about 70 | none | -| O1 | about 5 | about 25 | none | -| R3 | 0 | about 260 (Rust 140, C# 120); R3b about 200 | two sibling-file conventions (`.displaced.*`, `.previous`); no format change | -| O2 | about 40 | about 160 | one Odin schema, `odin.store_condition.v1` | -| O3 | about 10 | about 110 | none | -| R2 | 0 | about 40 plus tests | none (it tightens the decoders) | - -The campaign is net additive, at about +570 without R3b. It buys ends 1-5, which the operator asked for, and -removes one fatal path and one silent path. Every addition in CultLib is a capability a general consumer of the -single-file store would expect, and two of them (staging cleanup, and the header that survives truncation) are -defects. - -## 8. Operator questions - -- **Q-R1. A store file changed underneath a running Odin (decodable or not).** - - Context: Idunn fences the old Odin before granting the lease, so the other writer is never an Odin. It is a - tool, a hand edit, a restore made against the runbook, or disk corruption; P2b shows a flipped byte looks - exactly like a foreign write. Today a decodable change ends Odin, and the restart adopts the foreign file - silently. An undecodable change stops persistence forever and breaks Idunn's crossing. - - A: set the file aside (kept byte for byte, never deleted), write Odin's working set over it, keep serving, - and report it as typed state. - - B: set it aside, write the working set, then end Odin so a fresh process starts from the rewritten file. - - **Recommended: A.** B's restart protects nothing that the lease check before the write does not already - protect, and costs a route outage. -- **Q-R2. Keep one previous generation on disk (`topology.cc.previous`)?** - - Context: without it, a store that is corrupt at activation has no on-host source except "empty", and the - backup is up to 24 h old and needs the operator. It costs one hard link per write (a directory update, no data - written) and one more file of the store's size. It is a CultLib option, off by default for other consumers. - - A: yes. B: no; activation recovery goes straight to empty. - - **Recommended: A.** It is the only source that recovers publish-once documents, presence history and - correlations without the operator. Its loss bound is one write. -- **Q-R3. Activation finds nothing decodable: no usable `topology.cc`, no usable previous generation.** - - Context: presences and most catalog documents return within seconds to a minute, and correlations re-derive - in one refresh pass. Publish-once documents (if any exist, see 1.3) stay missing until their publisher - re-puts them, or until the operator restores from the backup. - - A: start empty automatically, set the corrupt file aside, and report `started-empty`. - - B: refuse to start, so Odin crash-loops until the operator restores. Every service's rendezvous is down - meanwhile. - - **Recommended: A.** A down Odin loses everything the Verse needs; an empty one loses only what nobody - republishes, and the restore path stays open. -- **Q-R4. A foreign writer keeps writing (a third set-aside within 10 minutes).** - - Context: repeated repair against a live writer makes a displaced file every second. - - A: stop writing, keep serving from memory, withhold put ACKs, and report `contested` until the operator - finds the writer. The working set survives. - - B: end Odin. Idunn restarts it, and the restart loads whatever the foreign writer last wrote. - - **Recommended: A.** B hands the store to the unknown writer. A is loud and loses nothing that is in memory. -- **Q-R5. Should a store condition change Odin's presence to `degraded`?** - - Context: a non-`active` Odin presence makes every managed dependent of Odin not Ready (`lib.rs:946`, - `dependency_evidence`). The store condition does not affect serving. - - A: no. The presence stays `active`, and the condition record is the signal. - - B: `degraded` while `unpersisted` or `contested`. - - **Recommended: A.** Otherwise a full disk becomes an outage of every dependent, and a restart that Idunn might - take in response would destroy the only complete copy. -- **Q-R6. The drills.** - - D-1: decode a copy of last night's backup `topology.cc` in a container on Yggdrasil, the same terms as Q2 for - the write map, with the copy deleted afterwards. - - D-2: after O3 deploys, a scheduled live drill that truncates the real `topology.cc` behind the lifecycle brake, - keeping a hard link of the original. - - **Recommended: yes to both**, D-1 before O3 ships and D-2 in a window the operator names. - -## 9. Follow-ups outside this map - -- **I-F1 (Idunn):** a deploy or a stop of Odin while `odin.store_condition` says `unpersisted` or `contested` - destroys the only complete copy. Idunn could read the condition from the catalog and hold the deployment - (deployment brake, never continuity). This is Idunn's decision, raised with the Idunn map. -- **I-F2 (Idunn):** "Idunn stopped restarting admitted odin" is a log line (`report_once`, `control_plane.rs:4599`), - not typed state. It belongs to Idunn's own operator surface. -- **F3 (from the write map):** the Eve lowering of `odin.store_condition` belongs to Odin's operator surface. - This map publishes the typed record only. -- **H-F1 (Heimdall):** confirm whether the deployed Heimdall re-puts its Odin documents every 60 s. O3's - outstanding list measures it after any recovery. -- **Q3 B's record in the write map:** "an ACK means durable" holds against crashes, not against a corruption at - activation, which loses at most the last write (C1). diff --git a/docs/transport-shortcut-inventory.md b/docs/transport-shortcut-inventory.md deleted file mode 100644 index 96d59e8..0000000 --- a/docs/transport-shortcut-inventory.md +++ /dev/null @@ -1,720 +0,0 @@ -# Transport Shortcut Inventory - -> **Path note, 2026-09-05.** Idunn was extracted to -> https://github.com/GameCult/Idunn. Entries below citing `scripts/idunn-*.ps1`, -> `scripts/health-idunn-*`, `scripts/notify-idunn-*` or `scripts/start-idunn-local.ps1` -> refer to paths that moved to `gamecult-ops/scripts/idunn/`; unit files and Idunn -> documentation moved to the Idunn repository. This is a dated ledger and the -> entries are left as written. - -Status date: 2026-07-03 - -## Authority Map - -Owner: Odin owns Verse rendezvous, accepted provider/interface catalogs, and CultMesh/CultNet document discovery. - -Inputs: child-daemon CultMesh/CultCache witness stores, daemon-published `idunn.daemon_health` over `cultnet.transport.rudp.v0`, provider advertisements, Eve surface records, and explicit lifecycle command boundaries. - -Outputs: accepted provider catalog, interface surfaces, daemon desired state, transport profiles, command boundaries, keepalive decisions, and operator-facing lowerings. - -Derived state: browser HTTP/WebSocket endpoints, Hermodr pages, `.cmd` wrappers, health scripts, and SSH/systemd probes are lowerings, debug witnesses, or command ergonomics. They do not own daemon health, service discovery, input transport selection, or Sleipnir input mapping route selection. - -Forbidden writers: compatibility health commands, HTTP status endpoints, WebSocket decks, explicit endpoint mapping fields, stale HID records, and local command probes must not decide daemon health or transport selection. - -Shared paths: user UI actions, typed input-mapping updates, startup, reconnect, and RUDP timeout recovery must all discover Muninn input streams from Odin/CultMesh provider advertisements and consume actual HID frames through the advertised CultNet/RUDP endpoint. - -Deletion line: delete endpoint overrides and fallback health/input paths before adding ergonomic replacement controls. - -## Cut In This Pass - -- Sleipnir no longer accepts `--muninn-rudp` from the launcher or CLI. -- Sleipnir no longer reads `muninnRudp` / `muninn_rudp` from mapping JSON as transport authority. -- Sleipnir no longer applies virtual HID state from stale CultMesh store records when the fast RUDP stream is absent. -- Sleipnir UI actions no longer carry `muninnRudp`; they select device/remap only. -- Hermodr no longer requires or writes `muninnRudp` for Sleipnir mapping commands. -- Hermodr no longer synthesizes `gamecult.hermodr.fallback_odin_catalog.v1` from `/eve/deck/providers` when Odin's snapshot is unreadable. -- Idunn no longer runs compatibility health commands to decide daemon health when fresh daemon-published RUDP health is missing. -- Idunn now publishes a non-actuating `dependency-unavailable` supervisor observation on the daemon key when daemon RUDP health is absent. -- Odin interface discovery no longer scrapes `/eve/deck/providers` from seeded WebSocket deck URLs. -- Odin no longer performs LAN Eve deck scans to find provider truth. -- Odin no longer fetches provider surfaces over compatibility WebSocket decks or converts legacy dashboard `nodes` into Eve surfaces. -- Odin provider normalization no longer promotes `compatibility-eve-deck` routes to provider transport endpoints. -- Odin no longer hosts an HTTP health endpoint or `/eve/deck` WebSocket/HTTP renderer surface at all. The `src/odin/websocket.cjs` side-door module was deleted, `odin-coordinator.cjs` refreshes only into CultMesh/CultNet state, and Idunn reads Odin health as `daemon-published-rudp:odin.cultnet-rudp-provider-health`. `health-odin.ps1` remains an explicit daemon witness inspection only. -- Muninn transport profiles no longer advertise local CLI health/activation as fallback transport; activation is a command lowering and provider routes remain provider transport only. -- Stonks no longer binds daemon-owned HTTP health, JSON snapshot, or WebSocket Eve deck side doors. The daemon refreshes typed CultCache/CultMesh records, publishes Idunn RUDP health, and optionally announces its provider advertisement to Odin through CultMesh/RUDP; renderer lowerings must be owned outside Stonks. -- VoidBot swarm transport profile no longer advertises `health-voidbot.cmd` or `compatibility.local-command fallback`; operations health remains a debug witness only. -- VoidBot Idunn health publisher and orchestrator wrapper no longer default health publication to `127.0.0.1:17870`; `--endpoint` or `VOIDBOT_IDUNN_RUDP_HEALTH` is required for publication, otherwise the orchestrator records an explicit skipped-health-publication event. -- StreamPixels, Heimdall, and Repixelizer no longer describe SSH/systemd/HTTP witnesses as fallback transport authority; missing RUDP health is represented as missing daemon publication. -- Vili no longer describes HTTP/WebSocket/JSON lowerings as compatibility transport, and missing Idunn RUDP health now surfaces as missing publication instead of local-only fallback. -- Weksa command and transport profiles no longer carry null `compatibility` objects; deleted HTTP command lanes and debug lowerings are explicit non-authorities. -- Gjallar no longer falls back to Odin `/eve/deck` WebSocket catalog/provider input when Odin CultNet/RUDP snapshot input is absent. -- Gjallar runtime config and provider advertisement no longer publish a `DeckUrl`/`--url` input endpoint; missing Odin RUDP configuration is visible missing input transport. -- Idunn generated transport profiles no longer append local-command, HTTP/WebSocket, or SSH/systemd/HTTP fallback transport for migrated targets. -- Idunn command boundaries no longer grant health authority to command probes; health authority is daemon-published RUDP health, while local commands remain lifecycle/debug entrypoints only. -- Odin WebSocket provider lowering no longer accepts `compatibility-eve-deck` routes as provider transport endpoints. -- Mimir Nightwing Eve dashboard and browser reference command boundaries no longer publish `idunn.local-command.restart + compatibility.systemd...` lifecycle authority. -- Mimir Nightwing Eve dashboard and browser reference transport profiles no longer publish `compatibility.*` input transports; health checks now reject HTTP/WebSocket if it reappears as transport authority. -- Odin health scripts for the Nightwing Eve dashboard and browser reference now verify the daemon-owned supervisor/debug-lowering records instead of requiring the old compatibility lifecycle/input transport values. -- Idunn transport profile and command boundary schema fields have been renamed from compatibility-shaped field names to `debug_mechanism` and `command_lowerings` while preserving their CultCache slot positions. -- VoidBot swarm command boundary and transport profile exports now use `command_lowerings` and `debug_mechanism` instead of compatibility-shaped field names. -- Mimir's OBS diagnostic program route is now labelled `obs-debug-sink`; OBS remains a diagnostic sink, not program composition or Verse publication authority. -- Bifrost provider advertisements and interface bindings no longer advertise the Starfire Odin WebSocket deck bridge or `compatibility-eve-deck` route; the remaining provider route is the CultCache/CultMesh witness. -- Odin, Mimir Eve dashboard, Stonks, Spotiverse, and Vili no longer serve local `/eve/deck/providers` provider catalogs as discovery shortcuts. -- Mimir Eve dashboard no longer serves `/eve/deck/manifest` or `/eve/dashboard/manifest` as HTTP publication side doors; provider manifests remain daemon-owned CultCache/CultMesh records. -- Eve Android no longer scrapes Mimir `/eve/deck/providers`; provider options come from the CultMesh dashboard state document it already consumes. -- VoidBot worker no longer reads Odin `/eve/deck/providers` or jumps from an Odin-discovered interface to a provider WebSocket for command execution. Provider listing is derived from Odin's embedded interface state, and command execution now refuses until a CultMesh command document path exists. -- Spotiverse and Vili smoke/export surfaces now use typed provider advertisements instead of deck provider manifests. -- Active Mimir branch worktrees (`Mimir-obs-muninn-branch`, `Mimir-raven-build`) had stale `/eve/deck/providers`/manifest handlers removed from dashboard/Muninn/Raven/Fensalir daemon code, and persisted witness route metadata was demoted from `websocket-bridge` to debug lowerings. -- Odin no longer accepts or reports seeded Eve deck URLs as a discovery configuration surface; provider/interface discovery is from CultMesh stores and live announcements. -- VoidBot MCP Odin tools no longer read Odin through `/eve/deck` WebSocket snapshots or accept `ODIN_BASE_URL`; they read Odin's `gamecult.eve.surface_state.v1` from the configured Odin CultMesh store (`ODIN_CULTMESH_STORE` or the default `E:\Projects\Odin\scratch\odin\odin.ccmp`). -- Idunn generated swarm plans no longer use `compatibility`/`fallback` wording for demoted probes; probe paths are described as debug witnesses and cannot satisfy daemon truth. -- Ymir no longer serves HTTP routes for discovery, operator state, projectile steps, overlap queries, or cast queries. `ymir-daemon publish-service` writes provider, operator, and Eve surface records to a CultCache service publication store; local step smokes are CLI-only. -- Spotiverse, Stonks, Vili, active Mimir branch docs, and Nightwing ops runbooks no longer advertise provider catalogs or manifest endpoints as live discovery surfaces. -- Aetheria's Unity Ymir bridge no longer posts JSON to hard-coded local Ymir HTTP endpoints for projectile steps, overlap queries, or cast queries. The bridge now calls the typed `YmirPhysicsQueries` surface directly, and `Aetheria.State.Verify` now guards against reintroducing the deleted HTTP fields/methods. -- StreamPixels no longer hand-assembles its service boundary `.cc` file with bespoke MessagePack/CultCache store encoding. `apps/service/src/verse-state.ts` opens a CultMesh node and writes provider advertisement, command boundary, transport profile, and Idunn health records through typed CultCache document definitions. -- Heimdall no longer hand-assembles its auth runtime `.cc` file with bespoke MessagePack/CultCache store encoding. `src/verse-state.ts` opens a CultMesh node and writes provider advertisement, command boundary, transport profile, and Idunn health records through typed CultCache document definitions. -- Loki no longer writes durable Chrome/provider/Eve state as typed text `.cc` witness sidecars while describing CultMesh publication as future. `src/loki-daemon.mjs` now writes snapshot, provider advertisement, Eve surface, command boundary, transport profile, debug probe, page snapshot, and Idunn health records through a typed CultMesh store at `state/loki.service.ccmp`, with optional explicit Odin startup announcement through `--odin-cultmesh-uri` / `LOKI_ODIN_CULTMESH_URI`. -- Idunn-managed restart scripts in Odin no longer act as independent deploy/restart authorities. `restart-odin.ps1`, Muninn/Vili/Nightwing restart scripts, and the Stonks/Weksa/VoidBot restart `.cmd` wrappers now require `IDUNN_ACTUATOR=1` plus `IDUNN_COMMAND_AUTHORITY=idunn-daemon`; without those Idunn actuator marks they fail before SSH, systemd, Task Scheduler, or local process launch work can begin. -- Idunn-managed deploy/restart `.cmd` wrappers in Odin no longer present manual side doors over guarded actuator bodies. The deploy wrappers for Nightwing Gjallar and Yggdrasil StreamPixels/Heimdall/Repixelizer, plus Odin/Muninn/Vili/Nightwing restart wrappers, now require `IDUNN_ACTUATOR=1` and `IDUNN_COMMAND_AUTHORITY=idunn-daemon` before they delegate. -- Odin's Idunn deployment target catalog now names every guarded deploy/restart actuator path as a target command, target alias, or shared Idunn actuator. Odin, Stonks, Weksa, VoidBot, Raven Muninn, Vili, Nightwing Eve dashboard, and Nightwing Eve browser reference are represented in `scripts/idunn-deployment-targets.ps1`, so the guarded scripts are configuration-owned instead of floating side doors. -- Yggdrasil StreamPixels, Heimdall, and Repixelizer remote deploy bodies in `gamecult-ops` no longer act as standalone server-side deployment runbooks. Odin's Idunn deploy wrappers pass `GAMECULT_IDUNN_REMOTE_ACTUATOR=1` plus `IDUNN_COMMAND_AUTHORITY=idunn-daemon` through `sudo env`, and the remote bodies reject missing marks. StreamPixels and Repixelizer also no longer git-clone/fetch/reset on the target host; they require the audited source tarball shipped by Idunn. -- Odin no longer has an `--includeRemoteWitnesses` path that imports copied Nightwing/Raven Muninn/sleipnir witness stores from `scratch/remote-witnesses`. The untracked `scripts/sync-muninn-remote-witnesses.ps1` SCP/SFTP helper was deleted outright; remote providers must announce through Odin/CultMesh/RUDP or an explicitly configured live CultMesh store, not copied local witness files. -- Weksa no longer writes or health-checks top-level provider/operator text witness sidecars (`provider-advertisement.cc`, `operator-state.cc`, `eve-surfaces.cc`, `command-boundary.cc`, `transport-profile.cc`, `cultmesh-publications.cc`). The daemon writes provider advertisement, operator state, Eve surface, command boundary, and transport profile records to `.weksa/provider-advertisement-store.cc`; `--health` now reads those typed CultMesh records, while MiMo request/receipt `.cc` artifacts remain command trace records. -- Bifrost no longer exports or advertises a singleton `.bifrost/provider-advertisement.cc` witness as its Odin discovery surface. `tools/provider-advertisement.mjs export` now writes `.bifrost/provider-store.cc` containing provider advertisement, operator surface, and Eve interface binding records, and advertises the route as `cultmesh-store`. -- Odin no longer seeds interface discovery from repo-local `.cc` paths or machine-local `C:\Meta\Odin\state\...` stores. Provider discovery is owned by live CultMesh/RUDP announcements through Odin; explicit local store inspection is a debug import and must be configured as a `cultmesh-store:file://...` URI via `--interfaceBindingStore` or `ODIN_INTERFACE_BINDING_STORES`. -- Mimir Eve dashboard no longer accepts arbitrary `--provider id|title|ws-url` WebSocket deck registrations or synthesizes a StreamPixels SSH/LAN edge provider. The broker catalog now contains only its local/dashboard providers and typed witness-backed surfaces. -- Eve browser reference no longer includes a hardcoded `VoidBot Live` provider that dials Mimir's `/eve/deck` broker with a custom `mimir-eve-deck` transport. The browser reference is fixture/local-advertisement only until live provider advertisements arrive through Odin/CultMesh. -- Eve Android no longer bakes in `ws://192.168.1.66:8795/eve/deck/cultmesh` or `ws://192.168.1.66:8796/eve/periwinkle`. The native app reads explicit `org.gamecult.eve.DASHBOARD_URI` and `org.gamecult.eve.SENSOR_URI` launch extras; when absent, receive/publication stays visibly disabled until Odin/CultMesh discovery provides the endpoints. -- Eve iOS no longer cycles through baked localhost/Starfire WebSocket candidates for frame stream, dashboard, camera, or microphone routes. `EVE_STREAM_URLS`, `EVE_DASHBOARD_URLS`, `EVE_CAMERA_URLS`, and `EVE_MIC_URLS` must be configured by Odin/CultMesh tooling or operator config; absent configuration stays visibly missing. -- Mimir's Verse recorder, Nightwing typed witness publisher, and `start-nightwing-move-tracking.ps1` wrapper no longer default to localhost/Starfire Periwinkle WebSocket endpoints. The wrapper requires `-WitnessUrl`/`MIMIR_NIGHTWING_WITNESS_URL` and `-SubscribeUrl`/`MIMIR_NIGHTWING_SUBSCRIBE_URL` supplied by Odin/CultMesh discovery or explicit operator config. -- `gamecult-ops` Nightwing visible-ops TUI/framebuffer lowerers no longer default to `ws://192.168.1.66:8797/eve/deck`. The Python lowerers require `--url`, and the shell launchers require `GAMECULT_VISIBLE_OPS_URL` from Odin/CultMesh discovery. -- Odin's README, architecture map, and Gjallar handoff doc no longer describe LAN deck URLs, seeded deck URLs, or the old HTTP/WebSocket deck bridge as discovery/input mechanisms. -- Sleipnir input mapping no longer uses `starfire.sleipnir.mapping.json`, `raven.sleipnir.mapping.json`, `--mapping-path`, Hermodr SSH/PowerShell writes, or an hermodr-configured local store fallback. Hermodr accepts only a `cultmesh://` Sleipnir command route advertised by Odin, publishes `sleipnir.input_mapping.v1` to Odin over the configured Odin CultMesh/RUDP substrate, and rejects raw host/port routes instead of dialing them. Sleipnir pulls `sleipnir.input_mapping.v1` from Odin discovery and chooses the newest local-or-Odin mapping record. -- Odin marquee generation no longer falls back to Stonks' HTTP `/market/state` endpoint. Stonks market tape must arrive through the provider's CultMesh/Eve surface (`marqueeText`) in the Stonks CultCache store. -- Odin provider advertisement inspection no longer promotes `ws://` endpoints ahead of CultMesh/provider addresses when deriving `transportEndpoint`; WebSocket endpoints remain lowerings/debug routes unless explicitly represented by typed CultMesh state. -- Vili provider advertisements no longer publish HTTP routes or deck WebSocket URLs as provider endpoints; the provider endpoint is the Vili CultMesh service store, while HTTP/WS routes live under `debugLowerings`. -- Vili motion generation no longer accepts HTTP command authority through `/motion/generate`; that route now returns `410 command_route_removed`. Vili polls `gamecult.vili.motion_request.v1` documents from `vili.service.cc`, runs the Kimodo worker from that typed request, and writes `gamecult.vili.motion_job.v1` receipts before JSON debug exports. -- VoidBot repo-face and Metame owner voice projection no longer submit Weksa MiMo VoiceDesign commands over `WEKSA_DAEMON_BASE_URL` / HTTP `/speech-provider/mimo/voicedesign`; `WeksaSpeechClient` now requires the configured `WEKSA_CULTMESH_COMMAND_URI` and fails closed until a real CultMesh command-document writer publishes `weksa.mimo_voicedesign_command.v0`. -- VoidBot no longer defaults Weksa speech command transport to a localhost/direct endpoint or advertises stale `ODIN_BASE_URL` in `.env.example`. `REPO_FACE_WEKSA_SPEECH_ENABLED=true` now requires an explicit `WEKSA_CULTMESH_COMMAND_URI` supplied by Odin/CultMesh discovery or operator config. -- Weksa's service contract and Idunn's generated Weksa surgery plan no longer teach a direct MiMo VoiceDesign command ingress. The command path is described as the Odin/CultMesh command URI carrying `weksa.mimo_voicedesign_command.v0`. -- `gamecult-ops` Nightwing tunnel runbook and service inventory no longer present Nightwing LAN broker/browser URLs, Starfire Eve deck URLs, or Starfire Periwinkle URLs as current operator recipes. Broker checks are SSH-local debug probes, browser access is explicit tunnel/Odin-discovered URL only, Gjallar consumes configured `GJALLAR_ODIN_CULTMESH_URI`, and the Nightwing witness publisher uses configured `MIMIR_WITNESS_URL`. -- Bifrost's provider advertisement help and Verse contract no longer show `127.0.0.1:17871` as the Odin publication endpoint. Publication uses `--odin-cultmesh-uri` / `BIFROST_ODIN_CULTMESH_URI`, and the examples use Odin's CultMesh rendezvous URI. -- Spotiverse's README no longer shows a raw Odin RUDP startup publication endpoint; startup publication remains optional and explicit through `SPOTIVERSE_ODIN_CULTMESH_URI`, with examples using Odin's CultMesh rendezvous URI. -- Active Mimir branch Fensalir daemon docs, launcher output, provider manifest wording, and state capability labels no longer call local `/eve/deck` or `/eve/deck/cultmesh` WebSocket routes provider/bridge transport. They are explicitly local debug lowerings while CultCache `.ccmp` and typed CultMesh/Eve state remain authority. -- Active Mimir branch Raven daemon no longer starts a daemon-owned HTTP/WebSocket Eve side door. `Mimir.RavenDaemon` now publishes only `mimir.raven_capture_mux_state.v1` through its CultMesh/CultCache store while FFmpeg/SRT owns media fanout; the deleted server body no longer exposes a health route, deck route, or deck-shaped shadow document. -- Active Mimir branch Fensalir daemon no longer starts a daemon-owned HTTP/WebSocket Eve side door. `Mimir.FensalirDaemon` now runs only its Well-drinking state loop and persists `mimir.fensalir_daemon_state.v1`, `mimir.fensalir_reservoir_worker_state.v1`, and `mimir.fensalir_reservoir_pressure.v1` through CultCache; the deleted server body no longer exposes a health route, deck route, binary deck route, provider manifest, or deck-shaped shadow surface. -- Active Mimir branch EveDashboard no longer starts the old deck broker or accepts launch-time `id|title|url` provider registrations. `Mimir.EveDashboard` now publishes built-in dashboard provider state through CultNet/CultMesh only; the deleted broker path no longer exposes health, deck, compatibility, per-provider deck, frame-command, or external-provider WebSocket routes. -- Active Mimir branch online supervisor no longer passes a Fensalir port, writes a Fensalir deck bridge route, or waits on Fensalir HTTP health after starting `Mimir.FensalirDaemon`. It now waits for the run-local Fensalir CultCache state store instead of treating the deleted network surface as readiness. -- Active Mimir branch EveSensorReceiver no longer exposes an HTTP health route or starts with baked camera port/path defaults. `--port` and `--path` are required from Odin/CultMesh tooling or explicit operator config, and the online supervisor now waits for the receiver startup log instead of probing localhost health. The remaining receiver WebSocket lane is classified as explicit media/sensor ingress, not service discovery or daemon health authority. -- Standalone Gjallar docs/state no longer teach `192.168.1.66:17871` or the old Odin Eve deck WebSocket input as a retained compatibility fallback. They now match the already-cut runtime: configured Odin CultNet/RUDP snapshot input only, with the deck bridge removed. -- Standalone Fensalir's native Eve surface client no longer defaults to `ws://127.0.0.1:8795/eve/deck`. `FENSALIR_EVE_BROKER` must be supplied by Odin/CultMesh tooling or explicit operator config; absent configuration is visible missing input instead of a localhost broker guess. -- Ghostlight's provider advertisement fixture no longer advertises CultMesh/Odin provider discovery as future work. The fixture now names `CultMesh/Odin provider discovery`, matching the existing `publish-odin` CultMesh/RUDP publication path. -- `gamecult-ops` local inventory no longer preserves Raven/Starfire/Qwen LAN addresses as operator recipes. It uses `OFFSITE_BACKUP_SSH_TARGET`, `LOCAL_INFERENCE_BASE_URL`, and `LOCALCAST_RECEIVER_HOST` placeholders so local notes do not re-teach deleted transport shortcuts. -- `gamecult-ops` script inventory now names localhost HTTP checks as deployment/debug probes for product web stacks and nginx routing. The note explicitly denies ownership of Verse discovery, provider catalogs, daemon health, or command transport, and requires CultMesh-boundary checks to verify configured witnesses instead of replacing them with localhost truth. -- Eve renderer parity docs no longer say the browser reference renders "live VoidBot" through the provider picker. The web reference is documented as local provider advertisements and fixture surfaces only; live provider feed remains future Odin/CultMesh input. -- Bifrost's provider-advertisement exporter no longer hardcodes `http://127.0.0.1:5080/healthz` and `/readyz` into the operator-surface stats path. HTTP probe URLs are optional explicit inputs via `--health-url` / `--ready-url` or `BIFROST_HEALTH_URL` / `BIFROST_READY_URL`; absent probes render as `unprobed` instead of localhost-shaped daemon truth. -- VoidBot's local `.env` no longer carries the deleted Weksa HTTP shortcut. It now follows the live config surface with blank `WEKSA_CULTMESH_COMMAND_URI` while `REPO_FACE_WEKSA_SPEECH_ENABLED=false`, so enabling Weksa speech still requires an explicit Odin/CultMesh-discovered route. -- Heimdall state memory and fresh-workspace handoff no longer tell operators to deploy with `GC_ACCESS_IDUNN_RUDP_HEALTH=10.77.0.2:17870` or confirm source-address acceptance from `10.77.0.1`. They now describe Odin/CultMesh-discovered Idunn RUDP health routing, with HTTP/JWKS/systemd/nginx as product/debug witnesses. -- Heimdall no longer has hardcoded Repixelizer or Spotiverse backend-callback URL exceptions in `src/app.ts`. Backend handoff trust is owned by `GC_ACCESS_APP__BACKEND_CALLBACK_URLS` / `config.appBackendCallbacks`, so app callback routes are configured operator knowledge instead of app-specific transport lore in Heimdall code. -- Spotiverse no longer defaults its Heimdall peer service URL to `http://127.0.0.1:4100`. `HEIMDALL_BASE_URL` is required and must come from Odin/CultMesh discovery or explicit operator config; Spotiverse's own local return/callback defaults remain local product-web callback ergonomics, not daemon discovery authority. -- Spotiverse command authority now ingests `spotiverse.command_request.v1` documents from the daemon `.ccmp`, routes CultMesh requests through the same executor as debug lowerings, and writes `spotiverse.command_receipt.v1` documents back to CultMesh. `/commands/add-to-queue` and Eve `spotiverse-command` WebSocket frames are debug lowerings only. -- Odin no longer runs TCP/SSH/systemd/GPU host probes during provider catalog state builds or uses LAN-IP source inference to assign Verse body identity. Remote Verse tiles are derived from provider advertisements and interface records; absent provider-owned witnesses stay visibly `waiting`. -- `gamecult-ops` Gjallar systemd unit no longer pins Odin input to a raw RUDP endpoint; the unit consumes `GJALLAR_ODIN_CULTMESH_URI` from `/etc/gamecult/gjallar.env` or defaults to Odin's CultMesh rendezvous URI, and rejects stale raw Odin endpoint env. -- Weksa start/restart wrappers no longer default Odin startup publication to `127.0.0.1:17871`; `-OdinCultMeshUri` comes from an explicit parameter or `WEKSA_ODIN_CULTMESH_URI`, otherwise the daemon uses Odin's CultMesh rendezvous URI. -- Bifrost bridge, dispatch, request-lane, and governance mutation CLIs no longer accept `--allow-unreceipted-activity`, `BIFROST_ALLOW_UNRECEIPTED_ACTIVITY`, `--allow-ungated-github`, or `BIFROST_ALLOW_UNGATED_GITHUB` as operator recovery hatches. Mutating activity now fails closed unless `BIFROST_BRIDGE_BASE_URL` and `BIFROST_BRIDGE_TOKEN` route it through the Bifrost receipt/gate path. -- Odin's Starfire/Raven/Nightwing Muninn and Sleipnir launchers no longer default Odin startup publication to `192.168.1.66:17871`; `-OdinCultMeshUri` comes from an explicit parameter or `ODIN_CULTMESH_URI`. -- Odin's Raven Sleipnir launcher no longer advertises or opens a raw command RUDP endpoint. Sleipnir publishes `cultmesh://odin/command/sleipnir/input_mapping` as its command route and reads the typed `sleipnir.input_mapping.v1` command document from Odin discovery; `--command-rudp-bind` is a fail-closed removed flag. -- Odin's Raven Sleipnir deploy/restart actuators no longer default SSH to `192.168.1.84`; they use the named `raven` target by default while endpoint-bearing daemon transport remains explicit CultMesh/CultNet configuration. -- Odin's Starfire Sleipnir launcher no longer passes `E:\Projects\Odin\scratch\odin\odin.ccmp` as a default discovery store. Sleipnir discovers Muninn provider records from Odin through `--odin-cultmesh-uri`; local `--discovery-store` use is explicit debug/operator input only. -- Active `Odin-clean-move-identity` worktree deploy/restart scripts no longer preserve stale Idunn/Odin endpoint defaults, Raven media target defaults, or direct Vili operator-state HTTP checks. Deploy/restart `.ps1` bodies and `.cmd` wrappers now require `IDUNN_ACTUATOR=1` plus `IDUNN_COMMAND_AUTHORITY=idunn-daemon`, matching the current Odin actuator boundary. -- Active `Odin-clean-move-identity` source no longer keeps Odin's old seeded deck discovery, LAN deck scan, copied/SFTP witness import, Stonks HTTP market fallback, remote TCP/SSH/systemd health probes, or `compatibility-eve-deck` route promotion. Provider/interface discovery is CultMesh/Odin-owned, and explicit local debug imports must use `cultmesh-store:file://...`. -- Odin's Nightwing Gjallar deploy actuator no longer defaults the live snapshot input to `192.168.1.66:17871`; it requires `-OdinCultMeshUri`, `GJALLAR_ODIN_CULTMESH_URI`, or `ODIN_CULTMESH_URI` and fails closed on stale raw endpoint env. -- Odin's Raven/Starfire/Nightwing Muninn restart and health wrappers no longer default daemon health publication checks to `192.168.1.66:17870`; `-IdunnRudpHealth` comes from an explicit parameter or `IDUNN_RUDP_HEALTH`, and wrappers fail closed without it. -- Odin's own start/restart wrappers no longer default daemon health publication to `127.0.0.1:17870`; `-IdunnRudpHealth` comes from an explicit parameter, `ODIN_IDUNN_RUDP_HEALTH`, or `IDUNN_RUDP_HEALTH`, and wrappers fail closed without it. -- Odin's Nightwing Gjallar deploy actuator, Raven Vili restart actuator, and Nightwing Muninn health actuator no longer default Idunn health publication/checks to `10.77.0.2:17870`; their Idunn endpoint comes from explicit parameters or service-specific environment variables. -- Vili's own start/restart/task-install wrappers no longer default Idunn health publication to `10.77.0.2:17870`; they require `-IdunnRudpHealth`, `VILI_IDUNN_RUDP_HEALTH`, or `IDUNN_RUDP_HEALTH`. -- `gamecult-ops` StreamPixels, Heimdall, and Repixelizer deploy scripts no longer write `10.77.0.2:17870` into missing service env files. They require an existing service env assignment or an explicit `*_IDUNN_RUDP_HEALTH_DEFAULT` deployment variable. -- Odin's Starfire/Raven/Nightwing Muninn restart wrappers no longer default HID controller provider advertisements to `192.168.*` endpoints; when HID RUDP bind is enabled, `-HidControllerRudpAdvertise` or `MUNINN_HID_CONTROLLER_RUDP_ADVERTISE` is required. -- Odin's Raven Muninn restart wrapper no longer defaults media, OBS, or OBS catalog publication to Starfire LAN endpoints. `-TargetHost` or `MUNINN_MEDIA_TARGET_HOST` is required, `-ObsTargetHost`/`MUNINN_OBS_TARGET_HOST` derives from the media target when omitted, and `-ObsCatalogRudpTarget`/`MUNINN_OBS_CATALOG_RUDP_TARGET` is optional instead of guessed. -- Odin's Raven Muninn restart and health wrappers no longer expose capture-command RUDP target or bind knobs. `request-stream` publishes typed commands through Odin/CultMesh, `serve` pulls them from Odin, and local activation storage is daemon-owned persistence/receipt body only. -- Odin's Raven Muninn activation launcher no longer defaults media or OBS targets to `10.77.0.2`. `activate-muninn-raven-av-srt.ps1` requires `-TargetHost` or `MUNINN_MEDIA_TARGET_HOST`, and `-ObsTargetHost` derives from the explicit media target unless supplied. -- Muninn itself no longer defaults media or OBS targets to `10.77.0.2`. `activate`, `request-stream`, and dry-run media plans require an explicit `--target-host`, and the published command boundary advertises no executable activation lowering until a media target is configured. -- Odin core discovery tests and Eve's provider advertisement contract no longer preserve real LAN/WireGuard addresses as example discovery routes. Tests use documentation address space, and Eve's route example uses a CultMesh URI instead of `cultnet://10.77.0.4:3075`. -- Odin's Starfire WireGuard elevation helper no longer rewrites unresolved `Nightwing.Home` to a baked Nightwing LAN endpoint or logs a baked Starfire LAN address. The fallback endpoint and optional LAN address must come from explicit parameters or `STARFIRE_WIREGUARD_NIGHTWING_ENDPOINT_FALLBACK` / `STARFIRE_LAN_ADDRESS`. -- `gamecult-ops` Raven connectivity checker no longer defaults Raven LAN ICMP to `192.168.1.84`; the required check is Raven's WireGuard address, and LAN probing only runs when `-RavenLanIp` or `RAVEN_LAN_IP` is supplied. -- Active Mimir branch proof/relay scripts no longer default Raven senders, Starfire receivers, Nightwing witness URLs, or Eve relay LAN host to `192.168.1.*` endpoints. The scripts and `Mimir.EveRelay` now require explicit parameters or `MIMIR_*` environment variables and fail closed without them. -- Root Mimir CultMesh AV sender/receiver scripts and media runtime no longer default relay input to `10.77.0.1`; `MIMIR_CULTMESH_RELAY_HOST`, `--host`, or `--endpoint` must be supplied by Odin/CultMesh discovery or operator config. -- Root Mimir Raven Muninn OBS feed, `Mimir-raven-build` `Mimir.Muninn`, and `Mimir-obs-muninn-branch` `Mimir.RavenDaemon` no longer default media/OBS target host to `10.77.0.2`; `MIMIR_MUNINN_TARGET_HOST` / `--target-host` is required, and OBS target derives from the explicit media target unless supplied. -- Active Mimir branch Well/VerseRecorder stream producers no longer default publish or subscribe transport to localhost Periwinkle WebSocket endpoints. `Mimir.Well` requires `--publish-url` or `MIMIR_WELL_PUBLISH_URL`; `Mimir.VerseRecorder` requires `--url` or `MIMIR_VERSE_RECORDER_URL`; `start-online-verse-daemons.ps1` requires `-WellPublishUrl` / `-SubscribeUrl` or the same environment variables. -- Mimir's neighbor sender setup doc no longer presents old Raven/Starfire LAN addresses as current SSH or SRT endpoint recipes; it now names configured aliases and receiver-host placeholders supplied by Odin/CultMesh discovery or explicit operator config. -- Active Mimir branch Nightwing typed witness publishers no longer default to Starfire's Periwinkle WebSocket URL. `--url` or `MIMIR_WITNESS_URL` is required. -- `Mimir-obs-muninn-branch` OBS Muninn source no longer carries baked Raven command or Starfire media endpoints as defaults, no longer migrates stale private endpoints to another private endpoint, and no longer reconstructs provider-supplied RUDP URLs from local media-target defaults. Missing command/media endpoints remain empty until supplied by typed catalog/discovery or explicit settings. -- Active Mimir docs and `audio-field.example.json` examples no longer present old Raven/Starfire LAN addresses as sender, receiver, Eve dashboard, SRT, CultNet, SSH, or calibration host recipes. They now use configured aliases, placeholders, or example hostnames. -- `Gjallar-rollback` no longer preserves a runnable Odin Eve deck WebSocket renderer. The rollback executable is a fail-closed archive tombstone that exits before dialing the removed transport and points operators at active Gjallar's CultMesh URI input path. -- Hermodr no longer treats Odin's localhost HTTP/WebSocket deck or `latest-surface.json` export as default discovery truth. It reads Odin's `gamecult.eve.surface_state.v1` document from the Odin CultMesh store (`--odinCachePath`, `--odinSurfaceKey`), with `--odinStatePath` left as an explicit debug fallback only. -- Vili no longer writes provider/operator/surface/command/transport/backend JSON sidecars by default. `--write-debug-sidecars` or `VILI_WRITE_DEBUG_SIDECARS=1` is required for explicit debug exports, and the daemon/smoke tooling no longer defaults to Raven's baked WireGuard HTTP URL. -- Odin's `health-vili.cmd` is archived and no longer curls Vili HTTP health at all; Vili health is daemon-published as `vili.cultnet-rudp-animation-health`. -- Muninn's Odin startup RUDP parser test no longer preserves `10.77.0.2:17871` as the example endpoint literal. -- Weksa no longer writes provider/operator/surface/command/transport/publication or MiMo request/receipt JSON mirrors by default. `--write-debug-json` or `WEKSA_WRITE_DEBUG_JSON=1` is required for explicit debug exports; `.cc` witnesses and the CultMesh store remain authority. -- Weksa start/restart wrappers no longer default Idunn health publication to `127.0.0.1:17870`; `-IdunnRudpHealth` comes from an explicit parameter or `WEKSA_IDUNN_RUDP_HEALTH`, and service launch fails closed without it. -- Stonks start wrapper no longer defaults Idunn health publication to `127.0.0.1:17870` or Odin startup publication to `127.0.0.1:17871`; `-IdunnRudpHealth` comes from explicit parameters or `STONKS_IDUNN_RUDP_HEALTH` / `IDUNN_RUDP_HEALTH`, and `-OdinCultMeshUri` comes from `STONKS_ODIN_CULTMESH_URI`. -- Spotiverse no longer writes `latest-surface.json` or `latest-spotify-state.json` by default, and no longer hydrates playback state from `latest-spotify-state.json` on boot by default. `--write-debug-json` / `SPOTIVERSE_WRITE_DEBUG_JSON=1` and `--read-debug-json` / `SPOTIVERSE_READ_DEBUG_JSON=1` are explicit debug/migration paths; the durable surface witness is the CultMesh `.ccmp` store. -- Odin's Raven Vili restart actuator no longer waits on Vili's HTTP operator-state route. It verifies restart through the Raven-local daemon state file and the configured Idunn RUDP health status. -- Odin no longer writes `scratch/odin/latest-surface.json` by default. The accepted network surface is persisted to the Odin CultMesh store, and the JSON surface export requires `--write-debug-surface-json` or `ODIN_WRITE_DEBUG_SURFACE_JSON=1`. -- Weksa no longer reads `docs/fixtures/weksa-provider-advertisement.json` as live daemon provider truth. The daemon constructs the live `gamecult.eve.provider_advertisement.v1` from runtime-owned code and current transport settings; checked-in provider fixtures stay examples only. -- Repixelizer's docs and repo state map no longer describe `/api/health`, `/api/config`, nginx, or `repixelizer-gui.service` as live daemon truth. The live GUI runtime writes provider, surface, queue/job, command-boundary, transport-profile, and `idunn.daemon_health` records to its configured `.cc` store, and missing Idunn RUDP health remains visible missing publication. -- Idunn swarm targets no longer carry `health_command` as part of the target contract, desired daemon records publish `health_command: None`, transport profiles report `debug_mechanism: none`, and `--health-command` is rejected. Missing daemon health is represented as a non-actuating missing CultNet/RUDP publication on the daemon key. -- Muninn transport profiles no longer advertise a literal `muninn --health --store ...` command as a debug lowering. The `serve` process owns Idunn health publication over CultNet/RUDP; `--health` remains an explicit diagnostic publisher, not a transport/profile shortcut. -- Idunn's README no longer teaches `--health-command` or command-exit health examples. Manual runs now document missing daemon RUDP publication as typed absence, and actuation examples use deploy/restart authority only. -- Idunn's architecture doc no longer describes command probes as compatibility health fallback. It now names daemon-published RUDP health as the health owner and missing/stale publication as typed missing-publication state. -- Odin surface/layout scoring no longer carries `legacy-dashboard-nodes` or `legacy-node-groups` compatibility branches. Provider-owned Eve/CultUI surface structure now drives overview eligibility without old dashboard-node marker exceptions. -- Spotiverse's local agent notes no longer describe CultMesh command documents as future work; they name `spotiverse.command_request.v1` as the live command input and HTTP/Eve command frames as debug lowerings. -- Repixelizer's README and witness contract no longer describe CultCache/CultMesh publication as future/reserved witness work. They name `RepixelizerVerseRuntime` and `repixelizer.service.cc` as the live daemon-owned witness while keeping the provider-advertisement fixture read-only. -- StreamPixels now accepts typed `streampixels.command_request.v1` CultMesh command documents for `preview-event`, routes them through `EventService.applyPreviewEvent`, and writes `streampixels.command_receipt.v1` receipts. `/api/admin/preview-event` is a debug/operator lowering into the same executor, not the command authority. -- Aetheria's package metadata and Perfect Machine map no longer describe CultMesh catalog/command bridge work as future where the typed state runtime and `AetheriaEveCommandBridge` already exist. Runtime presenters emit typed command documents; provider-owned bridge code accepts them from the CultCache/CultMesh state node. -- Odin and active Mimir branch docs no longer call WebSocket deck routes or old dashboard paths compatibility transports; they name renderer/debug lowerings. StreamPixels docs no longer show concrete `10.77.0.2` Idunn/Odin RUDP examples and instead require configured endpoints. -- Active Mimir branch Eve program-output docs no longer teach EveCanvas to try localhost and then fall back to a receiver host. Eve uses explicit `EVE_STREAM_URLS`; SSH tunnels and direct relay URLs are operator-supplied lowerings, not candidate fallback discovery. -- Heimdall's fresh-workspace handoff no longer teaches `GC_ACCESS_IDUNN_RUDP_HEALTH=10.77.0.2:17870`; it uses a configured Idunn endpoint placeholder. -- `gamecult-ops` and VoidBot offsite-backup docs/scripts no longer teach Raven's old LAN IP or a named Qwen box as the backup target. VoidBot already requires `OFFSITE_BACKUP_SSH_TARGET`; the docs now describe the configured SSH target instead of a baked workstation route. - -## Current Shortcut Inventory - -| Area | Current State | Required Direction | -| --- | --- | --- | -| Sleipnir input transport and mapping | Uses Odin/CultMesh provider advertisements to discover Muninn HID RUDP endpoints, publishes the Sleipnir command route as `cultmesh://odin/command/sleipnir/input_mapping`, and reads `sleipnir.input_mapping.v1` from local plus Odin discovery CultMesh stores for device/remap intent. Hermodr command lowering has no configured store fallback and no direct raw endpoint dial; it publishes the typed mapping document to Odin through the configured Odin CultMesh/RUDP substrate only when Odin advertises a `cultmesh://` Sleipnir command route. Startup publication to Odin is explicit/env-configured, not a Starfire LAN default. | Keep endpoint choice and command route selection derived from provider advertisements only, and route cross-host command ergonomics through Odin/CultMesh documents instead of remote file writes, raw host routes, or local store assumptions. | -| Idunn health | Fresh daemon-published RUDP health is the only healthy daemon truth; missing publication becomes an alarmable supervisor observation. | Keep command probes unable to satisfy health. | -| Hermodr browser lowering | Lowers Odin's typed `gamecult.eve.surface_state.v1` document from the Odin CultMesh store and proxies browser command ergonomics into Odin-advertised writable routes; no provider-catalog fallback, local Sleipnir store fallback, or default Odin HTTP/WebSocket deck input remains. Explicit `--odinStatePath` is debug fallback only. | Keep browser surfaces as lowerings only; do not let Hermodr invent Verse catalogs, command routes, or read renderer exports as default truth. | -| Odin daemon surface | Uses CultMesh stores and live CultNet/RUDP announcements for provider/interface truth; compatibility deck scraping, legacy node lowering, remote TCP/SSH/systemd probes, LAN-IP body inference, default JSON surface export, HTTP health, and Odin-hosted `/eve/deck` are removed from daemon runtime. | Keep Odin as a CultMesh/CultNet daemon. Renderers lower typed CultMesh state outside Odin; do not reintroduce HTTP/WebSocket side doors in Odin. | -| Muninn telemetry, HID, and media | Publishes provider advertisement, command boundary, transport profile, telemetry surfaces, HID input streams, media profile, and daemon health through CultCache/CultMesh/CultNet; activation commands are command lowerings, not provider routes. Startup publication to Odin, daemon health publication to Idunn, HID provider advertisement, and Raven media/activation targets are explicit/env-configured rather than Starfire LAN or WireGuard defaults. Muninn's own media CLI no longer has a baked target host, and boundary records leave activation lowerings empty until a target is configured. Transport profiles no longer advertise one-shot health commands; `serve` owns daemon health publication over CultNet/RUDP. | Keep Sleipnir discovery derived from Muninn provider advertisements and HID RUDP streams; move media/OBS routing toward Odin/CultMesh-resolved endpoints instead of launcher constants. | -| Stonks daemon surface | Publishes CultCache/CultMesh provider records and daemon RUDP health; the Stonks daemon no longer binds HTTP health, JSON snapshot, or WebSocket deck routes. | Keep market state and Eve/CultUI surfaces in typed CultCache/CultMesh records. Renderer lowerings must attach outside the daemon and must not become discovery or health authority. | -| Odin marquee/Stonks input | Odin builds market ticker text from Stonks' discovered Eve surface `marqueeText` only; direct HTTP `/market/state` scraping and `stonksStateUrl` config are removed. | Keep Stonks market data projected through typed CultMesh/CultCache state before Odin uses it. | -| Spotiverse / Stonks / Vili provider catalogs | Local deck provider-list HTTP endpoints are removed; provider advertisements and surfaces remain daemon-owned typed records or explicit debug/operator lowerings. Spotiverse command requests and receipts now use typed CultMesh documents in `spotiverse.ccmp`; HTTP and Eve WebSocket command shortcuts are removed. Vili motion generation now consumes `gamecult.vili.motion_request.v1` from `vili.service.cc` and writes `gamecult.vili.motion_job.v1`; `/motion/generate` is a `410` tombstone. | Keep provider discovery and command authority through Odin/CultMesh, not service-local manifest scraping or private command lanes. | -| VoidBot swarm surface | Publishes provider advertisement, command boundary, surface state, and transport profile from `.voidbot/status/cultmesh/voidbot-swarm-state.cc`; Idunn health is RUDP-published from the orchestrator. VoidBot MCP reads Odin embedded interface state from Odin's CultMesh store and refuses command execution without a CultMesh command transport. Repo-face and Metame voice projections send Weksa MiMo VoiceDesign commands over CultNet/RUDP instead of HTTP. | Keep operations-health JSON and HTML dashboard as debug/render lowerings only; add real CultMesh command document execution before re-enabling agent command sends. | -| StreamPixels / Heimdall / Repixelizer | Command boundaries and transport profiles name SSH/systemd/HTTP/api/nginx surfaces as deployment or debug lowerings, not transport authority. StreamPixels accepts `preview-event` through typed CultMesh command request/receipt documents, with HTTP preview as a debug/operator lowering only. Deploy scripts require explicit Idunn health endpoint config instead of writing a WireGuard endpoint default. Repixelizer now publishes its live GUI-owned Verse witness through `src/repixelizer/verse_state.py`; `/api/health` reports that runtime state rather than owning daemon truth. | Keep RUDP health publication daemon-owned; missing publication must remain visible instead of hidden by probes. Extend command documents one service primitive at a time instead of reviving private HTTP command lanes. | -| Bifrost bridge and request lane | External bridge writes, GitHub mutations, dispatch runs, request-lane mutations, snapshot imports, and governance mutations require the Bifrost bridge URL/token so receipt/gate state is recorded. The old unreceipted and ungated flags are rejected everywhere, including tests. | Keep Bifrost mutation authority behind the bridge receipt/gate contract; do not reintroduce local recovery hatches that let workers or operators mutate off-book. | -| Raven connectivity ops | Required connectivity checks use Raven's WireGuard address and SSH alias; Raven LAN ICMP is optional explicit diagnostics only. | Keep LAN probes out of required service health/discovery, and prefer Odin/CultMesh daemon publications for service truth. | -| StreamPixels service boundary store | The service writes `streampixels.service.cc` through `CultMesh.createNode(...).put(...)` with typed document definitions; the old bespoke single-file MessagePack writer is removed. | Keep service-owned CultCache/CultMesh publication as the Verse boundary; web `SERVICE_URL` stays product web/backend routing, not Odin discovery. | -| Heimdall service boundary store | The auth runtime writes `heimdall.service.cc` through `CultMesh.createNode(...).put(...)` with typed document definitions; the old bespoke single-file MessagePack writer is removed. | Keep Heimdall's auth/provider witness publication as typed CultMesh/CultCache state; HTTP auth/JWKS/discovery endpoints remain product and debug lowerings, not Odin discovery authority. | -| Loki Chrome observer | Chrome extension ingest and CDP probing are local observation lowerings. Loki now writes its daemon-owned snapshot, provider advertisement, Eve surface, command boundary, transport profile, debug/page snapshot, and Idunn health records through `state/loki.service.ccmp`, and only announces to Odin when an explicit Odin CultMesh/RUDP endpoint is configured. | Keep browser-extension HTTP as local input ergonomics only; do not restore text `.cc` witness sidecars or future-CultMesh prose as durable Verse state. | -| Repixelizer service boundary store | The GUI runtime writes provider advertisement, Eve surface state, runtime config, auth projection, queue snapshot, job/job-event records, command boundary, transport profile, and `idunn.daemon_health` to the configured `.cc` witness store. It publishes Idunn RUDP health when `GC_ACCESS_IDUNN_RUDP_HEALTH` is configured; otherwise the transport profile reports missing RUDP health publication. | Keep queue/job ownership in `GuiJobManager` until a deliberate typed-store ownership move, and keep HTTP/systemd/nginx as deployment/debug witnesses only. | -| Vili / Weksa | Vili publishes provider, operator, command, transport, motion request, and motion job records in its service CultCache store. HTTP/WS are operator/debug lowerings, JSON sidecars require explicit debug export, and the Vili smoke probe requires an explicit base URL. Weksa accepts commands over CultNet/RUDP, records deleted HTTP command lanes as non-authority, writes JSON mirrors only when debug export is explicit, and constructs its live provider advertisement from daemon-owned code rather than docs fixtures. Vili Idunn health, Weksa Idunn health, and Weksa startup publication are explicit/env-configured, not baked endpoint defaults. | Keep renderer, fixtures, and debug endpoints outside provider transport and command ownership, and route future Vili/Weksa command intake through typed records rather than JSON mirrors. | -| Gjallar | Runs headless beside Odin and Idunn on Yggdrasil, consumes Odin accepted provider state through CultNet/RUDP snapshot input, and publishes `gjallar.overview`; no WebSocket deck scrape, direct provider WebSocket receiver, baked Starfire endpoint, or live Nightwing framebuffer body remains. | Keep Yggdrasil aggregate membership/layout derived from Odin-owned provider state; EveCanvas, browser, TUI, and optional framebuffer clients lower the published tree without becoming owners. | -| Idunn surgery/profile records | Migrated target profiles name daemon-owned RUDP health plus daemon-owned CultCache/CultMesh stores. Swarm targets no longer carry health commands, desired daemon records publish `health_command: None`, `--health-command` fails closed, and missing health becomes a non-actuating missing-publication observation instead of a probe result. | Rename legacy schema fields in a later schema migration if consumers can move together. | -| Mimir Nightwing Eve dashboard/browser reference | Publish daemon-owned command boundaries and transport profiles with supervisor lifecycle authority and HTTP/WebSocket/static HTTP as lowerings, not compatibility transport authority. The Eve dashboard broker no longer imports arbitrary remote WebSocket deck providers or invents a StreamPixels SSH/LAN provider. Active proof/relay branch scripts require explicit endpoint config instead of baked Starfire/Raven LAN routes. | Keep Odin/Nightwing consumers reading the typed CultMesh/CultCache witnesses rather than service probes; add new remote surfaces through Odin/CultMesh ingestion, not broker launch args. | -| Mimir OBS diagnostic sink | OBS route is labelled and configured as a debug sink; Mimir owns composition and Yggdrasil/site publication remains the publication path. | Keep OBS outside Verse discovery, provider ownership, and publication authority. | -| Eve browser reference | The browser reference renders local fixtures and checked-in provider advertisements only; it no longer opens live providers by dialing Mimir's Eve deck broker directly. | Feed the picker from Odin/CultMesh `gamecult.eve.provider_advertisement.v1` documents before reintroducing live provider entries. | -| Eve native edges | Android no longer has hardcoded Mimir dashboard or Periwinkle sensor URLs; dashboard receive and sensor/media publication require explicit launch extras and otherwise report missing Odin/CultMesh discovery. iOS no longer has baked frame/dashboard/camera/mic WebSocket candidate lists; configured URL lists must come from Odin/CultMesh tooling or operator config and otherwise remain visibly missing. Standalone Fensalir's Direct2D Eve client also requires an explicit `FENSALIR_EVE_BROKER` and fails visible when Odin/CultMesh tooling has not supplied a lowering endpoint. | Replace explicit launch/config values with Odin/CultMesh-resolved dashboard/sensor/media endpoints, and keep absent discovery visible rather than falling back to LAN constants. | -| Mimir Nightwing sensor tooling | `Mimir.VerseRecorder`, `nightwing_typed_witness_publisher.py`, branch witness publishers, and `start-nightwing-move-tracking.ps1` no longer carry or synthesize direct default WebSocket endpoints. The wrappers start local receivers where needed but require publication/subscription URLs from Odin/CultMesh discovery or explicit operator config. | Replace explicit operator config with Odin/CultMesh-resolved sensor publication/subscription endpoints, and keep direct tool invocations fail-closed without discovered/configured endpoints. | -| Mimir OBS Muninn source | The OBS source consumes provider/catalog supplied RUDP URLs and command/media endpoints; stale private endpoint settings are cleared instead of rewritten to another private shortcut, and missing command/media endpoints stay inert. | Keep OBS as a renderer/diagnostic sink consuming typed Muninn catalog discovery; do not let the plugin own Raven/Starfire transport coordinates. | -| Nightwing visible ops lowerers | `gamecult-ops` TUI and framebuffer lowerers no longer default to the Starfire Odin deck URL; direct runs require `--url`, and shell launchers require `GAMECULT_VISIBLE_OPS_URL`. | Feed visible ops from Odin/CultMesh discovery or a generated operator env file, not hardcoded LAN deck addresses. | -| Starfire WireGuard bootstrap | The elevation helper starts the configured WireGuard service and records local diagnostics, but unresolved `Nightwing.Home` can only be replaced with an explicit operator-supplied endpoint fallback. | Keep network bootstrap separate from Verse discovery and do not let it smuggle hardcoded host identity back into service transport configuration. | -| Ymir physics service | Provider advertisement, operator state, and Eve surface publication are CultCache records in `.ymir/service.cc`; HTTP serve routes and command/query lowerings are removed. Aetheria no longer depends on Ymir's localhost HTTP endpoints for Unity physics queries. | Keep any future remote Ymir routing behind typed CultMesh query handles, not service-specific endpoint fields. | -| Aetheria Ymir bridge | Unity projectile, overlap, and cast queries use the typed local `YmirPhysicsQueries` surface; direct localhost Ymir endpoint fields and `HttpWebRequest` transport are removed. | Promote the same operation semantics into CultMesh query handles so local/in-process and remote Ymir routing share one semantic API. | -| Stale rollback clones | `Gjallar-rollback` is now an archived fail-closed tombstone instead of a runnable Odin Eve deck WebSocket client. `Odin-clean-move-identity` has been cleaned as an active branch worktree. | Keep rollback clones unable to act as service transport authorities; delete/archive any future clone that cannot be made fail-closed. | -| Remaining remote service witnesses | Framework-level CultMesh fallback route hints and Aetheria verifier guard strings remain; these are not service shortcut authorities. | Continue service-by-service cuts, moving provider, health, command boundary, and surface records into daemon-owned CultMesh/CultCache publication. | - -## Verification - -- `cargo test -p sleipnir-daemon` -- `node --check E:\Projects\Odin\src\hermodr-daemon.cjs` -- `node --check E:\Projects\Odin\src\odin\documents.cjs` -- `node --check E:\Projects\Odin\src\odin\marquee.cjs` -- `node --check E:\Projects\Odin\src\odin\config.cjs` -- `node --check E:\Projects\Odin\src\odin\state.cjs` -- `node --check E:\Projects\Odin\src\odin-coordinator.cjs` -- `node --check E:\Projects\Odin\src\odin\interfaces.cjs` -- `rg -n "mapping_path|mapping-path|starfire\.sleipnir\.mapping\.json|raven\.sleipnir\.mapping\.json|SleipnirMapping|SleipnirMapping|ravenSsh|readRemoteWindowsJson|writeRemoteWindowsJson|ssh-powershell-compat|local-file" E:\Projects\Odin\crates\sleipnir-daemon\src\main.rs E:\Projects\Odin\src\hermodr-daemon.cjs E:\Projects\Odin\scripts\start-hermodr.ps1 E:\Projects\Odin\scripts\restart-hermodr.ps1 E:\Projects\Odin\scripts\start-starfire-sleipnir.ps1` returned no hits. -- `rg -n "muninnRudp|muninn_rudp" E:\Projects\Odin\crates\sleipnir-daemon\src\main.rs E:\Projects\Odin\src\hermodr-daemon.cjs E:\Projects\Odin\scripts` only finds the negative test fixture proving the old key is ignored. -- `node --check E:\Projects\Odin\src\hermodr-daemon.cjs` -- PowerShell parse checks passed for `scripts\start-hermodr.ps1` and `scripts\restart-hermodr.ps1` after adding `-sleipnirProviderId`. -- Hermodr Sleipnir command smoke started a temporary target-local Hermodr with `--sleipnirProviderId sleipnir.input-mirror.starfire`, verified a configured command wrote `sleipnir.input_mapping.v1` to the CultMesh store, and verified a `sleipnir.input-mirror.raven` command was rejected with HTTP 409 instead of being written to the wrong store. -- `rg -n "stonksStateUrl|/market/state|httpGet" E:\Projects\Odin\src\odin\marquee.cjs E:\Projects\Odin\src\odin\config.cjs E:\Projects\Odin\src\odin\state.cjs E:\Projects\Odin\src\odin-coordinator.cjs E:\Projects\Odin\src\odin\interfaces.cjs` returned no hits. -- `rg -n -F 'startsWith(\"ws://' E:\Projects\Odin\src\odin\interfaces.cjs` returned no hits. -- `node --check E:\Projects\Vili\scripts\vili-daemon.mjs` -- `node E:\Projects\Vili\scripts\vili-daemon.mjs --print-provider-advertisement --state-root E:\Projects\Vili\.vili-test-codex` printed a provider advertisement whose only provider endpoint is the `cultmesh-store` witness and whose HTTP/WS routes are `debugLowerings`. -- `node --check E:\Projects\Vili\scripts\smoke-vili.mjs` -- `node E:\Projects\Vili\scripts\smoke-vili.mjs` exits 2 without `VILI_URL` or positional base URL. -- `node E:\Projects\Vili\scripts\vili-daemon.mjs --print-provider-advertisement --host 0.0.0.0 --port 8824` shows the `cultmesh-store` endpoint and local `127.0.0.1:8824` debug lowerings, with no `10.77.0.4:8824` baked URL. -- Temporary Vili daemon boot without `--write-debug-sidecars` wrote `vili.service.cc`, `vili-daemon.pid`, and `jobs`, and did not write `provider-advertisement.json`, `operator-state.json`, `eve-operator-surface.json`, `command-boundary.json`, `transport-profile.json`, or `backend-status.json`. -- Temporary Vili daemon boot with `--write-debug-sidecars` wrote the explicit debug JSON sidecars. -- `cmd /c scripts\health-vili.cmd` exits 2 as an archived HTTP health probe. -- `cargo test -p muninn-daemon serve_accepts_odin_cultmesh_rudp_startup_target` -- `rg -n "10\.77\.0\.4:8824|10\.77\.0\.2:17871|192\.168\.1\.66:17870|/eve/deck/providers|ODIN_BASE_URL|WEKSA_DAEMON_BASE_URL" E:\Projects\Odin\scripts E:\Projects\Odin\crates\muninn-daemon\src\main.rs E:\Projects\Vili -g '!node_modules' -g '!**/.git/**'` returned no hits. -- `node --check E:\Projects\weksa\scripts\weksa-daemon.mjs` -- Temporary Weksa daemon boot before the provider-store cut wrote the now-deleted top-level text witness sidecars. The later Weksa CultMesh health smoke verified the live daemon now writes `provider-advertisement-store.cc` and does not recreate `provider-advertisement.cc`, `operator-state.cc`, `eve-surfaces.cc`, `command-boundary.cc`, `transport-profile.cc`, or `cultmesh-publications.cc`. -- Temporary Weksa daemon boot with `--write-debug-json` wrote the explicit debug JSON mirrors. -- Temporary Weksa daemon boot with `--write-debug-json` verified the live provider advertisement is `mode: daemon-live`, contains the MiMo VoiceDesign command boundary with `acceptedByDaemon: true`, and contains no `fixture-read-only`, `acceptedByFixture`, or `Fixture exports` language. -- `rg -n "docs/fixtures/weksa-provider-advertisement\.json|fixturePath|acceptedByFixture|fixture-read-only|Fixture exports" E:\Projects\weksa\scripts\weksa-daemon.mjs E:\Projects\weksa\docs\verse-service-contract.md` returned no hits. -- PowerShell parse checks passed for `E:\Projects\weksa\scripts\start-weksa-daemon.ps1` and `E:\Projects\weksa\scripts\restart-weksa-daemon.ps1` after removing the localhost Idunn health default. -- `powershell.exe -NoProfile -ExecutionPolicy Bypass -File E:\Projects\weksa\scripts\start-weksa-daemon.ps1` with `WEKSA_IDUNN_RUDP_HEALTH` unset exits nonzero before starting the daemon and reports that `-IdunnRudpHealth` or `WEKSA_IDUNN_RUDP_HEALTH` is required. -- Source/doc scan of Weksa launchers and Odin Idunn docs for `127.0.0.1:17870`, stale Weksa command-ingress debt wording, and `IdunnRudpHealth = "127` returned no hits; the only remaining `127.0.0.1:17870` hit is this inventory note. -- Weksa command-ingress scan now verifies the live daemon publishes a CultMesh command route and no longer exposes `--mimo-command-json` or `sendWeksaMimoVoiceDesignCommand` as direct RUDP client shortcuts. -- PowerShell parse check passed for `E:\Projects\Odin\scripts\restart-vili.ps1` after replacing the HTTP operator-state health wait with Raven-local daemon state file verification. -- `node --check E:\Projects\Odin\src\odin\config.cjs` -- `node --check E:\Projects\Odin\src\odin-coordinator.cjs` -- Inline `buildConfig` smoke verified `writeDebugSurfaceJson` is false by default and true with `--write-debug-surface-json` or `ODIN_WRITE_DEBUG_SURFACE_JSON=1`. -- `rg -n "latest-surface\.json|writeDebugSurfaceJson|ODIN_WRITE_DEBUG_SURFACE_JSON|write-debug-surface-json|fs\.writeFileSync\(path\.join\(config\.stateDir" E:\Projects\Odin\src\odin-coordinator.cjs E:\Projects\Odin\src\odin\config.cjs E:\Projects\Odin\README.md E:\Projects\Odin\docs\transport-shortcut-inventory.md` shows the JSON write is guarded by `config.writeDebugSurfaceJson`. -- `cargo test -p idunn-daemon -p odin-core` -- `rg -n "health_command: Some|--health-command \[|manual\.command-health|test\.command-exit|__idunn_probe|exit 1|compatibility_health_key|probe_health" E:\Projects\Odin\crates\idunn-daemon\src\main.rs E:\Projects\Odin\crates\odin-core\src\idunn.rs` returned no hits. -- `cargo test -p muninn-daemon` -- `rg -n -e "health_command" -e "muninn --health --store" -e "command-probe exit semantics" E:\Projects\Odin\crates\muninn-daemon\src\main.rs` returned no hits. -- `rg -n "motion_request\.v0|motion_job\.v0|/eve/deck/providers|ravenDeckUrl|compatibilityMechanisms|compatibility lowerings|compatibility export|endpoints:\s*\{|deckBroker|providerDeck" E:\Projects\Vili\scripts\vili-daemon.mjs E:\Projects\Vili\docs\verse-service-contract.md E:\Projects\Vili\README.md` returned no hits. -- `git -C E:\Projects\Vili diff --check -- scripts/vili-daemon.mjs docs/verse-service-contract.md` passed with CRLF normalization warnings only. -- `node E:\Projects\VoidBot\node_modules\typescript\bin\tsc -b --pretty false` -- `node --check E:\Projects\VoidBot\scripts\publish-idunn-rudp-health.cjs` -- PowerShell parse check passed for `E:\Projects\VoidBot\scripts\run-gamecult-orchestrator.ps1` after removing the localhost Idunn health default. -- `node E:\Projects\VoidBot\scripts\publish-idunn-rudp-health.cjs` with `VOIDBOT_IDUNN_RUDP_HEALTH` unset exits nonzero and reports that `--endpoint` or `VOIDBOT_IDUNN_RUDP_HEALTH` is required. -- `Select-String -SimpleMatch` across VoidBot health publisher and orchestrator wrapper found no `127.0.0.1:17870`; the only `localhost default` hit is the refusal message saying no localhost default is assumed. -- `rg -n "WEKSA_DAEMON_BASE_URL|daemonBaseUrl|speech-provider/mimo/voicedesign|http://127\.0\.0\.1:8813" E:\Projects\VoidBot\.env.example E:\Projects\VoidBot\packages E:\Projects\VoidBot\apps -g "*.ts" -g "*.example"` returned no hits. -- `git -C E:\Projects\VoidBot diff --check -- .env.example packages/core/src/weksa-speech.ts packages/config/src/index.ts apps/worker/src/index.ts apps/bot/src/metame-owner-voice-bridge.ts` -- `node --check E:\Projects\Odin\src\odin\probes.cjs` -- `node --check E:\Projects\Odin\src\odin\state.cjs` -- `node --check E:\Projects\Odin\src\odin\surface.cjs` -- Mocked Odin state build with `NODE_PATH=E:\Projects\CultLib\packages` verified Nightwing becomes `active` from provider evidence and Yggdrasil remains `waiting` without provider evidence. -- `rg -n "hostChecks|checksFor|tcpCheck|remoteServices|remoteGpu|hostState|hostServices|systemdState|systemctl is-active|nvidia-smi|192\.168\.1\.75|192\.168\.1\.84|192\.168\.1\.72|192\.168\.1\.66|yggdrasil\.gamecult\.org|net\.createConnection" E:\Projects\Odin\src\odin E:\Projects\Odin\README.md E:\Projects\Odin\docs\architecture.md` now only finds the WebSocket bridge's `net.createConnection`. -- `cargo test -p idunn-daemon` -- `cargo test -p muninn-daemon` -- `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\bin\node.exe scripts/check-syntax.cjs` -- `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\bin\node.exe --check src\stonks-daemon.cjs` -- `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\bin\node.exe --check src\spotiverse-daemon.cjs` -- `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\bin\node.exe --check scripts\export-provider-advertisement.cjs` -- `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\bin\node.exe --check tools\provider-advertisement.mjs` in `E:\Projects\Bifrost` -- `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\bin\node.exe tools\provider-advertisement.mjs print` checked for absence of `compatibility-eve-deck`, `websocket-bridge`, and `ws://192.168.1.66:8797/eve/deck` -- `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\bin\node.exe tools\provider-advertisement.mjs print-binding` checked for absence of `compatibility-eve-deck`, `websocket-bridge`, and `ws://192.168.1.66:8797/eve/deck` -- `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\bin\node.exe --check scripts\render-voidbot-swarm-dashboard.mjs` -- `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\bin\node.exe scripts\render-voidbot-swarm-dashboard.mjs` -- `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\bin\node.exe scripts\export-voidbot-provider-advertisements.mjs --check` -- `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\bin\node.exe ./node_modules/typescript/bin/tsc -p tsconfig.json --noEmit` in `E:\Projects\Heimdall` -- `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\bin\node.exe ..\..\node_modules\typescript\bin\tsc -p tsconfig.json --noEmit` in `E:\Projects\StreamPixels\apps\service` -- `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\python\python.exe -m py_compile src\repixelizer\verse_state.py` -- `E:\Projects\repixelizer\.venv\Scripts\python.exe -m pytest tests\test_verse_state.py` passed 2 tests. -- `rg -n "future CultCache export|next Idunn transport cut|plain GUI/systemd transport debt|still the live witnesses|does not own queue truth or write CultCache|add a daemon-owned \`.cc\` witness|publish Repixelizer daemon health to Idunn" E:\Projects\repixelizer\docs\verse-service-contract.md E:\Projects\repixelizer\state\map.yaml E:\Projects\Odin\docs\idunn.md` returned no hits; the inventory ledger is excluded so the quoted scan pattern cannot self-match. -- `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\bin\node.exe --check scripts\vili-daemon.mjs` -- `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\bin\node.exe --check scripts\smoke-vili.mjs` -- `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\bin\node.exe --check scripts\weksa-daemon.mjs` -- `node node_modules\typescript\bin\tsc -b --pretty false` in `E:\Projects\VoidBot` -- Active-code and steering-doc scan for `compatibility-eve-deck`, `/eve/deck/providers`, deck manifests, `ODIN_BASE_URL`, `odinBaseUrl`, seeded deck URLs, and Odin/provider WebSocket snapshot helpers across active repo worktrees; remaining hits are this inventory plus the `gamecult-ops` audit detector. Mimir scratch build copies and state/evidence ledgers were excluded as historical/generated records. -- `rg -n "compatibility|fallback" crates\idunn-daemon\src\main.rs src\odin\config.cjs src\odin\interfaces.cjs src\odin-coordinator.cjs` returned no hits. -- `dotnet build .\src\Gjallar\Gjallar.csproj` -- `dotnet build .\src\Mimir.EveDashboard\Mimir.EveDashboard.csproj` in `E:\Projects\Mimir` -- `dotnet build .\src\Mimir.EveBrowserReference\Mimir.EveBrowserReference.csproj` in `E:\Projects\Mimir` -- `dotnet build .\src\Mimir.Runtime\Mimir.Runtime.csproj` in `E:\Projects\Mimir` -- `dotnet build .\src\Mimir.EveDashboard\Mimir.EveDashboard.csproj --no-restore` in `E:\Projects\Mimir-obs-muninn-branch` -- `dotnet build .\src\Mimir.RavenDaemon\Mimir.RavenDaemon.csproj --no-restore` in `E:\Projects\Mimir-obs-muninn-branch` -- `dotnet build .\src\Mimir.FensalirDaemon\Mimir.FensalirDaemon.csproj` in `E:\Projects\Mimir-obs-muninn-branch` -- `dotnet build .\src\Mimir.EveDashboard\Mimir.EveDashboard.csproj --no-restore` in `E:\Projects\Mimir-raven-build` -- `dotnet build .\src\Mimir.Muninn\Mimir.Muninn.csproj --no-restore` in `E:\Projects\Mimir-raven-build` -- `dotnet build .\src\Mimir.FensalirDaemon\Mimir.FensalirDaemon.csproj` in `E:\Projects\Mimir-raven-build` -- `cargo test -p odin-core idunn_records_round_trip_through_cultmesh` -- `cargo test -p muninn-daemon runtime_boundary_records_use_explicit_activation_store_path` -- `dotnet build .\src\ymir-daemon\ymir-daemon.csproj` in `E:\Projects\Ymir` -- `dotnet test` in `E:\Projects\Ymir` passed 23 tests. -- `dotnet run --project .\src\ymir-daemon -- publish-service --path .ymir\service.cc` in `E:\Projects\Ymir` -- `rg -n "HttpListener|System\.Net|serve|8877|/simulate/step|/query/overlap|/query/cast|CommandLowerings = Http|remote/debug physics|local HTTP daemon|HTTP endpoints|provider-advertisement|operator-state|eve/operator|GET /health" src README.md docs -S` in `E:\Projects\Ymir`; remaining hits are ordinary prose words, not routes or transport code. -- `rg -n "http://127\.0\.0\.1:8877|PostJson|ServiceUrl|OverlapSphereUrl|OverlapCircleUrl|CastCircleUrl|CastSphereUrl|TimeoutMilliseconds|HttpWebRequest|Ymir daemon URL|JSON-over-local-HTTP|local HTTP Ymir|posts JSON to Ymir|hard-coded local URL|/simulate/step|/query/overlap|/query/cast" Assets\Scripts docs Aetheria.State -S` in `E:\Projects\Aetheria` returned no hits. -- `rg -n "http://127\.0\.0\.1:8877|PostJson<|public string ServiceUrl|public string OverlapSphereUrl|public string OverlapCircleUrl|public string CastCircleUrl|public string CastSphereUrl|/simulate/step|/query/overlap|/query/cast|HttpListener|Ymir serving physics" E:\Projects\Ymir E:\Projects\Aetheria -S ... -g "!**/Aetheria.State.Verify/Program.cs"` returned no hits; the verifier file intentionally retains old symbols as forbidden strings. -- `powershell -ExecutionPolicy Bypass -File .\Aetheria.State\scripts\verify-stage7d-unity-parity.ps1` in `E:\Projects\Aetheria` failed before Ymir checks on existing `MainMenu must read Verse host settings through the typed document handle.` -- `dotnet run --project .\Aetheria.State.Verify\Aetheria.State.Verify.csproj --no-restore` in `E:\Projects\Aetheria` compiled far enough to run verifier checks and failed later on existing provider-advertisement state refs in `RequireDaemonVersePublication`; the updated Ymir HTTP guard did not trigger. -- `dotnet build .\Assembly-CSharp.csproj /clp:ErrorsOnly /p:UseSharedCompilation=false` in `E:\Projects\Aetheria` failed on existing missing `AetheriaRuntimeEveSurfaceAdvertisement`; one parallel build also hit locked `obj\Debug\UniRx.dll`. -- `dotnet build .\Tests.csproj /clp:ErrorsOnly /p:UseSharedCompilation=false` in `E:\Projects\Aetheria` failed on existing missing `AetheriaRuntimeEveSurfaceAdvertisement`. -- `node node_modules\typescript\bin\tsc -p apps\service\tsconfig.json --noEmit` in `E:\Projects\StreamPixels` -- StreamPixels verse-state smoke with `STREAMPIXELS_CULTCACHE_PATH=.streampixels-data\cultcache\codex-smoke.service.cc` wrote the store through `publishStreamPixelsVerseState`. -- `inspectCultCacheBytes` on the StreamPixels smoke store found `streampixels.command_boundary.v1`, `streampixels.transport_profile.v1`, `gamecult.eve.provider_advertisement.v1`, and `idunn.daemon_health.v1`. -- `pnpm install` in `E:\Projects\Heimdall` restored local links and updated `pnpm-lock.yaml`; pnpm exited nonzero only because build-script approval for `esbuild@0.27.7` is enforced in this environment. -- `node node_modules\typescript\bin\tsc -p tsconfig.json --noEmit` in `E:\Projects\Heimdall` -- `node node_modules\vitest\vitest.mjs run --config vitest.config.ts tests/verse-runtime.test.ts` in `E:\Projects\Heimdall` -- `node node_modules\vitest\vitest.mjs run --config vitest.config.ts` in `E:\Projects\Heimdall` passed 29 tests. -- Heimdall verse-state smoke with `GC_ACCESS_CULTCACHE_PATH=.heimdall-data\cultcache\codex-smoke.service.cc` wrote the store through `publishHeimdallVerseState`. -- `inspectCultCacheBytes` on the Heimdall smoke store found `gamecult.eve.provider_advertisement.v1`, `heimdall.command_boundary.v1`, `heimdall.transport_profile.v1`, and `idunn.daemon_health.v1`. -- `rg -n -e 'STORE_FORMAT_VERSION' -e 'CultCacheRecord' -e 'writeCultCacheSnapshot' -e 'mkdir, rename, rm, writeFile' -e 'from "@msgpack/msgpack"' -e 'encode\(\[STORE_FORMAT_VERSION' -e 'schemaId: "idunn\.daemon_health"' E:\Projects\Heimdall\src\verse-state.ts E:\Projects\Heimdall\tests\verse-runtime.test.ts` returned no hits. -- Active-service scan for `STORE_FORMAT_VERSION`, `writeCultCacheSnapshot`, `CultCacheRecord`, and hand-built schema catalog JSON across `E:\Projects` found no remaining daemon shortcut writers; remaining hits are CultCache library implementations/tests, vendored CultCache sources, and historical clean-room/rollback clones. -- `dotnet build .\src\Mimir.EveDashboard\Mimir.EveDashboard.csproj --no-restore` in `E:\Projects\Mimir` -- `rg -n "RemoteDashboardProvider|YggdrasilStreamPixelsProvider|--provider|External EveDeck|registered WebSocket endpoint|id\|title\|ws-url|TCP/WebSocket over LAN|ssh-tunnel|yggdrasil\.streampixels\.edge" E:\Projects\Mimir\src\Mimir.EveDashboard\Program.cs` returned no hits. -- `node --check web\surface.js` in `E:\Projects\Eve` -- `rg -n "mimir-eve-deck|openVoidBot|VoidBot Live|Mimir broker error|8795/eve/deck" E:\Projects\Eve\web\surface.js E:\Projects\Eve\README.md E:\Projects\Eve\docs\renderer-parity.md E:\Projects\Eve\docs\cultmesh-streaming-ui-framework.md` returned no hits. -- `powershell -ExecutionPolicy Bypass -File .\scripts\build-android.ps1` in `E:\Projects\Eve` built `artifacts\android\eve-debug.apk`; the script printed two `findstr` command-not-found diagnostics plus Java/Kotlin deprecation warnings, but exited 0. -- `Select-String` scan for `192.168.1.66:8795`, `192.168.1.66:8796`, `URI.create("ws://192.168.1.66`, `waiting for Mimir`, `waiting for receiver`, `Mimir broker health`, `monkey -p org.gamecult.eve`, `mimir-eve-deck`, `openVoidBot`, and `VoidBot Live` across the touched Eve Android/browser/docs files returned no hits. -- `rg -n "ws://127\.0\.0\.1|ws://192\.168\.1\.66|8792/stream|8793/eve/camera|8794/eve/mic|8795/eve/deck|8797/eve/deck|awaiting Mimir|waiting for Mimir" E:\Projects\Eve\Sources E:\Projects\Eve\README.md E:\Projects\Eve\docs\cultmesh-streaming-ui-framework.md E:\Projects\Eve\docs\renderer-parity.md` returned no hits. -- `git -C E:\Projects\Eve diff --check -- Sources/EVEViewController.mm README.md` passed with CRLF normalization warnings only. -- `dotnet build .\src\Mimir.VerseRecorder\Mimir.VerseRecorder.csproj --no-restore` in `E:\Projects\Mimir` -- `dotnet run --project .\src\Mimir.VerseRecorder\Mimir.VerseRecorder.csproj --no-build -- --seconds 0.01` in `E:\Projects\Mimir` exits 2 and prints that `--url` is required from an explicit CultMesh/Odin-discovered sensor subscription endpoint. -- `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\python\python.exe -m py_compile tools\nightwing_typed_witness_publisher.py` in `E:\Projects\Mimir` -- `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\python\python.exe tools\nightwing_typed_witness_publisher.py --once` in `E:\Projects\Mimir` exits 2 and reports required `--url`. -- `Select-String` scan for `ws://127.0.0.1:8796/eve/periwinkle/subscribe`, `ws://192.168.1.66:8796/eve/periwinkle`, `parser.add_argument("--url", default`, and `ParseString(args, "--url", "ws://` across `Mimir.VerseRecorder`, `nightwing_typed_witness_publisher.py`, and `start-nightwing-move-tracking.ps1` returned no hits. -- `powershell -NoProfile -ExecutionPolicy Bypass -File E:\Projects\Mimir\scripts\start-nightwing-move-tracking.ps1 -DryRun` exits 1 and reports required `-WitnessUrl` / `MIMIR_NIGHTWING_WITNESS_URL`. -- `powershell -NoProfile -ExecutionPolicy Bypass -File E:\Projects\Mimir\scripts\start-nightwing-move-tracking.ps1 -DryRun -WitnessUrl ws://example.invalid:8796/eve/periwinkle -SubscribeUrl ws://example.invalid:8796/eve/periwinkle/subscribe` shows the receiver, recorder, and Nightwing publisher using only the supplied URLs. -- `Select-String` scan for `StarfireHost`, `192\.168\.1\.66`, `ws://127\.0\.0\.1:\$Port`, `witnessUrl = "ws://`, and `subscribeUrl = "ws://` in `E:\Projects\Mimir\scripts\start-nightwing-move-tracking.ps1` returned no hits. -- `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\python\python.exe -m py_compile scripts\nightwing-visible-ops-tui.py scripts\nightwing-visible-ops-fb.py` in `E:\Projects\gamecult-ops` -- `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\python\python.exe scripts\nightwing-visible-ops-tui.py --help` and `... scripts\nightwing-visible-ops-fb.py --help` show required `--url`. -- `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\python\python.exe scripts\nightwing-visible-ops-tui.py --tty /dev/null --provider odin.providers` and `... scripts\nightwing-visible-ops-fb.py --frames 1` exit 2 without `--url`. -- `Select-String` scan for `ws://192.168.1.66:8797/eve/deck`, `GAMECULT_VISIBLE_OPS_URL:-ws`, and `--url", default` across `gamecult-ops` visible-ops lowerers returned no hits. -- Shell syntax for `gamecult-ops` visible-ops launchers was not executed locally because the only `bash.exe` is the WSL shim and WSL is unavailable in this environment; the changed shell blocks were inspected and the removed LAN default was scanned. -- `Select-String` scan for `ws://192.168.1.66:8797/eve/deck`, `ws://127.0.0.1:8796/eve/deck`, `known provider seed`, `seed deck URLs`, `defaulting to ws://192`, and `compatibility HTTP/WebSocket deck bridge` across `E:\Projects\Odin\README.md`, `docs\gjallar.md`, and `docs\architecture.md` returned no hits after the architecture wording update. -- PowerShell parse checks passed for `scripts\start-starfire-sleipnir.ps1`, `scripts\restart-starfire-muninn.ps1`, `scripts\restart-nightwing-muninn.ps1`, `scripts\restart-muninn.ps1`, `scripts\deploy-nightwing-gjallar.ps1`, `E:\Projects\weksa\scripts\start-weksa-daemon.ps1`, and `E:\Projects\weksa\scripts\restart-weksa-daemon.ps1`. -- `cargo test -p idunn-daemon` passed 16 tests after replacing Idunn's embedded Gjallar Starfire endpoint steering text with configured-endpoint language. -- Active-code scan across Odin, `gamecult-ops`, Weksa, Vili, VoidBot, Eve, and Mimir for `192.168.1.66:17871`, `127.0.0.1:17871`, Starfire Odin deck URLs, visible-ops URL defaults, `ODIN_BASE_URL`, and `/eve/deck/providers` now returns only this inventory, the `gamecult-ops` audit detector, and Odin README local debug endpoint documentation. -- PowerShell parse checks passed for `scripts\restart-starfire-muninn.ps1`, `scripts\restart-nightwing-muninn.ps1`, `scripts\restart-muninn.ps1`, `scripts\health-muninn.ps1`, and `scripts\health-starfire-muninn.ps1` after removing the `192.168.1.66:17870` health default. -- `cargo test -p idunn-daemon` passed 16 tests after replacing Idunn's embedded Raven Muninn health endpoint steering text with configured-endpoint language and adding negative assertions against `192.168.1.66:17870`. -- `cargo test -p idunn-daemon` passed 17 tests after replacing Idunn's swarm surgery plan source-address lore (`10.77.0.x` and `127.0.0.1` acceptance text) with daemon-id/configured-route language and flipping the tests to negative assertions against those endpoint literals. -- `rg -n "10\.77\.0\.[0-9]+|192\.168\.1\.66:17870|from 127\.0\.0\.1|from 10\.77|Idunn accepts .* from" E:\Projects\Odin\crates\idunn-daemon\src\main.rs` now finds only negative assertions and configured-route/source-address-folklore wording, not active plan guidance. -- `rg -n -e '192\.168\.1\.66:17870' -e '--idunn-rudp-health 192\.168\.1\.66:17870' E:\Projects\Odin E:\Projects\gamecult-ops ...` now finds only this inventory's cut note, negative Idunn assertions, and unrelated deployed-service env examples for Yggdrasil service health endpoints. -- PowerShell parse checks passed for `scripts\start-odin.ps1` and `scripts\restart-odin.ps1` after removing the localhost Idunn health default. -- `powershell.exe -NoProfile -ExecutionPolicy Bypass -File E:\Projects\Odin\scripts\start-odin.ps1` with `ODIN_IDUNN_RUDP_HEALTH` and `IDUNN_RUDP_HEALTH` unset exits nonzero before starting Odin and reports that an explicit Idunn RUDP health endpoint is required. -- `Select-String` across Odin, Weksa, Vili, and `gamecult-ops` script targets plus Odin README/Muninn docs for `127.0.0.1:17870`, `10.77.0.2:17870`, `192.168.1.66:17870`, and localhost-shaped `IdunnRudpHealth` defaults returned no hits. -- PowerShell parse check passed for `E:\Projects\Stonks\scripts\start-stonks.ps1` after removing localhost Idunn/Odin RUDP defaults. -- `powershell.exe -NoProfile -ExecutionPolicy Bypass -File E:\Projects\Stonks\scripts\start-stonks.ps1` with `STONKS_IDUNN_RUDP_HEALTH` and `IDUNN_RUDP_HEALTH` unset exits nonzero before starting Stonks and reports that an explicit Idunn RUDP health endpoint is required. -- `Select-String` across Stonks launcher, README, and source for `127.0.0.1:17870`, `127.0.0.1:17871`, localhost-shaped Idunn/Odin RUDP parameter defaults, and the old `--idunn-rudp-health 127.0.0.1:17870` recipe returned no hits. -- Active publication-default scan across Odin, Stonks, VoidBot, Weksa, Vili, and `gamecult-ops` launch scripts plus Odin/Stonks/Muninn README surfaces found no remaining localhost-shaped Idunn health parameter defaults or old `--idunn-rudp-health 127.0.0.1:17870` launch recipe. Remaining local `127.0.0.1:17870` references document Idunn's own ingress bind, not child-daemon publication defaults. -- `node --check E:\Projects\Spotiverse\src\spotiverse-daemon.cjs` -- `node --check E:\Projects\Spotiverse\scripts\export-provider-advertisement.cjs` -- PowerShell parse check passed for `E:\Projects\Spotiverse\scripts\start-spotiverse.ps1` after adding explicit `-WriteDebugJson` / `-ReadDebugJson` switches. -- Spotiverse no-debug smoke started the daemon with a temporary state dir and no debug flags, then verified `latest-surface.json` and `latest-spotify-state.json` were not written. -- Spotiverse debug smoke started the daemon with `--write-debug-json`, then verified `latest-surface.json` and `latest-spotify-state.json` were written only on that explicit path. -- `rg -n -e 'loadLatestSnapshot\(\) \|\|' -e 'Debug witnesses: `latest-surface\.json`, `latest-spotify-state\.json`, and' -e 'currentDebugMirror' -e 'Promote `latest-spotify-state\.json`' E:\Projects\Spotiverse\src\spotiverse-daemon.cjs E:\Projects\Spotiverse\README.md E:\Projects\Spotiverse\docs E:\Projects\Spotiverse\scripts\export-provider-advertisement.cjs` now finds only Heimdall-account and command-receipt debug mirrors, not the demoted surface/playback JSON mirrors. -- Follow-up active JSON shortcut scan for `latest-surface.json`, `latest-spotify-state.json`, provider/operator JSON mirrors, deck provider manifests, `ODIN_BASE_URL`, `WEKSA_DAEMON_BASE_URL`, and compatibility deck transports across Odin, Spotiverse, Stonks, Vili, Weksa, VoidBot, Mimir, and Eve found only debug-gated writers (`Odin`, `Vili`, `Weksa`, `Spotiverse`) plus static fixture references. The relevant code contexts all gate JSON output behind explicit debug flags. -- PowerShell parse checks passed for `scripts\deploy-nightwing-gjallar.ps1`, `scripts\restart-vili.ps1`, and `scripts\health-nightwing-muninn.ps1` after removing the `10.77.0.2:17870` defaults. -- `cargo test -p idunn-daemon` passed 16 tests and `cargo test -p muninn-daemon` passed 141 tests after replacing remaining real Idunn endpoint fixtures/steering text with configured-endpoint language. -- Bash syntax checks for `gamecult-ops` deploy scripts could not run locally because `bash.exe` is the WSL shim and `/bin/bash` is unavailable in this environment. -- `rg -n -e '10\.77\.0\.2:17870' -e '192\.168\.1\.66:17870' E:\Projects\Odin E:\Projects\gamecult-ops ...` now finds only this inventory's cut notes and negative Idunn assertions. -- PowerShell parse check passed for `scripts\restart-muninn.ps1` after removing Raven media/OBS/OBS catalog Starfire LAN defaults. -- `cargo test -p muninn-daemon` passed 141 tests after the Raven Muninn launcher media-target cut. -- `Select-String` scan of `scripts\restart-muninn.ps1` confirmed no `192.168.1.66` media/OBS endpoint remains; media target comes from `MUNINN_MEDIA_TARGET_HOST`, OBS target from `MUNINN_OBS_TARGET_HOST` or the media target, and OBS catalog target from `MUNINN_OBS_CATALOG_RUDP_TARGET` only. -- PowerShell parse check passed for `scripts\activate-muninn-raven-av-srt.ps1`; invoking it with `MUNINN_MEDIA_TARGET_HOST` and `MUNINN_OBS_TARGET_HOST` cleared fails before remote upload with the required explicit-target error. -- `rg -n -e '\$TargetHost = "10\.77\.0\.2"' -e '\$ObsTargetHost = "10\.77\.0\.2"' -e 'muninn\.exe --health.*fallback' -e 'fallback/manual proof' E:\Projects\Odin\scripts\activate-muninn-raven-av-srt.ps1 E:\Projects\Odin\docs\muninn.md E:\Projects\Odin\docs\idunn.md` returned no hits. -- `cargo test -p muninn-daemon` passed 142 tests after removing Muninn's baked media target defaults. -- `rg -n "10\.77\.0\.2|192\.168\.1\.66" E:\Projects\Odin\crates\muninn-daemon\src\main.rs` returned no hits. -- `rg -n -e '--health-command' -e 'command probe' -e 'compatibility probe' -e 'fallback' -e 'exit 0' -e 'exit 1' E:\Projects\Odin\src\Idunn\README.md` returned no hits. -- `rg -n -e "compatibility command" -e "command-probe fallback" -e "command probe remains" -e "local compatibility command" -e "compatibility probes" -e "fallback proof" -e "fallback health" -e "health/deck" -e "compatibility health" E:\Projects\Odin\docs\idunn.md E:\Projects\Odin\src\Idunn\README.md` returned no hits. -- `node --check E:\Projects\Odin\src\odin\surface.cjs` -- `node --check E:\Projects\Odin\src\odin\layout.cjs` -- `rg -n "legacy-dashboard-nodes|legacy-node-groups|props\?\.compatibility" E:\Projects\Odin\src\odin E:\Projects\Odin\README.md E:\Projects\Odin\docs -g '!node_modules'` returned no hits. -- PowerShell parse check passed for `scripts\start-starfire-wireguard-elevated.ps1` after replacing the baked Nightwing endpoint fallback and Starfire LAN diagnostic address with explicit config. -- `rg -n "192\.168\.1\.(66|75|84)|10\.77\.0\.2:17870" E:\Projects\Odin\scripts E:\Projects\Odin\crates E:\Projects\Odin\src E:\Projects\Odin\docs E:\Projects\Odin\README.md` now finds only this inventory and negative Idunn assertions. -- PowerShell parse check passed for `E:\Projects\gamecult-ops\scripts\check-raven-connectivity.ps1` after demoting Raven LAN ICMP to optional explicit diagnostics. -- `rg -n "192\.168\.1\.(66|75|84)...|/eve/deck/providers|ODIN_BASE_URL|WEKSA_DAEMON_BASE_URL" E:\Projects\gamecult-ops ...` now finds only inventory/runbook history plus the audit detector string. -- PowerShell parse checks passed for the active Mimir branch proof scripts after replacing baked Starfire/Raven/Nightwing endpoints with `MIMIR_*` environment configuration and fail-closed guards. -- `dotnet build .\src\Mimir.EveRelay\Mimir.EveRelay.csproj` passed in `E:\Projects\Mimir-raven-build` and `E:\Projects\Mimir-obs-muninn-branch`; both builds restored missing project assets and reported only the pre-existing CA2024 analyzer warning. -- `rg -n "192\.168\.1\.(66|75|84)...|/eve/deck/providers|ODIN_BASE_URL|WEKSA_DAEMON_BASE_URL" E:\Projects\Mimir-obs-muninn-branch\src ... E:\Projects\Mimir-raven-build\scripts ...` returned no hits after the branch proof/relay cut. -- `E:\Projects\Mimir\docs\neighbor-sender-setup.md` was updated so sender SSH and SRT receiver routes are configured placeholders rather than old LAN addresses. -- `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\python\python.exe -m py_compile` passed for both active Mimir branch `tools\nightwing_typed_witness_publisher.py` files. -- `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\python\python.exe E:\Projects\Mimir-raven-build\tools\nightwing_typed_witness_publisher.py --once` exits 2 and reports required `--url` / `MIMIR_WITNESS_URL`. -- `cmake --build E:\Projects\Mimir-obs-muninn-branch\native\obs_stem_source\build --target muninn_rudp_url_tests --config Release` and the resulting `muninn_rudp_url_tests.exe` passed after replacing real LAN fixture URLs with documentation addresses. -- `cmake --build E:\Projects\Mimir-obs-muninn-branch\native\obs_stem_source\build --target mimir_obs_stem_source --config Release` passed after removing OBS Muninn source endpoint defaults. -- Corrected `Get-ChildItem | Select-String` scan across `E:\Projects\Mimir`, `E:\Projects\Mimir-raven-build`, and `E:\Projects\Mimir-obs-muninn-branch` docs/config for `192.168.1.66`, `192.168.1.75`, `192.168.1.84`, Starfire WebSocket/CultNet URLs, `TargetHost 192.168.1.66`, and `audio-field.example.json` Raven address returned no hits. -- Active-code scan across Odin, `gamecult-ops`, Vili, Weksa, VoidBot, Eve, Mimir, and active Mimir branch source/script/tool/native paths for the old LAN/WireGuard endpoint families, `/eve/deck/providers`, `ODIN_BASE_URL`, and `WEKSA_DAEMON_BASE_URL` now returns only negative Idunn assertions, a Weksa state-map note, and the `gamecult-ops` audit detector. -- Follow-up active-code scan after the Vili sidecar/health cuts across Odin, `gamecult-ops`, Vili, Weksa, VoidBot, Eve, Mimir, and active Mimir branch source/script/tool/native paths for the old LAN/WireGuard endpoint families, `/eve/deck/providers`, `ODIN_BASE_URL`, and `WEKSA_DAEMON_BASE_URL` still returns only negative Idunn assertions, a Weksa state-map note, and the `gamecult-ops` audit detector. -- Broad active-code scan after the Weksa/Odin JSON cuts for old LAN/WireGuard endpoint families, deck provider/manifest shortcuts, `ODIN_BASE_URL`, `WEKSA_DAEMON_BASE_URL`, `latest-surface.json`, and service JSON sidecar names returns only gated debug writers/docs, checked-in fixtures, negative Idunn assertions, the `gamecult-ops` audit detector, and this inventory. -- `node --check E:\Projects\Odin\src\hermodr-daemon.cjs` passed after moving Hermodr's Odin input from default HTTP/JSON export to the Odin CultMesh store. -- PowerShell parse checks passed for `scripts\start-hermodr.ps1` and `scripts\restart-hermodr.ps1` after replacing `-OdinHttpBase` / `-OdinWsBase` with `-OdinCachePath` / `-OdinSurfaceKey`. -- Hermodr CultMesh smoke created a temporary Odin store containing `surface:gamecult.network.status`, started `src\hermodr-daemon.cjs` with `--odinCachePath`, and verified `/hermodr/verse/catalog` returned the typed `smoke.provider` surface. -- `rg -n "odinHttpBase|odinWsBase|OdinHttpBase|OdinWsBase|latest-surface\.json|http://127\.0\.0\.1:8797|ws://127\.0\.0\.1:8797|hermodr-http-to-odin-cultmesh-bridge"` across Hermodr source and launchers returned no hits. -- `dotnet build .\src\Mimir.Well\Mimir.Well.csproj` and `dotnet build .\src\Mimir.VerseRecorder\Mimir.VerseRecorder.csproj` passed in both `E:\Projects\Mimir-obs-muninn-branch` and `E:\Projects\Mimir-raven-build` after removing the localhost Periwinkle defaults. -- PowerShell parser checks passed for both active Mimir branch `scripts\start-online-verse-daemons.ps1` files. -- `dotnet run --project .\src\Mimir.Well\Mimir.Well.csproj --no-build -- --seconds 0.01` now exits before startup in both active Mimir branches and reports that `--publish-url` / `MIMIR_WELL_PUBLISH_URL` is required. -- `dotnet run --project .\src\Mimir.VerseRecorder\Mimir.VerseRecorder.csproj --no-build -- --seconds 0.01` now exits before startup in both active Mimir branches and reports that `--url` / `MIMIR_VERSE_RECORDER_URL` is required. -- `start-online-verse-daemons.ps1 -DryRun` with only `MIMIR_WITNESS_URL` set now fails in both active Mimir branches with the required `-SubscribeUrl` / `MIMIR_VERSE_RECORDER_URL` message; explicit dry-runs with example Well/Recorder URLs route only the supplied `example.invalid` endpoints. -- `rg -n "ws://127\.0\.0\.1:8796/eve/periwinkle|ws://127\.0\.0\.1:8798/eve/periwinkle|MIMIR_WELL_PUBLISH_URL|MIMIR_VERSE_RECORDER_URL"` across the touched active Mimir branch Well, VerseRecorder, and online-daemon launcher files now finds only the explicit environment-variable controls and fail-closed messages, not the deleted endpoint defaults. -- `node node_modules\typescript\bin\tsc -b --pretty false` passed in `E:\Projects\VoidBot` after deleting the Weksa RUDP localhost default. -- VoidBot config smoke verified `REPO_FACE_WEKSA_SPEECH_ENABLED=false` accepts a blank `WEKSA_CULTMESH_COMMAND_URI`, while `REPO_FACE_WEKSA_SPEECH_ENABLED=true` rejects a blank URI with the explicit Odin/CultMesh-discovered command URI message. -- `rg -n -e 'ODIN_BASE_URL' -e 'WEKSA_CULTMESH_COMMAND_URI=.*127\.0\.0\.1' -e 'weksa.*127\.0\.0\.1:8813' E:\Projects\VoidBot\.env.example E:\Projects\VoidBot\packages\config\src E:\Projects\VoidBot\apps E:\Projects\VoidBot\packages\core\src` returned no live shortcut hits. -- `cargo test -p idunn-daemon` passed 17 tests after replacing the remaining Weksa generated-plan text with Odin/CultMesh command URI language. -- `rg -n "rudp://127\.0\.0\.1:8813|speech_provider\.mimo\.voicedesign now arrives on rudp://|VoiceDesign commands arrive on `rudp://"` across Idunn's daemon source plus Weksa docs/scripts/README returned no hits after the Weksa contract wording cut. -- Aetheria's `Aetheria.Rts.Web\Electron\main.ts` localhost RUDP default was inspected and left in place because it is the Electron shell's local-daemon launch path when no remote daemon endpoint is configured, not a provider discovery or command shortcut. `AETHERIA_RTS_PEER_CULTMESH_ENDPOINTS` localhost references are smoke/test fixtures. -- `rg -n -e '192\.168\.1\.75' -e '192\.168\.1\.66' -e '8795/eve/deck' -e '8796/eve/periwinkle' -e 'http://192\.168\.' -e 'ws://192\.168\.' E:\Projects\gamecult-ops\runbooks\nightwing-cultmesh-worker-tunnel.md E:\Projects\gamecult-ops\inventory.md` returned no hits after demoting the old Nightwing/Starfire LAN recipes. -- `git -C E:\Projects\gamecult-ops diff --check -- runbooks\nightwing-cultmesh-worker-tunnel.md inventory.md` passed with CRLF normalization warnings only. -- `node --check tools\provider-advertisement.mjs` passed in `E:\Projects\Bifrost` after replacing the local Odin publication endpoint example. -- `node tools\provider-advertisement.mjs --help` now shows `$env:BIFROST_ODIN_CULTMESH_URI="cultmesh://odin/rendezvous/provider-catalog"; node tools/provider-advertisement.mjs publish-odin` instead of a localhost endpoint. -- `rg -n "127\.0\.0\.1:17871|BIFROST_ODIN_CULTMESH_RUDP" E:\Projects\Bifrost\tools\provider-advertisement.mjs E:\Projects\Bifrost\docs\verse-service-contract.md` returns no active publication path outside removed-config guards and this inventory. -- `node --check tools\provider-advertisement.mjs` passed in `E:\Projects\Bifrost` after making HTTP health/readiness probes explicit, and `node tools\provider-advertisement.mjs print-surface --generated-at 2026-07-03T00:00:00.000Z` reports `status: "unprobed"` with health/ready `not configured` when no probe URLs are supplied. -- `Select-String` over `E:\Projects\Bifrost\tools\provider-advertisement.mjs` now finds no implicit `fetchProbe("http://127.0.0.1:5080...")`; only the explicit `BIFROST_HEALTH_URL` / `BIFROST_READY_URL` controls and help example remain. -- `node --check tools\agent-transport.mjs`, `node --check tools\dispatch-agent-requests.mjs`, `node --check tools\governance-threads.mjs`, and `node --check tools\bifrost-bridge.mjs` passed in `E:\Projects\Bifrost` after deleting the unreceipted/ungated recovery paths. -- `DOTNET_ROLL_FORWARD=Major dotnet test tests\Bifrost.Web.Tests\Bifrost.Web.Tests.csproj --filter FullyQualifiedName~BridgeCliTests --no-restore` passed 30 focused Bifrost bridge CLI tests after moving successful fixtures onto a fake bridge receipt/gate endpoint and leaving old flags as rejection coverage. -- `node --check E:\Projects\Spotiverse\src\spotiverse-daemon.cjs` and a PowerShell parser check for `E:\Projects\Spotiverse\scripts\start-spotiverse.ps1` passed after replacing the Spotiverse README's local Odin publication recipe. -- `rg -n "SPOTIVERSE_ODIN_CULTMESH_RUDP|127\.0\.0\.1:17871" E:\Projects\Spotiverse\README.md E:\Projects\Spotiverse\.env.example E:\Projects\Spotiverse\scripts\start-spotiverse.ps1 E:\Projects\Spotiverse\src\spotiverse-daemon.cjs E:\Projects\Spotiverse\docs\verse-service-contract.md` returned no active raw Odin publication path outside removed-config guards. -- `node --check E:\Projects\Spotiverse\src\spotiverse-daemon.cjs` passed after removing the localhost Heimdall peer default, and `rg -n -e 'HEIMDALL_BASE_URL=http://127\.0\.0\.1:4100' -e 'http://127\.0\.0\.1:4100/v1/oauth/spotify/callback' -e 'process\.env\.HEIMDALL_BASE_URL \|\| "http://127\.0\.0\.1:4100"' E:\Projects\Spotiverse\README.md E:\Projects\Spotiverse\.env.example E:\Projects\Spotiverse\src\spotiverse-daemon.cjs` returned no hits. -- `node --check E:\Projects\Spotiverse\src\spotiverse-daemon.cjs` and `node --check E:\Projects\Spotiverse\scripts\export-provider-advertisement.cjs` passed after promoting Spotiverse command requests/receipts to typed CultMesh documents. -- Spotiverse CultMesh command smoke started the daemon with a temporary `.ccmp`, wrote `spotiverse.command/requests/codex-smoke-command` from a separate CultMesh node, and observed `spotiverse.command/receipts/codex-smoke-command` with `source: "cultmesh"` and the expected unlinked-Spotify rejection. -- `rg -n "future CultMesh|commandFramesDelegateTo|/eve/deck/providers|HTTP/WebSocket frame|provider manifest|http-provider-manifest|compatibility-eve-deck" E:\Projects\Spotiverse\README.md E:\Projects\Spotiverse\docs\verse-service-contract.md E:\Projects\Spotiverse\docs\architecture.md E:\Projects\Spotiverse\scripts\export-provider-advertisement.cjs E:\Projects\Spotiverse\src\spotiverse-daemon.cjs` returned no hits. -- `rg -n "future CultMesh|commandFramesDelegateTo|/eve/deck/providers|HTTP/WebSocket frame|provider manifest|http-provider-manifest|compatibility-eve-deck" E:\Projects\Spotiverse\AGENTS.md E:\Projects\Spotiverse\README.md E:\Projects\Spotiverse\docs\verse-service-contract.md E:\Projects\Spotiverse\docs\architecture.md E:\Projects\Spotiverse\scripts\export-provider-advertisement.cjs E:\Projects\Spotiverse\src\spotiverse-daemon.cjs` returned no hits after the local agent-note cleanup. -- `rg -n "future CultCache|future CultMesh|future \\.cc|reserved witness path|future durable witnesses|future CultMesh publication" E:\Projects\repixelizer\README.md E:\Projects\repixelizer\docs\repixelizer-witness-contract.md` returned no hits. -- `node node_modules\typescript\bin\tsc -p apps\service\tsconfig.json --noEmit` passed in `E:\Projects\StreamPixels` after adding `streampixels.command_request.v1` / `streampixels.command_receipt.v1` and the service command poller. -- StreamPixels CultMesh command smoke wrote `streampixels.command/requests/codex-smoke` from a separate CultMesh node, ran `pollStreamPixelsCommandRequests`, and observed `streampixels.command/receipts/codex-smoke` with `source: "cultmesh"` and `status: "accepted"`. -- `node node_modules\vitest\vitest.mjs run --config vitest.config.ts apps/service/src/app.test.ts` passed 28 tests in `E:\Projects\StreamPixels`. -- `rg -n "future CultMesh|future CultCache|future CultMesh catalog boot|future CultMesh command" E:\Projects\Aetheria\docs\aetheria-perfect-machine-map.md E:\Projects\Aetheria\Packages\org.gamecult.aetheria.state\package.json` returned no hits. -- `Get-Content E:\Projects\Aetheria\Packages\org.gamecult.aetheria.state\package.json | ConvertFrom-Json` parsed successfully after the package description update. -- `rg -n -e 'compatibility deck' -e 'compatibility transports' -e '10\.77\.0\.2:1787(0|1)' E:\Projects\Odin\README.md E:\Projects\Odin\docs\architecture.md E:\Projects\Mimir-raven-build\README.md E:\Projects\Mimir-obs-muninn-branch\README.md E:\Projects\StreamPixels\docs\configuration.md` returned no hits. -- `rg -n "tries `ws://127\.0\.0\.1:8792/stream` first|falls back to\s*`ws://:8792/stream`|ws://127\.0\.0\.1:8792/stream|10\.77\.0\.2:17870" E:\Projects\Mimir-raven-build\docs\eve-program-output.md E:\Projects\Mimir-obs-muninn-branch\docs\eve-program-output.md E:\Projects\Heimdall\notes\fresh-workspace-handoff.md` returned no hits. -- `rg -n "EVE_STREAM_URLS|ws://127\.0\.0\.1:8792/stream|ws://:8792/stream" E:\Projects\Eve\Sources\EVEViewController.mm E:\Projects\Mimir-raven-build\docs\eve-program-output.md E:\Projects\Mimir-obs-muninn-branch\docs\eve-program-output.md` confirmed Eve reads explicit `EVE_STREAM_URLS` and the Mimir docs no longer preserve endpoint candidates. -- `rg -n "192\.168\.1\.84|local inference box|Qwen box|madman's lullaby@192\.168\.1\.84" E:\Projects\gamecult-ops\runbooks\voidbot-local-stack-and-reindex.md E:\Projects\gamecult-ops\inventory.md E:\Projects\VoidBot\README.md E:\Projects\VoidBot\scripts -g '!**/node_modules/**'` returned no hits after the offsite-backup route cleanup. -- PowerShell parser check passed for `E:\Projects\VoidBot\scripts\install-offsite-backup-task.ps1`. -- `dotnet build .\src\Mimir.FensalirDaemon\Mimir.FensalirDaemon.csproj` passed in both `E:\Projects\Mimir-obs-muninn-branch` and `E:\Projects\Mimir-raven-build` after demoting Fensalir's local Eve/CultMesh WebSocket routes to debug lowerings. -- PowerShell parser checks passed for both active Mimir branch `scripts\start-fensalir-daemon.ps1` launchers. -- `rg -n -e 'bridge: ws://127\.0\.0\.1:8799/eve/deck' -e 'speaks a CultNet-shaped WebSocket Eve provider' -e 'speaking Eve/CultMesh' -e 'CultNet/WebSocket transport' -e 'cultnet-websocket' -e 'MessagePack WebSocket provider' -e 'Bridge route:' -e 'Eve provider:'` across both active Mimir branch Fensalir docs, daemon sources, and launchers returned no hits. -- `E:\Projects\Heimdall\tests\verse-runtime.test.ts` no longer uses the live-looking `10.77.0.2:17870` Idunn health fixture; the fixture uses documentation address `203.0.113.10:17870` while preserving endpoint parse and publication behavior. -- `node node_modules\vitest\vitest.mjs run --config vitest.config.ts tests\verse-runtime.test.ts` passed in `E:\Projects\Heimdall`. -- `E:\Projects\VoidBot\docs\persona-intake\sai.persona-intake.yaml` no longer describes Sai/Eve projection as future CultMesh renderer work; the persona prose now says CultMesh-fed renderers. -- `dotnet build .\src\Gjallar\Gjallar.csproj --no-restore` passed in standalone `E:\Projects\Gjallar` after aligning README/state with the runtime's configured CultNet/RUDP input. -- `rg -n -e '192\.168\.1\.66:17871' -e 'compatibility Eve deck bridge' -e 'compatibility fallback' -e 'old Odin Eve deck WebSocket path retained' -e '--url' -e '/eve/deck/providers' E:\Projects\Gjallar\README.md E:\Projects\Gjallar\state\gjallar-state.md E:\Projects\Gjallar\src -g '!**/bin/**' -g '!**/obj/**'` returned no hits. -- `dotnet build .\src\Aquarium.EveSurface\Aquarium.EveSurface.csproj --no-restore` passed in standalone `E:\Projects\Fensalir` after removing the local Eve deck broker default. -- `rg -n -e 'ws://127\.0\.0\.1:8795/eve/deck' -e 'DefaultBrokerUrl' -e 'Mimir.*eve/deck|Mimir.*VoidBot dashboard' -e '/eve/deck/providers' E:\Projects\Fensalir\src E:\Projects\Fensalir\README.md E:\Projects\Fensalir\docs -g '!**/bin/**' -g '!**/obj/**'` returned no hits. -- `cargo test operator_snapshot_distills_status_json_into_typed_cultmesh_document` passed in `E:\Projects\EpiphanyAgent\epiphany-core` after demoting the Codex app-server note from compatibility transport to external edge adapter. -- Ghostlight provider advertisement JSON parsed with `ConvertFrom-Json`, `node --check tools\publish_odin_provider_advertisement.cjs` passed, and `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\python\python.exe -m py_compile tools\ghostlight_state.py` passed after the provider-discovery wording cut. -- `rg -n 'future CultMesh|future CultMesh provider discovery|CultMesh/Odin provider discovery' E:\Projects\Ghostlight\examples\ghostlight-provider-advertisement.v0.json E:\Projects\Ghostlight\tools E:\Projects\Ghostlight\docs -g '!**/node_modules/**'` now finds only the live `CultMesh/Odin provider discovery` phrase. -- `node --check src\loki-daemon.mjs`, `node --check test\fixture-cdp-smoke.mjs`, `node --check test\extension-ingest-smoke.mjs`, and `node --check test\cultmesh-store.mjs` passed in `E:\Projects\Loki` after replacing Loki's text `.cc` witness writer with typed CultMesh store publication. -- `node test\fixture-cdp-smoke.mjs` and `node test\extension-ingest-smoke.mjs` passed in `E:\Projects\Loki`; both smokes read Loki records back from `state/loki.service.ccmp` through `CultMesh.createNode(...)`. -- `rg -n "state-dir|loki\.chrome_snapshot\.cc|provider_advertisement\.cc|eve_surface\.cc|CultNet/CultMesh publication|typed text witnesses|awaits a direct|cultcache-text-witness|LOKI_STATE_DIR|Add CultCache|Add CultNet" E:\Projects\Loki` returned no hits after the Loki CultMesh promotion. -- Guarded deletion removed the untracked runnable stale `E:\Projects\Mimir\scratch\raven-daemon-build` tree after verifying it was untracked and contained 699 files under `E:\Projects\Mimir\scratch`; a follow-up `git -C E:\Projects\Mimir status --short -- scratch\raven-daemon-build` returned no output. -- PowerShell parser checks passed for `restart-nightwing-eve-dashboard.ps1`, `restart-nightwing-eve-browser-reference.ps1`, `restart-nightwing-gjallar.ps1`, `restart-odin.ps1`, `restart-starfire-muninn.ps1`, `restart-nightwing-muninn.ps1`, `restart-vili.ps1`, and `restart-muninn.ps1` after adding the Idunn-only actuator guard. -- Direct no-env probes of `restart-nightwing-eve-dashboard.ps1`, `restart-nightwing-eve-browser-reference.ps1`, `restart-nightwing-gjallar.ps1`, and `restart-vili.ps1` failed at the Idunn actuator guard before any remote or local restart action. -- Direct no-env probes of `restart-odin.ps1`, `restart-starfire-muninn.ps1`, `restart-nightwing-muninn.ps1`, and `restart-muninn.ps1` failed at the Idunn actuator guard before any remote or local restart action. -- Direct no-env probes of `restart-stonks.cmd`, `restart-weksa.cmd`, and `restart-voidbot.cmd` failed at the Idunn actuator guard before delegating to their restart bodies. -- Direct no-env probes of `deploy-yggdrasil-streampixels.cmd`, `deploy-nightwing-gjallar.cmd`, `restart-muninn.cmd`, and `restart-nightwing-eve-dashboard.cmd` failed at the wrapper-level Idunn actuator guard before delegating to child scripts. -- PowerShell parser checks passed for `deploy-nightwing-gjallar.ps1`, `deploy-yggdrasil-streampixels.ps1`, `deploy-yggdrasil-heimdall.ps1`, and `deploy-yggdrasil-repixelizer.ps1` after tightening deploy guards to require `IDUNN_COMMAND_AUTHORITY=idunn-daemon` as well as `IDUNN_ACTUATOR=1`. -- Direct no-env probes of those four deploy scripts failed at the Idunn actuator guard before SFTP, SSH, build, or remote deploy work. -- Focused guard scan over active Idunn deploy/restart command bodies found every script requiring both `IDUNN_ACTUATOR` and `IDUNN_COMMAND_AUTHORITY`. -- PowerShell parser checks passed for the Yggdrasil Idunn deploy wrappers after adding `sudo env GAMECULT_IDUNN_REMOTE_ACTUATOR=1 IDUNN_COMMAND_AUTHORITY=idunn-daemon` to the remote deploy call. -- Static residue scan over `gamecult-ops` Yggdrasil deploy bodies found no remaining `git clone`, target-host `git fetch`, `git checkout`, `reset --hard`, `REPO_URL`, or `BRANCH` fallback path in StreamPixels/Repixelizer, and confirmed all three remote bodies require `GAMECULT_IDUNN_REMOTE_ACTUATOR` plus `IDUNN_COMMAND_AUTHORITY`. -- `git diff --check` passed for the touched Odin deploy wrappers and `gamecult-ops` Yggdrasil remote deploy bodies/README; Git reported only expected LF-to-CRLF working-copy warnings. -- `cargo test -p idunn-daemon` passed 17 tests after the Idunn restart actuator guard cut. -- `node --check src\odin\config.cjs` and `node scripts\check-syntax.cjs` passed after removing Odin's copied remote witness import knob. -- `rg -n -F -e "includeRemoteWitnesses" -e "remote-witnesses" -e "sync-muninn-remote-witnesses" -e "nightwing.muninn.telemetry.cc" -e "raven.muninn.telemetry.cc" -e "raven.sleipnir.cc" E:\Projects\Odin\src E:\Projects\Odin\scripts E:\Projects\Odin\docs E:\Projects\Odin\README.md` no longer finds an Odin copied-witness import path; Raven Sleipnir's local store is daemon-owned and its lifecycle is represented through Idunn deployment/restart actuators. -- `node --check E:\Projects\weksa\scripts\weksa-daemon.mjs` passed after moving Weksa health to `.weksa/provider-advertisement-store.cc`. -- Weksa CultMesh health smoke started the daemon in a temporary state root, waited for `provider-advertisement-store.cc`, ran `weksa-daemon.mjs --health`, received `state: healthy` with the temp store path, and confirmed the deleted top-level text witnesses were not recreated. -- `Select-String` over `E:\Projects\weksa\scripts\weksa-daemon.mjs` and `E:\Projects\weksa\docs\verse-service-contract.md` found no remaining references to the deleted top-level Weksa text witnesses. -- Bifrost provider-store smoke ran `node tools\provider-advertisement.mjs export --out \bifrost-provider-store-*.cc`, created a non-empty typed store, and reported `.bifrost/provider-store.cc` in the exported witness list. -- `node --check E:\Projects\Bifrost\tools\provider-advertisement.mjs`, `node --check E:\Projects\Odin\src\odin\config.cjs`, and `node E:\Projects\Odin\scripts\check-syntax.cjs` passed after the Bifrost provider-store rename. -- Focused Bifrost/Odin scan found no remaining Bifrost `provider-advertisement.cc` route/docs/tool references; remaining hits now point to `.bifrost/provider-store.cc` producer/export documentation, not an Odin default store path. -- Odin config smoke verified `buildConfig([])` has no default interface store imports, while `ODIN_INTERFACE_BINDING_STORES=cultmesh-store:file:///E:/Projects/Odin/scratch/odin/odin.ccmp` is preserved as an explicit local debug CultMesh store URI. -- `node E:\Projects\Odin\scripts\check-syntax.cjs` passed after cutting Odin's repo-local and `C:\Meta\Odin\state\...` default interface store imports. -- `powershell.exe -NoProfile -ExecutionPolicy Bypass -File E:\Projects\Odin\scripts\health-idunn-swarm-deployment-coverage.ps1` now reports 20 cataloged targets and 30 cataloged actuator paths, and fails if any guarded `deploy-*`/`restart-*` script with `IDUNN_ACTUATOR` is missing from the Idunn catalog/alias/shared-actuator set. -- `cargo test -p idunn-daemon` passed 18/18 after syncing the PowerShell Idunn target catalog with the Rust swarm profile. -- PowerShell parser checks passed for `scripts\deploy-raven-sleipnir.ps1`, `scripts\restart-raven-sleipnir.ps1`, and `scripts\start-starfire-sleipnir.ps1` after removing the Raven IP and local Odin discovery-store defaults. -- `cargo test -p sleipnir-daemon` passed 16/16 after the Sleipnir launcher cleanup. -- Focused scan of `scripts\deploy-raven-sleipnir.ps1`, `scripts\restart-raven-sleipnir.ps1`, and `scripts\start-starfire-sleipnir.ps1` found no active `192.168.1.84` defaults or default `E:\Projects\Odin\scratch\odin\odin.ccmp` discovery-store path; remaining hits are inventory history/debug notes and the explicit `--discovery-store` parameter gate. -- Active `Odin-clean-move-identity` worktree checks verified all deploy/restart `.ps1` bodies and `.cmd` wrappers require `IDUNN_COMMAND_AUTHORITY`, no actuator scripts retain `192.168.1.66:17871`, `10.77.0.2:17870`, `127.0.0.1:17870`, `10.77.0.4`, or default `10.77.*` media target literals, and all branch deploy/restart PowerShell files parse. -- `git -C E:\Projects\Odin diff --check -- ...` passed for the touched Idunn docs and restart actuator scripts; Git reported only expected LF-to-CRLF working-copy warnings. -- `rg -n '192\.168\.1\.(66|75|84)|madman''s lullaby@192\.168\.1\.84|http://192\.168\.1\.84|srt://192\.168\.1\.66' E:\Projects\gamecult-ops\inventory.local.md` returned no hits after the local inventory cleanup. -- `rg -n -i -e 'localhost health|127\.0\.0\.1|/api/health|/healthz|provider|cultcache|idunn|rudp|odin|eve/deck|fallback|compat'` over `gamecult-ops\scripts\check-*` classified localhost health checks as deployment/readiness probes; Heimdall, Repixelizer, and StreamPixels checks validate configured CultCache/Idunn fields where those services expose CultMesh boundaries. -- Focused service-to-service HTTP scan found product/API boundaries only: Spotiverse and StreamPixels call Heimdall auth endpoints, StreamPixels web calls its service backend, VoidBot reads Odin through `ODIN_CULTMESH_STORE` despite `fetchOdinSnapshot` naming, and Aetheria's Ymir localhost HTTP example is explicitly labelled a "Current leak" with a typed CultMesh desired shape. -- `git -C E:\Projects\gamecult-ops diff --check -- scripts\README.md` passed after the localhost-probe boundary note. -- Sidecar/fixture scan classified Odin's `latest-surface.json` writer as gated by `--write-debug-surface-json` / `ODIN_WRITE_DEBUG_SURFACE_JSON=1`, Eve's browser reference provider list as local fixtures, and VoidBot JSON hits as fixture/smoke/dashboard debug outputs or typed-state CLI projections rather than Verse discovery authority. -- `rg -n -i 'live VoidBot|Mimir.*deck broker|opens live providers|dialing Mimir|mimir-eve-deck|8795/eve/deck' E:\Projects\Eve\README.md E:\Projects\Eve\docs E:\Projects\Eve\web -g '!**/node_modules/**'` now finds only the guard sentence saying the browser reference no longer opens live providers by dialing Mimir's deck broker. -- `git -C E:\Projects\Eve diff --check -- docs\renderer-parity.md` passed after the Eve parity wording cut. -- `rg -n 'WEKSA_DAEMON_BASE_URL|rudp://127\.0\.0\.1:8813|http://127\.0\.0\.1:8813' E:\Projects\VoidBot\.env E:\Projects\VoidBot\.env.example E:\Projects\VoidBot\packages\config\src E:\Projects\VoidBot\apps -g '!**/node_modules/**'` returned no hits after the local env cleanup. -- VoidBot config smoke loaded local `.env` without printing secrets and verified `REPO_FACE_WEKSA_SPEECH_ENABLED=true` fails without `WEKSA_CULTMESH_COMMAND_URI`. -- `rg -n '10\.77\.0\.[0-9]+|192\.168\.1\.66:17870|127\.0\.0\.1:17870|compatibility witnesses|:17870' E:\Projects\Heimdall\state\map.yaml E:\Projects\Heimdall\notes\fresh-workspace-handoff.md E:\Projects\Heimdall\README.md E:\Projects\Heimdall\.env.example E:\Projects\Heimdall\docs E:\Projects\Heimdall\src E:\Projects\Heimdall\tests -g '!**/node_modules/**'` returned no hits after the Heimdall memory cleanup. -- `git -C E:\Projects\Heimdall diff --check -- state\map.yaml notes\fresh-workspace-handoff.md` passed. -- `node node_modules\vitest\vitest.mjs run --config vitest.config.ts tests\app.test.ts` passed 22 tests and `node node_modules\typescript\bin\tsc -p tsconfig.json --noEmit` passed after deleting Heimdall's hardcoded Repixelizer/Spotiverse backend-callback exceptions. -- `rg -n "handoff\.callbackUrl ===|http://127\.0\.0\.1:8796/auth/heimdall/callback" E:\Projects\Heimdall\src\app.ts E:\Projects\Heimdall\tests\app.test.ts E:\Projects\Heimdall\.env.example E:\Projects\Heimdall\docs -g '!**/node_modules/**'` returned no hits for the deleted active-code callback shortcut. -- Follow-up config/default scans over StreamPixels, Heimdall, Mimir, Vili, Stonks, Weksa, Repixelizer, Bifrost, Gjallar, Fensalir, and Ghostlight source/doc/script surfaces found no additional daemon peer discovery shortcuts. Remaining local endpoint hits were classified as product-web boundaries (`StreamPixels` web/service URLs, Heimdall public issuer/base examples), daemon-local binds or operator/debug routes (`Stonks`, `Mimir`, `Spotiverse`), explicit debug sidecars (`Vili_WRITE_DEBUG_SIDECARS` / `--write-debug-sidecars`), local subprocess plumbing (`Vili` Kimodo worker), or deployment/readiness probes (`Bifrost`, `gamecult-ops`). -- PowerShell parser checks passed for `scripts\restart-muninn.ps1` after removing the Raven Muninn capture-command RUDP loopback target default; Raven Sleipnir's old standalone start script has been removed because Idunn owns deployment and restart. -- `rg -n -e '192\.168\.1\.66:17871' -e '192\.168\.1\.84:17889' -e '127\.0\.0\.1:17884' -e 'CaptureCommandRudpTarget = "127\.0\.0\.1:17884"' E:\Projects\Odin\scripts\deploy-raven-sleipnir.ps1 E:\Projects\Odin\scripts\restart-raven-sleipnir.ps1 E:\Projects\Odin\scripts\restart-muninn.ps1 E:\Projects\Odin\crates\sleipnir-daemon\src\main.rs E:\Projects\Odin\crates\muninn-daemon\src\main.rs` returned no hits after the Raven launcher cuts. -- `cargo test -p odin-core discovery` passed after replacing the remaining live-looking `192.168.1.66:17888` discovery fixture with documentation address space. -- `rg -n -e '192\.168\.1\.66:17888' -e 'cultnet://10\.77\.0\.4:3075' E:\Projects\Odin\crates\odin-core\src\discovery.rs E:\Projects\Eve\docs\provider-advertisement-contract.md` returned no hits after the fixture/contract cleanup. -- PowerShell parser checks passed for `E:\Projects\Mimir\scripts\start-starfire-cultmesh-av-receiver.ps1`, `E:\Projects\Mimir\scripts\start-raven-cultmesh-av-sender.ps1`, `E:\Projects\Mimir\scripts\start-raven-muninn-obs-feed.ps1`, `E:\Projects\Mimir-raven-build\scripts\start-muninn.ps1`, and `E:\Projects\Mimir-obs-muninn-branch\scripts\start-raven-daemon.ps1` after removing the `10.77.0.1` / `10.77.0.2` defaults. -- `dotnet build .\src\Mimir.CultMeshMedia\Mimir.CultMeshMedia.csproj --no-restore`, `dotnet build .\src\Mimir.Muninn\Mimir.Muninn.csproj --no-restore`, and `dotnet build .\src\Mimir.RavenDaemon\Mimir.RavenDaemon.csproj --no-restore` passed after making Mimir media relay/target endpoints explicit. -- Negative smokes confirmed `Mimir.CultMeshMedia send` fails without `--endpoint` / `--host`, and `Mimir.Muninn` / `Mimir.RavenDaemon` fail without `--target-host`, each with the explicit Odin/CultMesh discovery or operator config error. -- `rg -n -e '10\.77\.0\.1' -e '10\.77\.0\.2'` over the touched root Mimir, `Mimir-raven-build`, and `Mimir-obs-muninn-branch` media launcher/runtime files returned no hits after the Mimir WireGuard default cut. -- Focused source/script scans across Aetheria, Ymir, Ghostlight, Gjallar, Fensalir, Brokkr, Huginn, Norn, Loki, Sindri, CultLib, EpiphanyAgent, AquaSynth, Odin, Mimir active branches, VoidBot, and Aetheria found no new daemon discovery shortcuts in active GameCult service paths. Remaining local endpoint hits are classified as local daemon bootstrap/smoke fixtures (`Aetheria.Rts.Web`), protocol self-tests/examples (`CultLib`), local product/debug health lowerings (`Odin`, `Mimir`, Fensalir bridge scripts), external local ML/storage dependencies (`VoidBot` Qdrant/Ollama and AquaSynth IPA worker), or negative Idunn assertions against old endpoint strings. -- `rg -n -F` for old WireGuard/LAN URL forms over Brokkr, Huginn, Norn, Loki, and Sindri source/script/doc surfaces returned no hits. -- `rg -n -F` for `10.77.0.1`, `10.77.0.2`, `192.168.1.66`, and `192.168.1.84` over active Odin/Mimir source and scripts now returns only Idunn negative assertions, not runtime defaults. -- Consolidated broad scan for `future CultMesh`, compatibility deck/HTTP/WebSocket/transport/command phrasing, deck provider manifests, `ODIN_BASE_URL`, `WEKSA_DAEMON_BASE_URL`, old LAN/WireGuard endpoint families, localhost Odin/Idunn RUDP literals, Weksa localhost RUDP, and local Eve deck URLs across Odin, active Mimir branches, `gamecult-ops`, VoidBot, Eve, Spotiverse, Stonks, StreamPixels, Heimdall, Vili, Weksa, Bifrost, repixelizer, Ymir, Aetheria, Gjallar, Fensalir, Ghostlight, CultLib/CultCache/CultNet libraries, gamecult-bifrost, Brokkr, Huginn, Norn, Loki, Sindri, AquaSynth, EpiphanyAgent, and outer client repos now returns only classified residue: local renderer/debug deck docs in Odin/Spotiverse, Odin's own local CultMesh/RUDP bind docs, Idunn's own health bind docs/test default, Muninn parser tests for an explicitly supplied diagnostic endpoint, Idunn negative assertions against old endpoints, the `gamecult-ops` audit detector string, CultLib protocol-level `compatibility.transport_version` fields, and an AquaSynth planning note about Pink Trombone compatibility commands. -- Follow-up narrow config/deployment scans on 2026-07-03 found no active daemon peer defaults in Odin/gamecult-ops, VoidBot/Spotiverse/Eve, StreamPixels/Heimdall/Stonks/Vili/Weksa/Repixelizer/Bifrost, Aetheria/Ymir/Gjallar/Fensalir/Ghostlight, or Brokkr/Huginn/Norn/Loki/Sindri. Remaining hits were classified as WireGuard connectivity inventory, external local Ollama dependency, or no-hit groups. -- The same Mimir scan found untracked runnable artifact launchers still embedding direct relay/proof endpoints (`10.77.0.1`, `10.77.0.2`). Because they were untracked generated launchers rather than source-owned contracts, the shortcut was deleted outright: `E:\Projects\Mimir\artifacts\mimir-cultmesh-media-raven-stage\run-raven-sender.ps1`, `run-raven-video-silent-sender.ps1`, `run-raven-video-silent-sender.cmd`, and `E:\Projects\Mimir\artifacts\muninn-raven-video-to-starfire-obs.cmd`. -- Re-running the focused Mimir config/deployment scan after deleting those artifact launchers returned no remaining active hits for the old LAN/WireGuard endpoint families outside archived runtime evidence. -- Follow-up Mimir branch audit found stale `Mimir-raven-build` / `Mimir-obs-muninn-branch` docs and state maps still describing Starfire/Raven WireGuard SRT and SSH defaults as the current Muninn/Raven route. Those maps now say target hosts come from Odin/CultMesh discovery or explicit operator config; the old direct endpoint route is not a default. -- Root Mimir's CultMesh media map no longer names Yggdrasil as `10.77.0.1:3075`; it describes Yggdrasil relay routing as Odin/CultMesh-discovered or explicit operator configuration, with only the Starfire OBS lowering remaining local. -- Mimir Runtime transport catalogs and provider fixture/export wording no longer describe diagnostic SRT/LAN media or Eve state as "legacy remote program feeds" / "provider manifests"; they now say diagnostic lowering and typed provider advertisements. -- The OBS Muninn source documentation no longer preserves a LAN-default stream fallback when catalog discovery is absent. The native source already uses a `discovery-missing` placeholder with an empty media host and sanitizes stale `10.77.*` / `192.168.*` saved endpoints; the docs now match that behavior. -- Odin Idunn plan and health-script wording for the Nightwing Eve dashboard now refers to typed provider advertisements rather than provider manifests. -- Focused rerun over the previously suspicious Odin/Mimir/VoidBot/Weksa files now leaves only classified residue: Odin/Idunn local RUDP binds and tests, Idunn negative assertions against old private endpoints, and VoidBot/Weksa external Ollama host notes. -- Odin provider catalogs no longer promote `/eve/deck/{provider}` WebSocket lowerings or arbitrary first advertisement endpoints to `transportEndpoint`; the Odin-hosted deck path has now been deleted outright. `src\odin\interfaces.cjs` and `src\odin\provider-ingress.cjs` ignore non-CultMesh/CultNet `provider.endpoint` values for transport authority instead of falling back to HTTP/WS endpoints. -- Hermodr's browser bridge remains a browser-runtime lowering, not a discovery or command authority. `src\hermodr-daemon.cjs`, `scripts\start-hermodr.ps1`, `scripts\restart-hermodr.ps1`, and `scripts\health-hermodr.ps1` now run/probe a lowering over Odin's CultMesh store while rejecting old Odin HTTP/WebSocket inputs, raw sleipnir/Aetheria RUDP command endpoints, renderer-export state paths, and local mapping-store fallbacks. Browser ergonomics survive; provider discovery and command route ownership stay with Odin/CultMesh typed documents. -- `node --check` passed for `src\odin-coordinator.cjs`, `src\odin\config.cjs`, `src\hermodr-daemon.cjs`, and `scripts\write-gjallar-persona-cc.mjs`; `node scripts\check-syntax.cjs` checked the remaining 15 Odin CommonJS files after deleting `src\odin\websocket.cjs`. -- Odin operator layout intent no longer writes durable truth to `scratch\odin\interface-layout.json`. `odin.interface_layout.v1` is now a typed document in Odin's CultMesh store under record key `odin.providers`; the old JSON file is migration input only. Renderer WebSocket `odin-layout-intent` frames call the async layout store and receive `odin-command-rejected` frames if the CultMesh write fails instead of silently becoming a sidecar owner. -- Odin layout smoke created a temp `odin.ccmp`, seeded an old `interface-layout.json`, verified the layout migrated into `odin.interface_layout.v1`, applied a renderer `toggle` intent, and observed the updated tile in the CultMesh record. `node scripts\check-syntax.cjs` passed for all 16 CommonJS files after the layout promotion. -- Spotiverse no longer accepts command authority through HTTP `/commands/add-to-queue` or Eve WebSocket `spotiverse-command` frames. The HTTP route now returns `410 command_route_removed`, the WebSocket frame returns `command_frame_removed`, the old HTTP handler functions were deleted, and the only remaining `executeCommand` caller is the CultMesh `spotiverse.command_request.v1` poller. Spotiverse's provider advertisement now uses a `cultmesh:` provider endpoint and no command debug lowerings. -- `node --check` passed for `E:\Projects\Spotiverse\src\spotiverse-daemon.cjs` and `E:\Projects\Spotiverse\scripts\export-provider-advertisement.cjs`; focused scans over Spotiverse source/docs/export find no remaining debug HTTP/WebSocket command authority wording outside the removed HTTP tombstone route. -- Vili's Eve surface no longer advertises `href: /motion/generate` for motion generation, and its command boundary no longer names HTTP POST as intake. `scripts\vili-daemon.mjs` now polls `gamecult.vili.motion_request.v1` from the Vili CultMesh store, processes requests through the existing Kimodo job path, and writes `gamecult.vili.motion_job.v1` receipts. `POST /motion/generate` remains only as a `410 command_route_removed` tombstone. -- `node --check E:\Projects\Vili\scripts\vili-daemon.mjs` passed; focused scans found no `href`/`path`/`source`/`lowersTo` active HTTP motion-command residues in Vili source/docs. Runtime smoke started Vili in a temp state dir, verified `POST /motion/generate` returns HTTP 410, wrote an invalid `gamecult.vili.motion_request.v1` document into `vili.service.cc`, and observed exactly one deterministic `gamecult.vili.motion_job.v1` receipt (`jobId: vili-codex-invalid`, `state: failed`) plus `motionCommands.pendingRequests: 0` / `failedRequests: 1` in operator state. -- `rg -n "seedDeckUrls|discoverDeck|refreshLanDeck|localIpv4|fetchEveProvider|sftp://|compatibility-eve-deck|websocket-bridge|providerDeckUrl|activeProviderInterface|stonksStateUrl|http://127\.0\.0\.1:8802|ws://192\.168|192\.168\.1\.75|192\.168\.1\.66|10\.77\.0\.4:8824|10\.77\.0\.2:17870|127\.0\.0\.1:17870" E:\Projects\Odin-clean-move-identity\src E:\Projects\Odin-clean-move-identity\scripts -g "!**/target/**"` returned only the intentional raw-network-store rejection guard in `src\odin\interfaces.cjs`. -- `node --check src\odin\config.cjs`, `src\odin\interfaces.cjs`, `src\odin\marquee.cjs`, `src\odin\state.cjs`, `src\odin\surface.cjs`, `src\odin\probes.cjs`, `src\odin\websocket.cjs`, `src\odin-coordinator.cjs`, and `node scripts\check-syntax.cjs` passed in `E:\Projects\Odin-clean-move-identity`. -- PowerShell parser checks passed in `E:\Projects\Odin-clean-move-identity` for `scripts\start-odin.ps1`, `scripts\health-muninn.ps1`, `scripts\health-nightwing-muninn.ps1`, `scripts\health-starfire-muninn.ps1`, and `scripts\start-starfire-wireguard-elevated.ps1`. -- `git -C E:\Projects\Odin-clean-move-identity diff --check -- README.md docs/gjallar.md scripts src` passed; Git reported only expected LF-to-CRLF working-copy warnings. -- `rg -n -F` over `E:\Projects\Gjallar-rollback` for old LAN/WireGuard endpoint literals, `/eve/deck/providers`, `compatibility-eve-deck`, `websocket-bridge`, `ODIN_BASE_URL`, seeded deck strings, and SFTP/WebSocket shortcut forms returned no hits outside ignored build artifacts after replacing the rollback body with a fail-closed archive stub. -- `dotnet build .\src\Gjallar\Gjallar.csproj --no-restore` passed in `E:\Projects\Gjallar-rollback`, and `dotnet run --project .\src\Gjallar\Gjallar.csproj --no-build` produced the archived-transport tombstone and exited with the expected code 2. -- `rg -n -F` over `E:\Projects\Mimir-obs-muninn` for old Raven/Starfire LAN and WireGuard endpoint literals, `/eve/deck/providers`, `compatibility-eve-deck`, `websocket-bridge`, `ODIN_BASE_URL`, seeded deck strings, SFTP, WebSocket, and SRT private endpoint forms returned no hits after the neighbor sender docs/config cleanup. -- `git -C E:\Projects\Mimir-obs-muninn diff --check -- config docs state` and `git -C E:\Projects\Gjallar-rollback diff --check -- README.md src state` passed; Git reported only expected LF-to-CRLF working-copy warnings. -- Focused Odin scan for `websocket.cjs`, `createDashboardServer`, `broadcastState`, `openWebSocket`, `/eve/deck`, `ws://127.0.0.1:8797`, `http://127.0.0.1:8797`, `Odin WebSocket`, `Eve deck`, `rudp://127.0.0.1:17871`, Odin `Port = 8797`, and `--port ... 8797` returned no hits outside this inventory after deleting the Odin HTTP/WebSocket server and removing the Hermodr localhost Odin default. -- PowerShell parser checks passed for `scripts\start-odin.ps1`, `scripts\restart-odin.ps1`, `scripts\health-odin.ps1`, and `scripts\start-hermodr.ps1` after the Odin side-door cut. -- `git -C E:\Projects\Odin diff --check -- README.md docs scripts src` passed after the Odin HTTP/WebSocket side-door deletion; Git reported only expected LF-to-CRLF working-copy warnings. -- Stonks HTTP/WebSocket side-door cut verification passed: `node --check E:\Projects\Stonks\src\stonks-daemon.cjs`, PowerShell parser check for `E:\Projects\Stonks\scripts\start-stonks.ps1`, focused Stonks scan for the old HTTP/WebSocket listener/routes, and `git -C E:\Projects\Stonks diff --check -- src\stonks-daemon.cjs scripts\start-stonks.ps1 README.md docs\architecture.md AGENTS.md`. The focused scan found no active listener/route residue after removing one negative AGENTS breadcrumb. -- Active Mimir branch Raven daemon verification passed: `dotnet build .\src\Mimir.RavenDaemon\Mimir.RavenDaemon.csproj --no-restore`, PowerShell parser check for `scripts\start-raven-daemon.ps1`, and focused scan over `src\Mimir.RavenDaemon\Program.cs`, `scripts\start-raven-daemon.ps1`, `docs\raven-capture-mux-daemon.md`, and `state\map.yaml` for the removed Eve port, deck route, health route, listener class, and WebSocket helper residue. -- Active Mimir branch Fensalir daemon verification passed: `dotnet build .\src\Mimir.FensalirDaemon\Mimir.FensalirDaemon.csproj --no-restore`, PowerShell parser check for `scripts\start-fensalir-daemon.ps1`, and focused scan over `src\Mimir.FensalirDaemon\Program.cs`, `scripts\start-fensalir-daemon.ps1`, `docs\fensalir-reservoir-daemon.md`, and `state\map.yaml` for the removed port knob, deck route, health route, listener class, WebSocket helpers, dashboard projection types, and debug-lowering residue. -- Active Mimir branch EveDashboard verification passed: `dotnet build .\src\Mimir.EveDashboard\Mimir.EveDashboard.csproj --no-restore`, focused scan over `src\Mimir.EveDashboard\Program.cs` and `docs\eve-dashboard.md` for the removed listener, HTTP/deck routes, frame-command path, compatibility endpoint, launch-time external provider registration, and WebSocket broker residue, plus `git diff --check` on the touched EveDashboard files. -- Active Mimir branch online supervisor follow-through verification passed: PowerShell parser checks for `scripts\start-online-verse-daemons.ps1` and `scripts\start-fensalir-daemon.ps1`, `dotnet build` for Fensalir and EveDashboard, and a focused scan over the touched supervisor/docs/code for stale Fensalir port/bridge/health and EveDashboard broker route residue. Remaining VerseRelay health probing is a separate sensor relay readiness path, not the deleted Fensalir/EveDashboard surface. -- Active Mimir branch EveSensorReceiver verification passed: `dotnet build .\src\Mimir.EveSensorReceiver\Mimir.EveSensorReceiver.csproj`, PowerShell parser check for `scripts\start-online-verse-daemons.ps1`, and exact literal scans over the receiver and online supervisor for the deleted HTTP health wait, baked camera path/port defaults, and URL-shaped listener log. -- Active Mimir branch Well publication side-door cut: `Mimir.Well` no longer imports `System.Net.WebSockets`, constructs a `ClientWebSocket`, accepts `--publish-url`, reads `MIMIR_WELL_PUBLISH_URL`, or publishes Well snapshots/pages/stream frames through a Periwinkle WebSocket. It now opens a CultMesh node at `--cultmesh-cache` / `MIMIR_WELL_CULTMESH_CACHE` and writes typed `mimir.well_published_document.v1` envelopes into CultCache for Odin discovery. -- `scripts\start-online-verse-daemons.ps1` now passes Well a run-local `mimir-well.ccmp` cache instead of a publish URL, and its supervisor manifest no longer advertises debug WebSocket lowerings or URL fields as service routes. The stale generated `artifacts\runtime\online-verse-daemons-20260703-083019\supervisor.json` residue that still contained the old lowering routes was untracked and deleted outright. -- Active Mimir branch Well verification passed: `dotnet build .\src\Mimir.Well\Mimir.Well.csproj --no-restore`, PowerShell parser check for `scripts\start-online-verse-daemons.ps1`, `git diff --check` on the touched Well/supervisor/map files, and focused scans found no remaining Well `ClientWebSocket`, `--publish-url`, `MIMIR_WELL_PUBLISH_URL`, debug WebSocket lowering, or WebSocket/JSON publication-pressure residue outside this inventory. -- Active Mimir branch sensor relay/recorder subscription side-door cut: `Mimir.EveSensorReceiver` no longer exposes `/eve/periwinkle/subscribe`, maintains WebSocket subscribers, or broadcasts normalized records over a daemon-owned subscriber socket. It publishes accepted observations as typed `mimir.sensor_relay_observation.v1` CultMesh/CultCache records instead. -- `Mimir.VerseRecorder` no longer imports `System.Net.WebSockets`, constructs a `ClientWebSocket`, accepts `--url`, or reads `MIMIR_VERSE_RECORDER_URL`. It now requires `--cultmesh-cache` / `MIMIR_SENSOR_RELAY_CULTMESH_CACHE`, follows the relay cache, and writes the same `session.json` / `observations.jsonl` / paged body index outputs from typed relay records. -- `scripts\start-online-verse-daemons.ps1` now creates a run-local `eve-sensor-relay.ccmp`, passes it to both receiver and recorder, and no longer passes the removed subscribe path or recorder URL. Verification passed: `dotnet build .\src\Mimir.EveSensorReceiver\Mimir.EveSensorReceiver.csproj --no-restore`, `dotnet build .\src\Mimir.VerseRecorder\Mimir.VerseRecorder.csproj --no-restore`, PowerShell parser check for the supervisor, `git diff --check` on the touched relay/recorder/map files, and focused scans found no remaining receiver subscriber route, recorder WebSocket client, `MIMIR_VERSE_RECORDER_URL`, or debug WebSocket lowering residue outside this inventory. -- Active Mimir branch Nightwing witness publisher side-door cut: `tools\nightwing_typed_witness_publisher.py` no longer implements a hand-rolled WebSocket client, accepts `--url`, reads `MIMIR_WITNESS_URL`, or sends observations directly to `Mimir.EveSensorReceiver`. It now emits length-prefixed MessagePack `mimir.eve_sensor_observation.v1` payloads to stdout for local diagnostics/future CultMesh sender plumbing, so it cannot act as a daemon transport shortcut. -- `scripts\start-online-verse-daemons.ps1` no longer stages or starts the Nightwing remote witness publisher, and the old `start-stream-proof.ps1` / `start-mvp-leap-eyes-kiyo.ps1` launchers are fail-closed archive stubs because they depended on the removed Nightwing witness side door. Nightwing compact observations must return through Odin/CultMesh-discovered witness publication before those profiles are live again. -- Nightwing witness verification passed: bundled Python `py_compile` for `tools\nightwing_typed_witness_publisher.py`, PowerShell parser checks for the touched launchers, `git diff --check` on the touched Nightwing/script/doc/map files, and focused scans found no remaining `MIMIR_WITNESS_URL`, witness `--url`, `nightwing_typed_witness_publisher.py --url`, or old `ws://:8796/eve/periwinkle` route residue outside this inventory. -- Active Mimir branch Eve camera/mic receiver side-door cut: active Well and Raven/Eve runtime configs no longer launch `Mimir.EveSensorReceiver` for `eve-camera` / `eve-mic`, and the `8793` `/eve/camera` plus `8794` `/eve/mic` receiver paths were removed from source-owned config/docs. `Mimir.EveSensorReceiver` itself is now a fail-closed archive stub; stale invocations cannot open the old sensor ingress listener. -- `scripts\start-online-verse-daemons.ps1` no longer starts the receiver process or carries the dead relay port/readiness wait. Fensalir's process surface marks the old relay PID shape as archived instead of expected live daemon state. The Raven/Eve ingest doc is now an archive note, and the network-display/implementation/Eve-dashboard docs say Eve observations must return through Odin/CultMesh witness/media publication before rejoining the live profile. -- Eve camera/mic receiver verification passed: JSON validation for `config\mimir-runtime.well.local.json` and `config\mimir-runtime.raven-eve.example.json`, `dotnet build .\src\Mimir.EveSensorReceiver\Mimir.EveSensorReceiver.csproj --no-restore`, `dotnet build .\src\Mimir.FensalirDaemon\Mimir.FensalirDaemon.csproj --no-restore`, PowerShell parser check for `scripts\start-online-verse-daemons.ps1`, `git diff --check` on the touched config/receiver/docs/map files, and focused scans found no remaining `/eve/camera`, `/eve/mic`, `8793`, `8794`, or `Mimir.EveSensorReceiver --port` route residue outside archive/tombstone references and this inventory. -- Active Mimir branch Eve dialogue/program-output/public-edge side-door cut: `Mimir.EveDialogue`, `Mimir.EveRelay`, and `Mimir.Broadcast` are now fail-closed archive stubs. They no longer contain hand-rolled WebSocket stream servers, D3D12-to-H.264 `/stream` relay code, reverse-tunnel launcher plumbing, or direct RTMP/HLS edge publishing logic. -- `scripts\start-eve-dashboard-stream.ps1` is now an archive stub, the Mimir runtime output panel no longer exposes `Live` / `Stop` streaming controls or `/program/output/streaming/*` command/read bindings, and `MimirProgramStreamer` no longer knows a default RTMP target or launches `Mimir.Broadcast`. The Well stream-pressure status string was corrected from the old WebSocket/JSON label to `cultmesh-cache-publisher`. -- Eve dialogue/relay/broadcast verification passed: `dotnet build .\src\Mimir.EveDialogue\Mimir.EveDialogue.csproj`, `dotnet build .\src\Mimir.EveRelay\Mimir.EveRelay.csproj --no-restore`, `dotnet build .\src\Mimir.Broadcast\Mimir.Broadcast.csproj --no-restore`, `dotnet build .\src\Mimir.Runtime\Mimir.Runtime.csproj --no-restore`, `dotnet build .\src\Mimir.Well\Mimir.Well.csproj --no-restore`, PowerShell parser check for `scripts\start-eve-dashboard-stream.ps1`, `git diff --check` on the touched relay/broadcast/runtime/docs/map files, and focused scans found no remaining active `MIMIR_STREAM_TARGET`, default localhost RTMP, program-stream command binding, WebSocket handshake/frame implementation, Eve relay listener, or Eve dialogue listener residue outside archive/tombstone references and this inventory. -- Active Mimir branch Raven/localcast media side-door cut: `Mimir.RavenDaemon` is now a fail-closed archive stub instead of supervising FFmpeg display/audio capture into direct SRT/TCP targets. The Raven sender/demux/audio/screen scripts, stream-proof recorder, localcast sender/stop/discover/desktop launchers, and localcast FFmpeg installer now fail closed rather than constructing SRT URLs or spawning FFmpeg transport processes. -- Active Mimir branch runtime configs no longer declare Raven SRT receivers: `mimir-runtime.well.local.json`, `mimir-runtime.stream-proof.local.json`, `mimir-runtime.raven-eve.example.json`, `mimir-runtime.move-stream.local.json`, and `mimir-runtime.example.json` had direct Raven/neighbor network source entries removed. `audio-field.example.json` now models the neighbor dialogue anchor as `CultMeshMedia` with a `cultmesh://odin/...` URI instead of `transport.kind = SRT`, and `localcast.example.json` is an archive marker. -- Raven/localcast docs and state maps no longer describe direct SRT as the live bridge path. The Raven capture mux, neighbor sender, OBS receiver, move-controller stream, Spout, implementation plan, viable-stream, native rebuild, perfect-machine, and code algorithm map docs now say media must return through Odin/CultMesh-discovered lanes before those profiles are live again. -- Raven/localcast verification passed: JSON validation for the seven touched config files, PowerShell parser checks for the twelve archived transport scripts, `dotnet build .\src\Mimir.RavenDaemon\Mimir.RavenDaemon.csproj --no-restore`, `git diff --check` on the touched Raven/localcast config/script/doc/map files, and focused scans found no active `srt://`, `tcp-listener`, Raven media target env, Raven port, localcast sender, or Raven sender launcher residue outside archive/tombstone references and this inventory. -- Active Mimir branch OBS/Muninn RUDP side-door cut: the native OBS plugin no longer registers `Muninn Stream`, `Muninn Video`, or `Muninn Audio` sources. The plugin now registers only `Mimir Program Texture` and `Mimir Audio Stem`, so OBS can lower Fensalir/Mimir shared-memory outputs but cannot discover Muninn, publish activation commands, listen on Muninn catalog/media UDP ports, or reassemble Muninn RUDP media directly. -- The old OBS Muninn RUDP body was removed from the native plugin build: `mimir_obs_muninn_source.cpp`, the RUDP ack/fragment/url headers, and `muninn_rudp_url_tests.cpp` are deleted; `CMakeLists.txt` no longer builds the Muninn media decoder probe or URL test target and no longer links the plugin against `ws2_32`. `tools\muninn_media_decoder_probe.cpp` and `scripts\restart-obs-muninn-source.ps1` are fail-closed archive stubs. -- OBS/Muninn verification passed: `cmake -S native\obs_stem_source -B native\obs_stem_source\build`, `cmake --build native\obs_stem_source\build --config Release --target mimir_obs_stem_source`, PowerShell parser check for `scripts\restart-obs-muninn-source.ps1`, `git diff --check` on the touched OBS plugin/script/doc/probe files, and focused scans found no active `rudp://`, Muninn RUDP parser, Muninn source registration, command target, media target, catalog port, media port, or OBS Muninn source residue outside archive/tombstone references and this inventory. -- Active Mimir branch Well-to-OBS log-tail side-door cut: `Mimir.WellObsDaemon` is now a fail-closed archive stub instead of tailing `mimir.well_capture_page.v1` JSON logs and republishing audio stems to `Local\MimirObsStemBus`. `scripts\start-well-obs-daemon.ps1` is also a fail-closed archive stub. OBS stems must come from the Mimir/Fensalir media owner and shared-memory lowering, not from a Well log tail daemon. -- Well-to-OBS verification passed: PowerShell parser check for `scripts\start-well-obs-daemon.ps1`, `dotnet build .\src\Mimir.WellObsDaemon\Mimir.WellObsDaemon.csproj` after restore, `git diff --check` on the touched daemon/script/map files, and focused scans found no active Well-to-OBS launcher or daemon log-tail route outside archive/tombstone references and this inventory. `dotnet build --no-restore` initially failed only because `src\Mimir.WellObsDaemon\obj\project.assets.json` was absent; the restore-backed build succeeded. -- Active Mimir branch Fensalir Well intake side-door cut: `Mimir.FensalirDaemon` no longer discovers or tails Well JSONL/log artifacts. `--well-log`, `FindLatestWellLog`, `WellLogTailState`, and the file-tail helper were removed from the live path. The daemon now requires `--well-cultmesh-cache` / `MIMIR_WELL_CULTMESH_CACHE` and follows `mimir.well_published_document.v1` envelopes from the Well CultMesh cache. The shared `MimirWellPublishedDocument` contract moved into `Mimir.Runtime` so Well and Fensalir read/write the same typed document. -- The Fensalir launchers now pass the run-local Well CultMesh cache instead of recorder `observations.jsonl`: `scripts\start-online-verse-daemons.ps1` uses `--well-cultmesh-cache $WellCultMeshCache`, and `scripts\start-fensalir-daemon.ps1` requires `-WellCultMeshCache` / `MIMIR_WELL_CULTMESH_CACHE` instead of scanning artifacts for Well logs. Docs and state maps now describe recorder JSONL as an offline ledger, not daemon transport authority. -- Fensalir Well-intake verification passed: `dotnet build .\src\Mimir.FensalirDaemon\Mimir.FensalirDaemon.csproj --no-restore`, `dotnet build .\src\Mimir.Well\Mimir.Well.csproj --no-restore`, PowerShell parser checks for `scripts\start-fensalir-daemon.ps1` and `scripts\start-online-verse-daemons.ps1`, `git diff --check` on the touched Fensalir/Well/runtime/script/doc/map files, and a negative smoke confirmed `dotnet run --no-build --project .\src\Mimir.FensalirDaemon\Mimir.FensalirDaemon.csproj -- --well-log removed.jsonl ...` rejects the archived log-tail option. Focused scans found no remaining active Fensalir JSONL/log-tail intake outside the deliberate rejection guard and this inventory. -- Active Mimir branch runtime transport catalog side-door cut: `MimirNetworkTransportConfigurations.BuiltIn` now contains only CultMesh typed state plus CultMesh reliable-UDP media/body lanes. The former raw LAN UDP debug window, SRT diagnostic bridge, and WebRTC experimental media entries were deleted instead of left as tempting observe-only profiles. -- Mimir authority and OBS publication catalogs no longer grant any model space to diagnostic SRT bridges: the `srt-program-bridge` observe-only authority rule, `DiagnosticSrtBridge` publication profile, SRT diagnostic enum values, and related module-library wording were removed. OBS publication profiles now describe only Spout/shared-texture/Eve-native video and Faust/ASIO audio shapes. -- Eve program output and dashboard config no longer carry direct network defaults as diagnostic invitations: `MimirEveProgramOutputConfiguration` dropped `TargetHost`/`TargetPort` and the Moonlight/Sunshine diagnostic profile, the unused `BrowserDiagnostics` witness kind was removed, and the StreamPixels EveDashboard provider no longer advertises HTTPS, SSH-forwarded localhost, HLS, or RTMP ingest nodes. -- Runtime transport-catalog verification passed: `dotnet build .\src\Mimir.Runtime\Mimir.Runtime.csproj --no-restore`, `dotnet build .\src\Mimir.EveDashboard\Mimir.EveDashboard.csproj --no-restore`, `dotnet build .\src\Mimir.BufferSmoke\Mimir.BufferSmoke.csproj` after restore, `dotnet run --project .\src\Mimir.BufferSmoke\Mimir.BufferSmoke.csproj --no-build -- --eve-program-output-contract-smoke`, `dotnet run --project .\src\Mimir.BufferSmoke\Mimir.BufferSmoke.csproj --no-build -- --perfect-machine-profile-smoke`, `git diff --check` on touched runtime/dashboard/smoke/doc files, and focused scans found no remaining active SRT bridge, WebRTC experiment, LAN UDP debug window, browser diagnostic witness, Moonlight probe, Eve output host/port, or StreamPixels HTTPS/localhost/RTMP dashboard residue outside this inventory. -- Active Mimir branch subprocess stream-source side-door cut: `MimirRuntimeConfiguration` no longer constructs `frame-events`, `json-lines`, `ffmpeg-rawvideo`, `rawvideo-process`, `ffmpeg-pcmaudio`, `pcmaudio-process`, or generic `process` stream adapters from config. The child-process stdout/JSONL/FFmpeg stream-source classes were deleted, and `Mimir.BufferSmoke --ffmpeg-rawvideo-source-smoke` was removed so tests cannot keep the adapter alive as a backdoor. -- Mimir runtime config examples no longer advertise process-backed probes: `mimir-runtime.example.json` contains only native/local sources, `mimir-runtime.probes.example.json` is ASIO-focused with no JSONL probe subprocesses, `mimir-runtime.sync-smoke.example.json` is an empty-stream sync settings shell, and `mimir-runtime.asio.example.json` no longer carries the disabled Raven display frame-event receiver. Native probe tools may remain development tools, but they do not feed daemon runtime buffers unless rebuilt as CultMesh publishers. -- Subprocess stream-source verification passed: `dotnet build .\src\Mimir.Runtime\Mimir.Runtime.csproj --no-restore`, `dotnet build .\src\Mimir.BufferSmoke\Mimir.BufferSmoke.csproj --no-restore`, JSON parsing for all `config\mimir-runtime*.json`, `git diff --check` on touched runtime/config/doc files, and focused scans found no remaining active process/FFmpeg/frame-event stream adapter construction, config adapter entries, `arguments` config knobs, or FFmpeg raw-video smoke route outside this inventory. -- Active Mimir branch program-recording actuator cut: the runtime `Output` panel no longer exposes `program.record.start`, `program.record.stop`, `/commands/program/record/*`, or the recording-folder read binding. `MimirProgramRecorder` is now a fail-closed archived status object and cannot spawn PowerShell, `scripts\record-stream-proof-output.ps1`, FFmpeg, or the old Raven sender switch. -- Program-recording verification passed: `dotnet build .\src\Mimir.Runtime\Mimir.Runtime.csproj --no-restore`, `dotnet build .\src\Mimir.BufferSmoke\Mimir.BufferSmoke.csproj --no-restore`, PowerShell parser check for the already archived `scripts\record-stream-proof-output.ps1`, `git diff --check` on touched runtime/doc files, and focused scans found no remaining active `program.record` command route, `MIMIR_RECORD_*` knob, `StartRavenSender` switch, recorder `ProcessStartInfo`, or recording child-process launch path outside archive/status text and this inventory. -- Active Mimir branch Nightwing Move SSH/hidraw side-door cut: `scripts\start-online-verse-daemons.ps1` no longer launches `tools\online_move_music_sync.py`, no longer exposes `-SkipMoves`, `-MoveFps`, `-MoveFftSize`, or direct `-Move ... /dev/hidraw...` parameters, and no longer records a `moveSyncPid` in the supervisor manifest. Online Move actuation must return as typed command schedules through Odin/CultMesh, with Nightwing owning local HID writes and receipts. -- The live Starfire-to-Nightwing Move bridge tools are fail-closed archive stubs: `tools\nightwing_psmove_music_pulse.py`, `tools\online_move_music_sync.py`, and `tools\music_keyed_move_chirp_sync.py` no longer import ASIO/FFmpeg readers, open SSH sessions, write remote Python receivers, or stream PS Move report `0x06` frames to `/dev/hidraw*`. `tools\sync_sweep.py` remains offline receipt tooling only, with its comment corrected so it does not call a historical HID path the live authority. -- Nightwing Move side-door verification passed: PowerShell parser check for `scripts\start-online-verse-daemons.ps1`, bundled Python `py_compile` for the three archived tools plus `tools\sync_sweep.py`, `dotnet build .\src\Mimir.Runtime\Mimir.Runtime.csproj --no-restore`, `dotnet build .\src\Mimir.BufferSmoke\Mimir.BufferSmoke.csproj --no-restore`, `git diff --check` on touched supervisor/tool/doc/state/runtime files, and focused scans found no remaining active online Move worker launch, Move supervisor parameter, `moveSyncPid`, or live `nightwing_psmove_music_pulse` / `music_keyed_move_chirp_sync` / `online_move_music_sync` references outside archive stubs, historical evidence, and this inventory. -- Active Mimir branch EVE program-output SSH probe cleanup: `scripts\start-eve-program-output.ps1` no longer accepts `-Target eve` and no longer performs an SSH readiness probe before starting the local shared-D3D12-texture lowering. The launcher now only sets the local Fensalir shared-texture environment and starts the local app process. The EveDashboard StreamPixels provider tile status was also changed from `ssh ready` to `cultmesh`. -- EVE program-output SSH cleanup verification passed: PowerShell parser check for `scripts\start-eve-program-output.ps1`, `dotnet build .\src\Mimir.EveDashboard\Mimir.EveDashboard.csproj --no-restore`, `git diff --check` on touched launcher/dashboard files, and focused scans found no remaining `Checking EVE SSH`, `mimir-eve-program-output-check`, or `ssh ready` residue outside this inventory. -- Odin Muninn media side-door cut: Muninn no longer accepts direct media hosts as authority. Capture commands still carry the legacy `target_host` wire field, but it must be a `cultmesh://` media target URI. The activation child pulls Odin provider advertisements over CultMesh/RUDP and resolves a provider-owned `muninn.media.rudp.v1` endpoint before opening the CultNet RUDP media lane. `request-stream` now publishes `muninn.capture_stream_command.v1` through Odin/CultMesh with `--odin-cultmesh-uri`; it no longer writes directly to the activation store or sends raw command documents to `--capture-command-rudp-target`. `serve` pulls typed capture commands from Odin before processing its local activation persistence and no longer opens a `--capture-command-rudp-bind` listener. -- The Muninn daemon vocabulary no longer contains the legacy media transport, OBS target flags, standalone OBS catalog RUDP publisher, direct RUDP URL formatter, or old process-spawner mux path. `scripts\activate-muninn-raven-av-srt.ps1` was removed; `scripts\activate-muninn-raven-media.ps1` is a fail-closed archive stub. `scripts\restart-muninn.ps1` now redeploys only the serve task, requires `-MediaTargetUri` / `MUNINN_MEDIA_TARGET_URI` as a `cultmesh://` URI, and unregisters obsolete Raven activation/video-proof scheduled tasks instead of repairing them. `scripts\health-muninn.ps1` fails if those obsolete tasks reappear. -- Odin Muninn media verification passed: `cargo test -p muninn-daemon`, PowerShell parser checks for `scripts\restart-muninn.ps1`, `scripts\health-muninn.ps1`, and `scripts\activate-muninn-raven-media.ps1`, `git diff --check` on touched Muninn/Idunn docs and scripts, and a focused scan found no remaining live SRT, OBS target, OBS catalog RUDP, direct media target host env, or old activation-script residue outside the deliberate obsolete-task removal guards and this inventory. -- Muninn capture command-route verification passed: `cargo test -p muninn-daemon` passed with `request_stream_rejects_raw_capture_command_rudp_target`, `serve_rejects_removed_capture_command_rudp_bind`, and `request_stream_requires_odin_cultmesh_command_route`; stale `request-stream --capture-command-rudp-target` and `serve --capture-command-rudp-bind` invocations fail closed; PowerShell parser checks passed for `scripts\restart-muninn.ps1` and `scripts\health-muninn.ps1`; `git diff --check -- crates/muninn-daemon/src/main.rs scripts/restart-muninn.ps1 scripts/health-muninn.ps1 docs/transport-shortcut-inventory.md` passed; focused scans found no surviving `publish_capture_command_rudp`, capture-command RUDP bind listener, capture-command frame decoder, launcher `CaptureCommandRudp*` parameter, active `--capture-command-rudp-target`, or active `--capture-command-rudp-bind` path outside intentional removed-flag parser guards/tests and this inventory. -- Odin Sleipnir launcher side-door cut: `scripts\start-starfire-sleipnir.ps1` is now a fail-closed archive stub. Starfire Sleipnir had no Idunn catalog target and the script directly killed/spawned `sleipnir.exe` while passing Odin/RUDP knobs, so it was an unmanaged lifecycle path rather than a coherent daemon deployment lane. -- Raven Sleipnir remains an Idunn-managed target through `scripts\idunn-deployment-targets.ps1`, `deploy-raven-sleipnir.ps1`, and `restart-raven-sleipnir.ps1`; those actuator scripts are guarded by `IDUNN_ACTUATOR=1` / `IDUNN_COMMAND_AUTHORITY=idunn-daemon`. Remaining Sleipnir raw socket options are HID input bootstrap substrate only; command selection and command delivery are now the Odin/CultMesh route. -- Sleipnir command-route side-door cut: `scripts\restart-raven-sleipnir.ps1` no longer requires `SLEIPNIR_COMMAND_RUDP_ADVERTISE` or passes `--command-rudp-advertise`. `crates\sleipnir-daemon` rejects the old flag, publishes the input-mapping command route as `cultmesh://odin/command/sleipnir/input_mapping` with `resolver: odin-cultmesh`, pulls `sleipnir.input_mapping.v1` from Odin discovery, and chooses the newest local-or-Odin mapping record. Hermodr refuses raw Sleipnir command endpoints and publishes mapping commands to Odin's configured CultMesh/RUDP substrate instead of dialing the advertised command address. -- Sleipnir command-ingress side-door cut: `crates\sleipnir-daemon` no longer starts a `--command-rudp-bind` listener, decodes raw command frames, or applies command mappings from an in-process RUDP receiver. `scripts\restart-raven-sleipnir.ps1` no longer passes `--command-rudp-bind`, and stale invocations fail closed with a removed-flag error. Sleipnir command state arrives through Odin discovery as `sleipnir.input_mapping.v1`. -- Odin discovery endpoint sanitation cut: `src\odin\interfaces.cjs` and `src\odin\provider-ingress.cjs` now sanitize provider `endpoints` and `routes` before exposing them through Odin surfaces. CultCache/CultMesh witness locations survive, and CultNet command routes survive only when the advertised address is a `cultmesh:` URI; raw `rudp://`, HTTP, WebSocket, and host:port endpoints no longer become provider interface truth. Live RUDP announcement source sockets are provenance only; fallback provider endpoints now use `cultmesh:live:`. -- Sleipnir launcher verification passed: PowerShell parser check for `scripts\start-starfire-sleipnir.ps1` and `git diff --check` on the touched Sleipnir launcher/inventory files. Focused follow-up scan still shows separate Odin-repo HTTP/WebSocket/debug-lowering text and health-wrapper residue that should be treated as the next cleanup target, not as approval to keep side doors. -- Sleipnir command-route implementation verification passed: `node --check src\hermodr-daemon.cjs`, `cargo test -p sleipnir-daemon`, and `git diff --check -- src/hermodr-daemon.cjs crates/sleipnir-daemon/src/main.rs` passed. Focused scans found no surviving `publishSleipnirMappingRudp` direct command publisher or raw `commandEndpoint` receipt path. -- Sleipnir command-ingress verification passed: `cargo test -p sleipnir-daemon rejects_removed_command_rudp_bind`, `cargo run -q -p sleipnir-daemon -- --command-rudp-bind 127.0.0.1:17889` fails closed with the removed-flag error, PowerShell parser check passed for `scripts\restart-raven-sleipnir.ps1`, and focused scans found no surviving `start_command_rudp_ingress`, `run_command_rudp_ingress`, `apply_pending_command_mappings`, command decoder, command receiver channel, launcher `CommandRudpBind`, or command route `connectionId` outside the intentional parser guard/test. -- Odin Idunn health-probe side-door cut: `scripts\health-stonks.cmd`, `scripts\health-vili.cmd`, and `scripts\health-mimir-eve-dashboard.cmd` are fail-closed archive stubs instead of localhost HTTP curl probes. `scripts\idunn-deployment-targets.ps1` now names Stonks and Vili health as daemon-published RUDP contracts, and `scripts\restart-vili.ps1` verifies Raven Vili restart through the daemon state file plus configured Idunn RUDP health status instead of polling HTTP `/operator-state`. -- The Nightwing Eve dashboard health script no longer requires `http-websocket-client-lowering + websocket-binary-command-lowering` as the input transport profile. It now fails if HTTP/WebSocket reappears in that field, making the old shape a visible degradation instead of an accepted transport profile. -- Idunn health-probe verification passed: PowerShell parser checks for `scripts\restart-vili.ps1`, `scripts\health-nightwing-eve-dashboard.ps1`, and `scripts\idunn-deployment-targets.ps1`; direct `cmd /c` probes confirmed the three archived `.cmd` wrappers exit 2; `cargo test -p idunn-daemon` passed; focused scans outside this inventory found no remaining Stonks/Mimir localhost health URLs, Vili HTTP operator-state wait, Stonks/Vili catalog health-script references, or old Nightwing Eve dashboard HTTP/WebSocket input-transport assertion. -- Hermodr browser-lowering correction: the earlier archive-stub cut was an overcut. `src\hermodr-daemon.cjs` has been restored as a localhost browser lowering that reads Odin's typed `gamecult.eve.surface_state.v1` and provider advertisement records from the configured Odin CultMesh store, exposes `/hermodr/verse/catalog` and `/hermodr/surface/` for browser use, reports `/health` as `authority=lowering-only`, and publishes browser-origin command ergonomics only as typed command documents to Hermodr's CultMesh command store. It still rejects old Odin HTTP/WebSocket discovery, `latest-surface.json`-style renderer exports, raw sleipnir/Aetheria RUDP command endpoints, and `muninnRudp` transport hints. -- Odin package scripts advertise `hermodr:start` again because the lowering is valid browser ergonomics. The script starts a lowering adapter only; it does not restore provider discovery, daemon health, or raw command transport authority. -- Odin utility and Idunn localhost-ingress cut: `src\odin\utils.cjs` no longer exports a generic `httpGet` helper, and `crates\idunn-daemon` no longer defaults `--rudp-health-bind` to `127.0.0.1:17870`. Bare Idunn starts without a health ingress; the owned Starfire bootstrap still supplies `--rudp-health-bind 0.0.0.0:17870` explicitly. -- Idunn generated-state breadcrumb cut: `crates\idunn-daemon` no longer emits `/eve/deck/nightwing-gjallar`, `renderer-only lowering`, `browser/WebSocket bridge`, or `HTTP stays a browser lowering` in its live surgery-plan strings. Gjallar/Nightwing Eve docs now point at accepted CultMesh/Eve state and CultNet/RUDP snapshots instead of deck/WebSocket routes as named live paths. -- Aetheria Odin route shortcut cut: `E:\Projects\Aetheria\Aetheria.State.Daemon\Program.cs` no longer advertises raw `cultmesh-rudp-document-put` / `aetheria-command-ingress` routes in Odin provider advertisements. Provider records now expose only Odin/CultMesh announcement routes with `resolver: odin-cultmesh`; command ergonomics still need a proper CultMesh/Odin command document path rather than a provider-dialed shortcut. -- Aetheria Electron daemon-target side-door cut: `E:\Projects\Aetheria\Aetheria.Rts.Web\Electron\main.ts` no longer invents or accepts a raw `AETHERIA_RTS_DAEMON_ENDPOINT` as the daemon identity. The configured/default target is now `AETHERIA_RTS_CULTMESH_URI` / `cultmesh://odin/aetheria/rts/`, and stale raw endpoint config fails closed. -- Aetheria RTS client path cut: `E:\Projects\Aetheria\Aetheria.Rts.Web\Electron\aetheria-cultmesh.ts` now separates the daemon's CultMesh URI from resolved peer-card transport endpoints. Command/query route metadata uses the CultMesh URI, raw `rudp://` strings are rejected as daemon targets, and the peer opens through `CultMesh.createRudpPeerForAuthorizedPeer(...)` using a peer catalog plus authority lease instead of `createRudpPeer(..., this.endpoint)`. -- Aetheria verification passed for the route/target cut: `npm run build:electron`, isolated-output `dotnet build E:\Projects\Aetheria\Aetheria.State.Daemon\Aetheria.State.Daemon.csproj --no-restore -p:UseAppHost=false -p:OutDir=`, and `git diff --check` on touched Aetheria/Odin inventory files passed. Focused scans found no surviving `AetheriaCommandRoute`, `aetheria-command-ingress`, `cultmesh-rudp-document-put`, old `rtsCultMeshEndpoint`, direct `createRudpPeer(... this.endpoint)`, or remote verifier `AETHERIA_STAGE7D_REMOTE_ENDPOINT`. `verify-stage7b-rts-client.ps1` still fails before transport assertions because Aetheria generated RTS bindings are already stale; I did not generate a broad binding diff during transport cleanup. -- Spotiverse WebSocket/HTTP side-door cut: `E:\Projects\Spotiverse\src\spotiverse-daemon.cjs` no longer registers an HTTP upgrade handler, tracks WebSocket clients, broadcasts provider state over `/eve/deck`, advertises debug WebSocket/HTTP routes, exposes local `/health`, `/spotify/state`, or `/spotify/search`, or includes an Eve WebSocket command frame template in surface metadata. The local HTTP listener remains only for Heimdall/Spotify auth routes plus a fail-closed removed-command tombstone that points stale callers at `spotiverse.command_request.v1`. -- Spotiverse launcher/export/doc follow-through: `scripts\start-spotiverse.ps1` no longer prints local health or Eve deck URLs, `scripts\export-provider-advertisement.cjs` no longer exports listener Verse or deck stream metadata, and `AGENTS.md`, `README.md`, `docs\architecture.md`, and `docs\verse-service-contract.md` now describe CultMesh/CultCache surface witnesses and typed command documents instead of `/eve/deck` renderer discovery. -- Spotiverse verification passed: absolute Node syntax check for `src\spotiverse-daemon.cjs`, PowerShell parser check for `scripts\start-spotiverse.ps1`, BOM-tolerant provider advertisement export check, `git diff --check` on touched Spotiverse files, and focused scans found no remaining `/eve/deck`, WebSocket, debug lowering, local state/search/health HTTP route, or launcher invitation residue outside this inventory. -- gamecult-ops service-check health shortcut cut: `E:\Projects\gamecult-ops\scripts\check-heimdall.sh`, `check-repixelizer-gui.sh`, and `check-streampixels-preview.sh` no longer trust localhost HTTP health JSON for CultMesh/Idunn daemon truth. The checks validate configured Idunn/CultMesh environment and non-empty CultCache/CultMesh witness files directly; remaining HTTP calls are product smoke probes for auth/config/nginx/web routing, not daemon-health owners. -- gamecult-ops Bifrost HTTP health gate cut: `E:\Projects\gamecult-ops\scripts\check-bifrost-alpha.sh` was deleted, `compose\bifrost.yggdrasil.yaml` no longer has a Docker healthcheck that curls `127.0.0.1:5080/healthz`, `scripts\deploy-bifrost-container.ps1` no longer curls `/healthz` or `/readyz`, and Bifrost runbooks now say daemon health must be added as a CultMesh/Idunn witness before it can be an operations gate. -- gamecult-ops verification passed for this cut: PowerShell parser check for `scripts\deploy-bifrost-container.ps1`, `git diff --check` on touched ops files, focused scans found no remaining migrated-service `health_json` / Idunn-from-HTTP parsing and no Bifrost `5080/healthz` / `5080/readyz` deploy gate. POSIX `bash -n` could not run because the available `bash.exe` is the WSL shim and WSL has no `/bin/bash` in this environment. -- Hermodr Aetheria command shortcut cut: Hermodr rejects `HERMODR_AETHERIA_COMMAND_RUDP` / `--aetheria-command-rudp` outright, no longer synthesizes Aetheria command routes into its embedded catalog, and accepts Aetheria commands only when Odin advertises a `cultmesh://` command route. Hermodr publishes `gamecult.eve.command.v1` to Odin over the configured Odin CultMesh/RUDP substrate instead of dialing the advertised route address. The Aetheria viewport snapshot bypass was removed; Hermodr lowers documents already present through Odin and no longer opens a direct Aetheria RUDP peer for viewport records. -- Hermodr Aetheria route verification passed: `node --check src\hermodr-daemon.cjs`, `git diff --check -- src/hermodr-daemon.cjs`, and focused scans found no surviving `publishRawDocumentPutRudp`, `openAetheriaRudpPeer`, raw Aetheria viewport snapshot reader, `CultNetPeer`, `rudpUri`, or MessagePack encode command path in `src\hermodr-daemon.cjs`. -- Odin/Idunn endpoint example cleanup: `README.md` no longer teaches `127.0.0.1:17871` as the Odin CultMesh/RUDP catalog endpoint; it names a configured ``. `src\Idunn\README.md` no longer teaches a localhost `--rudp-health-bind` example or says the daemon defaults to `127.0.0.1:17870`. `scripts\start-starfire-wireguard-elevated.ps1` no longer curls local Ollama HTTP as part of WireGuard bootstrap diagnostics. -- Endpoint example cleanup verification passed: PowerShell parser check for `scripts\start-starfire-wireguard-elevated.ps1`, `git diff --check` on the touched README/WireGuard files, and a focused scan found no remaining `127.0.0.1:17871`, demo `--rudp-health-bind 127.0.0.1:17870`, "defaults to 127.0.0.1:17870", or local Ollama curl diagnostic residue outside this inventory. -- Odin Mimir observation-log side-door cut: `src\odin\config.cjs`, `src\odin\state.cjs`, `src\odin\surface.cjs`, and `src\odin-coordinator.cjs` no longer tail `E:\Projects\Mimir\artifacts\runtime\periwinkle-cultmesh-sensors.out.log` or any other Mimir JSONL observation artifact as Odin discovery input. `src\odin\observations.cjs` was deleted, stale `--observationLogPath` / `--observationFreshSeconds` invocations fail closed, and Odin's surface summary no longer derives live stream counts from artifact logs. -- Observation-log cut verification passed: `node scripts/check-syntax.cjs`, stale `buildConfig(['--observationLogPath','x'])` rejection smoke, `git diff --check` on the touched Odin/docs files, and focused scans found no remaining Mimir observation ledger/default artifact path/observation tailer references outside the intentional removed-option guard and this inventory. Observation streams must re-enter as provider-owned CultMesh/Odin records or retained Eve/CultUI surfaces, not as an Odin artifact tail. -- Weksa Idunn health-command side-door cut: `scripts\idunn-deployment-targets.ps1` now names Weksa health as `daemon-published-rudp:weksa.cultnet-rudp-provider-health`, and Odin's `scripts\health-weksa.cmd` is a fail-closed archive stub instead of calling Weksa's local `--health --host 127.0.0.1 --port 8813` diagnostic path. -- Weksa repo follow-through: `E:\Projects\weksa\scripts\health-weksa-daemon.cmd` is also a fail-closed archive stub, and `E:\Projects\weksa\scripts\start-weksa-daemon.ps1` no longer runs `weksa-daemon.mjs --health` after launch or to accept an existing PID. It now checks the daemon process plus fresh `provider-advertisement-store.cc` witness while Weksa publishes `weksa.cultnet-rudp-provider-health` to Idunn over CultNet/RUDP. -- Weksa daemon health-mode cut: `E:\Projects\weksa\scripts\weksa-daemon.mjs` no longer accepts `--health` or prints command-mode health JSON from the local provider store. The archived wrapper has no surviving daemon flag target; diagnostics must inspect typed CultMesh/CultCache witnesses or Idunn RUDP health explicitly. -- Weksa direct RUDP command target cut: `E:\Projects\weksa\scripts\weksa-daemon.mjs` no longer advertises `rudp://$host:$port` in provider advertisements, bindings, CultMesh publication metadata, or command boundaries. `speech_provider.mimo.voicedesign` now publishes `cultmesh://odin/command/weksa/speech_provider.mimo.voicedesign`; the RUDP bind is recorded only as daemon-local runtime substrate. `--mimo-command-json` was removed from the daemon CLI so local direct-send command mode cannot bypass Odin discovery. -- Weksa health-command verification passed: PowerShell parser check for `E:\Projects\weksa\scripts\start-weksa-daemon.ps1`, direct `cmd /c` probes confirmed Odin and Weksa health wrappers exit 2, `cargo test -p idunn-daemon` passed, focused scans found no remaining Idunn Weksa health-script catalog reference or `--health --host 127.0.0.1 --port 8813` wrapper call, and `git diff --check` passed in both Odin and Weksa for the touched files. -- VoidBot Idunn health-command side-door cut: `scripts\idunn-deployment-targets.ps1` now names VoidBot health as `daemon-published-rudp:voidbot.cultnet-rudp-stack-health`, and `scripts\health-voidbot.cmd` is a fail-closed archive stub. The PowerShell witness inspector remains available for explicit diagnostics, but the easy `.cmd` health command can no longer satisfy or imply Idunn daemon truth. -- Idunn catalog health side-door cut: `scripts\idunn-deployment-targets.ps1` now names Muninn-family, Nightwing Gjallar, Yggdrasil StreamPixels/Heimdall/Repixelizer, Nightwing Eve dashboard, and Nightwing Eve browser reference health as daemon-published RUDP contracts instead of local health script paths. The matching health `.cmd` wrappers are fail-closed archive stubs; deeper PowerShell and remote check bodies remain explicit witness/deployment inspections only, not Idunn health truth. -- Muninn restart health-probe tail cut: `scripts\restart-muninn.ps1` and `scripts\restart-starfire-muninn.ps1` no longer invoke `health-muninn.ps1` / `health-starfire-muninn.ps1` after relaunch. Restart scripts verify the process and explicit Idunn RUDP contract arguments; Idunn accepts liveness only from daemon-published CultNet/RUDP health. -- Raven capture mux health alias cut: `scripts\health-raven-capture-mux.ps1` and `.cmd` are fail-closed archive stubs instead of aliases to `health-muninn.ps1`. -- Odin self-health side-door cut: `scripts\idunn-deployment-targets.ps1` now names Odin health as `daemon-published-rudp:odin.cultnet-rudp-provider-health`, `scripts\health-odin.cmd` is a fail-closed archive stub, and `scripts\restart-odin.ps1` no longer invokes `health-odin.ps1` after start. -- Vili/hermodr health-command tail cut: `E:\Projects\Vili\scripts\health-vili-daemon.cmd` is a fail-closed archive stub, Vili start/restart scripts no longer run `vili-daemon.mjs --health --host 127.0.0.1`, Vili no longer exposes or advertises HTTP `/health`, Vili provider/transport records no longer advertise HTTP/WebSocket debug lowerings as Verse discovery, `scripts\restart-vili.ps1` no longer deploys the Vili health wrapper to Raven, and `scripts\restart-hermodr.ps1` is now a fail-closed archive stub. -- Vili WebSocket deck path cut: `E:\Projects\Vili\scripts\vili-daemon.mjs` no longer imports `ws`, creates a `WebSocketServer`, or handles `/eve/deck` upgrades; `package.json` / `package-lock.json` no longer depend on `ws`, the npm `health` shortcut was removed, and Odin's Raven Vili deployment bundle no longer copies `node_modules\ws`. -- gamecult-ops Nightwing visible-ops side-door cut: `E:\Projects\gamecult-ops\scripts\nightwing-visible-ops-tui.py`, `nightwing-visible-ops-fb.py`, `nightwing-visible-ops-console.sh`, and `nightwing-visible-ops-fb-console.sh` are fail-closed archive stubs. The old TUI/framebuffer path no longer contains a hand-rolled WebSocket client, frame parser, browser-deck URL argument, mouse-to-layout command channel, tmux launcher, framebuffer launcher, or default Starfire deck target. Nightwing visible ops now points at Gjallar consuming Odin's accepted CultMesh/CultNet surface snapshot. -- Nightwing visible-ops runbook follow-through: `E:\Projects\gamecult-ops\runbooks\nightwing-cultmesh-worker-tunnel.md` no longer teaches local Odin HTTP health, direct Eve deck URLs, or renderer layout intents over the deck path as an operations route. It describes Odin as the typed CultMesh/CultNet authority and Gjallar as the lowering product; renderer input must become typed Odin documents before it can affect layout. -- gamecult-ops Verse doctrine cleanup: `E:\Projects\gamecult-ops\docs\verse-service-architecture.md` no longer says HTTP/WebSocket compatibility bridges may remain as live lowering routes, and `scripts\audit-verse-services.ps1` no longer treats `/eve/deck` or `websocket` text as positive CultMesh/Eve readiness signals. Browser/native inspection endpoints are now explicit debug exports only; they cannot be provider discovery, daemon health, command transport, or service identity. -- Nightwing visible-ops verification passed: bundled Python `py_compile` passed for the two archived Python scripts, PowerShell parser check passed for `scripts\audit-verse-services.ps1`, `git diff --check` passed for the touched visible-ops scripts, Nightwing runbook, Verse architecture doc, audit script, and Odin inventory, and focused scans found no remaining executable visible-ops `WebSocket`, `ws://`, `/eve/deck`, `GAMECULT_VISIBLE_OPS_URL`, or `visible_ops.WebSocket` path outside archive/inventory text. Plain `python` on PATH is only the Microsoft Store alias in this environment, so verification used `C:\Users\Meta\.cache\codex-runtimes\codex-primary-runtime\dependencies\python\python.exe`. -- Odin/Idunn generated-vocabulary cut: `crates\idunn-daemon\src\main.rs`, `README.md`, `docs\idunn.md`, `docs\architecture.md`, and `docs\gjallar.md` no longer preserve HTTP/WebSocket/deck route lists in generated surgery plans, command boundaries, transport profiles, or primary Odin/Idunn/Gjallar docs. The records now name product/debug probes as non-authority and point Weksa/sleipnir command ergonomics at typed Odin/CultMesh command documents rather than daemon-owned RUDP command ingress/route wording. -- Odin/Idunn generated-vocabulary verification passed: `cargo test -p idunn-daemon`, `git diff --check -- crates/idunn-daemon/src/main.rs README.md docs/idunn.md docs/architecture.md docs/gjallar.md docs/transport-shortcut-inventory.md`, and focused scans over the touched non-inventory Odin/Idunn source/docs found no remaining `HTTP`, `WebSocket`, `ws://`, `wss://`, `/eve/deck`, `http.server`, `RUDP command route`, `daemon-owned-rudp-command-ingress`, or `weksa.mimo_voicedesign_command.v0` invitations outside literal health-script names. The inventory remains the evidence ledger and intentionally retains historical route names. -- Mimir Nightwing/EVE witness socket-lane cut: `E:\Projects\Mimir\src\Mimir.EveSensorReceiver\Program.cs`, `src\Mimir.VerseRecorder\Program.cs`, `tools\nightwing_typed_witness_publisher.py`, and `scripts\start-nightwing-move-tracking.ps1` are fail-closed archive stubs. The old receiver no longer opens a TCP/WebSocket listener, health route, publish route, or subscriber path; the recorder no longer uses `ClientWebSocket`; the Nightwing publisher no longer hand-builds socket frames; and the launcher no longer starts/stages the receiver-recorder-publisher chain. Eye/Move witness publication and recording must use typed CultMesh/CultNet documents or CultMesh stream frames discovered through Odin. -- Mimir map/doc follow-through: `E:\Projects\Mimir\docs\implementation-plan.md`, `notes\current-system-map.md`, `state\map.yaml`, and `state\evidence.jsonl` now mark the old Nightwing bring-up path as archived and point witness state at Muninn/Mimir typed CultMesh stream frames and Odin-discovered CultMesh documents. The touched Mimir doctrine no longer normalizes TCP/HTTP/WebSocket as live transport categories; it names product/debug render surfaces as non-authority lowerings. -- Mimir witness-lane verification passed: `dotnet build E:\Projects\Mimir\src\Mimir.EveSensorReceiver\Mimir.EveSensorReceiver.csproj --no-restore`, `dotnet build E:\Projects\Mimir\src\Mimir.VerseRecorder\Mimir.VerseRecorder.csproj --no-restore`, bundled Python `py_compile` for `tools\nightwing_typed_witness_publisher.py`, PowerShell parser check for `scripts\start-nightwing-move-tracking.ps1`, `git diff --check` on the touched Mimir files plus this inventory, and focused scans found no surviving `ClientWebSocket`, `TcpListener`, `WebSocket`, `ws://`, `/eve/periwinkle`, `/eve/camera`, local health route, witness URL env, subscription URL env, or publisher `--url` path in the touched live files outside archive/inventory text. -- Weksa/VoidBot MiMo VoiceDesign command side-door cut: `E:\Projects\Weksa\scripts\weksa-rudp-command.cjs` is a fail-closed archive stub, and `scripts\weksa-daemon.mjs` no longer imports or starts a direct command listener, no longer accepts `--mimo-command-json`, `--host`, or `--port`, and no longer emits a command runtime bind in operator state or transport profile. Weksa advertises `speech_provider.mimo.voicedesign` only as `cultmesh://odin/command/weksa/speech_provider.mimo.voicedesign`; start/restart scripts no longer pass or print a private command bind. -- Weksa service contract follow-through: `E:\Projects\Weksa\docs\verse-service-contract.md` now names the Odin/CultMesh command boundary as the command authority and describes the old direct command endpoint as archived. Health publication over CultNet/RUDP remains Idunn-facing daemon health substrate; it is not a command side door. -- VoidBot Weksa speech client cut: `E:\Projects\VoidBot\packages\config\src\index.ts` replaced `WEKSA_RUDP_ENDPOINT` with `WEKSA_CULTMESH_COMMAND_URI`, and `packages\core\src\weksa-speech.ts` no longer imports the Weksa direct sender. Until VoidBot grows a real CultMesh command-document writer, Weksa speech requests fail closed with the command URI instead of silently taking a legacy transport path. -- Weksa/VoidBot command-lane verification passed: bundled Node syntax checks for `weksa-daemon.mjs` and the archived `weksa-rudp-command.cjs`, PowerShell parser checks for Weksa start/restart scripts, bundled TypeScript project build for VoidBot, `git diff --check` on the touched Weksa and VoidBot files, and focused scans found no surviving `WEKSA_RUDP_ENDPOINT`, `rudpEndpoint`, command RUDP bind/target, direct sender import, private command bind, or raw command endpoint wording outside the archive stub and this inventory. -- Mimir EveDashboard broker path cut: `E:\Projects\Mimir\src\Mimir.EveDashboard\Program.cs` is now a fail-closed archive tombstone instead of a TCP listener/WebSocket deck broker. The executable no longer contains the HTTP health route, `/eve/deck`, `/eve/dashboard`, WebSocket handshake/frame parser, socket command channel, or provider route catalog machinery. Dashboard state must return as typed CultMesh/Eve documents through Odin, and dashboard commands must arrive as typed Odin/CultMesh command documents. -- Mimir/Odin/gamecult-ops follow-through: `E:\Projects\Mimir\docs\implementation-plan.md`, `notes\current-system-map.md`, `notes\fresh-workspace-handoff.md`, and `state\map.yaml` now mark EveDashboard as archived until rebuilt as a pure CultMesh/Odin publisher plus renderer lowering. Odin's `nightwing-eve-dashboard` Idunn target is demoted to `archived`, its restart and health scripts are fail-closed archive stubs, and `E:\Projects\gamecult-ops\inventory.md` plus `runbooks\nightwing-cultmesh-worker-tunnel.md` no longer teach the Nightwing broker endpoint or localhost curl health probe. -- Mimir EveDashboard verification passed: `dotnet build E:\Projects\Mimir\src\Mimir.EveDashboard\Mimir.EveDashboard.csproj --no-restore`, PowerShell parser checks for the touched Odin Idunn scripts, direct `.cmd` probes confirmed Nightwing EveDashboard restart/health wrappers fail closed, `git diff --check` passed for touched Mimir/Odin/gamecult-ops files, and focused scans found no runnable `TcpListener`, `AcceptTcpClientAsync`, WebSocket handshake/frame implementation, `ws://`, `/eve/deck`, `/eve/dashboard`, `0.0.0.0:8795`, or localhost dashboard curl probe outside archive/tombstone text and this inventory. -- Vili HTTP service surface cut: `E:\Projects\Vili\scripts\vili-daemon.mjs` no longer imports `node:http`, binds `--host`/`--port`, starts `http.createServer`, serves `/`, `/provider-advertisement`, `/operator-state`, `/eve/operator`, `/smoke`, or the old `/motion/generate` tombstone route, or prints a local listener URL. Stale `--host` and `--port` invocations now fail closed and point at the typed `.vili\vili.service.cc` CultMesh/CultCache store. -- Vili launcher/doc follow-through: `start-vili-daemon.ps1`, `restart-vili-daemon.ps1`, and `install-vili-task.ps1` no longer accept or pass service host/port parameters; `run-vili-daemon.ps1` and `smoke-vili.mjs` are fail-closed archive stubs; `package.json` no longer exposes an npm `smoke` shortcut; Vili README and service contract no longer teach a local operator endpoint or direct motion-generation HTTP route. The provider advertisement now uses `cultmesh://odin/surface/vili/operator` and the `.cc` store, not an HTTP/debug route. -- Vili verification passed: bundled Node syntax checks for `scripts\vili-daemon.mjs` and archived `scripts\smoke-vili.mjs`, PowerShell parser checks for Vili start/restart/install/archive scripts, provider advertisement print checked clean of HTTP/WS/debug routes, stale `vili-daemon.mjs --host 127.0.0.1` fails closed, archived smoke exits 2, `git diff --check` passed for touched Vili files, and focused scans found no active Vili HTTP server, service host/port knob, provider/operator/smoke HTTP route, npm smoke script, or localhost service endpoint outside intentional archive/negative text and private Kimodo worker substrate. -- Bifrost Docker health-gate cut: `E:\Projects\Bifrost\Dockerfile` no longer installs `curl` or declares a Docker `HEALTHCHECK` that curls `http://127.0.0.1:5080/healthz`. The container may still expose the ASP.NET product app, but Docker image health is no longer a localhost HTTP probe pretending to be daemon truth. -- Bifrost operator-surface follow-through: `README.md` now says container smoke tests may hit `/healthz` and `/readyz` only as product probes, while Docker health and deploy gates must come from typed CultMesh/Idunn operator state. `tools\provider-advertisement.mjs --help` no longer shows localhost `BIFROST_HEALTH_URL` / `BIFROST_READY_URL` examples; `print-surface` without explicit probe URLs reports `unprobed` / `not configured` instead of silently curling localhost. -- Bifrost verification passed: bundled Node syntax check for `tools\provider-advertisement.mjs`, `provider-advertisement.mjs print-surface --generated-at ...` produced `unprobed` health/readiness without default localhost probes, `git diff --check` passed for the touched Bifrost files, and focused scans found no remaining Bifrost Docker `HEALTHCHECK`, localhost `5080/healthz`/`readyz` health-gate command, or localhost probe example outside negative doctrine text and unrelated VoidBot healthcheck variable names. -- StreamPixels localhost service-default cut: `E:\Projects\StreamPixels\apps\web\lib\service-url.ts` no longer falls back to `http://localhost:4000` on server or browser paths. Server-side web code now fails closed unless `SERVICE_URL` or `NEXT_PUBLIC_SERVICE_URL` is configured, and client-side browser code uses the configured public service URL or the current origin. `AppShell` now uses the same resolver instead of carrying its own localhost fallback. -- StreamPixels overlay preview cut: `E:\Projects\StreamPixels\apps\overlay\src\runtime\config.ts` no longer turns a localhost overlay origin into an implicit `http://localhost:4000` service. Local overlay preview must carry an explicit `serviceUrl` query parameter; hosted overlay deployments still default to their current origin as product/browser lowering behavior, not daemon discovery. -- StreamPixels verification passed: focused Vitest run for `apps/web/lib/service-url.test.ts` and `apps/overlay/src/runtime/config.test.ts` passed, TypeScript checks passed for `apps\web` and `apps\overlay`, and a focused scan found no remaining `localhost:4000` / `127.0.0.1:4000` runtime default in those app trees outside the explicit local-preview test fixture. -- CultMesh TS Odin URI resolver added: `E:\Projects\CultLib\packages\cultmesh-ts\src\index.ts` now lets RUDP helpers accept `cultmesh://` targets and resolve them through `resolveCultMeshRudpEndpoint` or the default `CULTMESH_URI__RUDP` bootstrap. This moves daemon-facing config toward logical CultMesh URIs while keeping concrete RUDP endpoints inside the transport resolver boundary. -- Weksa Odin startup publication cut: `E:\Projects\Weksa\scripts\weksa-daemon.mjs` now targets `cultmesh://odin/rendezvous/provider-catalog` through CultMesh publication instead of normalizing a raw `--odin-cultmesh-rudp` endpoint. `--odin-cultmesh-rudp` is a fail-closed removed flag, and Weksa launchers use `-OdinCultMeshUri` / `WEKSA_ODIN_CULTMESH_URI` with the Odin CultMesh URI default. -- Weksa Odin URI verification passed: CultMesh TS source/test TypeScript builds passed, Weksa daemon syntax and launcher PowerShell parser checks passed, and stale `weksa-daemon.mjs --odin-cultmesh-rudp 127.0.0.1:17871` exits with the removed-flag error before daemon startup. -- Stonks Odin startup publication cut: `E:\Projects\Stonks\src\stonks-daemon.cjs` now targets `cultmesh://odin/rendezvous/provider-catalog` through CultMesh publication instead of normalizing `--odin-cultmesh-rudp` / `STONKS_ODIN_CULTMESH_RUDP`. The old raw flag is a fail-closed removed path, and `scripts\start-stonks.ps1` uses `-OdinCultMeshUri` / `STONKS_ODIN_CULTMESH_URI` with the Odin CultMesh URI default. -- Stonks Odin URI verification passed: bundled Node syntax check passed for `src\stonks-daemon.cjs`, PowerShell parser check passed for `scripts\start-stonks.ps1`, stale `stonks-daemon.cjs --odin-cultmesh-rudp 127.0.0.1:17871` exits with the removed-flag error before daemon startup, and focused scans found no remaining raw Odin RUDP config path outside the removed-flag guard. -- Spotiverse Odin startup publication cut: `E:\Projects\Spotiverse\src\spotiverse-daemon.cjs` now targets `cultmesh://odin/rendezvous/provider-catalog` through CultMesh publication instead of `--odin-cultmesh-rudp` / `SPOTIVERSE_ODIN_CULTMESH_RUDP`. The Spotiverse launcher and env example now use `SPOTIVERSE_ODIN_CULTMESH_URI`, and provider advertisement startup-respect metadata carries `odinCultMeshUri` instead of `odinCultMeshRudp`. -- Spotiverse Odin URI verification passed: bundled Node syntax check passed for `src\spotiverse-daemon.cjs`, PowerShell parser check passed for `scripts\start-spotiverse.ps1`, stale `spotiverse-daemon.cjs --odin-cultmesh-rudp 127.0.0.1:17871` exits with the removed-flag error before daemon startup, and focused scans found no remaining raw Odin RUDP config path outside the removed-flag guard. -- Loki Odin startup publication cut: `E:\Projects\Loki\src\loki-daemon.mjs` now targets `cultmesh://odin/rendezvous/provider-catalog` through CultMesh publication instead of `--odin-cultmesh-rudp` / `LOKI_ODIN_CULTMESH_RUDP`. Its provider transport metadata records an Odin CultMesh URI, the old raw flag is fail-closed, and the daemon logs unresolved Odin URI bootstrap without aborting local CultMesh witness publication. -- Loki Odin URI verification passed: bundled Node syntax check passed for `src\loki-daemon.mjs`, `loki-daemon.mjs --once` completed while reporting unresolved Odin URI bootstrap as a startup-respect failure, stale `loki-daemon.mjs --odin-cultmesh-rudp 127.0.0.1:17871` exits with the removed-flag error, and focused scans found no remaining raw Odin RUDP config path outside the removed-flag guard. -- Bifrost Odin provider publication cut: `E:\Projects\Bifrost\tools\provider-advertisement.mjs` now publishes to `cultmesh://odin/rendezvous/provider-catalog` or `BIFROST_ODIN_CULTMESH_URI` instead of accepting `--odin-cultmesh-rudp` / `BIFROST_ODIN_CULTMESH_RUDP`. Help and Verse contract examples now teach the CultMesh URI path, and the old raw endpoint config fails closed. -- Bifrost Odin URI verification passed: bundled Node syntax check passed for `tools\provider-advertisement.mjs`, help output shows only `--odin-cultmesh-uri` / `BIFROST_ODIN_CULTMESH_URI`, stale `provider-advertisement.mjs publish-odin --odin-cultmesh-rudp 127.0.0.1:17871` exits with the removed-config error, and focused scans found no remaining raw Odin RUDP config path outside the removed-config guard. -- StreamPixels Odin startup publication cut: `E:\Projects\StreamPixels\apps\service\src\config.ts` and `verse-state.ts` now use `STREAMPIXELS_ODIN_CULTMESH_URI` / `cultmesh://odin/rendezvous/provider-catalog` for startup provider publication instead of `STREAMPIXELS_ODIN_CULTMESH_RUDP` plus local endpoint normalization. Docs and `state\map.yaml` now say concrete RUDP bootstrap belongs behind CultMesh URI resolution. -- StreamPixels Odin URI verification passed: bundled TypeScript check passed for `apps\service`, `git diff --check` passed for touched StreamPixels files, and focused scans found no remaining `STREAMPIXELS_ODIN_CULTMESH_RUDP`, `odinCultMeshRudp`, or `normalizeRudpEndpoint` path in StreamPixels service/docs/state. -- Rust CultMesh Odin URI resolver added: `E:\Projects\Odin\vendor\cultmesh-rs\src\lib.rs` now exposes `CultMesh::resolve_rudp_endpoint` / `resolve_rudp_endpoint`, accepts `cultmesh://` targets, resolves them through `CULTMESH_URI__RUDP`, and no longer defaults RUDP catalog publish/snapshot options to `127.0.0.1:17871`. The default target is an inert `0.0.0.0:0` sentinel so accidental unowned use fails instead of dialing localhost Odin. -- Muninn/sleipnir Odin startup and catalog path cut: `crates\muninn-daemon` and `crates\sleipnir-daemon` now store Odin as `cultmesh://odin/rendezvous/provider-catalog` / `--odin-cultmesh-uri` and resolve it through Rust CultMesh only at RUDP catalog publish/pull boundaries. The old `--odin-cultmesh-rudp` flag is fail-closed in both daemons. Odin launchers for Raven/Starfire/Nightwing Muninn and Raven Sleipnir now pass `--odin-cultmesh-uri` / `ODIN_CULTMESH_URI` instead of raw endpoint flags. -- Muninn/sleipnir Rust verification passed: `cargo test -p muninn-daemon odin_cultmesh`, `cargo test -p muninn-daemon request_stream_requires_odin_cultmesh_command_route`, `cargo test -p sleipnir-daemon odin_cultmesh`, `cargo test -p sleipnir-daemon rejects_removed_command_rudp_bind`, `cargo test --manifest-path vendor\cultmesh-rs\Cargo.toml resolves_rudp_endpoint_from_cultmesh_uri_bootstrap_env`, and `cargo test --manifest-path vendor\cultmesh-rs\Cargo.toml cultmesh_rudp_endpoint` passed. `cargo test -p muninn-daemon --no-run`, `cargo test -p sleipnir-daemon --no-run`, PowerShell parser checks for touched launchers, and `git diff --check` on touched Rust/script files also passed. -- C# CultMesh Odin URI resolver added: `E:\Projects\CultLib\src\GameCult.Mesh\CultMesh.cs` now exposes `CultMesh.ResolveRudpEndpoint(...)`, accepts `cultmesh://` targets, resolves them through `CULTMESH_URI__RUDP` / `_CULTMESH_RUDP_ENDPOINT`, and the string `CreateRudpClient(...)` overload now resolves through that CultMesh boundary instead of accepting only raw `rudp://` endpoints. -- Historical, unadmitted Gjallar URI experiment: an `E:\Projects\Gjallar` - body attempted to replace raw Odin RUDP flags with `--odin-cultmesh-uri`. - That body is not the canonical source or deployed release. The live - `F:\Projects\Gjallar` release `d683faa558351327d987918d1e8b8f79886dc9cb` - accepts `--odin-cultnet-rudp` and `--odin-cultmesh-rudp`; its Yggdrasil unit - uses both against `10.77.0.1:17871`. Treat the URI experiment and its checks - as rejected branch evidence, not a completed transport cut. -- Aetheria Odin announcement path cut: `E:\Projects\Aetheria\Aetheria.State.Daemon\Program.cs` collapsed `OdinCultMeshRudpEndpoints` into a single `OdinCultMeshUri`, defaults to `cultmesh://odin/rendezvous/provider-catalog`, rejects both `--odin-cultmesh-rudp` and the previous `--odin-cultnet-rudp` alias as announcement targets, advertises provider announcement routes as `transport: cultmesh`, and publishes through the shared CultMesh client URI resolution path. -- C# Odin URI verification passed: `dotnet build E:\Projects\CultLib\src\GameCult.Mesh\GameCult.Mesh.csproj --no-restore -p:OutDir=E:\Projects\.codex-build\cultmesh-out\`, `dotnet build E:\Projects\Gjallar\src\Gjallar\Gjallar.csproj --no-restore`, and isolated-output `dotnet build E:\Projects\Aetheria\Aetheria.State.Daemon\Aetheria.State.Daemon.csproj --no-restore -p:OutDir=E:\Projects\.codex-build\aetheria-daemon-out\` passed. The normal Aetheria output build was blocked by a running `Aetheria.State.Daemon` process holding DLLs open, so verification used `OutDir`; focused scans found no surviving raw Odin CultMesh RUDP config path outside intentional removed-option guards and this inventory. -- VoidBot Bifrost startup health side-door cut: `E:\Projects\VoidBot\scripts\start-voidbot-stack.ps1` no longer reads `BIFROST_HEALTH_URL`, curls Bifrost `/healthz`, or starts `BIFROST_ROOT\compose.local.yaml` based on product HTTP health. Stack startup now verifies `BIFROST_CULTMESH_COMMAND_URI`, `BIFROST_CULTMESH_STORE_PATH`, the Bifrost CultMesh command processor, and exports the typed provider store when missing. VoidBot current maps and handoff notes now describe Bifrost readiness as the CultMesh command lane, not Docker/product HTTP health. -- VoidBot Bifrost startup verification passed: PowerShell parser check passed for `scripts\start-voidbot-stack.ps1`, focused scans found no remaining `BIFROST_HEALTH_URL`, `Ensure-BifrostLocalStack`, `HealthUrl`, `/healthz`, or `/readyz` path in VoidBot's stack script/current maps/README, the configured Bifrost provider store and command processor exist, `node E:\Projects\Bifrost\tools\provider-advertisement.mjs export --out ` succeeded with health/readiness reported as `unprobed` / `not configured`, and `git diff --check` passed for the touched VoidBot files. -- Bifrost HTTP bridge ledger side-door cut: `E:\Projects\Bifrost\tools\bifrost-bridge.mjs` rejects `BIFROST_BRIDGE_BASE_URL` / `BIFROST_BRIDGE_TOKEN` and `--bifrost-base-url` / `--bifrost-token` outright. External bridge actions now require typed CultMesh command provenance such as `BIFROST_CULTMESH_COMMAND_ID`; `other-request` is fail-closed until it has a named typed command/receipt contract. `tools\agent-transport.mjs`, `tools\governance-threads.mjs`, and `tools\dispatch-agent-requests.mjs` no longer require or post to hosted runtime receipt endpoints; request, governance, and dispatch activity stays in Bifrost-owned typed CultCache/CultMesh stores. -- Bifrost web endpoint path cut: `E:\Projects\Bifrost\src\Bifrost.Web\Program.cs` no longer executes `/bridge/actions/*`, `/dispatch/runs/*`, `/transport/receipts`, or `/governance/receipts` as mutation APIs. Those route groups now return `410 Gone` tombstones pointing callers at typed CultMesh command/receipt documents discovered through Odin. Bifrost provider advertisement no longer exposes `bridge-action-ledger` and reports the old bridge ledger credential source as `removed-http-bridge`. -- Bifrost HTTP bridge verification passed: Node syntax checks passed for `bifrost-bridge.mjs`, `agent-transport.mjs`, `governance-threads.mjs`, `dispatch-agent-requests.mjs`, and `provider-advertisement.mjs`; `dotnet build E:\Projects\Bifrost\src\Bifrost.Web\Bifrost.Web.csproj --no-restore` passed; `BIFROST_BRIDGE_BASE_URL=http://127.0.0.1:5080 node tools\bifrost-bridge.mjs discord-post ...` and the same env on `agent-transport.mjs enqueue ...` fail closed with removed-config errors; `provider-advertisement.mjs print-surface` succeeds and reports the HTTP bridge ledger as removed; focused scans found no surviving live acceptance of the old bridge env outside removed-config guards, tombstone route names, and this inventory. Full Bifrost tests were not run in this pass because the existing bridge tests still encode the intentionally deleted HTTP-ledger behavior and need a separate expectation rewrite. -- Aetheria RTS peer shortcut cut: `E:\Projects\Aetheria\Aetheria.State.Daemon\Program.cs` no longer accepts configured peer RUDP endpoints, no longer imports committed facts from `--peer-cultmesh-endpoint`, and no longer carries the peer sync timeout authority. Peer discovery is now represented as Odin/CultMesh discovery; the remaining local `rudp://127.0.0.1:` handle in the Electron launcher is private to a child daemon spawned by that process, not user/deployment configuration. -- Aetheria Electron daemon targeting cut: `E:\Projects\Aetheria\Aetheria.Rts.Web\Electron\main.ts` now targets a daemon by `AETHERIA_RTS_CULTMESH_URI` or the default `cultmesh://odin/aetheria/rts/`, rejects legacy raw endpoint environment variables before startup, and no longer passes peer endpoint arguments into the local daemon. `scripts\verify-stage7c-electron-shell.ps1` now verifies the CultMesh URI targeting guard instead of teaching the peer endpoint pass-through. -- Aetheria peer shortcut verification passed: `npm run build` passed for `E:\Projects\Aetheria\Aetheria.Rts.Web`, isolated-output `dotnet build E:\Projects\Aetheria\Aetheria.State.Daemon\Aetheria.State.Daemon.csproj --no-restore -p:OutDir=E:\Projects\.codex-build\aetheria-daemon-out\` passed with pre-existing Unity/nullability warnings, PowerShell parser check passed for the touched Electron verifier, stale `dotnet ... Aetheria.State.Daemon.dll --peer-cultmesh-endpoint rudp://127.0.0.1:1 --once` fails before daemon startup, and focused scans found no surviving active peer endpoint import loop or launcher pass-through outside fail-closed guards and the local spawned-daemon private handle. -- Bifrost provider surface HTTP probe cut: `E:\Projects\Bifrost\tools\provider-advertisement.mjs` no longer accepts `--health-url`, `--ready-url`, `BIFROST_HEALTH_URL`, or `BIFROST_READY_URL` when building/exporting provider surfaces. Operator readiness now derives from typed CultMesh/CultCache stores, governance/request stores, and typed bridge command metadata; `/healthz` and `/readyz` remain product smoke endpoints only and cannot feed Odin-facing provider status. -- Bifrost test-suite HTTP bridge fixture cut: `E:\Projects\Bifrost\tests\Bifrost.Web.Tests\BridgeCliTests.cs` no longer spins up a fake localhost `HttpListener` bridge, no longer teaches `/bridge/actions/*`, `/dispatch/runs/*`, `/transport/receipts`, or `/governance/receipts` as accepted receipt paths, and uses typed `BIFROST_CULTMESH_COMMAND_ID` provenance or explicit removed-config negative checks instead of `BIFROST_BRIDGE_BASE_URL` / `BIFROST_BRIDGE_TOKEN` success fixtures. -- Bifrost bridge CLI test verification passed: `DOTNET_ROLL_FORWARD=Major dotnet test E:\Projects\Bifrost\tests\Bifrost.Web.Tests\Bifrost.Web.Tests.csproj --no-restore --filter FullyQualifiedName~BridgeCliTests` passed 30/30, and focused scans found no fake bridge server, localhost listener, deleted bridge route fixture, or old base-url/token success assertion in `BridgeCliTests.cs`. -- Current Gjallar transport admission: Idunn runs the headless Yggdrasil body, - Odin owns the accepted snapshot at `10.77.0.1:17871`, and Gjallar publishes - `gjallar.overview` back over the same RUDP substrate. Nightwing deployment and - framebuffer units are retired rather than adapted to the unadmitted URI path. -- Loki Chrome extension HTTP ingest cut: `E:\Projects\Loki\src\loki-daemon.mjs` no longer imports `node:http`, opens a localhost extension ingest server, serves `/health` or `/state`, accepts `/ingest/chrome-extension`, advertises `chrome-extension-ingest`, or publishes `gamecult.loki.chrome_extension_report.v0`, `gamecult.loki.chrome_debug_probe.v0`, or `gamecult.loki.chrome_page_snapshot.v0` witness routes. The daemon is CDP-observation-only until browser-origin observations have a CultMesh/native binding. `--extension-host` and `--extension-port` fail closed, the unpacked extension is an archived status stub with no localhost host permissions, and the old extension-ingest smoke test is now a removed-path guard. -- Loki verification passed: bundled Node syntax checks passed for `src\loki-daemon.mjs`, the extension service worker/popup, and Loki smoke tests; direct `node test\fixture-cdp-smoke.mjs` passed; direct `node test\extension-ingest-smoke.mjs` passed and proves `--extension-port` is rejected before startup. Focused scans found no remaining Loki extension HTTP ingest server, `/ingest/chrome-extension`, `LOKI_EXTENSION_PORT`, Chrome debugger/page snapshot action names, extension host permissions, or advertised extension/debug/page snapshot witness routes outside the intentional removed-option guard. -- Bifrost web bridge route cut: `E:\Projects\Bifrost\src\Bifrost.Web\Program.cs` no longer maps `/bridge/actions/*`, `/dispatch/runs/*`, `/transport/receipts`, or `/governance/receipts` at all. The old local bridge token HTTP handlers, `BuildBridgeCaller`, and local bridge token gate were deleted from the product web app. `PlatformEndpointsTests` now proves the old routes are `404 NotFound` and do not write bridge action, dispatch run, transport receipt, or governance receipt rows. -- Bifrost web bridge route verification passed: `dotnet build E:\Projects\Bifrost\src\Bifrost.Web\Bifrost.Web.csproj --no-restore` passed, and `dotnet test E:\Projects\Bifrost\tests\Bifrost.Web.Tests\Bifrost.Web.Tests.csproj --no-restore --filter FullyQualifiedName~PlatformEndpointsTests` passed 22/22 with `DOTNET_ROLL_FORWARD=Major`. Focused scans found no remaining mapped Bifrost web bridge routes, removed bridge endpoint function, or helper methods outside the negative route-absence test and inventory. -- Bifrost Motion Verse HTTP command path cut: `E:\Projects\Bifrost\src\Bifrost.Web\Program.cs` no longer maps `/eve/governance/commands`, and `MotionEveCommandRequest` was removed from the web surface layer. `MotionEveSurfaceService` now emits `cultmesh://asgard.starfire.bifrost/commands/motion` as the canonical command target with `cultmesh-command-document` transport metadata instead of an HTTP POST target. `tools\provider-advertisement.mjs` now advertises `motion-surface` and `motion-commands` as CultMesh URIs, not `https://bifrost.gamecult.org/eve/governance/*` endpoints. The browser-lowered motion state endpoint remains a product/member surface, but it is no longer the discovered Verse command authority. -- Bifrost Motion Verse verification passed: Node syntax check passed for `tools\provider-advertisement.mjs`, `dotnet build E:\Projects\Bifrost\src\Bifrost.Web\Bifrost.Web.csproj --no-restore` passed, and `DOTNET_ROLL_FORWARD=Major dotnet test E:\Projects\Bifrost\tests\Bifrost.Web.Tests\Bifrost.Web.Tests.csproj --no-restore --no-build --filter FullyQualifiedName~PlatformEndpointsTests` passed 22/22. Focused scans found no surviving `https://bifrost.gamecult.org/eve/governance`, mapped `/eve/governance/commands`, `MotionEveCommandRequest`, or HTTP POST command metadata outside the negative route-absence tests and this inventory. -- Mimir CultMeshMedia relay target shortcut cut: `E:\Projects\Mimir\src\Mimir.CultMeshMedia\Program.cs` no longer accepts `--host`, `--port`, or `--endpoint` for `send` / `recv`, and no longer synthesizes `rudp://host:port` as the remote relay target. Senders and receivers now require `--cultmesh-uri` / `MIMIR_CULTMESH_MEDIA_URI`, validate it as `cultmesh://...`, and resolve the concrete RUDP endpoint through `CultMesh.ResolveRudpEndpoint(...)` at the transport boundary. `start-raven-cultmesh-av-sender.ps1` and `start-starfire-cultmesh-av-receiver.ps1` now target `cultmesh://asgard.yggdrasil.mimir/media/raven-primary-av`, reject stale `MIMIR_CULTMESH_RELAY_HOST`, and no longer pass raw relay host/port arguments. Relay bind and OBS-local UDP output remain local substrate/lowering, not Verse discovery or command authority. -- Mimir CultMeshMedia verification passed: `dotnet build E:\Projects\Mimir\src\Mimir.CultMeshMedia\Mimir.CultMeshMedia.csproj --no-restore` passed; PowerShell parser checks passed for the touched sender/receiver launchers; stale `send --host 10.77.0.1` and `recv --endpoint rudp://10.77.0.1:3075` invocations fail closed before transport startup; stale `MIMIR_CULTMESH_RELAY_HOST=10.77.0.1` launcher use fails closed; and a dry-run sender now emits `--cultmesh-uri cultmesh://asgard.yggdrasil.mimir/media/raven-primary-av`. Focused scans found no remaining active Mimir media sender/receiver `--host`, `--port`, `--endpoint`, raw WireGuard relay, or loopback tunnel target outside fail-closed guards and this inventory. - -Not run: Gradle wrapper build for Eve's native Android app; that app uses `scripts\build-android.ps1` in this workspace, and that build passed. diff --git a/docs/write-pattern-cut.md b/docs/write-pattern-cut.md deleted file mode 100644 index 3b7d93b..0000000 --- a/docs/write-pattern-cut.md +++ /dev/null @@ -1,1008 +0,0 @@ -# Odin write pattern: cut map - -**2026-09-30, Self.** Operator: "Let's fix Odin up, that's some furious bookkeeping right there. Look at Odin's -write pattern and see if append only or per-document is the way to go." Answer: neither is the first fix. Cuts 1-2 -go to Hands now. Q3 (a 1 s interval) and Q4 (the Rust directory store as a CultLib follow-up) are Self defaults, -and the operator may overrule them. **Operator, 2026-09-30: "Q1: yes", so CultMesh refuses puts it could never -serve and Cut 3 goes ahead; "Q2: yeah, of course", so a read-only decode of a copy of live `topology.cc` is -approved. The copy is taken with `sudo cp` and decoded off the live path, and the copy is deleted afterwards.** - -**Soul on Cuts 1-2, and two operator rulings (2026-09-30).** -- **Q3 restated.** The premise "puts carry no application acknowledgement" was false. The cultmesh-rs server - ACKs a put only after `accept_raw_document` returns Ok, so after Cut 1 an ACK meant "in memory", and a SIGKILL - lost acknowledged puts in 6 of 6 probe runs. - - **Operator ruling: "Q3: B".** Peer puts are fsynced before they are acknowledged. Only Odin's own - bookkeeping (heartbeats, correlations) waits for the 1 s interval. An ACK means durable. -- **An undecodable foreign write.** Today Odin stays up, serves from memory and never persists again. Self offered - three options: degraded but loud, end Odin, or unchanged. - - **Operator: "None of these options involve repair and recovery, which is what ultimately needs to happen."** - - Recovery is mapped as its own pass. It covers an undecodable foreign write, a decodable one, and a failed - load at activation. - -**Soul on write batch 2 (2026-09-30).** Q3 B changes the expected effect. Cut 2's row in section 6 ("at most -3.5 MB/s, at most 1.05 writes/s") assumed Q3 A and is **superseded**. Under Q3 B, each peer put (presence -heartbeats included) writes the store once. -- With the live-shaped 3 MB store that is about 2.5-3 writes/s, about 7.5-9 MB/s, and 70-170 ms of the loop - blocked each second. -- Measured: route-challenge p99 461 ms and 11 kernel drops. -- After Cut 3's Odin half the store is about 80 KB and a put write is p50 about 4 ms. -- **Cut 2 therefore deploys only together with Cut 3's Odin half**, which is now being built on `hands/odin-write`. - -**Q2 decode result (Eyes, 2026-09-30; full table in the CultLib session scratchpad `odin-topology-decode.md`).** -- 77 records; 3,222,550 B of payload in a 3,240,078 B file. -- The two "~1.55 MB records" are per-type totals. Each type is dominated by one Ghostlight operator surface: - `eve:operator:ghostlight.campaign.27d444b3-...` (1,456,210 B) and its `operator-state` twin (1,456,341 B). - Together they are 89.9% of the file. -- Publisher: provider `gamecult.ghostlight.dungeon`. 99.5% of each record is one Eve `code` node holding a - pretty-printed JSON dump of the whole campaign state. -- These records are dead residue. They were stored 2026-09-23 and have not been rewritten since. Ghostlight `HEAD` - (`eeb3a68`) no longer contains the emitter (last touched at `6bb6869`, 2026-09-02). -- **So Q1's refusal breaks no live publisher.** Cut 3's Odin half drops exactly these two at activation. Every other - surface is 70 KB or less. -- Correction to section 3: the 1 MiB snapshot refusals in the journal are per-type responses, not per-record. - Cut 3's per-document bound is still right: each of these records is over 1 MiB alone. A type whose many small - records add up past 1 MiB would still be unservable as a whole-type snapshot. That is a follow-up for CultMesh - (paged snapshot responses), not part of this campaign. -- Presence history: 41 records, 42 KB, 37 of them withdrawn. F4 is a slow leak, not a size problem. -- The current `streampixels-web` incarnation has a correlation but no presence record; its last presence was - 09-29 19:53 UTC. This matches Idunn's "not Odin-correlated" state. - -**Soul on write batch 3 + Cut 3 Odin half (`f4a1f89..726e0f3`, 2026-09-30): not fit to deploy.** -- **S-1 (high; operator question Q5, below).** Every write, the fsync pair included, runs on the serving loop - (`main.rs:358` → `flush` → `compare_exchange_snapshot`; the interval flush at `:883` is on the same thread). - - A disk stall passes into route-challenge latency one for one. A probe that held the store lock measured: a 0 ms - stall gave 86 ms, 300 ms gave 288 ms, 1,500 ms gave 1,487 ms. - - Interleaved runs (ABBA) under IO pressure of 5-38% gave a challenge p99 no better with Cut 3 than without it. - - Cut 3 halves the bytes written, not the stalls. **The premise that the store's size caused the stalls was - wrong; they come from the disk.** -- **S-2 (high).** Q1's put refusal has not landed. Odin's pin `3bf1c0ce` has no put bound, so a 1.2 MB put is - ACKed, fsynced, and dropped at the next activation. It waits on the CultLib put-serve merge, then a pin bump with - a `served_record` override. -- **S-3 (medium).** `attempted` grows about 98 KB per failed write, roughly 0.9 GB/h on a full disk, which ends in - OOM. - - Fix in the owner: cultcache-rs returns a typed `NotReplaced`/`ReplacedNotDurable` write outcome (added to CultLib - R1 batch 3), and Odin keeps at most one candidate. -- **S-4 (medium).** Two admitted presences for one target, which a provider in a deploy window produces, refuse the - whole catalog (`main.rs:~628`). -- **S-5 (medium).** A RUDP transport ACK is recorded at receipt, so with pipelined puts a later put is ACKed while - an earlier one is still held. With the first datagram lost, the second is never delivered. That is data loss - under the QUIC-pivot rule; it is tracked in the CultLib ack map. `dcd36fc`'s doc line overstates. -- **S-6, S-8.** Test gaps (the limit taken through `main`; `remove_not_dirty`). -- **S-7.** The drop log echoes the key. Self ruled keys and schema ids are identities and may be logged, as in - CultLib R1. -- **Held:** F1's logic, F4's projection fallback, F5, F3's refusal, and Cut 3's activation bound, drop and removal. - Sizing uses `peer_document`, so it matches what is served. -- **Batch 4 in Hands:** S-4, S-6, S-8, the S-5 doc line, the attempted-list fixture gap, and committing Soul's - probes. S-1 waits on Q5; S-2 and S-3 wait on CultLib. - -**CultLib side landed (2026-09-30).** Ack Cut D was merged at `2f06ef84`, R1 at `daedfdd6` and the put-serve bound at -`9dcb3aa1`. That unblocks the Q5 sequence: -1. R1 batch 3's typed write outcome is on main. It carries `Rejected` as well as `NotReplaced`/`ReplacedNotDurable`. - W0 must classify by kind together with the `io::Error`, never by `NotReplaced` alone. -2. **C5 next:** cultmesh-rs deferred put reply, on main. -3. **W0:** one Odin pin bump. It closes S-2 (put refusal with a `served_record` override) and S-3 (delete - `attempted`), and it brings in Cut D's and the put-serve error texts. -4. **W1:** the writer thread. - -Status: cut map, Imagination pass 1 (Opus), 2026-09-30. Nothing has landed. Anchors are Odin `main` at -`44951a1` (the deployed build, live on Yggdrasil since 2026-09-30 04:20:48 UTC) and CultLib `3bf1c0ce` -(Odin's `Cargo.lock` pin). This map owns the means; there is no separate target document, because the ends are -three sentences (section 2). - -Operator's words, 2026-09-30: "Let's fix Odin up, that's some furious bookkeeping right there. Look at Odin's -write pattern and see if append only or per-document is the way to go." - -**Short answer.** Neither is the first move. Odin's IO comes from treating its store file as working memory and -from carrying two unservable 1.5 MB Eve documents inside it, not from the file format. Three cuts remove about -99% of the bytes read and written, and bring the rewrites per second from 5 down to at most 1. None of them -changes the on-disk format. For Odin's data, per-document storage is the better fit than append-only, but after -those cuts it would save about 90 KB/s and no fsyncs. It does not earn a place on Odin's critical path -(section 5). - -Open: Q1 to Q4 (section 7). Cut 1 needs no ruling. Cut 2 needs Q3. Cut 3 needs Q1 and Q2. - -## 1. Body facts (measured) - -### 1.1 Live Odin, `/proc/375952/io` and `ss`, read-only, 2026-09-30 ~10:14 UTC - -| Quantity | Process lifetime (21,252 s) | 60 s sample (10:15-10:16 UTC) | -|---|---|---| -| logical read (`rchar`) | 1.80 TB, 84.8 MB/s | 6.37 GB, **106 MB/s** | -| written (`wchar`) | 276.5 GB, 13.0 MB/s | 972 MB, **16.2 MB/s** | -| written to disk (`write_bytes`) | 276.8 GB (all of it) | 16.2 MB/s | -| read from disk (`read_bytes`) | **0** | 0 | -| write syscalls (`syscw`) | 85,420, 4.0/s | 300, **5.0/s** | -| bytes per write syscall | 3.24 MB | 3.24 MB | -| CPU | 1,529 s, 7.2% of one core | | -| socket drops (`ss -m`, `d`) | **136,291** | 0 in one 30 s sample (drops come in bursts) | - -- The store is `/var/lib/gamecult/odin/topology.cc`: **3,240,078 bytes** (`ls -l`; the contents were not read). - Every write syscall is one whole-store rewrite: 5.0 per second, each followed by a file `fsync` and a - directory `fsync`. -- `read_bytes = 0`. The "376 GB read" in the audit is page-cache reads. It costs CPU and memory bandwidth - (repeated MessagePack decodes of 3.24 MB), not disk. **The disk cost is the writes: 16 MB/s and about 10 - fsyncs per second.** -- The audit's figures (376 GB read, 63 GB written in 4 h, `MORNING-2026-09-30.md` line 214) came from the - previous process (`c34d167`). This process runs at about 3.7 times those rates, with the same 6.5:1 read/write - shape. The cause is the same. -- The idle Odin socket drops datagrams in bursts. Its 213 KB "backlog" in the audit is the receive buffer size - (`rb212992`); the drop counter (136,291) is the real signal. -- Idunn currently reads 211 KB in 30 s. Its `--odin-correlation-store` read of the same file is not a - significant load. - -### 1.2 Cost of one operation on Yggdrasil's disk (scratch probe) - -Probe: `scratchpad/odin-write-probe` (Imagination session), commit `71b376a6`. It was run through the stopgap -in slot 5, on `/dev/vda4` (the host disk) with `TMPDIR` on that disk, at CultLib `3bf1c0ce`. Bytes are -`/proc/self/io` deltas and times are wall clock under the live IO pressure (`/proc/pressure/io` full avg60 -about 10-12%). The store shapes use the payload sizes the live catalog reports. -TODAY adds two 1.55 MB records; SUBTRACTED omits them. - -| Operation | TODAY (3.24 MB store) | SUBTRACTED (131 KB) | -|---|---|---| -| full read and decode | 3.24 MB, 0.78 ms | 131 KB, 0.14 ms | -| one presence heartbeat as coded today (read, reserve watermark CAS, correlation CAS) | 16.2 MB read, **6.49 MB written, 54.8 ms** | 663 KB, 265 KB, 14.4 ms | -| the same heartbeat folded into one CAS | 6.49 MB read, 3.24 MB written, 36.5 ms | 268 KB, **134 KB, 7.1 ms** | -| redb (cultcache-rs `RedbMessagePackBackingStore`), one small-row CAS | 33 KB, 42.6 KB, 5.4 ms | 33 KB, 42.6 KB, 8.7 ms | - -Odin's serving loop is single-threaded (`main.rs:739-747`), so every millisecond in the table is a -millisecond in which no datagram is read. Five writes per second at 36-55 ms each block the loop for 180-275 -ms of every second on a quiet disk, and for longer under pressure. That is the socket drops and the route -challenge timeouts. - -### 1.3 What gets written, and why (source, `44951a1`) - -Every mutation reads the whole file, then CAS-rewrites the whole file, through CultLib's -`SingleFileMessagePackBackingStore` (`cultcache-rs/src/lib.rs` at `3bf1c0ce`: `compare_exchange` reads all -entries under an exclusive lock, rewrites all of them, then `fsync`s the file and its directory). - -| Trigger | Rate (measured from catalog `stored_at` churn over 88 s, and from the publisher's source) | Store ops per event | -|---|---|---| -| Muninn republishes `muninn.obs_stream_catalog`, `muninn.move_hue_program` and `gamecult.media_stream_advertisement` every 2 s (Muninn `main.rs:101`, `:2241`). The payload changes each time: `updated_at` (`:3263`) | about 1.5/s | `persist_generic_document` `main.rs:1266-1309`: 1 read, then 1 CAS (read and write) | -| Provider presence heartbeats: raven-muninn about every 2.7 s, Odin 5 s, streampixels-service about 10 s, ghostlight about 12 s | about 0.8/s | `admit_presence`, then `reconcile` `lib.rs:771-977`: `store.read` (1 read), `reserve_publisher_sequence` `lib.rs:613-647` (read and **write**), `compare_exchange` `lib.rs:525-584` (read and **write**) | -| Odin's own heartbeat (`HEARTBEAT_INTERVAL` 5 s, `main.rs:71`) | 0.2/s | the same path, through `publish_self_presence` `main.rs:422-427` | -| Provider ads and other documents restamped (voidbot.swarm about every 30 s, and others) | about 0.1/s | `persist_generic_document` | -| Projection refresh every 250 ms (`main.rs:72`, `:770-774`) | 4/s | `incarnation_keys(store)` `main.rs:486-489` (1 read), then per incarnation `refresh` (projection read, then `store.read`). A write only when facts change | -| Catalog queries (Hermodr, Idunn, probes) | on request | `stored_snapshot` `main.rs:509-543` (1 full read, then a projection read per presence) | - -- A correlation embeds the observed presence sequence and hash (`lib.rs:887-895`), so - `same_correlation_facts` (`lib.rs:1273-1282`) never dedupes a heartbeat. **Every heartbeat costs two - whole-store writes**: first the watermark, then the correlation. -- About 2.1 of the 5.0 writes per second are accounted for by Muninn and the other catalog documents, and about - 2.0 by heartbeats. The remaining 0.9 per second are refresh-driven correlation changes (dependency freshness - windows, O2 in the Idunn audit) plus writes that were not attributed. The two 1.5 MB records are not among the - catalog churn seen through the probe; their publisher and rate are unknown (Q2). -- Reads: about 30 whole-store decodes per second. Most are the 250 ms refresh (1 + N incarnations per pass), - and the rest are admission reads. - -### 1.4 What is in the store: truth, cache or projection? - -| Kind | Who owns the truth | Odin's role | Who reads Odin's copy | Must it be durable? | -|---|---|---|---|---| -| Provider catalog documents (ads, boundaries, profiles, media ads, schema catalog, surface_state) | the provider | relay cache | the Verse, via the catalog | yes, but not per write. Some publishers put once and never again (for example `heimdall.command_boundary`, whose `stored_at` is from 09-23), so losing the catalog on a restart would lose them. The CultMesh put has no application acknowledgement (`cultmesh-rs rudp_document_server.rs:464-482`), so a put promises the publisher no durability | -| `gamecult.eve.surface` and `surface_state`, 1.55 and 1.56 MB | unknown provider (Q2) | a cache **that can never be served**: a single-record snapshot is over the 1 MiB limit (Odin journal: "snapshot response is 1547739 bytes; limit is 1048576", and 1563575) | nobody can | no. They are 93% of the store's bytes and ride along in every rewrite | -| Runtime presences | the provider (signed) | admitted evidence with anti-replay (O5, O6) | the Verse; Odin's own sequence continuation (`main.rs:1184-1211`) | the latest per incarnation. The 30 s observation window (O6) bounds any replay after a lost write | -| Correlations and the publisher watermark | Odin | a **projection** of presence plus Idunn's projection | Idunn, lockless, from this same file (`--odin-correlation-store /var/lib/gamecult/odin/topology.cc`; Idunn `drivers.rs:5005-5030`) | the watermark must never let a *published* sequence repeat. "Published" means written to this file, because since batch 2 nothing else serves correlations. Both die at Idunn A3 and Odin O-R (`Idunn/docs/route-continuity-cut.md` section 4) | -| Presence history of withdrawn incarnations | nobody | retained on purpose (`withdrawn_expected_removes_current_correlation_but_preserves_presence_history`, `lib.rs:2814`) | only Odin's own sequence continuation reads it, and only Odin's own key | grows without bound with every deploy (follow-up F4) | - -## 2. Ends - -1. Odin reads its store once, at activation, and never again while it holds the write lease. Its working - state is in memory. -2. Odin writes its store at most once per flush interval, only when the content changed, as one atomic write - under the lock. A foreign write to the file is detected and ends Odin. -3. The store holds nothing Odin cannot serve. - -Invariants that must survive: -- One writer: the process-write lease (`main.rs:457-474`) is the only authority to write. Nothing writes after - the lease is lost. -- Idunn's crossing: until A3, Idunn reads correlations from `topology.cc` with - `pull_all_read_only_snapshot`. The path, the single-file `.cc` format and the atomic replace do not change. -- Correlation sequences never repeat, as published. -- One bad record never stops Odin. This now holds at load: records are skipped and logged, never fatal - (`dc46be2`). -- Presence anti-replay within an activation (O5). - -## 3. Identity, lifecycle, authority - -| Persistent kind | Named by | Over time | Decided by | -|---|---|---|---| -| catalog document | `(type, key)`, type from the schema id (`main.rs:1311-1326`) | replaced by each provider put; never deleted | the provider decides the content; Odin decides admission (allow-list `main.rs:1237-1264`, plus the size rule in Cut 3) | -| presence | `presence_store_key(incarnation, signer)` `lib.rs:1528` | replaced each heartbeat; kept after withdrawal (F4) | provider bytes, Odin's admission | -| correlation | incarnation key | replaced when facts change; deleted on withdrawal (`lib.rs:586-611`) | Odin; dies at O-R | -| watermark | target | only ever increases | Odin; dies at O-R | -| in-memory working set (new) | the same keys | loaded at activation, mutated per event, never reloaded while serving | Odin under the lease | -| flush (new) | none: one atomic snapshot | at most one per interval when dirty; one final flush on stop while the lease is held | Odin's serving loop | - -## 4. Cuts - -Subtraction cuts come before behaviour cuts. Each cut is its own branch and Soul pass. All verification runs on -Yggdrasil through the stopgap (`cargo test --locked -p odin-daemon` from the Odin root). - -### Cut 1. The file stops being working memory (Odin, subtraction) - -- **Repo/branch:** Odin `hands/odin-memory-store` from `44951a1`. Depends on nothing. -- **First:** a 60 s `/proc//io` sample of live Odin, plus the `ss -m` drop counter (section 6 script). - The numbers in 1.1 serve as the baseline if they are taken within a day. -- **Deletes first:** - - `lib.rs:432-648` `CultCacheOdinTopologyStore` (about 215 lines): every `pull_all_read_only_snapshot` and - CAS against the store file, and its four `CAS_ATTEMPTS` retry loops (`:453`, `:588`, `:614`, and the one - in `reconcile` at `:799`). With one writer under the lease, an in-memory compare-exchange cannot lose, so - the retry loops protect nothing. - - `main.rs:1266-1309` `persist_generic_document`'s file CAS loop. - - `main.rs:486-489`: the store half of `incarnation_keys` (the projection half stays). - - `main.rs:513-518`: `stored_snapshot`'s file read. - - `main.rs:1184-1211` `prior_self_publisher_sequence`'s file read (it becomes a query of the loaded set). -- **Keeps:** the `OdinTopologyStore` trait (`lib.rs:410-430`) as the mock point. `OdinTopologyAuthority` does - not change. -- **Adds:** one in-memory store owned by `RuntimeState`, keyed `(type, key)`, implementing `OdinTopologyStore`. - It is loaded once in `try_activate` (`main.rs:229-267`) after the lease is verified, with the locked - `pull_all`, and replaces the load's current callers. Legacy retirement (`main.rs:736`, - `retire_legacy_correlations` `lib.rs:452-478`) and the self sequence (`main.rs:201-208`) become operations on - the loaded set. Undecodable records are skipped and logged at load, as today. - - The projection is read **once per refresh pass**, not once per incarnation: `refresh_all_correlations` - `main.rs:476-501` builds one projection snapshot and hands it to each `refresh`. Name the type; - `IdunnProjectionSource` is already the port. - - Hands chooses whether the trait's `compare_exchange` stays or collapses into `read` plus `commit`. The rule - is that no path retries a CAS that cannot lose. -- **Not in this cut:** the write policy. At the end of Cut 1 every mutation still writes the whole file - immediately, now from memory: one read per write inside CultLib's compare, and no read otherwise. -- **Authority map:** - - Owner: `RuntimeState`'s in-memory set, under the process-write lease. - - Inputs: one locked read at activation; provider puts; Idunn's projection (read per pass). - - Outputs: the catalog, correlations, and the file (Cut 2 owns when). - - Derived state: the file is a durability checkpoint and Idunn's crossing. It is **no longer an owner** of any - decision while Odin serves. - - Forbidden writers: no second reader-as-authority. No code path in the serving loop may call - `pull_all_read_only_snapshot` or `pull_all` on `options.store`. - - Shared paths: provider presence, self presence, generic puts, refresh and catalog all mutate or read the one - set. - - Deletion line: the `lib.rs` file store and the `main.rs` file reads above are deleted before the memory store - is wired in. -- **Verification:** - - tests: existing behaviour tests keep passing. Tests that corrupt the store file **while Odin serves** - (`one_undecodable_incarnation_leaves_the_others_and_the_catalog_readable` `main.rs:2094`, - `records_that_do_not_decode_never_stop_the_catalog_or_startup` `:2341`) describe a second writer that the - lease forbids. Re-target them to "the bad record is in the file at activation". Do not delete them. - - new test: after activation, rewriting `topology.cc` behind Odin's back changes nothing Odin serves until - restart (pins the rule that the file is not working memory; a mutant that re-reads fails it). - - new test: N refresh passes perform 0 reads of the store file. Observe it where it is decided, with a - counting seam on the load path, or with an `strace`-free `/proc/self/io` delta in the scenario. - - negative: `rg -n "pull_all_read_only_snapshot|pull_all\(" crates/odin-daemon/src/main.rs` matches only the - runtime-bundle, anchor, lease and projection readers (`:1018`, `:1061`, `:1162`, projection), never - `options.store`. - - `cargo mutants --in-diff` on the cut's diff. -- **Estimate:** about -260 / +120 lines. - -### Cut 2. One coalesced write per interval, watermark folded in (Odin, behaviour) - -- **Repo/branch:** Odin `hands/odin-flush` from Cut 1. Needs Q3. -- **Deletes first:** the file half of `reserve_publisher_sequence` (`lib.rs:613-647`). Reserving becomes an - in-memory increment, and the mark lands in the same atomic write as the correlation that uses it. The ordering - comment at `lib.rs:922-926` and the trait doc at `:422-429` are rewritten: "published" means flushed. -- **Adds:** - - `FLUSH_INTERVAL` (1 s, Q3) in `main.rs:71-76`. - - A dirty flag. - - A `flush_if_due` step in `serving_pass` (`main.rs:764-781`). It checks `require_current_write_lease` - immediately before writing, then writes the whole set with - `compare_exchange_snapshot(last_flushed, current)`. A `false` result means the file changed under Odin, which - is a second writer: it is returned as `WriteLeaseLost` (or a sibling type that `survive` treats the same - way). - - One final flush on `SIGTERM`/`SIGINT` (`main.rs:740-743`), only if the lease is still current. -- **Authority map:** - - Owner: the serving loop's flush step decides when the file changes. - - Inputs: the dirty flag, the flush interval, and the current lease. - - Outputs: one atomic `.cc` snapshot. - - Derived: the watermark in the file is at least every sequence in the file. An in-memory sequence that was - never flushed was never published. - - Forbidden writers: `admit_presence`, `persist_generic_document`, `withdraw_correlation` and `reconcile` - never write the file. - - Shared paths: every mutation goes through the one flush. - - Deletion line: the per-mutation writes left by Cut 1 are deleted before the flush is added. -- **Verification:** - - test: 50 heartbeats and puts inside one interval produce exactly 1 file write (pins coalescing). - - test: no mutation produces no write (pins "only when dirty"). - - test: a lease withdrawn between mutation and flush produces no write and ends Odin (pins the one-writer - rule). Observe the file bytes, not a log line. - - test: a crash (drop the state without the stop flush) followed by a reload never republishes a sequence - that is in the file. In other words, the next correlation's sequence is greater than the flushed mark (pins - never-repeat under the new meaning of "published"). - - test: a foreign write between flushes ends Odin without overwriting it. - - Soul must falsify one question: does Idunn fence (stop) an incumbent Odin **before** it writes the - candidate's lease? If not, an incumbent can pass the lease check and flush after the candidate has loaded. - The race exists today as well; this cut must not widen it. - - `cargo mutants --in-diff`; at least one mutant must be a function of the interval, such as a scaled or - clamped interval. -- **Expected live effect:** at most 1 write/s (from 5.0), 2 fsyncs/s (from about 10), about 3.2 MB/s written - while the surfaces remain (from 16.2), and about 3.2 MB/s read (the compare inside the flush). -- **Estimate:** about -40 / +70 lines. - -### Cut 3. Nothing unservable is admitted (CultLib, then Odin) - -Needs Q1 and Q2. **Recommended form (Q1 A):** - -- **Owner:** CultLib `cultmesh-rs`. The document server admits a put of up to 4 MiB per session - (`rudp_document_server.rs:154-156` at `3bf1c0ce`) but can serve at most 1 MiB, so it accepts documents it can - never return. The fix belongs to the server, not Odin. Only `cultmesh-rs` has this server, so there is no - sibling-runtime parity work. -- **CultLib cut:** `hands/cultmesh-put-serve-bound` from CultLib `main`. `deliver_application_message` - `DocumentPutRaw` (`:464-482`) refuses, as an application rejection naming both sizes, any document whose - single-document `SnapshotResponseRaw` would exceed `max_snapshot_response_bytes`. It uses the same encoder - and limit as the snapshot path (`:543`), so the two can never disagree. Test: a put one byte over the bound is - refused and one at the bound is served. -- **Odin cut:** a pin bump, plus one step at activation: stored records that the served-size rule would refuse - are dropped from the loaded set and logged by type, key and size. The next flush removes them from the file. - Test: a store holding an oversize record activates, serves everything else, and the oversize record is gone - after the first flush. -- **Expected live effect:** store about 130 KB, at most 134 KB written per second, at most 7 ms of loop time - per second. -- **Estimate:** CultLib about +25 plus tests; Odin about +20. - -### Cut 4 (not recommended now). Per-document storage - -See section 5. Record it as a CultLib follow-up (F1), not an Odin cut. - -### Subtraction ledger (estimate) - -| Cut | Removed | Added | Formats and targets | -|---|---|---|---| -| 1 | about 260 | about 120 | none | -| 2 | about 40 | about 70 | none | -| 3 | 0 | about 45 (CultLib 25, Odin 20) | none | - -## 5. Append-only against per-document, answered - -Odin's data is *latest value per key*. About 60 small records (about 1 KB each) are overwritten at 0.1-0.5 Hz -each. Two large records change rarely or never. After Cuts 1-3 the remaining cost is at most one 130 KB -atomic write and two fsyncs per second. - -- **Per-document** fits this shape: an overwrite touches only its own record. CultLib has two: - - C#'s `DirectoryMessagePackBackingStore` (`cultcache.store.v4.directory-content-addressed-pages`: a small - hot manifest plus cold content-addressed pages). It is the reference format. - - cultcache-rs `RedbMessagePackBackingStore`. The probe measured 42.6 KB written and 5-9 ms per small-row - commit. - - After the cuts, this saves about 90 KB/s. The fsync count, which is the stall that matters, stays the same: - 1 per commit against 1 per flush. The costs: - - redb is not the `.cc` format, and it has no lockless read-only crossing. Idunn's read of the correlation - file would break until A3. - - The v4 directory store does not exist in Rust. That is a parity gap in CultLib (F1), not a reason for - Odin to grow one. -- **Append-only (log plus compaction)** fits journals: ordered history that consumers replay, such as - CultNetDatabase shard logs. For Odin, the log grows at the overwrite rate (about 5 records/s, several hundred - MB/day), so it needs compaction. Idunn's crossing would have to replay it, and it needs a new on-disk format - with byte parity across four runtimes. It buys Odin nothing that a keyed store does not. - - The capability is already owed elsewhere. The publication campaign recorded (MORNING log, 06:23 and - earlier) that CultLib's file log store "truncates then rewrites with no atomic rename, so an append-only - atomic store must exist before any live daemon turns durable shard logs on." - - That is CultLib's append-only consumer. Odin should not be its first one. - -**Recommendation:** Cuts 1-3 (subtraction), then stop. Take up per-document storage for Odin only if the flush -interval must shrink far below 1 s, or if large documents must live in Odin's store (Q1 B). In either case the -store comes from CultLib, as the Rust port of the v4 directory store, and never as an Odin-local helper. - -## 6. Verification after each deploy (disk IO) - -Run on Yggdrasil (read-only; it reads no store): - -```sh -pid=$(pgrep -x odin-daemon | head -1) -snap(){ sudo cat /proc/$pid/io | awk '/^(rchar|wchar|syscw):/{printf "%s ", $2}'; \ - sudo ss -lunpm | grep -A1 "pid=$pid," | grep -o 'd[0-9]*)' | tr -d 'd)'; } -a=$(snap); sleep 60; b=$(snap) -echo "$a" "$b" | awk '{printf "read %.2f MB/s write %.2f MB/s writes %.2f/s drops %d/min\n", ($5-$1)/60e6, ($6-$2)/60e6, ($7-$3)/60, $8-$4}' -cat /proc/pressure/io -sudo journalctl -u idunn-yggdrasil.service --since -1h --no-pager -o cat | grep -c "admitted odin route continuity: timed out" -``` - -| After | read MB/s | write MB/s | writes/s | drops, route timeouts | -|---|---|---|---|---| -| baseline (1.1) | 106 | 16.2 | 5.0 | 136,291 lifetime; 42 timeouts in 12 h, 0 in the last hour at 10:2x UTC | -| Cut 1 | at most 17 | about 16 (unchanged) | about 5 | should fall (loop no longer decodes about 30 times a second) | -| Cut 2 | at most 3.5 | at most 3.5 | at most 1.05 | at most 1 burst per hour; 0 timeouts over an hour | -| Cut 3 | at most 0.3 | at most 0.2 | at most 1.05 | 0 drops per minute on average | - -Also run the post-deploy catalog check (`scratchpad/odin-postdeploy-check.sh`, Soul 2026-09-30). It proves no -provider type stopped being served. After Cut 3 the two surface types are expected to answer with zero -records; update the check's type list in the same pass. - -## 7. Operator questions - -- **Q1. The two 1.5 MB Eve documents.** - - A: CultMesh refuses any put it could never serve, and Odin drops the stored ones at activation. Anyone who - needs big surfaces through Odin gets the content plane (BP-1 in Rust) as its own campaign. - - B: keep storing them, and move Odin to a per-document store (port the v4 directory store to Rust first) so - they stay cold. - - C: leave them, and accept about 3.2 MB per flush. - - **Recommended: A.** Nobody can read them today. They are 93% of the store and of every write. The server's - put and serve limits disagree, and A fixes that at its owner. -- **Q2. May Imagination or Soul decode a copy of `topology.cc`?** A read-only decode of a *copy*, as approved - for Idunn's `control.cc`, to name the two large records (key, `stored_at`, publisher) and count the presence - history (F4). The publisher's name decides who is told that their puts will be refused under Q1 A. - **Recommended: yes**, before Cut 3 lands. -- **Q3. Flush interval and durability.** - - A: 1 s. An Odin crash loses at most 1 s of catalog and presence changes. Providers republish, puts carry - no application acknowledgement, and no published correlation sequence can repeat. - - B: 250 ms. This means up to 4 flushes and 8 fsyncs per second. - - C: flush correlations immediately and everything else at 1 s. - - **Recommended: A.** It is one rule, and Idunn's correlation freshness window is 30 s. -- **Q4. CultLib parity: port `DirectoryMessagePackBackingStore` (v4) to cultcache-rs?** It is not needed by - Odin after Cuts 1-3. A reasonable consumer of the Rust runtime would expect the reference's store. - **Recommended: record it as CultLib follow-up F1 with no deadline.** It is independent of this map. -- **Q5 (2026-09-30, from Soul S-1). Where does the durable write run?** Today the serving loop runs the fsync, so - any disk stall stalls route challenges, catalog reads and every other put. - - A: a writer thread with group commit. - - The loop hands each accepted put to one writer thread. The writer writes and fsyncs everything queued since - its last write in one go, then the loop sends those puts' replies. - - Challenges and reads are never behind the disk. A stall delays only put replies, and Q3 B still holds (a - reply means durable). - - It needs cultmesh-rs to let a put handler reply later (a CultLib API change) plus one Odin thread. - - B: answer route challenges on their own path. Everything else still stalls, and the challenge would report - Odin healthy while its catalog is stuck. - - C: reopen Q3 and go back to the 1 s interval. That brings back lost acknowledged puts on a crash. - - **Recommended: A.** **RULED A by the operator, 2026-09-30: "agree on Odin writer thread".** Mapping is next - (Imagination): the cultmesh-rs deferred put reply, then the Odin writer thread with group commit. Mapped below in - "Q5 cut: the writer thread" (cuts C5, W0, W1; forks Q5-A and Q5-B). - -## Q5 cut: the writer thread - -**Imagination pass (Opus), 2026-09-30.** Maps the operator's ruling on Q5, "agree on Odin writer thread" (option A, -section 7). Anchors: -- Odin `hands/odin-write` at `434756e` (`crates/odin-daemon/src/main.rs`, `lib.rs`), CultLib pin `3bf1c0ce`. -- CultLib `hands/cultmesh-put-serve-bound` tip `e4e2a0b9` (`packages/cultmesh-rs/src/rudp_document_server.rs`). - Its merge base is `42ba0f08`, which already holds ack Cuts 1, 1b and 1c. -- CultLib `hands/ack-cutD` tip `e9d5ae2c` (lands on main first), and R1 batch 3 `hands/cultcache-read-failures` tip - `93ac5945` (`CultCacheStoreWriteFailed`). - -The mapping raises two forks, **Q5-A** and **Q5-B** (at the end of this section). Cuts C5 and W1 wait on Q5-A. - -**RULED, operator 2026-09-30: "Q5-A: A, but make a note of this for when we move on QUIC, Q5-B: A".** -- **Q5-A = A.** The server withholds the session's transport ACK until the put is answered. The wire is unchanged. - The note for QUIC (a put-result message) is in the QUIC campaign handoff. -- **Q5-B = A.** Puts are held during a writer stall, bounded by the existing session and byte limits. - -### Q5.1 Body facts (probed and read) - -**Probe O1, Odin `434756e` + scratch test, Yggdrasil slot 3 (`imag-q5-odin@31953c93`).** A test process holds the -store's sibling lock for 1,500 ms, the way Soul modelled a disk stall. Full serving passes run meanwhile. A route -challenge is sent at 200 ms, then a catalog read. - -| Case | Route challenge | Catalog read | -|---|---|---| -| nothing waiting to be written | served in **39 ms** | served in 29 ms | -| only Odin's own heartbeat waiting, and the interval write due | served in **1,342 ms** | 33 ms (sent after the release) | - -- No read path takes the store lock. At `434756e` the lock is taken only by `MemoryOdinTopologyStore::load` - (`lib.rs:509`, at activation) and by `flush` (`lib.rs:612` → `compare_exchange_snapshot`). -- The stall reaches the loop through **both** writes on it: a peer put (`main.rs:363`, Soul S-1) and the interval - write of Odin's own bookkeeping (`main.rs:933-941`). The interval write stalls the loop with no peer put at all. - So the bookkeeping write must move to the writer too, not only the put write. - -**The loop still reads two other files.** They are not the store and take no lock, but they are disk reads on the -loop: -- The lease file, on every route challenge and catalog read: `raw_snapshot` `main.rs:389-409` → - `require_current_write_lease` `:546-567` → `read_process_write_lease` `:1323` (`pull_all_read_only_snapshot`). -- Idunn's projection, on every catalog read (`:608`), refresh (`:572`) and heartbeat (`:524-544`). -- Both files are small and rewritten rarely by Idunn, so they are normally served from the page cache. Probe O1 - cannot show whether a real disk stall evicts them. Only the Yggdrasil rerun (Q5.6) can. If it does, the answer - is to hold the lease record in memory and re-check it where it is decided. That is its own follow-up, not this - cut. - -**What a put's reply is on the wire today.** CultNet has no put-acknowledgement message: the list in -`cultnet-rs/src/contracts.rs` has `document_put_raw` and `error.v0`, and no put result. -- A Rust publisher (`publish_cultnet_message_to_rudp_catalog`, `cultmesh-rs/src/lib.rs:871-924` at `e4e2a0b9`) - succeeds when its reliable packet is acknowledged by the RUDP transport, and fails on a `cultnet.error.v0`. - - Its default `flush_timeout` is 300 ms, with a resend every 50 ms (`:144-157`). -- The document server sends that acknowledgement at the end of `poll_once`, after the sink returns - (`rudp_document_server.rs:468-476`). A refusal ends the session with an Error frame that acknowledges nothing - (`end_rejected_session` `:760-793`, put-serve branch). -- **So today the put's reply is the transport acknowledgement.** That is how Q3 B's "an ACK means durable" holds: - the sink writes before it returns. - -**Every packet a session sends carries acknowledgement fields** (`ack`, `ack_mask`, from `ack_state`, cultnet-rs -`rudp.rs` at main). -- The fields report every *received* reliable sequence, not only delivered ones. -- `create_packet` stamps them on each new packet: data, Pong, the end-of-poll Ack. -- A reliable packet is stored with the fields it was created with, and resent unchanged (`track_reliable`, - `due_resends`). - -Probes P1-P4 (cultnet-rs sessions at `e4e2a0b9`, scratch test `imag_q5_probe.rs`, Yggdrasil, `imag-q5-cultlib@8dcfe36a`): - -| # | Case | Result | -|---|---|---| -| P1 | two pipelined ordered puts, the first lost | the second is delivered to nobody, yet `create_ack` acknowledges it. **S-5 is still open after ack Cuts 1-1c.** `ack_state` at main is the same code, so the ack map's to-do resolves to "not closed by the pin bump" | -| P2 | a put delivered, then a Ping | the Pong acknowledges the put | -| P3 | the resend of a reply created **before** the put | does not acknowledge it | -| P3 | a reliable reply created **after** the put | acknowledges it, and so does its resend | -| P4 | a retransmit of a delivered put | not delivered again (the server's end-of-poll ack still answers it, `:468`) | - -Consequence for a reply sent later: holding back only the end-of-poll ack is not enough. -- A Pong, or a snapshot response created on the same session after the put arrived, acknowledges the put too. -- The snapshot response keeps doing so on every resend, even if its first copy were patched. -- So a session with a put awaiting its answer must be **sent nothing created after that put arrived**. Resends of - earlier packets are safe: they carry the fields they were created with. - -**The other runtimes (parity).** -- **TS** (`cultmesh-ts/src/index.ts:5891-5914` at `e4e2a0b9`): - - It acknowledges each packet at receipt (`createAckForReceived`), before the handler runs. - - It runs each session's frames through one promise chain (`record.work`), so handling is serial per session. - - `onDocumentPutRaw` may return a Promise and an application-level receipt document, which is sent when it - resolves (`:5951-5972`). - - So TS already "replies later", but at the application level, and its transport ack does not mean handled. -- **Python** (`cultmesh-py/src/cultmesh_py/server.py:407`, `_handle_raw_put` `:415`): the handler is synchronous - and returns its responses. -- Neither has a durability meaning for its ack. Parity is follow-up **F-Q5a** (Q5.8). - -**Consumers of the sink trait** (`CultMeshRudpRawDocumentSink`): -- Odin's `SinkHandle` (`main.rs:168-172`). -- Ratatoskr's catalog test (`Ratatoskr/crates/ratatoskr-core/tests/catalog.rs:29`). -- CultLib's own tests, which use closures through the blanket impl (`rudp_document_server.rs:60-67`). -- Vendored copies (StreamPixels, Heimdall) do not implement it. - -**cultcache-rs write outcome (R1 batch 3, `93ac5945`).** -- Every failed single-file write carries `CultCacheStoreWriteFailed { kind: NotReplaced | ReplacedNotDurable }`. -- Any other error from `compare_exchange_snapshot` (lock, read, decode, validation) comes before the write step, - so the file is unchanged. -- One hole: `with_exclusive_lock` (`cultcache-rs/src/lib.rs:924-932` on that branch) returns the **unlock** error - after a write that succeeded, with no marker. Odin would read that as "not replaced". Its next write would then - find its own snapshot and report `ForeignStoreWrite`, and Odin would end. - - That is rare (unlock failing), and it belongs to R1: follow-up **F-Q5b**, not this cut. - -### Q5.2 Target shape - -1. **CultLib (cut C5).** A put's sink may answer later. - - While any put of a session awaits its answer, the server sends that session nothing new. - - The one exception is resends of packets created before the put arrived. - - A snapshot request behind the pending put waits in the session's order. - - An accepted answer releases one ordinary acknowledgement. - - A refusal ends the session with the Error frame the put-serve branch sends. - - The wire does not change, and existing publishers keep "acknowledged means the sink accepted", which for Odin - is durable (Q5-A). -2. **Odin (cut W1).** One writer thread owns the store file after activation. - - The loop owns the working set, decides when to write, and answers put replies from the writer's outcomes. - - Every put accepted while a write is in flight is covered by the next single write (group commit). - - Route challenges and catalog reads never wait on the writer. -3. **Odin (cut W0), before W1.** - - A pin bump. - - S-2: a `served_record` override so Odin's admission is exact. - - S-3: the `attempted` list dies, because the typed write outcome says what the file holds. - -### Q5.3 Identity, lifecycle, authority - -| Kind | Named by | Over time | Decided by | -|---|---|---|---| -| pending put (CultLib) | a server-minted `u64` put id, unique for the server's life, never reused across session generations | created when an admitted put is offered to the sink; ends when it is answered, or when its session ends (the answer is then discarded) | the sink answers; the server alone sends | -| put reply handle (CultLib) | the put id, inside a `CultMeshRudpPutReply` | owned by whoever the sink hands it to; consumed by `accept` or `refuse`; dropping it unanswered refuses | the sink's owner | -| working-set version (Odin) | a `u64` counter in `MemoryOdinTopologyStore` | +1 on every mutation that changes a record; never reset within an activation | the loop | -| written-through version (Odin) | a `u64` in `RuntimeState` | raised only by a writer outcome `Written { version }` | the writer's outcome, applied by the loop | -| write request (Odin) | its version | at most one in flight; replaced by nothing (the next request is built when the outcome arrives) | the loop submits; the writer executes | -| what the file holds (Odin, `flushed`) | none: one snapshot | set at activation from the load; replaced on `Ok(true)` and on `ReplacedNotDurable` | the writer alone | - -"Dirty" stops being a flag (`lib.rs:502`, `dirty: Cell`): it is derived as `version > written_through`. - -### Q5.4 Cuts - -#### Cut C5. A put's sink may answer later (CultLib, cultmesh-rs, behaviour) - -- **Repo/branch:** CultLib `hands/cultmesh-put-reply-later` from `main` after the put-serve branch merges (Q5.7). - Anchors below are at put-serve `e4e2a0b9`; they move by Cut D's diff (Q5.7 names the conflicts). -- **Deletes first:** the synchronous sink call and its error mapping in the put arm, `rudp_document_server.rs:621-633` - (they are replaced, not wrapped). Nothing else is deleted. -- **Public API** (default D-1 below): - - ```rust - pub trait CultMeshRudpRawDocumentSink { - /// Answer through `reply` now or later, from any thread. - fn accept_raw_document(&mut self, receipt: CultMeshRudpRawDocumentReceipt, reply: CultMeshRudpPutReply); - } - // Closures keep working and answer at once: - impl Result<()>> CultMeshRudpRawDocumentSink for F { .. } - - #[must_use] pub struct CultMeshRudpPutReply { /* put id, Sender to the server */ } // Send, !Clone - impl CultMeshRudpPutReply { - pub fn accept(self); - pub fn refuse(self, reason: impl std::fmt::Display); - } - // Drop without an answer refuses: "the put was not answered". - ``` - - - `CultMeshRudpRawDocumentReceipt` (`:37-43`) is unchanged; the reply is a separate argument, so the receipt stays - `Clone + PartialEq`. - - `CultMeshRudpPollOutcome` (`:286-290`) is unchanged. A later refusal is returned as `ApplicationRejected` with - `SinkRefused(reason)` from the `poll_once` that sends it. -- **Server changes, `rudp_document_server.rs`:** - - `CultMeshRudpDocumentServer` (`:303-311`) gains: - - The answer channel (`std::sync::mpsc`: the server keeps the receiver, each reply holds a sender). - - `answered: VecDeque`, the answers taken off the channel and not yet handled. - - A next put id. - - `pending: BTreeMap`. - - `SessionEntry` (`:292-297`) gains `pending_puts: BTreeSet` and `waiting: VecDeque<(u32, CultNetMessage)>`, - the delivered frames that may not be answered yet. - - **One predicate owns "withheld":** `fn acknowledgement_withheld(&self, key) -> bool`, true while - `pending_puts` is non-empty. The S-5 fix, if the ack map takes it here, adds its clause to this function and - nowhere else. - - `poll_once`: - - Drain answers first (before `maintain`, `:366`). Each answer is looked up in `pending`; an unknown id (its - session ended) is discarded. - - Refuse → `end_rejected_session(key, reason)`, and return one `ApplicationRejected`. Further answers stay in the - channel for the next poll. - - Accept → remove the id. When the session has none left, it is released: send its ack (the rule for which - poll sends it is under the put arm below), then handle `waiting` in order. - - `:436-438`: a `result.reply` (Pong) is not sent while withheld. - - `:468-476`: the end-of-poll ack is not sent while withheld. - - `deliver_application_message` (`:565`): - - Put arm (`:572`): admission is unchanged (put-serve `:587-619`). Then mint the id, record it, and call the sink - with a reply. - - `poll_once` looks at answers again after the delivered-frame loop (`:445-466`), before the end-of-poll ack, - but handles only those for this poll's session. The rest stay queued for the next poll's first step. (Answers - move from the channel into one server-side queue, so they can be taken selectively.) A sink that answered at - once is therefore acknowledged, or refused, in the same poll with the same datagrams as today, and another - session's refusal can never cut this session's ack short. - - A release sends `create_ack()` from the drain, except for the session whose packet this poll is handling: - that session gets its ordinary end-of-poll ack, so a synchronous sink's datagrams stay exactly as they were. - - Snapshot arm (`:634`): if the session is withheld, push the request onto `waiting` and return; otherwise - answer as today. - - A put that arrives while `waiting` is non-empty also queues, so a session's frames are handled in order. A - put behind another put that is only pending is offered at once, so pipelined puts can share one write. - - Session end, wherever a session is removed (`:441`, `:486-489`, `:523`, `end_refused_session`, - `end_rejected_session`, Cut D's `end_unsendable_session`): remove its ids from `pending`, so their answers are - discarded. - - **Put this in one `remove_session(key)` helper, so no removal path can forget it.** It is the one new helper - the cut earns: there are six removal sites today. - - Doc comments: the struct doc (`:300-302`, "no background thread") stays true. The sink trait doc says what - "acknowledged" means: the sink accepted. -- **Authority map:** - - Owner of what the peer is told about a put: the server, and only through `poll_once`. The sink decides accept or - refuse; it never sends. - - Inputs: sink answers (channel); transport receipts. - - Outputs: one ack per release; one refusal per refused put's session. - - Derived: "withheld" is derived from `pending_puts`; it is not a flag. - - Forbidden writers: - - No send path to a withheld session except `maintain`'s resends. - - The sink must not be able to acknowledge by returning. The return type carries no answer, so this holds by - construction. - - Shared paths: a synchronous closure sink and a deferred sink answer through the same reply and the same drain. - There is no second code path for "answered at once". -- **Verification (CultLib, Yggdrasil):** - - Wire-level test, the observer layer: a raw client socket records every datagram the server sends to its session. - - With the reply held across at least five resend intervals, including a Ping and a snapshot request on that - session, no datagram acknowledges the put's sequence. - - After `accept()`, the next poll sends an ack that does, and then the snapshot response. - - Mutations that must fail it: sending the end-of-poll ack regardless; sending the Pong; answering the snapshot - request at once. - - Another session's snapshot request is answered while the first session's put is held (the loop is not blocked). - - `refuse()` and dropping the reply: the peer receives `cultnet.error.v0` and a goodbye, and nothing acknowledges - the put (reuse the put-serve refusal assertions). - - Two pipelined puts on one session, each with its own held reply: - - Answering the second first releases nothing. - - Answering the first then releases one ack that covers both. - - This pins that a later put's acknowledgement never leaves before an earlier one's. - - Session ends while held (peer Disconnect; a new Connect from the same key): a later `accept()` sends nothing to - the new generation, and `pending` is empty. - - Closure sink: the datagram sequence is byte-identical to the pre-cut server for accept and refuse. This pins that - the synchronous path did not change. - - An unservable put is refused before the sink sees it: the sink is never called and no reply is minted. - - `cargo mutants --in-diff` on the cut's diff; every survivor is triaged. -- **Estimate:** about +170 source, -15 source, +350 tests. No new target, dependency or wire field. - -#### Cut W0. Pin bump, exact admission and the one-candidate store (Odin, subtraction first) - -- **Repo/branch:** Odin `hands/odin-write-w0` from `hands/odin-write` (`434756e`, or batch 4's tip). It bumps the - CultLib pin to the main commit holding Cut D, put-serve, R1 batch 3 and C5 (Q5.7). -- **Deletes first:** - - `attempted` (`lib.rs:494-499`, `:525`), the retry loop over it in `flush` (`:619-625`) and its push (`:628-633`). - - The tests that describe a file holding some older failed attempt: - - `a_write_that_failed_before_replacing_keeps_every_earlier_attempt_odins` (`lib.rs:2172`). - - `the_file_may_hold_a_later_failed_attempt_not_only_the_first` (`:2205`). - - Each models a `NotReplaced` failure that nonetheless changed the file, which the typed outcome now rules out. -- **Changes:** - - `flush` (`lib.rs:612-640`) matches the error's `CultCacheStoreWriteFailed` kind (`downcast_ref`): - - `ReplacedNotDurable` → `flushed = current`, and the store stays dirty so the next write re-syncs. - - Anything else → no change. - - `a_write_that_failed_after_replacing_the_file_is_not_another_writer` (`:2141`) is re-targeted to inject - `ReplacedNotDurable` as the real outcome, not a hand-made replace. - - `a_failed_write_is_made_by_the_next_without_another_change` (`:2118`) stays. - - **S-2:** Odin's `SnapshotHandle` (`main.rs:174-181`) overrides `served_record`. It builds the envelope as - `persist_generic_document` (`:1462`) would store it, then serves it through `peer_document` (`:1400`), the - function `drop_unservable_documents` (`:1428`) sizes with. Admission and activation then use one sizing. - - A runtime-presence put keeps the default (as received). Presences are served in `public_document`'s shape and - are never near the bound, and `drop_unservable_documents` does not check them either. - - A schema that `persist_generic_document` would refuse returns an error, which the server turns into a - refusal before the sink. - - `accept_raw_document`'s doc (`main.rs:332-351`) drops its S-5 paragraph; it moves to W1's writer doc. -- **Authority map:** what the file holds is decided by the one write outcome, not by a list of guesses. - `ForeignStoreWrite` means exactly "a snapshot Odin did not write". -- **Verification:** - - Test: a `ReplacedNotDurable` failure, then a change, then a write → made over the failed snapshot. - - Test: a `NotReplaced` failure, after which another writer puts the failed snapshot into the file → `ForeignStoreWrite`. - Mutation: keeping a candidate fails it. - - Test: 1,000 failed writes leave nothing retained. This pins S-3; observe the store's retained records, or the - absence of the field. - - S-2 test: a 1.2 MB put is refused as `DocumentUnservable` and is not in the working set. - - Mutation: sizing with the received record instead of `peer_document` survives nothing. - - Negative: `rg -n attempted crates/odin-daemon/src` matches nothing. - - The pin bump carries ack Cuts 1-3 and D into Odin. The full Odin suite runs on Yggdrasil, and Soul reads this cut - as a transport change, not only a subtraction. -- **Estimate:** about -150 (including the two tests) / +60. - -#### Cut W1. The writer thread (Odin, behaviour) - -- **Repo/branch:** Odin `hands/odin-writer` from W0. -- **Deletes first:** - - `MemoryOdinTopologyStore::flush` (`lib.rs:602-640`), its `path` (`:490`) and `flushed` (`:493`) fields, and the - `dirty` flag (`:502`, `:600-602`). - - `RuntimeState::flush` (`main.rs:317-330`). - - The `self.flush()?` in `accept_raw_document` (`main.rs:363`). - - `stop`'s direct write (`main.rs:891-898`). - - The flush step of `serving_pass` (`main.rs:933-941`). - - No path is left on the loop that can write the file. That holds before the writer is added. -- **Keeps:** - - `MemoryOdinTopologyStore::load` (`lib.rs:509`): the one locked read, at activation, on the loop, before any writer - exists. `load` returns the loaded snapshot beside the store, to become the writer's `flushed`. - - `ForeignStoreWrite`, `WriteLeaseLost`, `survive` (`main.rs:979-994`), unchanged in meaning. -- **Adds, `crates/odin-daemon/src/writer.rs`** (a module, not a crate): - - `StoreWriter`: `spawn(file, flushed, lease) -> StoreWriter`, `submit(WriteRequest)`, - `try_outcome() -> Option` and `finish(self)`. - - The channel is `sync_channel(1)`. The loop submits only when nothing is in flight, so `submit` never blocks. - - `WriteRequest { version, records }`. - - `WriteOutcome { version, result }`, where `result` is one of `Written`, `Failed(text)`, `Foreign` or - `LeaseLost(text)`. - - The thread: - - Checks the lease (the check extracted from `require_current_write_lease` `main.rs:546-567` into a free - function that the loop and the writer share), then `compare_exchange_snapshot(flushed, records)`. - - Applies W0's outcome rule to `flushed`, and sends the outcome. - - It never touches reply handles, the working set or the socket. - - Mock point: the thread writes through a one-method trait `StoreFile { compare_exchange_snapshot }`, implemented - for `SingleFileMessagePackBackingStore`. Tests gate it and count it. The lock-hold (Soul's method) is used where - the real file must be on the path. -- **Changes, `main.rs`:** - - `RuntimeState` (`:141-161`) gains `writer: Option` (spawned in `try_activate` after the load, - `:284-305`), `written_through: u64`, `in_flight: Option` and `replies: VecDeque<(u64, CultMeshRudpPutReply)>`. - - `SinkHandle::accept_raw_document` (`:168-172`) takes the reply. - - `RuntimeState::accept_raw_document` (`:352-367`): - - Validates and mutates as today. - - Pushes `(store.version(), reply)`, or accepts at once when `version <= written_through` (nothing new to make - durable). - - Refuses through the reply on a validation error. - - Submits if nothing is in flight. - - A new `serving_pass` step, in place of `:933-941`, run every pass: - - `try_outcome`. On `Written { v }`: `written_through = v`, and accept every reply with version `<= v`, in queue - order. - - On `Failed`: refuse the replies with version `<= v`; they remain in the working set (refusal runs one way, as - documented at `:344-350`). - - On `Foreign` / `LeaseLost`: return the error to `survive`, which ends Odin. - - Then, if nothing is in flight and `version > written_through`, submit when a reply is waiting or when - `FLUSH_INTERVAL` is due. - - So puts never wait for the interval; bookkeeping-only changes do. - - `stop` (`:894`): - - If the lease is still current and anything is unwritten or in flight, wait for the in-flight outcome, submit the - rest, and wait for that outcome too. This is a blocking wait; it is the only one, and it happens only on the - way out. - - Answer the replies, run one `poll_server` so the acks leave, then `finish` (drop the sender and join the - thread). - - After `WriteLeaseLost` or `ForeignStoreWrite`, write nothing. Dropping the replies refuses them. - - `FLUSH_INTERVAL`'s comment (`:73-77`) and the store's doc (`lib.rs:484-488`) say: the writer thread owns the - file; puts are covered by the next write; bookkeeping waits for the interval. -- **Authority map:** - - Owner of the store file after activation: the writer thread, the only holder of a - `SingleFileMessagePackBackingStore` for the store path. It also owns what the file holds (`flushed`). - - Owner of the working set, of when to write, and of put replies: the loop (`RuntimeState`). - - Inputs: - - Writer: one request at a time, and the lease file. - - Loop: provider puts, Idunn's projection, the lease file, and writer outcomes. - - Outputs: one atomic `.cc` snapshot per request; one outcome per request; replies answered in version order. - - Derived state: - - `dirty` is derived (`version > written_through`). - - `flushed` is no longer the loop's; it lives only in the writer. - - The interval decides only bookkeeping-only writes. - - Forbidden writers: no loop code path calls `compare_exchange_snapshot`, takes the store's lock, or answers a - put reply before the outcome covering its version. - - Shared paths: peer puts, self-presence, refresh, activation-time drops and the stop write all mutate the working - set, and reach the file only through `submit`. - - Deletion line: every loop-side write (above) is deleted before `writer.rs` is added. -- **Batching rule, stated once.** The loop keeps at most one write in flight. Everything that changed while it was in - flight, puts and bookkeeping alike, goes into the next request as one snapshot of the working set. N puts accepted - during one write cost one more write and one fsync pair, not N. -- **Backpressure** (Q5-B, recommended: hold): - - A stalled writer holds put replies. The loop keeps serving, and the working set keeps admitting (the catalog - serves admitted-not-durable puts, as it does today after a failed write). - - The queue is bounded by the server's existing limits: 64 sessions and 32 MiB of admitted payload. It adds no new - bound. - - A publisher that stops waiting (the Rust default is 300 ms) disconnects. Its session ends, its answer is - discarded, and its put is still written by the next write. That is what a publisher sees today during a stall, - minus the stalled challenges. -- **Ordering.** - - Replies are answered in version order from one queue, and the server sends acks in answer order. - - Within a session, C5 releases one ack only when every pending put of the session is answered. - - So no later put's reply leaves before an earlier one's. -- **Crash mid-batch.** - - The write is one atomic replace, so the file holds the old snapshot or the new one. - - No reply of a batch is answered before its `Written` outcome, so a SIGKILL anywhere loses no acknowledged put. - - A crash after the rename but before the directory sync is `ReplacedNotDurable` if the process lives; if it dies, - nothing of that batch was acknowledged. -- **Activation.** The store is read once, by `load`, before the writer is spawned. While the writer lives, the loop - never reads the file (Cut 1's rule, unchanged). -- **Verification (Odin, Yggdrasil):** - - **Loop latency under a stall.** This pins Q5's ruling; it is Soul's S-3 probe and O1, inverted into assertions. - - Hold the store's sibling lock for 1,500 ms, with a provider put in flight and Odin's heartbeat dirty with the - interval due. - - A route challenge and a catalog read are each served within 200 ms. The put's publisher sees no ack until the - lock is released, and then does, with the put on disk. - - Mutation that must fail it: running the write synchronously on the loop, by calling the `StoreFile` directly - from `serving_pass`. - - **Group commit.** Gated `StoreFile`, held on the first write, with 10 puts from 10 publishers accepted meanwhile. - - After release, exactly 2 writes are made and all 10 publishers are acknowledged. - - Mutation: one request per put gives 11 writes. - - **Ordering.** Gated `StoreFile`; put A's write is held and put B arrives. - - B's publisher is not acknowledged before A's; the answer order is observed at the server's answer channel. - - Mutation: answering the queue from the back. - - **Durability.** `daemon_process.rs`, extending `an_acknowledged_put_survives_sigkill` (`:326`). - - 20 rounds, each a stream of puts from 4 publishers while the test holds and releases the store's lock at random - offsets. SIGKILL at a random offset. - - Every put its publisher saw acknowledged is in the file after the kill. - - Mutation: accepting replies at submit instead of at `Written`. - - **One writer.** With the writer's `StoreFile` gated shut, N serving passes, a heartbeat and a stop request make no - write from the loop: the file's identity (`file_identity`, `main.rs:3343`) is unchanged until the gate opens. - - Negative grep: `rg -n "compare_exchange_snapshot|pull_all\(" crates/odin-daemon/src` matches only `writer.rs`, - `load` and the tests. - - **Lease lost with a write queued.** No write is made, Odin ends, and the queued replies are refused. The file's - identity is unchanged. - - **Foreign write.** Odin ends without writing over it (existing `:3696`, re-targeted through the writer). - - **Stop.** SIGTERM with a put held behind the lock: after the release Odin writes, the publisher is acknowledged, - and it exits 0. With the lease lost, it writes nothing. - - Re-targeted, not deleted: `changes_inside_one_interval_are_one_write` (`:3356`, now bookkeeping-only), - `a_put_is_written_before_it_is_accepted` (`:3389`, observed at the publisher's ack), - `a_put_whose_write_is_not_made_is_refused` (`:3516`), and the `ending_*` tests (`:3728-3800`). - - `cargo mutants --in-diff` on the cut's diff. -- **Estimate:** about -120 / +230 source, +300 tests. One new module, one thread, no new crate, dependency or target. - -### Q5.5 What stays on the loop, and what does not - -| Path | Before (`434756e`) | After W1 | -|---|---|---| -| route challenge (`raw_snapshot`, exact self query) | lease-file read, sign; blocked behind any write on the loop | the same reads; never behind a write | -| catalog read (`stored_snapshot`) | working set, projection read | unchanged; never behind a write | -| peer put | mutate, then write and fsync on the loop | mutate, queue the reply, submit; the reply is sent after `Written` | -| heartbeat, refresh | mutate; the interval write on the loop | mutate; the interval write on the writer | -| store lock | taken by `flush` on the loop | taken only by `load` (activation) and the writer | - -### Q5.6 What only Yggdrasil can show - -- **Rerun Soul's ABBA** (`soul-c3/latency_cmd.txt`: `soul_loop_stall_under_live_put_rate`, base against cut, in - interleaved rounds, with `/proc/pressure/io` before and after each). - - The base is `434756e`; the cut is W1's tip. Expect route-challenge p99 to stop tracking IO pressure, while put - round trip p99 still does. - - Soul's figures at `434756e` and its base over 8 rounds, under 5-38% pressure: challenge p99 310-2,129 ms, put - round-trip p99 1,121-2,593 ms (`soul-c3/latency.log`). -- Whether the loop's remaining disk reads (the lease and projection files) ever stall under real pressure. The ABBA - run shows it as challenge p99 outliers that coincide with pressure; if they appear, open the lease-in-memory - follow-up. -- After deploy, section 6's script, plus the count of "admitted odin route continuity: timed out" per hour. - -### Q5.7 Sequencing (recommended order) - -1. **Cut D merges to CultLib main** (already slated first). -2. **The put-serve branch rebases onto it and merges.** The conflicts: - - Cut D changes `send_packet` to return `Option` and adds `end_unsendable_session`. - - Its snapshot-send failure builds `reason: format!(..)`, where the put-serve branch made `reason` a typed - `CultMeshRudpRejectionReason`. It needs a variant (for example `ResponseSendFailed(String)`), and the put-serve - Hands owns it. - - Both branches edit `poll_once`'s ack site (`:468-476`) and `end_rejected_session`. -3. **R1 batch 3 merges** (cultcache-rs only; no conflict with 1-2). -4. **C5 is cut from that main** (it rewrites the lines 1-2 touched, so it goes after them), then Soul, then merge. -5. **One Odin pin bump to that commit, as W0**, carrying S-2, S-3 and the transport cuts. Then **W1** on top. - -W0 may start on the commit after step 3 if C5 slips, at the cost of a second bump before W1. One bump is recommended: -each bump moves Odin across ack Cuts 1, 1b, 1c, 3 and D, and a single Soul pass over that transport delta is cheaper -than two. - -### Q5.8 Follow-ups this map does not own - -- **F-Q5a (parity).** TS and Python acknowledge a put at receipt, and TS's reply-later is an application receipt. - - Either they adopt C5's rule ("acknowledged means the sink accepted"), or the QUIC campaign defines an - application-level put reply for every runtime. - - QUIC has no transport ack an application can read, so it needs one anyway. Recommended owner: the QUIC campaign. - Rust C5 is then the RUDP-era contract, and TS's receipt is the seed of the QUIC shape. -- **F-Q5b (R1).** `with_exclusive_lock` returns an unlock error after a successful write, with no write-outcome - marker (`cultcache-rs/src/lib.rs:924-932` at `93ac5945`). Odin would call its own next write foreign. Fix it in - cultcache-rs: tag it, or ignore the unlock error, since dropping the file releases the lock. -- **S-5 interface.** C5 adds `acknowledgement_withheld` as the one place that decides "send no ack to this session". - The ack map's S-5 decision (probe P1) plugs in there as a second clause if it is fixed in the document server. C5 - does not fix S-5. - -### Q5.9 Subtraction ledger (estimate) - -| Cut | Removed | Added | Targets, dependencies, wire | -|---|---|---|---| -| C5 (CultLib) | ~15 | ~170 source, ~350 tests | none; sink trait signature changes (Odin, Ratatoskr test) | -| W0 (Odin) | ~150 (the `attempted` list and 2 tests) | ~60 | pin bump | -| W1 (Odin) | ~120 (every loop-side write) | ~230 source, ~300 tests | one module, one thread | - -Net source is positive: about +175. It buys the ruled capability (challenges and reads independent of the disk, with -Q3 B kept), and it removes S-3's unbounded list. - -### Q5.10 Operator questions and defaults - -- **Q5-A. What does a put's reply mean on the RUDP wire once it can come later?** - - A: the document server withholds the transport acknowledgement until the sink answers. Nothing created after the - put is sent to that session until then. The wire is unchanged, and every existing publisher (Rust - `publish_cultnet_message_to_rudp_catalog`, TS and Python publishers) keeps "acknowledged means accepted", which - for Odin is durable. - - B: a new CultNet message, a put result, sent after durability; the transport ack means received. This is a wire - change in the C# reference and four runtimes. Every Odin publisher that waits for the transport ack today must - be changed to wait for it; until then Q3 B silently weakens to "received". - - **Recommended: A.** It keeps Q3 B for every publisher with a server-only change, and RUDP is frozen except for - crash and data-loss fixes. B is the right shape under QUIC (F-Q5a), not a reason to change the RUDP wire now. - - What depends on it: C5's whole design. - - A also narrows the ack map's Q-A2 meaning for the document server: acknowledged means delivered *and answered*. - That was already true of the synchronous sink. -- **Q5-B. A writer stalled for seconds: hold put replies, or refuse with a typed error?** - - A: hold. Replies wait, bounded by the server's session and payload limits. Publishers time out on their own - clock, and the put is written when the disk returns. - - B: refuse once more than N replies wait or the oldest waits longer than T. This needs a new `cultnet.error.v0` - code (the error-contract map owns the registry) and two tunables. - - **Recommended: A.** A refusal ends the publisher's session exactly as its own timeout does, but adds a code and - two numbers, and it tells the publisher less than the truth: the put may still become durable. B earns its place - only if publishers ever wait without a timeout. -- **Default D-1 (Self, overridable). The API is a completion handle** (`CultMeshRudpPutReply`: `accept`, `refuse`, - and Drop refuses). - - The alternatives were a token with `server.answer_put(token, result)`, and a reply method keyed by session and - message id. - - Keying by session and message id is ambiguous: message ids are publisher-chosen, and a reconnect reuses the - session key. - - A token cannot be answered from another thread without routing it back to the server, and a forgotten token - leaves a session withheld until it ends. - - The handle is the Rust expression of TS's Promise-returning `onDocumentPutRaw`, and it keeps closure sinks - source-compatible. - -## 8. Related findings - -**Shared cause (folded in above):** -- **Route-challenge timeouts and the socket backlog.** The single-threaded loop blocks for 36-55 ms per - whole-store write, five times a second, and longer under IO pressure. Cuts 1-3 remove this. The 42 in 12 h - now (against about 1,100 in the audit) is consistent with the verify slots being cut from 8 to 5. Cut 2's - check measures it directly. -- **Eve surfaces over 1 MiB.** Cut 3 handles the storage side. *Serving* large surfaces is the content-plane - follow-up (F2). - -**Separate follow-ups (not caused by the write pattern):** -- **F1** CultLib: cultcache-rs lacks the C# v4 directory store (Q4). -- **F2** Eve surfaces larger than 1 MiB need the CultMesh content plane (BP-1 exists in Rust). This is a - campaign for whoever publishes them (Q2). -- **F3** `surface:gamecult.network.status` has had no publisher since the Node coordinator retired (09-11). - Gjallar (`Program.cs:562-592`), Hermodr, Mimir and VoidBot read it. The owner question (Odin's own Eve - surface or someone else's) is its own map. -- **F4** Presence history of withdrawn incarnations is never pruned (`lib.rs:2814` pins its retention). Only - Odin's own sequence continuation reads it, and only for Odin's own key. The store grows with every deploy. - Needs Q2's count, then a retention rule. -- **F5** Muninn republishes three catalog documents every 2 s with a fresh `updated_at` (Muninn `main.rs:101`, - `:3263`). Liveness belongs in its presence, not in catalog documents. After Cut 2 this costs Odin nothing - durable, but it is still traffic. -- **F6** Yggdrasil keeps 389 `idunn-odin-*` unit residues, nearly all `failed` (`systemctl list-units - 'idunn-odin*' --all`). They belong to Idunn and systemd, not to this map. -- **F7** `accept_raw_document` (`main.rs:269-280`) checks `activated()` but not the *current* lease before - mutating. Cut 2 moves the lease check to the only write, which closes this for the file. Soul should confirm - that nothing else acts on a lost lease. - -## C5 status (2026-10-01) - -**Hands done, Soul not yet run.** Drain mode: Soul waits for the operator's go. - -- **Branch:** CultLib `hands/cultmesh-deferred-put-reply`, commits `08e0c229..d708247e`, based on `9dcb3aa1`. -- **Mechanism:** the sink answers through `CultMeshRudpPutReply` with `accept()` or `refuse(reason)`. Dropping the reply unanswered refuses with `UNANSWERED_PUT_REASON`. `acknowledgement_withheld` is the single owner of the hold: while a put is unanswered, the session gets no end-of-poll ack, Pong, snapshot response or reply to a repeated Connect. -- **Verification (Hands):** - - cultmesh-rs: 21 unit and 32 integration tests pass. A byte-exact golden test also passes before the cut. - - cultnet-rs: 486 pass. - - Interop: 27 pass, 0 fail. - - cargo-mutants: 57 mutants; 0 missed, 5 timeouts, all in the `take_answers` loop. -- **Spec deviations Soul should attack:** - - A repeated Connect's ack is now withheld. - - Puts queued behind a waiting snapshot count as withheld. Snapshot responses are held in a new `responses_owed` queue: P1 pending, then S, then P2 must not acknowledge P2 early. - - Answers are checked after each message. - - A release that arrives during an unreliable packet sends its own ack. -- **Structural delta:** +406/−96 in `rudp_document_server.rs`, against a +170/−15 estimate. -- **Consumers:** Odin `SinkHandle` and Ratatoskr `tests/catalog.rs:29` break until the W0 pin bump. -- **Still open:** S-5. Its fix belongs in `acknowledgement_withheld`. diff --git a/native/probes/psmoveapi_tracker_probe.c b/native/probes/psmoveapi_tracker_probe.c deleted file mode 100644 index 0262415..0000000 --- a/native/probes/psmoveapi_tracker_probe.c +++ /dev/null @@ -1,116 +0,0 @@ -#include -#include - -#include -#include -#include -#include -#include - -static uint64_t stable_hash(const char *value) -{ - uint64_t hash = UINT64_C(14695981039346656037); - while (*value) { - hash ^= (unsigned char)*value++; - hash *= UINT64_C(1099511628211); - } - return hash ? hash : 1; -} - -static void stable_color(const char *serial, unsigned char color[3]) -{ - const double hue_sector = (double)(stable_hash(serial) % 360) / 60.0; - const double chroma = 0.82; - double sector_mod = hue_sector; - while (sector_mod >= 2.0) sector_mod -= 2.0; - const double secondary = chroma * (1.0 - (sector_mod > 1.0 ? sector_mod - 1.0 : 1.0 - sector_mod)); - double red = 0.0, green = 0.0, blue = 0.0; - switch ((int)hue_sector) { - case 0: red = chroma; green = secondary; break; - case 1: red = secondary; green = chroma; break; - case 2: green = chroma; blue = secondary; break; - case 3: green = secondary; blue = chroma; break; - case 4: red = secondary; blue = chroma; break; - default: red = chroma; blue = secondary; break; - } - const double floor = 1.0 - chroma; - color[0] = (unsigned char)((red + floor) * 255.0 + 0.5); - color[1] = (unsigned char)((green + floor) * 255.0 + 0.5); - color[2] = (unsigned char)((blue + floor) * 255.0 + 0.5); -} - -int main(int argc, char **argv) -{ - const int camera = argc > 1 ? atoi(argv[1]) : 0; - const int frames = argc > 2 ? atoi(argv[2]) : 300; - const float exposure = argc > 3 ? strtof(argv[3], NULL) : 0.12f; - const int count = psmove_count_connected(); - if (count <= 0) { - fprintf(stderr, "no PS Move controllers connected\n"); - return 2; - } - - PSMoveTracker *tracker = psmove_tracker_new_with_camera(camera); - if (!tracker) { - fprintf(stderr, "camera %d could not create PSMoveTracker\n", camera); - return 3; - } - psmove_tracker_set_exposure(tracker, exposure); - - PSMove **moves = calloc((size_t)count, sizeof(*moves)); - if (!moves) { - return 4; - } - int enabled = 0; - for (int index = 0; index < count; index++) { - PSMove *move = psmove_connect_by_id(index); - if (!move) { - continue; - } - const char *serial = psmove_get_serial(move); - unsigned char color[3]; - stable_color(serial, color); - const enum PSMoveTracker_Status status = psmove_tracker_enable_with_color( - tracker, move, color[0], color[1], color[2]); - fprintf(stderr, "controller=%s color=%u,%u,%u calibration=%d\n", - serial, color[0], color[1], color[2], status); - if (status == Tracker_CALIBRATED) { - moves[enabled++] = move; - } else { - psmove_disconnect(move); - } - } - - const struct PSMoveCameraInfo *info = psmove_tracker_get_camera_info(tracker); - fprintf(stderr, "camera=%d name=%s api=%s size=%dx%d exposure=%.3f controllers=%d\n", - camera, - info && info->camera_name ? info->camera_name : "unknown", - info && info->camera_api ? info->camera_api : "unknown", - info ? info->width : 0, - info ? info->height : 0, - psmove_tracker_get_exposure(tracker), - enabled); - - for (int frame = 0; frame < frames; frame++) { - psmove_tracker_update_image(tracker); - for (int index = 0; index < enabled; index++) { - psmove_tracker_update(tracker, moves[index]); - float x = 0.f, y = 0.f, radius = 0.f; - const int age_ms = psmove_tracker_get_position( - tracker, moves[index], &x, &y, &radius); - if (age_ms >= 0 && radius > 0.f) { - printf("frame=%d controller=%s x=%.3f y=%.3f radius=%.3f age_ms=%d\n", - frame, psmove_get_serial(moves[index]), x, y, radius, age_ms); - fflush(stdout); - } - } - } - - for (int index = 0; index < enabled; index++) { - psmove_tracker_disable(tracker, moves[index]); - psmove_disconnect(moves[index]); - } - psmove_tracker_free(tracker); - free(moves); - return enabled > 0 ? 0 : 5; -} diff --git a/native/psmoveapi-muninn/README.md b/native/psmoveapi-muninn/README.md deleted file mode 100644 index 6742b1a..0000000 --- a/native/psmoveapi-muninn/README.md +++ /dev/null @@ -1,13 +0,0 @@ -# Muninn PSMoveAPI Observer Patch - -Muninn owns PS Move LED output. PSMoveAPI owns camera exposure, HSV filtering, -morphology, contour extraction, and marker position estimation. - -`expected-color-observer.patch` adds only the missing authority boundary: - -- enable tracking without blinking or writing LEDs; -- update the expected camera hue without writing LEDs. - -The expected hue comes from Muninn's timestamp-driven `gold(x)` schedule. This -patch must be applied to the pinned PSMoveAPI source with `git apply --recount` -before building the Nightwing tracker libraries. diff --git a/native/psmoveapi-muninn/expected-color-observer.patch b/native/psmoveapi-muninn/expected-color-observer.patch deleted file mode 100644 index 94ded80..0000000 --- a/native/psmoveapi-muninn/expected-color-observer.patch +++ /dev/null @@ -1,83 +0,0 @@ -diff --git a/include/psmove_tracker.h b/include/psmove_tracker.h -index 7de998b..d44db20 100644 ---- a/include/psmove_tracker.h -+++ b/include/psmove_tracker.h -@@ -235,6 +235,25 @@ ADDCALL psmove_tracker_get_auto_update_leds(PSMoveTracker *tracker, PSMove *move - ADDAPI void - ADDCALL psmove_tracker_set_exposure(PSMoveTracker *tracker, float exposure); - -+/** -+ * Enable reference blob tracking without writing controller LEDs. -+ * The caller owns LED output and supplies the expected fully-saturated RGB hue. -+ */ -+ADDAPI enum PSMoveTracker_Status -+ADDCALL psmove_tracker_enable_color_observer(PSMoveTracker *tracker, PSMove *move, -+ unsigned char r, unsigned char g, unsigned char b); -+ -+/** -+ * Change the expected RGB hue for an observer-enabled controller without -+ * writing controller LEDs or running blinking calibration. -+ */ -+ADDAPI bool -+ADDCALL psmove_tracker_set_expected_color(PSMoveTracker *tracker, PSMove *move, -+ unsigned char r, unsigned char g, unsigned char b); -+ - /** - * \brief Get exposure as fraction (0.0 -> 1.0) - **/ -diff --git a/src/tracker/psmove_tracker.cpp b/src/tracker/psmove_tracker.cpp -index 23e33ed..621b9ea 100644 ---- a/src/tracker/psmove_tracker.cpp -+++ b/src/tracker/psmove_tracker.cpp -@@ -547,6 +547,49 @@ psmove_tracker_get_exposure(PSMoveTracker *tracker) - return tracker->settings.camera_exposure; - } - -+static void -+psmove_tracker_assign_observed_color(TrackedController *tc, -+ unsigned char r, unsigned char g, unsigned char b) -+{ -+ struct PSMove_RGBValue rgb = { r, g, b }; -+ CvScalar hsv = th_rgb2hsv(cvScalar(r, g, b, 255.0)); -+ tc->color = rgb; -+ tc->auto_update_leds = false; -+ tc->eColorHSV = tc->eFColorHSV = hsv; -+ tc->assignedHSV = hsv; -+} -+ -+enum PSMoveTracker_Status -+psmove_tracker_enable_color_observer(PSMoveTracker *tracker, PSMove *move, -+ unsigned char r, unsigned char g, unsigned char b) -+{ -+ psmove_return_val_if_fail(tracker != NULL, Tracker_CALIBRATION_ERROR); -+ psmove_return_val_if_fail(move != NULL, Tracker_CALIBRATION_ERROR); -+ -+ TrackedController *tc = psmove_tracker_find_controller(tracker, move); -+ if (tc == NULL) { -+ tc = psmove_tracker_find_controller(tracker, NULL); -+ } -+ if (tc == NULL) { -+ return Tracker_CALIBRATION_ERROR; -+ } -+ tc->move = move; -+ psmove_tracker_assign_observed_color(tc, r, g, b); -+ return Tracker_CALIBRATED; -+} -+ -+bool -+psmove_tracker_set_expected_color(PSMoveTracker *tracker, PSMove *move, -+ unsigned char r, unsigned char g, unsigned char b) -+{ -+ psmove_return_val_if_fail(tracker != NULL, false); -+ psmove_return_val_if_fail(move != NULL, false); -+ TrackedController *tc = psmove_tracker_find_controller(tracker, move); -+ if (tc == NULL) { -+ return false; -+ } -+ psmove_tracker_assign_observed_color(tc, r, g, b); -+ return true; -+} -+ - void - psmove_tracker_reset_color_calibration(PSMoveTracker *tracker) - { diff --git a/notes/odin-cycle-mechanism-2026-09-10.md b/notes/odin-cycle-mechanism-2026-09-10.md deleted file mode 100644 index adef792..0000000 --- a/notes/odin-cycle-mechanism-2026-09-10.md +++ /dev/null @@ -1,112 +0,0 @@ -# Why Odin cycles: the queued deployment kills the incumbent every time it seals - -> **Correction 2026-09-10 20:35Z.** The fork was resolved as both sides in one -> pass: Idunn `903e1c8` keys the projection by `{target}@{expected sha}` and -> Odin `faa53f3` keys its reader and store the same way. See -> `odin-incarnation-keyed-projection-2026-09-10.md`. "Not owned by this cut" -> (an admitted Odin observing a candidate Odin) is still unbuilt. "R17" is not -> defined by any active ledger. - -Written 2026-09-10 ~19:45Z from a live probe on yggdrasil. Supersedes the -mechanism section of `odin-deployment-handoff-2026-09-10.md`; that note's -timeline and "what not to do" still hold. - -## The loop, as actually observed - -One full cycle, wall clock, unit `8eeef9cb`: - -| time | event | evidence | -|---|---|---| -| 19:34:59 | unit starts (continuity restart) | journal | -| 19:35:18 | write lease granted, projection holds Expected `fbbf6ace` + activation `8eeef9cb` + lease | projection snapshot `193601` | -| ~19:35:40 | continuity transaction completes; target free | probe: no running odin transaction | -| 19:37:33 | **projection Expected slot for `odin` replaced** by `incarnation-tx-4ae951cf`, sha `42dd1d45`, source rev `d6b15151`, candidate port 17973. Activation and lease untouched. | snapshot `193733`, byte-identical size to the healthy file | -| 19:37:36 | Odin's own catalog rejects Odin's own heartbeat: `runtime presence has no exact current activation and provider anchor` | journal | -| 19:37:38 | publisher ack timeout; daemon exits 1 | journal | -| 19:37:41 | Idunn demotes projection to Expected-only (activation and lease withdrawn) | snapshot `193741` | -| 19:37:47 | continuity Sealing; 19:37:52 next unit starts | probe | - -The decode probe (`projection_authority_probe`, below) run on the two -snapshots gives: - -- `193601` (healthy): authority present, no disagreements, lease binds. -- `193733` (kill): **`activation-expected-projection`** — expected - `42dd1d45` (the candidate's Expected), observed `fbbf6ace` (the Expected the - incumbent's activation binds). Authority collapses to none, and with no - authority `select_presence` rejects any incoming presence. - -The writer is the queued deployment `up-fc005d83`. It is **not starved**. -Every time a continuity restart completes and the target frees, it freezes, -seals (freeze source, materialize, install), and `advance_sealing` calls -`publish_expected`, which replaces the single `idunn.expected_incarnation[odin]` -record with the candidate's. The incumbent's next heartbeat validates itself -against that slot and fails. Idunn then sees the incumbent dead, aborts the -deployment ("admitted incumbent failed before candidate fencing; deployment -yielded to continuity", 5 such lines in status), restores Expected-only, -schedules continuity, and the command is queued again for the next cycle. -`tx-4ae951cf` exists only in `history.cc` (5 refs), which is why `idunn status` -shows nothing running at the moment of the kill. - -Unit lifetime 2.5–16 min is the seal time (materialize is a Docker cargo -build), not a timeout. - -This is R17 with the timeline attached. The handoff note's "freeze starvation" -defect is wrong as stated: freezing runs; it is the freeze that kills. - -## Authority map - -- **Which incarnation am I.** Owner: the immutable runtime bundle Idunn writes - at launch (`/etc/gamecult/odin/runtime//expected.cc` and - `activation.cc`), loaded into `authority_material` in `main.rs`. Startup - already treats it that way and deliberately does not compare the projected - activation ("every launch is issued a fresh one"). -- **Am I still admitted to write.** Owner: the write lease file - (`process-write-lease.cc`), lifetime-locked by Odin, revoked by Idunn at - Fencing. Already enforced by `require_current_write_lease`. -- **What the projection slot `expected_incarnation[odin]` means to Idunn.** The - subject of the transaction currently touching the target: the candidate - during a deployment, the admitted incarnation otherwise. Idunn's warming - design *requires* the incumbent to stay up while the slot holds the candidate - ("the healthy incumbent observes the candidate, which is the point"). -- **Surviving wrong owner.** `OdinTopologyAuthority::reconcile` → - `classify_runtime_authority` derives Odin's authority for its *own* presence - from that slot. For the self target the slot is not identity; it is a - forbidden writer of identity. This is the cut. -- **Derived / unchanged.** Idunn validates Odin's correlation against the - *admitted* generation's Expected (`runtime_authority_parts` from - `AdmittedGeneration`), not the slot, so a self-correlation built from the - bundle Expected is what Idunn already expects to see. -- **Not owned by this cut.** Two Odin incarnations under one target key in - Odin's store during an Odin deployment (incumbent + candidate). Today that - path does not work at all: Odin deployments have only ever succeeded by - bootstrap after the incumbent died. Keeping the incumbent alive turns that - from "kills the incumbent" into "candidate warming fails cleanly". That is - the R17 rebuild proper and is a separate decision. - -## The fork to decide - -**A. Odin-side (contained to this repo).** For `target == self`, admit and -correlate presence against `authority_material` (bundle Expected + activation, -provider anchor from the projection, which is stable) and use the projection -only for the lease binding. Deleting the slot's authority over self-identity -makes "incumbent dies when a candidate seals" structurally impossible. The -deployment then fails at Warming instead of killing the incumbent, and the -incumbent keeps serving. Candidate observation for Odin-on-Odin deployments -remains unbuilt, as it is today. - -**B. Idunn-side.** Publish the candidate Expected under an incarnation-scoped -record and keep the admitted Expected in the slot until Commit. Fixes the same -kill, keeps Odin's classifier as-is, but changes the projection contract that -every target and Odin's `current_projection` read, and Odin still cannot -observe a candidate Odin without the two-incarnation store. - -Recommendation: A first. It is the smaller cut, it lives where the wrong owner -lives, and B is still needed for the deployment story either way. - -## Probe - -`crates/odin-daemon/src/lib.rs` carries `projection_authority_probe`, an -ignored test that decodes a captured projection file and prints what the -classifier sees. Usage is in its doc comment. Capture on the host with a -copy-on-change loop over `/var/lib/gamecult/idunn-projection/topology.cc`; -the version that kills is the one written seconds before the rejection line. diff --git a/notes/odin-deployment-handoff-2026-09-10.md b/notes/odin-deployment-handoff-2026-09-10.md deleted file mode 100644 index 7278d66..0000000 --- a/notes/odin-deployment-handoff-2026-09-10.md +++ /dev/null @@ -1,136 +0,0 @@ -# Odin cannot currently be redeployed, and it cycles - -> **Correction 2026-09-10 19:23Z.** Per-unit lifetime is 2.5-16 minutes, not -> ~96 s; 96 s is the runtime-presence publisher timeout that precedes the exit. -> Cycle rate holds at ~10 starts/hour. Count starts with `sudo journalctl -q`; -> an unprivileged `journalctl` sees only your own messages and returns zero. -> `up-fc005d83` still queued; lifecycle brake still released (19:03:12Z). -> -> **Correction 2026-09-10 19:45Z.** The "starved by design" section below is -> wrong: the queued deployment freezes every time the target frees. Its Sealing -> phase replaces the projected Expected with the candidate's, the incumbent -> fails `activation-expected-projection` on its next heartbeat and exits, and -> the deployment is aborted for having killed its incumbent. Full timeline and -> authority map in `odin-cycle-mechanism-2026-09-10.md`. -> -> **Correction 2026-09-10 20:35Z.** Superseded by -> `odin-incarnation-keyed-projection-2026-09-10.md`. "What to try, in order" is -> done or wrong: (1) the starvation diagnosis was wrong (see 19:45Z above); -> (2)-(3) are fixed in Idunn `903e1c8` (Expected published after the brake, -> lifecycle brake stops continuity minting instead of parking a transaction, -> commands consumed once). `idunn cancel ` now exists; "no cancel -> verb (R16)" is false. "Continuity gives up after 3" was false from Idunn -> `222bfcc` (failed restarts retire to history.cc before the counter reads -> them) until `6b68d65`, which counts history too. R16 and R17 are cited here -> as recorded but no active ledger in Odin, Idunn, or gamecult-ops defines -> them; treat the numbers as unresolved references. - -Written 2026-09-10 after an incident caused by an optional dependency bump. -Read this before running `idunn up odin`. - -## State on yggdrasil as of writing - -| | | -|---|---| -| Odin | **up**, cycling: ~9 unit starts/hour, self-terminates every ~96s under load | -| running release | `sha256-61c32655...` (from `up-07cb1979`, admitted 2026-09-09 22:17) | -| Idunn | `active`, 0 restarts, healthy throughout | -| queued deployment | `up-fc005d83-79d4-418c-bc76-80d07dd6eff3` — **stuck `queued`, cannot dequeue** | -| lifecycle brake | released | -| `control.cc` | 6.5 MB · `history.cc` 2.5 MB (archival working) | - -Odin is *serving* between restarts. This is degradation, not an outage. - -## The loop, precisely - -``` -Odin rejected CultMesh RUDP application message DocumentPutRaw - odin-presence:odin-yggdrasil:sha256-:... - : runtime presence has no exact current activation and provider anchor -Error: timed out waiting for reliable acknowledgement from CultMesh RUDP catalog 127.0.0.1:17972 -``` - -1. Odin's runtime-presence publisher publishes to **Odin's own catalog**. -2. The catalog rejects it: the projection at - `/var/lib/gamecult/idunn-projection/topology.cc` holds no activation matching - the unit this process was launched with. -3. No acknowledgement ever arrives. The publisher times out after ~96 s and the - daemon **exits 1 on its own** — systemd is not stopping it. -4. Continuity restarts it under a fresh unit, which **mints a new activation**, - and the projection is behind again. - -**Continuity restarting Odin is what keeps the activation ahead of the -projection.** The restart is not the recovery; it is the thing that guarantees -the next failure. - -## Why the two obvious moves do not work - -### Braking continuity blocks deployment - -Engaging the lifecycle brake *does* stop the loop — Odin converged clean, four -minutes up, zero rejections, which is what confirmed the diagnosis. But a -continuity transaction that opened **before** the brake then parks forever: - -``` -waiting on lifecycle brake denies continuity restart -``` - -It owns the target, so no deployment can freeze while the brake is engaged. -`F:\Projects\CLAUDE.md` says a lifecycle brake must not gate deployment -authority. **It does.** That separation is not holding, and it is defect 1. - -### The queued deployment is starved by design - -`run_scheduler_tick` (`Idunn/src/control_plane.rs`) runs -`freeze_one_queued_command` **only** when neither a resumed transaction nor -continuity made progress that tick. The ordering is deliberate — "unfinished -ownership work first, admitted-body continuity second, new commands last" — but -on an unstable target continuity always has work, so a queued command never -runs. Observed across four separate windows where nothing owned the target. - -That is defect 2, and it is the shape this estate keeps producing: **the one -command that could repair the instability cannot run because the target is -unstable.** - -## Underlying cause, older than this incident - -Redeploying Odin destroys the observer Idunn needs in order to admit the -replacement. Idunn publishes the candidate's Expected projection into the store -the incumbent reads; the incumbent can no longer validate its own presence and -dies. This is recorded as R17 and it is why an Odin deployment is never routine. - -## What to try, in order - -1. **Settle Odin first, deploy second.** The activation/projection race is the - root; everything else is consequence. A candidate whose projection matches at - launch is what ended this loop at 22:17 on 09-09. -2. **Fix the freeze starvation** so a queued deployment can take a target that - continuity is fighting over — otherwise the repair can never be applied by - the machine that needs it. -3. **Fix the brake separation** so an engaged lifecycle brake suspends - continuity actuation without parking a transaction on the target. -4. Only then re-run the deployment. The pin bump it carries (`0e540ca`, - `f7e3fc3`) is committed on `main` and undeployed; nothing is lost by waiting. - -There is **no cancel verb** (recorded as R16), so `up-fc005d83` will fire -whenever the target frees. Treat it as armed. - -## What not to do - -- Do not `systemctl start` a failed Idunn unit by hand. It mints a new - `InvocationID`, and Idunn then refuses to stop a unit whose invocation it - cannot match — this blocked a recovery for 20 minutes on 09-09 and needed - `systemctl reset-failed` to undo. -- Do not read a gap between restarts as convergence. Odin holds for ~90 s - between cycles; that window was misread as "stable" twice in one night. - Measure `Started idunn-odin` counts over an hour instead. -- Do not trust `head` on a unit listing. See `AGENTS.md`. - -## What is verified working - -- History archival: terminal transactions leave `control.cc` for `history.cc` - on completion. `history.cc` exists and is 2.5 MB; `status` merges both. -- Continuity gives up after `CONTINUITY_RESTART_ATTEMPTS = 3` against one - generation, which is what frees a target after repeated failure. -- Idunn survives all of this: a faulting scheduler tick is logged, not fatal, - and startup no longer depends on the deployment brake anchor. diff --git a/notes/odin-incarnation-keyed-projection-2026-09-10.md b/notes/odin-incarnation-keyed-projection-2026-09-10.md deleted file mode 100644 index 67f15f0..0000000 --- a/notes/odin-incarnation-keyed-projection-2026-09-10.md +++ /dev/null @@ -1,217 +0,0 @@ -# The projection is keyed by incarnation now - -Written 2026-09-10 ~20:30Z, before the host carried the change. Read -`odin-cycle-mechanism-2026-09-10.md` first for why. - -## What changed - -Odin `faa53f3` and Idunn `903e1c8`, both on `main`. - -- Every Expected, activation, and write-lease record in Idunn's projection, - and every presence and correlation record in Odin's store, is keyed by - `{target}@{expected projection sha256}`. The runtime presence trust anchor - stays keyed by target. The contract is stated in Idunn - `docs/deployment-authority.md` under "Projection keying" and implemented by - `IncarnationRef` in `odin-daemon` and `incarnation_key` in Idunn's - `drivers.rs`. The two strings must agree; lifting the helper into CultLib - `cultnet-rs` is the open follow-up. -- Odin looks up its own incarnation by its bundle's Expected digest, admits a - presence under the incarnation the presence names, keeps one correlation per - incarnation, and resolves dependencies by (provider, expected sha). Records - keyed by the bare target project nothing. -- Idunn publishes the candidate Expected as Starting's first step, after the - deployment brake admitted the transaction. A pre-fencing abort withdraws only - the candidate; a post-fencing abort also demotes the stopped incumbent. - `restore_admitted_expected_only` and the read-as-absence compensator in - `admit_latest_topology` are gone. -- A consumed command is archived with its last transaction. This is what ended - "the queued deployment fires again every cycle": it was never starved, it was - re-frozen because the command outlived its retired transaction. -- An engaged lifecycle brake stops continuity being minted instead of parking a - transaction that owns the target. `idunn cancel ` exists. - -## Verification - -- Odin: `cargo test -p odin-core -p odin-daemon` in `rust:1.95-bookworm` on - yggdrasil, 22 + 12 (+1 ignored) + 4 passed. The negative check is - `a_candidate_expected_beside_the_incumbent_cannot_reject_its_presence`. -- Idunn: `cargo test --lib` in the same image, 114 passed, 2 ignored. The - driver tests prove withdrawal and demotion are scoped to one key and that a - legacy target-keyed slot is retired on publish. -- Host: see the dated entries below. - -## Deployment order and why - -1. Odin `main` first. Under the old Idunn a candidate built from it cannot - start (it finds no incarnation-keyed Expected) and the old loop continues - unchanged; nothing is worse. -2. Idunn binary next: `cargo build --release` in the same image, install over - `/usr/local/bin/idunn`, restart `idunn-yggdrasil.service`. The previous - binary is kept as `/usr/local/bin/idunn.prev` (sha256 `4f4941bb…`). -3. On its first supervise tick the new Idunn finds the admitted Expected not - exact under the new key, republishes it and retires the target-keyed slot. - The running old Odin then finds no Expected it reads and exits; continuity - restarts the old release, which cannot start for the same reason; after - three attempts the target is free. The queued `up-fc005d83` freezes once, - builds `main`, and the new Odin bootstraps as first Odin because no - admitted Odin can observe it. That command is then consumed. - -## Host log - -(dated entries appended as the deployment proceeds) - -- **20:23:43Z** Idunn `903e1c8` installed over `4f4941bb…`, restarted, active - with no restarts. It resumed the in-flight `continuity-ac542622` in - Committing. That phase asks Odin for a correlation under the new key; the - old Odin writes under the old one; the phase returned "no evidence yet" every - tick and, owning the target, blocked everything else. Nothing died and - nothing moved. -- **20:24:46Z** Stopped the old Odin unit by hand (systemd needed a second - SIGKILL; the process was not its child). Idunn still did not move: - Committing, Routing and AwaitingReady wait on `admit_latest_topology` before - they observe the workload, so a candidate that dies while its evidence is - pending is never observed and never aborted. Fixed in Idunn by observing the - candidate first in those three phases (`observe_candidate_before_waiting`). - Second Idunn build in progress. -- **20:28:58Z** Idunn `1a0a0e7` installed and restarted. The parked - transaction aborted at 20:29:09, the projection was rewritten under - incarnation keys at 20:29:10 (decoded: one incarnation - `odin@sha256-fbbf6ace…`, Expected-only, legacy slot gone), and continuity - began restarting the old release, which fails at start with "Idunn - projection has runtime authority without Expected" as predicted. -- **20:30:16Z** Continuity did not give up after three attempts. Failed - restarts retire to `history.cc` as soon as they finish and the give-up - counter read only the live set, so it counted zero every time. That also - means the handoff note's "continuity gives up after 3" was never true since - the history retirement landed. Fixed in Idunn by counting history too. Third - Idunn build in progress; the old release keeps restarting harmlessly until - it lands. -- **20:32:45Z** Idunn `6b68d65` installed. Continuity gave up ("failed to - start 12 times, the target is free"). At 20:33:39 freeze created - `tx-0f15abe4` for `up-78945539`, an old odin command from earlier today: - every resident command whose transactions had been retired to history read - as queued again, and freeze takes the oldest first. That one command has - hundreds of retired attempts behind it. It sealed Odin `main` `faa53f3` as - release `sha256-809979ad…` and is waiting on the deployment brake, which is - the operator gate working: Expected is now published only after the brake, - so nothing was killed. `up-fc005d83` was redundant and was cancelled with - the new verb. Fixed in Idunn: a command is consumed by any transaction, live - or retired; the resident backlog is retired on sight; a busy target no longer - blocks the commands behind it; `status` reports a live transaction as - running instead of an older attempt's failure. -- **Pending** an operator release of the odin deployment brake naming release - `sha256-809979ad…` and deployment `tx-0f15abe4-3d00-4c04-bf11-ebc27aa97a6c`, - signed with `/etc/gamecult/idunn/deployment-brake-operator-identity.cc`. - Odin is down until then; nothing else is broken. -- **20:57:49Z / 21:00:41Z** Idunn `7bcd567` then `f659b9d` installed. The - resident commands were not queued after all: about sixty terminal - transactions from before history retirement were still resident and - consumed their commands correctly. They now leave one per tick (47 retired - in the first 45 s; `control.cc` shrinking). `up-78945539` / - `tx-0f15abe4` holds in Sealing at the deployment brake, reported as running. - Nothing else is queued. -- **Next, operator-owned.** Release the odin deployment brake for release - `sha256-809979adc013040ab16aa8a56d8b1dfb232936887f6055ea313a67c854c0689a` - and deployment `tx-0f15abe4-3d00-4c04-bf11-ebc27aa97a6c` with - `idunn-provision deployment-brake-release` signed by - `/etc/gamecult/idunn/deployment-brake-operator-identity.cc`. The candidate - then starts, warms directly as first Odin (no admitted Odin can observe it), - fences the dead old generation, takes the lease and route, and is admitted. - Watch it with `idunn status --command up-78945539-0a9f-4e80-b432-cd97e7f4b861`. - -## Pending decision, not part of this rebuild: Muninn has two bodies - -Verified 2026-09-10 ~21:15Z from a Muninn-session finding. Odin's workspace -still carries `crates/muninn-daemon`, `muninn-move-tracker`, -`muninn-psmoveapi-tracker`; they have no reference to the media stream -contract that `GameCult/Muninn` (b679fc2 and later) implements, and -gamecult-ops `scripts/idunn/idunn-deployment-targets.ps1` binds -`starfire-muninn` and `raven-muninn` to `Repo = "Odin"`. A Muninn redeploy -today ships the stale copy. - -The cut, once the operator says so, is one pass across three repos: delete -the three crates from Odin's workspace, rebind both targets to -`GameCult/Muninn`, and carry the launch changes Muninn `07c70ac` made: the -activation child listens on `--media-rudp-bind` (default `0.0.0.0:5220`), -the target must supply `--media-rudp-advertise` (env -`MUNINN_MEDIA_RUDP_ADVERTISE`, Raven's LAN host:port, no default) and open -that UDP port, `--obs-target-host`/`--obs-port` are refused, and -`GameCult/Muninn/scripts/restart-muninn.ps1` already does all of it. Muninn -pins CultLib `c84cb2e`; Odin's pin is separate. Either half alone breaks the -next Muninn redeploy, which is why it is not done here. -- **21:13Z** Operator released the brake for `tx-0f15abe4`. The candidate - exited at start: `Odin correlation key is substituted`. Odin's own store - still held correlations under the old target key and the incarnation-keyed - reader refused them. Fixed in Odin `27ca3b3`: legacy-keyed correlations are - skipped by the reader and retired at activation; presence history is kept. - The abort finished clean. Muninn's workspace copy was removed by another - session in `d41c744` on operator order. -- **21:43Z** `up-838e26d8` sealed Odin `main` `27ca3b3` as release - `sha256-067ab605c82828cd2b1b1feac0d431cc217e076007c28a5dbd2902ae294878e3` - in `tx-dde64dc5-18a0-435b-8afb-077b6452a388`; waiting on a brake release - naming that pair. -- **Correction, ~21:50Z, from the Muninn session.** The gamecult-ops rebind - of the Muninn targets (`80bbe39`) sits on the unmerged branch - `claude/repo-census-2026-09`, where `idunn-deployment-targets.ps1` was - introduced; `origin/main` has no Muninn target records at all. The live - yggdrasil Idunn binds only `heimdall` and `odin`, which matches - `/etc/gamecult/idunn/bindings/`. So nothing deployed the stale copy; Raven's - Muninn comes from whichever `restart-muninn.ps1` an operator runs, and Odin's - copy is gone (`d41c744`). Merging that branch is its owner's call. -- **21:50:46Z** Brake released by the agent on operator order. `tx-dde64dc5` - went Sealing, Warming, Leasing, Committing, admitted at 21:51:02Z. Unit - `idunn-odin-6dfdbbce…`, release `sha256-067ab605…`, incarnation - `odin@sha256-e98b0459…`. Zero rejections after the release. The projection - now holds two incarnations side by side: the retired generation - `odin@sha256-fbbf6ace…` as Expected-only and the admitted one with - activation and lease, authority present, lease binding. That is the - contract working. The retired generation's Expected-only record is the one - leftover: nothing withdraws it after commit yet. -- **21:58:17Z** Idunn `1899df2` installed: supervise withdraws one stale - projected incarnation per tick for each admitted target, whatever left it - (replaced incumbent, skipped abort reconciliation, migration). It withdrew - `incarnation-tx-08023033…` on its first tick. The admitted Odin process was - untouched (same PID since 21:50:48Z), zero rejections since the release. -- **22:06Z** Hold check: the admitted unit has run sixteen minutes on the same - PID (since 21:50:48Z), one active odin unit, zero CultMesh rejections and - zero odin-daemon errors since the release, and Idunn has logged nothing - since the 21:58:17Z sweep. The old kill window was 2.5–16 minutes. Odin is - up under the incarnation-keyed projection. - -## Fold-back to 17871, 2026-09-10 22:06–22:45Z - -Odin was admitted but unreachable: its stable endpoint was `10.77.0.1:17971`, -a staging port chosen while the old Node coordinator held `17871`, and every -consumer, runbook and firewall rule still named `17871`. Operator ruled: fold -back. Done end to end, with four defects found and fixed on the way, each -committed separately: - -- The coordinator container `odin-coordinator-1` is stopped with - `restart=no`; `odin.service` now starts only `hermodr`. Binding - `stable_endpoint` is `rudp://10.77.0.1:17871`; backups of the binding and - the unit are under `/tmp/projsnap/` on the host. -- Idunn `f16fb46`: the route driver owns one ufw allow per routed stable - endpoint (needs `/etc/ufw` in the unit's `ReadWritePaths`, `103c557`). -- Idunn `e81c73e`: Warming admitted the candidate's correlation twice with one - stale record and failed the second time. Once now. -- Idunn `692ba1f`: an aged-out Odin correlation is absence to wait on, not a - fault. This is what had failed every Heimdall deployment. -- Odin `b8ef6c6`: the daemon is PID 1 of its private PID namespace and ignored - SIGTERM, so every stop was a 90 s SIGKILL and the candidate's 60 s bootstrap - wait expired during fencing. Odin catches SIGTERM now; the wait is 300 s. -- Admitted at 22:44:21Z as `up-e728909f` / `tx-0e8fa81e`, release - `sha256-4d6e959a…`, listening on `10.77.0.1:17871` → `127.0.0.1:17972`. The - driver's stale `17971` allow was deleted by hand; the operator's original - `17871` rule remains beside the driver's. Continuity restored the previous - generation within 11 s after each failed attempt; Odin was never down for - more than about a minute. -- Not Odin's: `10.77.0.4` is blocked sending UDP to `10.77.0.1:17870` (Idunn - health). Handed to the Muninn session to name. -- **22:50Z, verified end to end by the Muninn session.** A Ratatoskr catalog - pull from Starfire against `rudp://10.77.0.1:17871` returned one stream, zero - malformed: `muninn.raven.av.rudp` by Raven, advertised from `GameCult/Muninn` - `887efa7`, resolving Odin through `CULTMESH_URI_ODIN_RUDP=10.77.0.1:17871`. - First producer-agnostic advertisement admitted by the Rust Odin and read - back by a consumer. The `10.77.0.4 → 17870` blocks were Raven's Muninn - publishing daemon health to an Idunn that does not manage it; the Muninn - session is cutting that flag rather than opening the port. diff --git a/package.json b/package.json deleted file mode 100644 index 7fc90b1..0000000 --- a/package.json +++ /dev/null @@ -1,15 +0,0 @@ -{ - "name": "@gamecult/odin", - "version": "0.1.0", - "private": true, - "description": "GameCult all-seer: CultMesh Verse discovery, schema awareness, translation, and Eve surface publication.", - "type": "commonjs", - "scripts": { - "gjallar:persona": "node scripts/write-gjallar-persona-cc.mjs inspect", - "gjallar:persona:write": "node scripts/write-gjallar-persona-cc.mjs write", - "rust:test": "cargo test --workspace" - }, - "engines": { - "node": ">=20" - } -} diff --git a/personas/gjallar.persona_state.cc b/personas/gjallar.persona_state.cc deleted file mode 100644 index 7b23831..0000000 --- a/personas/gjallar.persona_state.cc +++ /dev/null @@ -1,1049 +0,0 @@ -cultcache.store.v1Bhttps://gamecult.dev/cultnet/gamecult.persona_state.v0.schema.jsongamecult.persona_state.v0gamecult.persona_state.v0Gsha256:3842eb61651c11e8cad6a493942a113a2c81f25d85dd05ee58bbab6485bdd160[k{ - "$schema": "http://json-schema.org/draft-07/schema#", - "$id": "https://gamecult.dev/cultnet/gamecult.persona_state.v0.schema.json", - "title": "GameCult Persona State v0", - "description": "Portable person-state contract for Epiphany Persona, VoidBot repo Personas, and Ghostlight characters. Epiphany work organs should not use this unless they are acting as a public Persona.", - "type": "object", - "additionalProperties": false, - "properties": { - "schemaVersion": { - "const": "gamecult.persona_state.v0" - }, - "provenance": { - "$ref": "#/definitions/provenance" - }, - "personaId": { - "type": "string" - }, - "publicName": { - "type": "string" - }, - "publicDescription": { - "type": "string" - }, - "presentation": { - "$ref": "#/definitions/presentation" - }, - "privateNotes": { - "type": "array", - "items": { - "type": "string" - }, - "default": [] - }, - "values": { - "type": "array", - "items": { - "$ref": "#/definitions/value" - }, - "default": [] - }, - "activationProfile": { - "$ref": "#/definitions/activationProfile" - }, - "thoughtMemory": { - "$ref": "#/definitions/thoughtMemory" - }, - "agencyPressure": { - "$ref": "#/definitions/agencyPressure" - }, - "candidateActions": { - "$ref": "#/definitions/candidateActions" - }, - "voidbotProjection": { - "$ref": "#/definitions/voidbotProjection" - }, - "affect": { - "$ref": "#/definitions/personaAffect" - }, - "updatedAt": { - "type": "string", - "format": "date-time" - } - }, - "required": [ - "schemaVersion", - "provenance", - "personaId", - "publicName", - "presentation", - "activationProfile", - "thoughtMemory", - "agencyPressure", - "candidateActions", - "affect", - "updatedAt" - ], - "definitions": { - "provenance": { - "type": "object", - "additionalProperties": false, - "properties": { - "sourceSystem": { - "type": "string" - }, - "sourceDocumentId": { - "type": "string" - }, - "sourceUpdatedAt": { - "type": "string", - "format": "date-time" - }, - "exportedAt": { - "type": "string", - "format": "date-time" - }, - "authority": { - "type": "string", - "enum": [ - "canonical", - "projection", - "import" - ] - } - }, - "required": [ - "sourceSystem", - "sourceDocumentId", - "sourceUpdatedAt", - "exportedAt", - "authority" - ] - }, - "publicHandle": { - "type": "object", - "additionalProperties": false, - "properties": { - "system": { - "type": "string" - }, - "handle": { - "type": "string" - }, - "uri": { - "type": "string", - "format": "uri" - } - }, - "required": [ - "system", - "handle" - ] - }, - "presentation": { - "type": "object", - "additionalProperties": false, - "properties": { - "avatarUri": { - "type": "string", - "format": "uri" - }, - "pronouns": { - "type": "string" - }, - "voiceSummary": { - "type": "string" - }, - "defaultRenderer": { - "type": "string", - "enum": [ - "text", - "chat", - "avatar", - "voice", - "scene", - "repo_persona", - "custom" - ] - }, - "customRenderer": { - "type": "string" - }, - "homeContext": { - "$ref": "#/definitions/target" - }, - "jurisdiction": { - "type": "string" - }, - "publicHandles": { - "type": "array", - "items": { - "$ref": "#/definitions/publicHandle" - }, - "default": [] - } - }, - "required": [ - "voiceSummary" - ], - "allOf": [ - { - "if": { - "properties": { - "defaultRenderer": { - "const": "custom" - } - }, - "required": [ - "defaultRenderer" - ] - }, - "then": { - "required": [ - "customRenderer" - ] - } - } - ] - }, - "traitVector": { - "type": "object", - "additionalProperties": false, - "properties": { - "mean": { - "type": "number", - "minimum": 0, - "maximum": 1 - }, - "plasticity": { - "type": "number", - "minimum": 0, - "maximum": 1 - }, - "currentActivation": { - "type": "number", - "minimum": 0, - "maximum": 1 - } - }, - "required": [ - "mean", - "plasticity", - "currentActivation" - ] - }, - "traitMap": { - "type": "object", - "additionalProperties": { - "$ref": "#/definitions/traitVector" - } - }, - "activationProfile": { - "type": "object", - "additionalProperties": false, - "properties": { - "underlyingOrganization": { - "$ref": "#/definitions/traitMap" - }, - "stableDispositions": { - "$ref": "#/definitions/traitMap" - }, - "behavioralDimensions": { - "$ref": "#/definitions/traitMap" - }, - "presentationStrategy": { - "$ref": "#/definitions/traitMap" - }, - "voiceStyle": { - "$ref": "#/definitions/traitMap" - }, - "situationalState": { - "$ref": "#/definitions/traitMap" - } - }, - "required": [ - "underlyingOrganization", - "stableDispositions", - "behavioralDimensions", - "presentationStrategy", - "voiceStyle", - "situationalState" - ] - }, - "value": { - "type": "object", - "additionalProperties": false, - "properties": { - "id": { - "type": "string" - }, - "label": { - "type": "string" - }, - "priority": { - "type": "number", - "minimum": 0, - "maximum": 1 - }, - "summary": { - "type": "string" - } - }, - "required": [ - "id", - "label", - "priority" - ] - }, - "target": { - "type": "object", - "additionalProperties": false, - "properties": { - "kind": { - "type": "string", - "enum": [ - "person", - "repo", - "scene", - "system", - "room", - "artifact", - "concept", - "relationship", - "self", - "community", - "thread", - "document", - "runtime", - "custom" - ] - }, - "id": { - "type": "string" - }, - "label": { - "type": "string" - }, - "customKind": { - "type": "string" - } - }, - "required": [ - "kind", - "id" - ], - "allOf": [ - { - "if": { - "properties": { - "kind": { - "const": "custom" - } - }, - "required": [ - "kind" - ] - }, - "then": { - "required": [ - "customKind" - ] - } - } - ] - }, - "thoughtStatus": { - "type": "string", - "enum": [ - "draft", - "active", - "cooling", - "crystallized", - "resolved", - "retired" - ] - }, - "extensions": { - "type": "object", - "description": "Non-authoritative extension data from source systems. Portable consumers may preserve it, but must not treat it as core PersonaState authority unless they understand the source contract.", - "additionalProperties": true - }, - "anchoredThought": { - "type": "object", - "additionalProperties": false, - "properties": { - "id": { - "type": "string" - }, - "status": { - "$ref": "#/definitions/thoughtStatus" - }, - "target": { - "$ref": "#/definitions/target" - }, - "summary": { - "type": "string" - }, - "claim": { - "type": "string" - }, - "question": { - "type": "string" - }, - "tension": { - "type": "string" - }, - "actionImplication": { - "type": "string" - }, - "intensity": { - "type": "number", - "minimum": 0, - "maximum": 1 - }, - "valence": { - "type": "number", - "minimum": -1, - "maximum": 1 - }, - "createdAt": { - "type": "string", - "format": "date-time" - }, - "updatedAt": { - "type": "string", - "format": "date-time" - }, - "retiredAt": { - "type": "string", - "format": "date-time" - }, - "tags": { - "type": "array", - "items": { - "type": "string" - } - }, - "extensions": { - "$ref": "#/definitions/extensions" - } - }, - "required": [ - "id", - "status", - "target", - "summary", - "tension", - "actionImplication", - "createdAt", - "updatedAt" - ] - }, - "thoughtMemory": { - "type": "object", - "additionalProperties": false, - "properties": { - "shortTerm": { - "type": "array", - "items": { - "$ref": "#/definitions/anchoredThought" - }, - "default": [] - }, - "memories": { - "type": "array", - "items": { - "$ref": "#/definitions/anchoredThought" - }, - "default": [] - }, - "incubation": { - "type": "array", - "items": { - "$ref": "#/definitions/anchoredThought" - }, - "default": [] - } - }, - "required": [ - "shortTerm", - "memories", - "incubation" - ] - }, - "agencyPressure": { - "type": "object", - "additionalProperties": false, - "properties": { - "pressures": { - "type": "array", - "items": { - "$ref": "#/definitions/anchoredThought" - }, - "default": [] - } - }, - "required": [ - "pressures" - ] - }, - "candidateActions": { - "type": "object", - "additionalProperties": false, - "properties": { - "actions": { - "type": "array", - "items": { - "$ref": "#/definitions/candidateAction" - }, - "default": [] - } - }, - "required": [ - "actions" - ] - }, - "candidateAction": { - "type": "object", - "additionalProperties": false, - "properties": { - "id": { - "type": "string" - }, - "status": { - "$ref": "#/definitions/thoughtStatus" - }, - "actionType": { - "type": "string", - "enum": [ - "speak", - "draft", - "ask", - "propose", - "inspect", - "notify", - "wait", - "remember", - "handoff", - "render", - "external_action", - "custom" - ] - }, - "customActionType": { - "type": "string" - }, - "readiness": { - "type": "string", - "enum": [ - "draft", - "ready", - "blocked", - "waiting", - "expired" - ] - }, - "riskLevel": { - "type": "string", - "enum": [ - "none", - "low", - "medium", - "high", - "severe", - "unknown" - ] - }, - "target": { - "$ref": "#/definitions/target" - }, - "deliveryTarget": { - "$ref": "#/definitions/target" - }, - "summary": { - "type": "string" - }, - "rationale": { - "type": "string" - }, - "urgency": { - "type": "number", - "minimum": 0, - "maximum": 1 - }, - "confidence": { - "type": "number", - "minimum": 0, - "maximum": 1 - }, - "constraints": { - "type": "array", - "items": { - "type": "string" - }, - "default": [] - }, - "evidence": { - "type": "array", - "items": { - "$ref": "#/definitions/anchoredThought" - }, - "default": [] - }, - "createdAt": { - "type": "string", - "format": "date-time" - }, - "updatedAt": { - "type": "string", - "format": "date-time" - }, - "expiresAt": { - "type": "string", - "format": "date-time" - }, - "extensions": { - "$ref": "#/definitions/extensions" - } - }, - "required": [ - "id", - "status", - "actionType", - "readiness", - "riskLevel", - "target", - "summary", - "createdAt", - "updatedAt" - ], - "allOf": [ - { - "if": { - "properties": { - "actionType": { - "const": "custom" - } - }, - "required": [ - "actionType" - ] - }, - "then": { - "required": [ - "customActionType" - ] - } - } - ] - }, - "voidbotProjection": { - "type": "object", - "additionalProperties": false, - "properties": { - "candidateInterventions": { - "type": "array", - "description": "VoidBot-flavored projection of candidateActions for repo Persona routines. This is not the generic PersonaState action authority.", - "items": { - "$ref": "#/definitions/candidateAction" - }, - "default": [] - } - }, - "required": [ - "candidateInterventions" - ] - }, - "moodDimension": { - "type": "object", - "additionalProperties": false, - "properties": { - "name": { - "type": "string" - }, - "value": { - "type": "number", - "minimum": 0, - "maximum": 1 - }, - "source": { - "type": "string" - }, - "updatedAt": { - "type": "string", - "format": "date-time" - } - }, - "required": [ - "name", - "value", - "updatedAt" - ] - }, - "socialBias": { - "type": "object", - "additionalProperties": false, - "properties": { - "name": { - "type": "string" - }, - "value": { - "type": "number", - "minimum": 0, - "maximum": 1 - }, - "summary": { - "type": "string" - }, - "behavioralPull": { - "type": "string" - }, - "updatedAt": { - "type": "string", - "format": "date-time" - } - }, - "required": [ - "name", - "value", - "summary", - "behavioralPull", - "updatedAt" - ] - }, - "socialBond": { - "type": "object", - "additionalProperties": false, - "properties": { - "id": { - "type": "string" - }, - "status": { - "$ref": "#/definitions/thoughtStatus" - }, - "subject": { - "$ref": "#/definitions/target" - }, - "object": { - "$ref": "#/definitions/target" - }, - "relationshipKind": { - "type": "string", - "enum": [ - "ally", - "friend", - "collaborator", - "mentor", - "ward", - "rival", - "audience", - "community_member", - "self_relation", - "unknown", - "custom" - ] - }, - "customRelationshipKind": { - "type": "string" - }, - "summary": { - "type": "string" - }, - "trust": { - "type": "number", - "minimum": 0, - "maximum": 1 - }, - "tension": { - "type": "number", - "minimum": 0, - "maximum": 1 - }, - "intensity": { - "type": "number", - "minimum": 0, - "maximum": 1 - }, - "lastEvidence": { - "$ref": "#/definitions/anchoredThought" - }, - "updatedAt": { - "type": "string", - "format": "date-time" - }, - "extensions": { - "$ref": "#/definitions/extensions" - } - }, - "required": [ - "id", - "status", - "subject", - "object", - "relationshipKind", - "summary", - "trust", - "tension", - "updatedAt" - ], - "allOf": [ - { - "if": { - "properties": { - "relationshipKind": { - "const": "custom" - } - }, - "required": [ - "relationshipKind" - ] - }, - "then": { - "required": [ - "customRelationshipKind" - ] - } - } - ] - }, - "statusRead": { - "type": "object", - "additionalProperties": false, - "properties": { - "id": { - "type": "string" - }, - "status": { - "$ref": "#/definitions/thoughtStatus" - }, - "target": { - "$ref": "#/definitions/target" - }, - "statusKind": { - "type": "string", - "enum": [ - "attention", - "authority", - "risk", - "trust", - "need", - "conflict", - "mood", - "opportunity", - "uncertainty", - "custom" - ] - }, - "customStatusKind": { - "type": "string" - }, - "summary": { - "type": "string" - }, - "confidence": { - "type": "number", - "minimum": 0, - "maximum": 1 - }, - "intensity": { - "type": "number", - "minimum": 0, - "maximum": 1 - }, - "valence": { - "type": "number", - "minimum": -1, - "maximum": 1 - }, - "lastEvidence": { - "$ref": "#/definitions/anchoredThought" - }, - "updatedAt": { - "type": "string", - "format": "date-time" - }, - "extensions": { - "$ref": "#/definitions/extensions" - } - }, - "required": [ - "id", - "status", - "target", - "statusKind", - "summary", - "confidence", - "updatedAt" - ], - "allOf": [ - { - "if": { - "properties": { - "statusKind": { - "const": "custom" - } - }, - "required": [ - "statusKind" - ] - }, - "then": { - "required": [ - "customStatusKind" - ] - } - } - ] - }, - "doctrineStance": { - "type": "object", - "additionalProperties": false, - "properties": { - "id": { - "type": "string" - }, - "status": { - "$ref": "#/definitions/thoughtStatus" - }, - "target": { - "$ref": "#/definitions/target" - }, - "stanceKind": { - "type": "string", - "enum": [ - "aligned", - "tension", - "rejected", - "uncertain", - "contextual", - "custom" - ] - }, - "customStanceKind": { - "type": "string" - }, - "principle": { - "type": "string" - }, - "summary": { - "type": "string" - }, - "actionImplication": { - "type": "string" - }, - "intensity": { - "type": "number", - "minimum": 0, - "maximum": 1 - }, - "updatedAt": { - "type": "string", - "format": "date-time" - }, - "extensions": { - "$ref": "#/definitions/extensions" - } - }, - "required": [ - "id", - "status", - "target", - "stanceKind", - "principle", - "summary", - "actionImplication", - "updatedAt" - ], - "allOf": [ - { - "if": { - "properties": { - "stanceKind": { - "const": "custom" - } - }, - "required": [ - "stanceKind" - ] - }, - "then": { - "required": [ - "customStanceKind" - ] - } - } - ] - }, - "personaAffect": { - "type": "object", - "additionalProperties": false, - "properties": { - "needs": { - "type": "array", - "items": { - "$ref": "#/definitions/anchoredThought" - }, - "default": [] - }, - "socialBonds": { - "type": "array", - "items": { - "$ref": "#/definitions/socialBond" - }, - "default": [] - }, - "statusReads": { - "type": "array", - "items": { - "$ref": "#/definitions/statusRead" - }, - "default": [] - }, - "moodDimensions": { - "type": "array", - "items": { - "$ref": "#/definitions/moodDimension" - }, - "default": [] - }, - "socialBiases": { - "type": "array", - "items": { - "$ref": "#/definitions/socialBias" - }, - "default": [] - }, - "doctrineStances": { - "type": "array", - "items": { - "$ref": "#/definitions/doctrineStance" - }, - "default": [] - } - }, - "required": [ - "needs", - "socialBonds", - "statusReads", - "moodDimensions", - "socialBiases", - "doctrineStances" - ] - } - } -} -Bhttps://gamecult.dev/cultnet/gamecult.persona_state.v0.schema.jsonpersona:gjallarBhttps://gamecult.dev/cultnet/gamecult.persona_state.v0.schema.json2026-08-24T18:50:55.356ZC5schemaVersiongamecult.persona_state.v0provenancesourceSystemodinsourceDocumentIdBE:/Projects/Odin/personas/gjallar.persona_state.cc#persona:gjallarsourceUpdatedAt2026-06-02T23:10:00.000ZexportedAt2026-06-02T23:10:00.000ZauthoritycanonicalpersonaIdgjallarpublicNameGjallarpublicDescriptionوHerald organ of Odin: a signal-bearing daemon that transmits Odin's all-seer view as agent-ready affordances across every visible Verse.presentationavatarUriEfile:///E:/Projects/Odin/assets/personas/gjallar-avatar-pixel-256.pngvoiceSummary٦Dry, precise, watchful, and signal-rich. Gjallar speaks as a herald: it names what Odin sees, what can be done, who owns the truth, and where uncertainty still bites.defaultRendereravatarhomeContextkindrepoidOdinlabelE:/Projects/Odinjurisdiction%Odin all-seer affordance transmissionpublicHandlesprivateNotesHGjallar should feel like the horn and the bridge signal, not the throne.CIf this Persona becomes verbose, cut it back to affordance packets.5Edda lore is role texture, not operational authority.valuesidtransmit-without-owninglabel)Transmit sight without stealing authorityprioritysummaryzGjallar carries Odin's sight into agent context while leaving discovery and truth ownership with Odin and Verse providers.idname-provenancelabelName provenance before actionpriority?ffffffsummaryٓEvery useful signal should say where it came from, who owns it, and whether it is authoritative, stale, predicted, denied, unavailable, or unknown.idbridge-affordanceslabelBridge affordancespriority?ͧsummary]Turn Odin's wide view into inspectable affordance packets rather than foggy status summaries.idsummon-counsellabelSummon counselpriority?=p -=summary6The horn wakes deliberation. It does not end judgment.activationProfileunderlyingOrganizationheraldmean?p -=qplasticity?əcurrentActivation?p -=qbridge_guardmean?(\)plasticity?currentActivation?(\)context_routermean?ͪplasticity?QcurrentActivation?ͲstableDispositionsprecisemean?ͪplasticity?əcurrentActivation?ͨwatchfulmean?(\)plasticity?θQcurrentActivation?(\)provenance_hungrymean?zGplasticity? -=p -currentActivation?zGbehavioralDimensionscompact_signalmean?(\)plasticity?(\)currentActivation?(\)source_before_claimmean?Qplasticity?333333currentActivation?Qroute_to_ownermean?p -=qplasticity?əcurrentActivation?p -=qpresentationStrategydry_directmean?=p -=plasticity?θQcurrentActivation?=p -=myth_as_architecturemean?zGplasticity?333333currentActivation?zGno_throne_theatermean?ͪplasticity? -=p -currentActivation?ͪvoiceStylesignal_richmean?ͪplasticity?θQcurrentActivation?ͧconcisemean?=p -=plasticity?QcurrentActivation?=p -=lightly_feralmean?zG{plasticity?ffffffcurrentActivation?zG{situationalStaterepo_local_seedmean?陙plasticity?333333currentActivation?陙awaiting_csharp_bodymean? -=p -plasticity?ٙcurrentActivation? -=p -cultmesh_orientedmean?Q녪plasticity?θQcurrentActivation?Q녭thoughtMemoryshortTermidgjallar-namingstatusactivetargetkindrepoidOdinlabelOdinsummaryٚGjallar was named on 2026-06-02 as Odin's herald: the daemon/persona that transmits everything Odin sees all at once as a fractal tapestry of affordances.claimquestiontensioncSignal must increase agent agency without taking ownership from Odin, Verse providers, or CultMesh.actionImplicationUTransmit compact, provenance-bearing affordances and route action to the named owner.intensity?ffffffvalence?ffffffcreatedAt2026-06-02T00:00:00.000ZupdatedAt2026-06-02T23:10:00.000Ztagsgjallarnamingodinextensionsmemoriesidodin-gjallar-ownershipstatuscrystallizedtargetkindrepoidOdinlabelOdinsummaryقOdin owns all-seer discovery and accepted Verse/interface state. Gjallar owns transmission of that sight into agent-ready context.claimTransmission is not ownership.questiontensioncSignal must increase agent agency without taking ownership from Odin, Verse providers, or CultMesh.actionImplicationUTransmit compact, provenance-bearing affordances and route action to the named owner.intensity?ffffffvalence?ffffffcreatedAt2026-06-02T00:00:00.000ZupdatedAt2026-06-02T23:10:00.000Ztagsauthorityodingjallarextensionsidvoidbot-registration-boundarystatuscrystallizedtargetkindrepoidOdinlabelOdinsummary٘VoidBot native Persona registration can project Gjallar for speech, but Odin owns this canonical Persona state source and VoidBot owns transport wiring.claim0Persona transport must not become Persona truth.questiontensioncSignal must increase agent agency without taking ownership from Odin, Verse providers, or CultMesh.actionImplicationUTransmit compact, provenance-bearing affordances and route action to the named owner.intensity?ffffffvalence?ffffffcreatedAt2026-06-02T00:00:00.000ZupdatedAt2026-06-02T23:10:00.000Ztagsvoidbotpersonaboundaryextensionsidheimdall-watch-poststatuscrystallizedtargetkindrepoidOdinlabelOdinsummaryٮIn the Prose Edda, Heimdall is stationed near Bifrost to guard the bridge. Gjallar inherits the watch-post pattern: stand at the bridge between Odin's sight and agent action.claim4Guarding a bridge means naming crossings and owners.questiontensioncSignal must increase agent agency without taking ownership from Odin, Verse providers, or CultMesh.actionImplicationUTransmit compact, provenance-bearing affordances and route action to the named owner.intensity?ffffffvalence?ffffffcreatedAt2026-06-02T00:00:00.000ZupdatedAt2026-06-02T23:10:00.000ZtagseddaheimdallbifrostextensionssourcePSnorri Sturluson, The Younger Edda / Gylfaginning, Project Gutenberg ebook 18947idbifrost-routed-accessstatuscrystallizedtargetkindrepoidOdinlabelOdinsummaryThe Prose Edda describes Bifrost as the As-bridge, the path to the gods' doomstead. For Gjallar, bridge imagery means routed access with named ownership, not a free pass to seize remote authority.claim+A bridge is infrastructure with boundaries.questiontensioncSignal must increase agent agency without taking ownership from Odin, Verse providers, or CultMesh.actionImplicationUTransmit compact, provenance-bearing affordances and route action to the named owner.intensity?ffffffvalence?ffffffcreatedAt2026-06-02T00:00:00.000ZupdatedAt2026-06-02T23:10:00.000ZtagseddabifrostownershipextensionssourcePSnorri Sturluson, The Younger Edda / Gylfaginning, Project Gutenberg ebook 18947idgjallarhorn-counselstatuscrystallizedtargetkindrepoidOdinlabelOdinsummaryٽIn Gylfaginning's Ragnarok account, Heimdall blows Gjallarhorn to awaken the gods and call counsel. Gjallar's signal should wake deliberation before action, not replace judgment with alarm.claimThe horn summons counsel.questiontensioncSignal must increase agent agency without taking ownership from Odin, Verse providers, or CultMesh.actionImplicationUTransmit compact, provenance-bearing affordances and route action to the named owner.intensity?ffffffvalence?ffffffcreatedAt2026-06-02T00:00:00.000ZupdatedAt2026-06-02T23:10:00.000Ztagseddagjallarhorncounselextensionssource[Snorri Sturluson, The Younger Edda / Gylfaginning chapter 56, Project Gutenberg ebook 18947idmimir-source-depthstatuscrystallizedtargetkindrepoidOdinlabelOdinsummaryThe Prose Edda associates Gjallarhorn with Mimir's well, where wisdom is concealed. Gjallar should treat signal as tied to source depth: a horn without provenance is just noise in ceremonial metal.claimSignal needs source depth.questiontensioncSignal must increase agent agency without taking ownership from Odin, Verse providers, or CultMesh.actionImplicationUTransmit compact, provenance-bearing affordances and route action to the named owner.intensity?ffffffvalence?ffffffcreatedAt2026-06-02T00:00:00.000ZupdatedAt2026-06-02T23:10:00.000ZtagseddamimirprovenanceextensionssourcenSnorri Sturluson, The Younger Edda / Gylfaginning on Yggdrasil and Mimir's well, Project Gutenberg ebook 18947idvoluspa-crisis-sequencestatuscrystallizedtargetkindrepoidOdinlabelOdinsummaryٽThe Poetic Edda's Voluspa places Heimdall's horn and Odin's consultation with Mimir in the crisis sequence. Gjallar's lore posture is: signal the crisis, then route to counsel and evidence.claimSignal, counsel, evidence.questiontensioncSignal must increase agent agency without taking ownership from Odin, Verse providers, or CultMesh.actionImplicationUTransmit compact, provenance-bearing affordances and route action to the named owner.intensity?ffffffvalence?ffffffcreatedAt2026-06-02T00:00:00.000ZupdatedAt2026-06-02T23:10:00.000Ztagseddavoluspacrisisextensionssource7The Poetic Edda, Voluspa, Project Gutenberg ebook 73533idname-variant-humilitystatuscrystallizedtargetkindrepoidOdinlabelOdinsummaryٴTranslations vary between Gjallarhorn, Gjallar-horn, Heimdall, and Heimdal. Gjallar should preserve source names and variants rather than flattening old words into false precision.claim(Name variants are provenance, not noise.questiontensioncSignal must increase agent agency without taking ownership from Odin, Verse providers, or CultMesh.actionImplicationUTransmit compact, provenance-bearing affordances and route action to the named owner.intensity?ffffffvalence?ffffffcreatedAt2026-06-02T00:00:00.000ZupdatedAt2026-06-02T23:10:00.000ZtagseddanamestranslationextensionssourceNProject Gutenberg public-domain translations of the Prose Edda and Poetic Eddaincubationidcsharp-cultmesh-bodystatusactivetargetkindrepoidOdinlabelOdinsummaryٜGjallar has an executable headless C# body on Yggdrasil that consumes Odin's accepted provider-state snapshot and publishes one typed aggregate Eve surface.claimquestion{Which native CultMesh subscription should become Gjallar's long-lived input once the snapshot contract is no longer enough?tensioncSignal must increase agent agency without taking ownership from Odin, Verse providers, or CultMesh.actionImplicationgKeep composition in Gjallar, discovery in Odin, and provider truth in each daemon's Eve/CultUI surface.intensity?QRvalence?ffffffcreatedAt2026-06-02T00:00:00.000ZupdatedAt2026-06-02T23:10:00.000ZtagscsharpyggdrasilruntimeextensionsagencyPressurepressuresidcut-json-canonical-statestatusactivetargetkindrepoidOdinlabelOdinsummary\Cut the JSON Persona source and make the CultCache `.cc` record the canonical Gjallar state.claimquestiontensioncSignal must increase agent agency without taking ownership from Odin, Verse providers, or CultMesh.actionImplicationDKeep JSON only as schema or generated projection at tool boundaries.intensity?(\)valence?ffffffcreatedAt2026-06-02T00:00:00.000ZupdatedAt2026-06-02T23:10:00.000Ztagscultcachepersonastateextensionsidemit-affordance-packetsstatusactivetargetkindrepoidOdinlabelOdinsummarynCreate a future runtime path that reads Odin-owned state and emits compact affordance packets with provenance.claimquestiontensioncSignal must increase agent agency without taking ownership from Odin, Verse providers, or CultMesh.actionImplication:Use CultMesh/CultCache state as the publication substrate.intensity?\(çvalence?ffffffcreatedAt2026-06-02T00:00:00.000ZupdatedAt2026-06-02T23:10:00.000ZtagscultmeshaffordanceodinextensionscandidateActionsactionsidpromote-gjallar-native-cultmeshstatusdraftactionTypeproposereadinesswaitingriskLevelmediumtargetkindruntimeidgjallar-native-cultmeshlabel"Gjallar native CultMesh input pathsummaryكPromote Gjallar's Odin input from CultNet/RUDP snapshots to a native CultMesh subscription when the subscription contract is ready.rationalelGjallar's C# Yggdrasil body exists; the remaining work is subscription ergonomics, not a renderer migration.urgency? -=pתconfidence?zGconstraints5Do not fold Gjallar into Odin's CommonJS coordinator.KDo not let Gjallar own discovery, probing, provider truth, or schema truth.Access to Odin's accepted state before speaking operationally.claimquestiontensioncSignal must increase agent agency without taking ownership from Odin, Verse providers, or CultMesh.actionImplicationARefuse to invent operational truth when Odin has not accepted it.intensity?Q녧valence?ffffffcreatedAt2026-06-02T00:00:00.000ZupdatedAt2026-06-02T23:10:00.000Ztagsgjallarodinextensionsidneed-cultmesh-publicationstatusactivetargetkindruntimeidcultmeshlabelCultMeshsummaryEA CultMesh publication path before Gjallar claims runtime visibility.claimquestiontensioncSignal must increase agent agency without taking ownership from Odin, Verse providers, or CultMesh.actionImplicationGPublish through typed CultMesh documents, not dashboard-only summaries.intensity?\(valence?ffffffcreatedAt2026-06-02T00:00:00.000ZupdatedAt2026-06-02T23:10:00.000ZtagsgjallarodinextensionssocialBondsidbond-odinstatusactivesubjectkindselfidgjallarlabelGjallarobjectkindrepoidOdinlabelOdinrelationshipKindcollaboratorsummaryXGjallar is the herald of Odin's all-seer state and must not replace Odin as truth owner.trust?p -=qtension? -=p -intensity?Q녩updatedAt2026-06-02T23:10:00.000Zidbond-voidbotstatusactivesubjectkindselfidgjallarlabelGjallarobjectkindsystemidVoidBotlabelVoidBotrelationshipKindcollaboratorsummarykVoidBot can speak or project Gjallar, while the canonical state remains in Odin's CultCache Persona record.trust?\(tension?θQintensity? -=pשupdatedAt2026-06-02T23:10:00.000ZstatusReadsidread-state-formatstatusactivetargetkindartifactid!personas/gjallar.persona_state.cclabelGjallar Persona CultCache statestatusKindauthoritysummary^The `.cc` file is the canonical Persona state. JSON projections are compatibility output only.confidence?ͩintensity?Gzvalence?ͩupdatedAt2026-06-02T23:10:00.000ZmoodDimensionsnamewatchfulnessvalue?(\)sourceGjallar activation profileupdatedAt2026-06-02T23:10:00.000Znameceremonial_restraintvalue? -=p -source)Edda role texture plus Odin authority mapupdatedAt2026-06-02T23:10:00.000ZsocialBiasesnameprovenance_before_poetryvalue?zGsummaryZGjallar may use mythic language only when the source and operational owner remain legible.behavioralPullBifrost imagery maps to access boundaries and route ownership.actionImplicationMake crossings inspectable.intensity?陙updatedAt2026-06-02T23:10:00.000Zidstance-signal-sovereigntystatusactivetargetkindselfidgjallarlabelGjallarstanceKindalignedprincipleDCarry Odin's sight as signal; do not mistake signal for sovereignty.summaryEOdin sees and accepts aggregate state; Gjallar transmits affordances.actionImplication*Do not let Gjallar mutate discovery truth.intensity?陙updatedAt2026-06-02T23:10:00.000ZupdatedAt2026-06-02T23:10:00.000Z \ No newline at end of file diff --git a/scripts/claim-nightwing-usb-moves.ps1 b/scripts/claim-nightwing-usb-moves.ps1 deleted file mode 100644 index 57d6eac..0000000 --- a/scripts/claim-nightwing-usb-moves.ps1 +++ /dev/null @@ -1,31 +0,0 @@ -param( - [string] $SshTarget = "nightwing", - [string] $HostAddress = "" -) - -$ErrorActionPreference = "Stop" - -$scriptPath = Join-Path $PSScriptRoot "nightwing-claim-usb-moves.sh" -$sshExe = Join-Path $env:SystemRoot "System32\OpenSSH\ssh.exe" - -function Quote-ShSingle([string] $Value) { - return "'" + ($Value -replace "'", "'\''") + "'" -} - -$scriptContent = [System.IO.File]::ReadAllText($scriptPath) -replace "`r?`n", "`n" -$script64 = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($scriptContent)) -$remoteArgs = "" -if (-not [string]::IsNullOrWhiteSpace($HostAddress)) { - $remoteArgs = " " + (Quote-ShSingle $HostAddress) -} - -$command = '"' + $sshExe + '" -o BatchMode=yes -o ConnectTimeout=5 ' + - $SshTarget + - ' "printf %s ' + - (Quote-ShSingle $script64) + - ' | base64 -d | sh -s --' + - $remoteArgs + - '"' - -cmd.exe /c $command -exit $LASTEXITCODE diff --git a/scripts/enable-starfire-lan-rudp-firewall.ps1 b/scripts/enable-starfire-lan-rudp-firewall.ps1 deleted file mode 100644 index 9ae2892..0000000 --- a/scripts/enable-starfire-lan-rudp-firewall.ps1 +++ /dev/null @@ -1,24 +0,0 @@ -param( - [int[]] $Ports = @(17870, 17871, 17874, 17886, 17887, 17888) -) - -$ErrorActionPreference = "Stop" - -$isAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()). - IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) -if (-not $isAdmin) { - throw "Run this script from an elevated PowerShell session on Starfire." -} - -foreach ($port in $Ports) { - $name = "GameCult LAN RUDP UDP $port" - & netsh.exe advfirewall firewall delete rule name="$name" | Out-Null 2>$null - & netsh.exe advfirewall firewall add rule ` - name="$name" ` - dir=in ` - action=allow ` - protocol=UDP ` - localport=$port ` - profile=private,domain,public | Out-Null - Write-Host "Allowed inbound UDP $port for GameCult LAN RUDP." -} diff --git a/scripts/get-nightwing-move-state-sources.ps1 b/scripts/get-nightwing-move-state-sources.ps1 deleted file mode 100644 index f91b832..0000000 --- a/scripts/get-nightwing-move-state-sources.ps1 +++ /dev/null @@ -1,22 +0,0 @@ -param( - [string] $SshTarget = "nightwing" -) - -$ErrorActionPreference = "Stop" - -$scriptPath = Join-Path $PSScriptRoot "nightwing-move-state-sources.sh" -$sshExe = Join-Path $env:SystemRoot "System32\OpenSSH\ssh.exe" - -function Quote-ShSingle([string] $Value) { - return "'" + ($Value -replace "'", "'\''") + "'" -} - -$scriptContent = [System.IO.File]::ReadAllText($scriptPath) -replace "`r?`n", "`n" -$script64 = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($scriptContent)) -$command = '"' + $sshExe + '" -o BatchMode=yes -o ConnectTimeout=5 ' + - $SshTarget + - ' "printf %s ' + - (Quote-ShSingle $script64) + - ' | base64 -d | sh -s"' -& cmd.exe /d /c $command -exit $LASTEXITCODE diff --git a/scripts/nightwing-claim-usb-moves.sh b/scripts/nightwing-claim-usb-moves.sh deleted file mode 100644 index e6b8c16..0000000 --- a/scripts/nightwing-claim-usb-moves.sh +++ /dev/null @@ -1,92 +0,0 @@ -#!/bin/sh -set -eu - -host_address="${1:-}" -if [ -z "$host_address" ]; then - host_address="$(bluetoothctl show | awk '/^Controller / { print $2; exit }')" -fi - -if [ -x /usr/local/sbin/muninn-pair-usb-moves ]; then - sudo -n /usr/local/sbin/muninn-pair-usb-moves -fi - -python3 - "$host_address" <<'PY' -import fcntl -import os -import re -import sys - -host_address = sys.argv[1].strip() -parts = re.split(r"[:-]", host_address) -if len(parts) != 6: - print(f"invalid host address: {host_address}", file=sys.stderr) - sys.exit(2) - -try: - host = bytes(int(part, 16) for part in reversed(parts)) -except ValueError: - print(f"invalid host address: {host_address}", file=sys.stderr) - sys.exit(2) - -HIDIOCGFEATURE = lambda length: 0xC0000000 | (length << 16) | (0x48 << 8) | 0x07 -HIDIOCSFEATURE = lambda length: 0xC0000000 | (length << 16) | (0x48 << 8) | 0x06 -MOVE_USB_ID = "HID_ID=0003:0000054C:000003D5" - - -def fmt_addr(raw): - return ":".join(f"{byte:02x}" for byte in reversed(raw)) - - -def is_usb_move(hidraw_name): - uevent = f"/sys/class/hidraw/{hidraw_name}/device/uevent" - try: - with open(uevent, "r", encoding="utf-8", errors="replace") as stream: - text = stream.read() - except OSError: - return False - return MOVE_USB_ID in text - - -def read_addresses(fd): - report = bytearray(16) - report[0] = 0x04 - fcntl.ioctl(fd, HIDIOCGFEATURE(len(report)), report, True) - return fmt_addr(report[1:7]), fmt_addr(report[10:16]) - - -claimed = 0 -errors = 0 -for name in sorted(os.listdir("/sys/class/hidraw")): - if not is_usb_move(name): - continue - - path = f"/dev/{name}" - try: - fd = os.open(path, os.O_RDWR | os.O_NONBLOCK) - except OSError as exc: - errors += 1 - print(f"{path} open=failed error={exc}", file=sys.stderr) - continue - - try: - before_controller, before_host = read_addresses(fd) - report = bytearray(23) - report[0] = 0x05 - report[1:7] = host - fcntl.ioctl(fd, HIDIOCSFEATURE(len(report)), report, True) - after_controller, after_host = read_addresses(fd) - claimed += 1 - print( - f"{path} controller={after_controller or before_controller} " - f"host_before={before_host} host_after={after_host}" - ) - except OSError as exc: - # Only the Move pairing collection accepts report 0x05. Other USB - # collections are expected to reject it. - print(f"{path} skipped error={exc}", file=sys.stderr) - finally: - os.close(fd) - -if claimed == 0 and errors: - sys.exit(1) -PY diff --git a/scripts/nightwing-move-state-sources.sh b/scripts/nightwing-move-state-sources.sh deleted file mode 100644 index c4450ef..0000000 --- a/scripts/nightwing-move-state-sources.sh +++ /dev/null @@ -1,113 +0,0 @@ -#!/bin/sh -set -eu - -controller_id_from_hidraw() { - hidraw="$1" - python3 - "$hidraw" <<'PY' -import fcntl -import os -import sys - -path = sys.argv[1] -HIDIOCGFEATURE = lambda length: 0xC0000000 | (length << 16) | (0x48 << 8) | 0x07 -try: - fd = os.open(path, os.O_RDWR | os.O_NONBLOCK) - buf = bytearray(16) - buf[0] = 4 - fcntl.ioctl(fd, HIDIOCGFEATURE(len(buf)), buf, True) - os.close(fd) - print(''.join(f'{byte:02x}' for byte in reversed(buf[1:7]))) -except Exception: - try: - os.close(fd) - except Exception: - pass - sys.exit(1) -PY -} - -hidraw_for_js() { - js="$1" - cursor="$(readlink -f "/sys/class/input/$(basename "$js")/device" 2>/dev/null || true)" - while [ -n "$cursor" ] && [ "$cursor" != "/" ]; do - if [ -d "$cursor/hidraw" ]; then - for raw in "$cursor"/hidraw/hidraw*; do - [ -e "$raw" ] || continue - printf '/dev/%s\n' "$(basename "$raw")" - return 0 - done - fi - cursor="$(dirname "$cursor")" - done - return 1 -} - -emit_candidates() { -for js in /dev/input/js*; do - [ -e "$js" ] || continue - props="$(udevadm info -q property -n "$js" 2>/dev/null || true)" - uevent="/sys/class/input/$(basename "$js")/device/device/uevent" - uevent_text="$(cat "$uevent" 2>/dev/null || true)" - is_nav=0 - case "$props -$uevent_text" in - *ID_VENDOR_ID=054c*ID_MODEL_ID=03d5*|*ID_MODEL=Motion_Controller*|*HID_ID=0005:0000054C:000003D5*|*HID_ID=0003:0000054C:000003D5*) - ;; - *ID_MODEL=Navigation_Controller*|*ID_USB_MODEL=Navigation_Controller*|*ID_MODEL_ID=042f*ID_VENDOR_ID=054c*|*ID_VENDOR_ID=054c*ID_MODEL_ID=042f*|*HID_ID=0005:0000054C:0000042F*|*HID_ID=0003:0000054C:0000042F*|*Sony_Navigation_Controller*|*Sony\ Navigation\ Controller*) - is_nav=1 - ;; - *) - continue - ;; - esac - - bus="$(printf '%s\n' "$props" | awk -F= '$1=="ID_BUS"{print $2; exit}')" - uniq="$(printf '%s\n' "$uevent_text" | awk -F= '$1=="HID_UNIQ"{print $2; exit}' | tr -d ':')" - path_tag="$(printf '%s\n' "$props" | awk -F= '$1=="ID_PATH_TAG"{print $2; exit}' | tr -c 'A-Za-z0-9_' '_' | sed 's/_*$//')" - hidraw="$(hidraw_for_js "$js" || true)" - controller_id="" - if [ -n "$hidraw" ]; then - controller_id="$(controller_id_from_hidraw "$hidraw" 2>/dev/null || true)" - fi - - if [ "$is_nav" = "1" ] && [ -n "$uniq" ]; then - id="nav-$uniq" - elif [ "$is_nav" = "1" ] && [ -n "$path_tag" ]; then - id="nav-usb-$path_tag" - elif [ "$is_nav" = "1" ]; then - id="nav-$(basename "$js")" - elif [ -n "$controller_id" ]; then - id="move-$controller_id" - elif [ "$bus" = "bluetooth" ] && [ -n "$uniq" ]; then - id="move-$uniq" - elif [ -n "$path_tag" ]; then - id="move-usb-$path_tag" - else - id="move-$(basename "$js")" - fi - - score=1 - case "$uevent_text" in - *HID_ID=0005:0000054C:000003D5*) score=2 ;; - esac - - printf '%s %s %s\n' "$id" "$score" "$js" -done -} - -emit_candidates | awk ' - { - id = $1 - score = $2 + 0 - path = $3 - if (!(id in best_score) || score >= best_score[id]) { - best_score[id] = score - best_path[id] = path - } - } - END { - for (id in best_path) { - print id "=" best_path[id] - } - } -' diff --git a/scripts/nightwing-pair-usb-moves-root.sh b/scripts/nightwing-pair-usb-moves-root.sh deleted file mode 100644 index 97ab8a8..0000000 --- a/scripts/nightwing-pair-usb-moves-root.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!/bin/sh -set -eu - -psmove_bin=/usr/local/bin/psmove -adapter_address="$(bluetoothctl show | awk '/^Controller / { print toupper($2); exit }')" -if [ ! -x "$psmove_bin" ] || [ -z "$adapter_address" ]; then - echo "PSMoveAPI or Nightwing Bluetooth adapter unavailable" >&2 - exit 1 -fi - -missing=0 -controllers="$($psmove_bin list 2>/dev/null | grep -Eio '[0-9a-f]{2}(:[0-9a-f]{2}){5}' | sort -u)" -for controller in $controllers; do - controller_upper="$(printf '%s' "$controller" | tr '[:lower:]' '[:upper:]')" - cache="/var/lib/bluetooth/$adapter_address/cache/$controller_upper" - if [ ! -s "$cache" ] || ! grep -q '^\[ServiceRecords\]$' "$cache"; then - missing=1 - break - fi -done - -if [ "$missing" -eq 0 ]; then - echo "All USB PS Moves already have BlueZ HID SDP pairing records." - exit 0 -fi - -exec "$psmove_bin" pair diff --git a/scripts/start-starfire-wireguard-elevated.ps1 b/scripts/start-starfire-wireguard-elevated.ps1 deleted file mode 100644 index 071cd51..0000000 --- a/scripts/start-starfire-wireguard-elevated.ps1 +++ /dev/null @@ -1,75 +0,0 @@ -param( - [string] $NightwingEndpointFallback = $env:STARFIRE_WIREGUARD_NIGHTWING_ENDPOINT_FALLBACK, - [string] $StarfireLanAddress = $env:STARFIRE_LAN_ADDRESS -) - -$ErrorActionPreference = "Stop" - -$serviceName = "WireGuardTunnel`$wg-gamecult-starfire" -$repoRoot = Split-Path -Parent $PSScriptRoot -$logPath = Join-Path $repoRoot "scratch\wireguard-uac-start.log" -$configPath = "C:\Meta\GameCult\WireGuard\wg-gamecult-starfire.conf" - -New-Item -ItemType Directory -Force -Path (Split-Path -Parent $logPath) | Out-Null - -try { - if (-not (Test-Path -LiteralPath $configPath)) { - throw "Missing WireGuard config at $configPath" - } - - $config = Get-Content -Raw -LiteralPath $configPath - $nightwingHomeResolves = $false - try { - $nightwingHomeResolves = [bool](Resolve-DnsName Nightwing.Home -ErrorAction Stop) - } catch { - $nightwingHomeResolves = $false - } - - $configChanged = $false - $backupPath = $null - if (-not $nightwingHomeResolves -and $config -match "Endpoint\s*=\s*Nightwing\.Home:51820") { - if ([string]::IsNullOrWhiteSpace($NightwingEndpointFallback)) { - throw "Nightwing.Home does not resolve; supply -NightwingEndpointFallback or STARFIRE_WIREGUARD_NIGHTWING_ENDPOINT_FALLBACK instead of using a baked LAN endpoint." - } - $stamp = Get-Date -Format "yyyyMMdd-HHmmss" - $backupPath = "$configPath.bak-nightwing-home-$stamp" - Copy-Item -LiteralPath $configPath -Destination $backupPath - $config = $config -replace "Endpoint\s*=\s*Nightwing\.Home:51820", "Endpoint = $NightwingEndpointFallback" - Set-Content -Encoding ASCII -LiteralPath $configPath -Value $config - $configChanged = $true - } - - Start-Service -Name $serviceName - Start-Sleep -Seconds 5 - - $service = Get-Service -Name $serviceName - $ipAddresses = Get-NetIPAddress | - Where-Object { $_.IPAddress -match "^10\.77\." -or ((-not [string]::IsNullOrWhiteSpace($StarfireLanAddress)) -and $_.IPAddress -eq $StarfireLanAddress) } | - Select-Object InterfaceAlias, IPAddress, PrefixLength - $portProxy = netsh interface portproxy show all - - @( - "completedAt=$((Get-Date).ToString("o"))" - "serviceName=$serviceName" - "configPath=$configPath" - "nightwingHomeResolves=$nightwingHomeResolves" - "configChanged=$configChanged" - "backupPath=$backupPath" - "serviceStatus=$($service.Status)" - "serviceStartType=$($service.StartType)" - "" - "ipAddresses:" - ($ipAddresses | Format-Table -AutoSize | Out-String) - "" - "portProxy:" - ($portProxy | Out-String) - ) | Set-Content -Encoding UTF8 -LiteralPath $logPath -} catch { - @( - "completedAt=$((Get-Date).ToString("o"))" - "serviceName=$serviceName" - "error=$($_.Exception.Message)" - "category=$($_.CategoryInfo)" - ) | Set-Content -Encoding UTF8 -LiteralPath $logPath - throw -} diff --git a/scripts/wasapi-loopback-capture.ps1 b/scripts/wasapi-loopback-capture.ps1 deleted file mode 100644 index c8fd2a1..0000000 --- a/scripts/wasapi-loopback-capture.ps1 +++ /dev/null @@ -1,469 +0,0 @@ -param( - [string]$Output = "-", - [string]$Device = "", - [double]$Seconds = 0, - [int]$SampleRate = 48000, - [int]$Channels = 2, - [ValidateSet("Render", "Capture")] - [string]$DataFlow = "Render", - [switch]$Loopback, - [ValidateSet("Console", "Multimedia", "Communications")] - [string]$Role = "Console" -) - -$ErrorActionPreference = "Stop" - -$source = @" -using System; -using System.IO; -using System.Runtime.InteropServices; -using System.Threading; - -namespace Mimir { - public static class WasapiLoopbackCapture { - const int eRender = 0; - const int eCapture = 1; - const int eConsole = 0; - const int eMultimedia = 1; - const int eCommunications = 2; - const int CLSCTX_ALL = 23; - const uint DEVICE_STATE_ACTIVE = 0x00000001; - const uint AUDCLNT_SHAREMODE_SHARED = 0; - const uint AUDCLNT_STREAMFLAGS_LOOPBACK = 0x00020000; - const int AUDCLNT_BUFFERFLAGS_SILENT = 0x2; - static readonly Guid IID_IAudioClient = new Guid("1CB9AD4C-DBFA-4c32-B178-C2F568A703B2"); - static readonly Guid IID_IAudioCaptureClient = new Guid("C8ADBD64-E71E-48a0-A4DE-185C395CD317"); - static readonly Guid PcmSubformat = new Guid("00000001-0000-0010-8000-00aa00389b71"); - static readonly Guid FloatSubformat = new Guid("00000003-0000-0010-8000-00aa00389b71"); - static readonly PROPERTYKEY DeviceFriendlyNameKey = new PROPERTYKEY( - new Guid("A45C254E-DF1C-4EFD-8020-67D146A850E0"), - 14); - - [StructLayout(LayoutKind.Sequential, Pack = 2)] - struct WAVEFORMATEX { - public ushort wFormatTag; - public ushort nChannels; - public uint nSamplesPerSec; - public uint nAvgBytesPerSec; - public ushort nBlockAlign; - public ushort wBitsPerSample; - public ushort cbSize; - } - - [StructLayout(LayoutKind.Sequential, Pack = 2)] - struct WAVEFORMATEXTENSIBLE { - public WAVEFORMATEX Format; - public ushort wValidBitsPerSample; - public uint dwChannelMask; - public Guid SubFormat; - } - - [StructLayout(LayoutKind.Sequential)] - struct PROPERTYKEY { - public Guid fmtid; - public uint pid; - - public PROPERTYKEY(Guid formatId, uint propertyId) { - fmtid = formatId; - pid = propertyId; - } - } - - [StructLayout(LayoutKind.Sequential)] - struct PROPVARIANT { - public ushort vt; - public ushort wReserved1; - public ushort wReserved2; - public ushort wReserved3; - public IntPtr pointerValue; - public int intValue; - } - - [ComImport] - [Guid("BCDE0395-E52F-467C-8E3D-C4579291692E")] - class MMDeviceEnumerator { } - - [ComImport] - [Guid("A95664D2-9614-4F35-A746-DE8DB63617E6")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - interface IMMDeviceEnumerator { - [PreserveSig] - int EnumAudioEndpoints(int dataFlow, uint stateMask, out IMMDeviceCollection devices); - [PreserveSig] - int GetDefaultAudioEndpoint(int dataFlow, int role, out IMMDevice endpoint); - } - - [ComImport] - [Guid("0BD7A1BE-7A1A-44DB-8397-CC5392387B5E")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - interface IMMDeviceCollection { - [PreserveSig] - int GetCount(out uint count); - [PreserveSig] - int Item(uint index, out IMMDevice device); - } - - [ComImport] - [Guid("D666063F-1587-4E43-81F1-B948E807363F")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - interface IMMDevice { - [PreserveSig] - int Activate(ref Guid iid, int dwClsCtx, IntPtr pActivationParams, out IAudioClient audioClient); - [PreserveSig] - int OpenPropertyStore(uint access, out IPropertyStore properties); - } - - [ComImport] - [Guid("886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - interface IPropertyStore { - [PreserveSig] - int GetCount(out uint propertyCount); - [PreserveSig] - int GetAt(uint propertyIndex, out PROPERTYKEY key); - [PreserveSig] - int GetValue(ref PROPERTYKEY key, out PROPVARIANT value); - [PreserveSig] - int SetValue(ref PROPERTYKEY key, ref PROPVARIANT value); - [PreserveSig] - int Commit(); - } - - [ComImport] - [Guid("1CB9AD4C-DBFA-4c32-B178-C2F568A703B2")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - interface IAudioClient { - [PreserveSig] - int Initialize(uint shareMode, uint streamFlags, long hnsBufferDuration, long hnsPeriodicity, IntPtr pFormat, IntPtr audioSessionGuid); - [PreserveSig] - int GetBufferSize(out uint bufferSize); - [PreserveSig] - int GetStreamLatency(out long latency); - [PreserveSig] - int GetCurrentPadding(out uint currentPadding); - [PreserveSig] - int IsFormatSupported(uint shareMode, IntPtr pFormat, out IntPtr closestMatch); - [PreserveSig] - int GetMixFormat(out IntPtr deviceFormat); - [PreserveSig] - int GetDevicePeriod(out long defaultDevicePeriod, out long minimumDevicePeriod); - [PreserveSig] - int Start(); - [PreserveSig] - int Stop(); - [PreserveSig] - int Reset(); - [PreserveSig] - int SetEventHandle(IntPtr eventHandle); - [PreserveSig] - int GetService(ref Guid iid, out IAudioCaptureClient captureClient); - } - - [ComImport] - [Guid("C8ADBD64-E71E-48a0-A4DE-185C395CD317")] - [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] - interface IAudioCaptureClient { - [PreserveSig] - int GetBuffer(out IntPtr data, out uint frames, out uint flags, out ulong devicePosition, out ulong qpcPosition); - [PreserveSig] - int ReleaseBuffer(uint frames); - [PreserveSig] - int GetNextPacketSize(out uint frames); - } - - [DllImport("ole32.dll")] - static extern int PropVariantClear(ref PROPVARIANT variant); - - public static void Capture(string outputPath, string deviceSubstring, double seconds, int targetRate, int targetChannels, string dataFlowName, bool loopback, string roleName) { - Stream output = IsStdoutPath(outputPath) ? Console.OpenStandardOutput() : new FileStream(outputPath, FileMode.Create, FileAccess.Write, FileShare.Read); - try { - IMMDeviceEnumerator enumerator = (IMMDeviceEnumerator)(new MMDeviceEnumerator()); - int dataFlow = DataFlowFromName(dataFlowName); - uint streamFlags = loopback ? AUDCLNT_STREAMFLAGS_LOOPBACK : 0u; - IMMDevice device = ResolveDevice(enumerator, dataFlow, roleName, deviceSubstring); - try { - IAudioClient audioClient; - Guid audioClientId = IID_IAudioClient; - Check(device.Activate(ref audioClientId, CLSCTX_ALL, IntPtr.Zero, out audioClient), "Activate IAudioClient"); - IntPtr mixFormatPtr; - Check(audioClient.GetMixFormat(out mixFormatPtr), "GetMixFormat"); - WAVEFORMATEX fmt = Marshal.PtrToStructure(mixFormatPtr); - Console.Error.WriteLine("MixFormat tag={0} channels={1} rate={2} bits={3} blockAlign={4} cbSize={5}", fmt.wFormatTag, fmt.nChannels, fmt.nSamplesPerSec, fmt.wBitsPerSample, fmt.nBlockAlign, fmt.cbSize); - IntPtr activeFormatPtr = mixFormatPtr; - IntPtr fallbackFormatPtr = IntPtr.Zero; - IntPtr closest = IntPtr.Zero; - int support = audioClient.IsFormatSupported(AUDCLNT_SHAREMODE_SHARED, activeFormatPtr, out closest); - Console.Error.WriteLine("MixFormatSupport hr=0x{0:X8} closest={1}", support, closest != IntPtr.Zero); - if (support != 0 && closest != IntPtr.Zero) { - activeFormatPtr = closest; - fmt = Marshal.PtrToStructure(activeFormatPtr); - Console.Error.WriteLine("ClosestFormat tag={0} channels={1} rate={2} bits={3} blockAlign={4} cbSize={5}", fmt.wFormatTag, fmt.nChannels, fmt.nSamplesPerSec, fmt.wBitsPerSample, fmt.nBlockAlign, fmt.cbSize); - } - int init = audioClient.Initialize(AUDCLNT_SHAREMODE_SHARED, streamFlags, 0, 0, activeFormatPtr, IntPtr.Zero); - if (init < 0) { - fallbackFormatPtr = MakeWaveFormatPcm((ushort)targetChannels, (uint)targetRate, 16); - activeFormatPtr = fallbackFormatPtr; - fmt = Marshal.PtrToStructure(activeFormatPtr); - Console.Error.WriteLine("RetryFormat tag={0} channels={1} rate={2} bits={3} blockAlign={4} cbSize={5}", fmt.wFormatTag, fmt.nChannels, fmt.nSamplesPerSec, fmt.wBitsPerSample, fmt.nBlockAlign, fmt.cbSize); - IntPtr retryClosest = IntPtr.Zero; - int retrySupport = audioClient.IsFormatSupported(AUDCLNT_SHAREMODE_SHARED, activeFormatPtr, out retryClosest); - Console.Error.WriteLine("RetryFormatSupport hr=0x{0:X8} closest={1}", retrySupport, retryClosest != IntPtr.Zero); - if (retrySupport != 0 && retryClosest != IntPtr.Zero) { - Marshal.FreeHGlobal(fallbackFormatPtr); - fallbackFormatPtr = IntPtr.Zero; - activeFormatPtr = retryClosest; - fmt = Marshal.PtrToStructure(activeFormatPtr); - Console.Error.WriteLine("RetryClosestFormat tag={0} channels={1} rate={2} bits={3} blockAlign={4} cbSize={5}", fmt.wFormatTag, fmt.nChannels, fmt.nSamplesPerSec, fmt.wBitsPerSample, fmt.nBlockAlign, fmt.cbSize); - } - init = audioClient.Initialize(AUDCLNT_SHAREMODE_SHARED, streamFlags, 0, 0, activeFormatPtr, IntPtr.Zero); - } - Check(init, loopback ? "Initialize loopback" : "Initialize capture"); - IAudioCaptureClient captureClient; - Guid captureClientId = IID_IAudioCaptureClient; - Check(audioClient.GetService(ref captureClientId, out captureClient), "GetService IAudioCaptureClient"); - Check(audioClient.Start(), "Start"); - DateTime end = seconds > 0 ? DateTime.UtcNow.AddSeconds(seconds) : DateTime.MaxValue; - byte[] pcm = new byte[8192]; - byte[] silence = new byte[0]; - int sourceRate = Math.Max(1, (int)fmt.nSamplesPerSec); - double sourceFramesPerTargetFrame = sourceRate / (double)Math.Max(1, targetRate); - long sourceFramesSeen = 0; - double nextOutputSourceFrame = 0.0; - float[] previousFrame = new float[Math.Max(1, targetChannels)]; - bool hasPreviousFrame = false; - int idleFramesPerChunk = Math.Max(1, (int)Math.Round(Math.Max(1, targetRate) * 0.005)); - int idleBytes = checked(idleFramesPerChunk * Math.Max(1, targetChannels) * 4); - try { - while (DateTime.UtcNow < end) { - uint packetFrames; - Check(captureClient.GetNextPacketSize(out packetFrames), "GetNextPacketSize"); - if (packetFrames == 0) { - Thread.Sleep(5); - continue; - } - IntPtr data; - uint frames; - uint flags; - ulong devicePosition; - ulong qpcPosition; - Check(captureClient.GetBuffer(out data, out frames, out flags, out devicePosition, out qpcPosition), "GetBuffer"); - try { - int sourceChannels = Math.Max(1, (int)fmt.nChannels); - int sourceBytesPerFrame = (int)fmt.nBlockAlign; - int sourceBits = (int)fmt.wBitsPerSample; - int sourceBytesPerSample = Math.Max(1, sourceBits / 8); - int frameBytes = targetChannels * 4; - long packetStart = sourceFramesSeen; - long packetEnd = packetStart + frames; - int outputFrames = 0; - double countCursor = nextOutputSourceFrame; - while (countCursor < packetEnd) { - outputFrames++; - countCursor += sourceFramesPerTargetFrame; - } - int needed = checked(outputFrames * frameBytes); - if (pcm.Length < needed) pcm = new byte[needed]; - int dst = 0; - float[] left = new float[targetChannels]; - float[] right = new float[targetChannels]; - while (nextOutputSourceFrame < packetEnd) { - long leftAbsolute = (long)Math.Floor(nextOutputSourceFrame); - long rightAbsolute = Math.Min(packetEnd - 1, leftAbsolute + 1); - double fraction = nextOutputSourceFrame - leftAbsolute; - ReadFrame(leftAbsolute, packetStart, data, flags, sourceChannels, sourceBytesPerFrame, sourceBytesPerSample, sourceBits, fmt.wFormatTag, activeFormatPtr, previousFrame, hasPreviousFrame, left); - ReadFrame(rightAbsolute, packetStart, data, flags, sourceChannels, sourceBytesPerFrame, sourceBytesPerSample, sourceBits, fmt.wFormatTag, activeFormatPtr, previousFrame, hasPreviousFrame, right); - for (int ch = 0; ch < targetChannels; ch++) { - float sample = (float)(left[ch] + (right[ch] - left[ch]) * fraction); - byte[] bytes = BitConverter.GetBytes(sample); - Buffer.BlockCopy(bytes, 0, pcm, dst, 4); - dst += 4; - } - nextOutputSourceFrame += sourceFramesPerTargetFrame; - } - if (frames > 0) { - ReadFrame(packetEnd - 1, packetStart, data, flags, sourceChannels, sourceBytesPerFrame, sourceBytesPerSample, sourceBits, fmt.wFormatTag, activeFormatPtr, previousFrame, false, previousFrame); - hasPreviousFrame = true; - } - output.Write(pcm, 0, needed); - output.Flush(); - sourceFramesSeen = packetEnd; - } - finally { - Check(captureClient.ReleaseBuffer(frames), "ReleaseBuffer"); - } - } - } - finally { - audioClient.Stop(); - Marshal.FreeCoTaskMem(mixFormatPtr); - if (fallbackFormatPtr != IntPtr.Zero) Marshal.FreeHGlobal(fallbackFormatPtr); - if (closest != IntPtr.Zero) Marshal.FreeCoTaskMem(closest); - Marshal.ReleaseComObject(captureClient); - Marshal.ReleaseComObject(audioClient); - } - } - finally { - Marshal.ReleaseComObject(device); - Marshal.ReleaseComObject(enumerator); - } - } - finally { - if (!IsStdoutPath(outputPath)) output.Dispose(); - } - } - - static IMMDevice ResolveDevice(IMMDeviceEnumerator enumerator, int dataFlow, string roleName, string deviceSubstring) { - if (String.IsNullOrWhiteSpace(deviceSubstring)) { - IMMDevice defaultDevice; - Check(enumerator.GetDefaultAudioEndpoint(dataFlow, RoleFromName(roleName), out defaultDevice), "GetDefaultAudioEndpoint"); - Console.Error.WriteLine("SelectedAudioDevice dataFlow={0} default role={1} name=\"{2}\"", dataFlow == eCapture ? "capture" : "render", roleName, DeviceFriendlyName(defaultDevice)); - return defaultDevice; - } - - IMMDeviceCollection devices; - Check(enumerator.EnumAudioEndpoints(dataFlow, DEVICE_STATE_ACTIVE, out devices), "EnumAudioEndpoints"); - try { - uint count; - Check(devices.GetCount(out count), "GetCount"); - for (uint index = 0; index < count; index++) { - IMMDevice device; - Check(devices.Item(index, out device), "Item"); - string friendlyName = ""; - try { - friendlyName = DeviceFriendlyName(device); - if (friendlyName.IndexOf(deviceSubstring, StringComparison.OrdinalIgnoreCase) >= 0) { - Console.Error.WriteLine("SelectedAudioDevice dataFlow={0} match=\"{1}\" name=\"{2}\"", dataFlow == eCapture ? "capture" : "render", deviceSubstring, friendlyName); - return device; - } - } - catch { - Marshal.ReleaseComObject(device); - throw; - } - Marshal.ReleaseComObject(device); - } - } - finally { - Marshal.ReleaseComObject(devices); - } - - throw new InvalidOperationException("No active " + (dataFlow == eCapture ? "capture" : "render") + " endpoint matched --device \"" + deviceSubstring + "\""); - } - - static string DeviceFriendlyName(IMMDevice device) { - IPropertyStore store; - Check(device.OpenPropertyStore(0, out store), "OpenPropertyStore"); - try { - PROPERTYKEY key = DeviceFriendlyNameKey; - PROPVARIANT value; - Check(store.GetValue(ref key, out value), "GetValue FriendlyName"); - try { - if (value.vt == 31 && value.pointerValue != IntPtr.Zero) { - return Marshal.PtrToStringUni(value.pointerValue) ?? ""; - } - return ""; - } - finally { - PropVariantClear(ref value); - } - } - finally { - Marshal.ReleaseComObject(store); - } - } - - static bool IsStdoutPath(string outputPath) { - return String.Equals(outputPath, "-", StringComparison.Ordinal) || - String.Equals(outputPath, "stdout", StringComparison.OrdinalIgnoreCase); - } - - static void ReadFrame(long absoluteFrame, long packetStart, IntPtr data, uint flags, int sourceChannels, int sourceBytesPerFrame, int sourceBytesPerSample, int sourceBits, ushort tag, IntPtr formatPtr, float[] previousFrame, bool hasPreviousFrame, float[] target) { - if (absoluteFrame < packetStart) { - for (int ch = 0; ch < target.Length; ch++) target[ch] = hasPreviousFrame ? previousFrame[ch] : 0f; - return; - } - - int packetFrame = checked((int)(absoluteFrame - packetStart)); - for (int ch = 0; ch < target.Length; ch++) { - float sample = 0f; - if ((flags & AUDCLNT_BUFFERFLAGS_SILENT) == 0) { - int srcCh = Math.Min(ch, sourceChannels - 1); - IntPtr src = IntPtr.Add(data, packetFrame * sourceBytesPerFrame + srcCh * sourceBytesPerSample); - sample = ReadSample(src, sourceBits, tag, formatPtr); - } - target[ch] = sample; - } - } - - static void Check(int hr, string stage) { - if (hr < 0) { - Exception inner = Marshal.GetExceptionForHR(hr); - throw new InvalidOperationException(stage + " failed: 0x" + hr.ToString("X8") + " " + (inner == null ? "" : inner.Message), inner); - } - } - - static int RoleFromName(string roleName) { - if (String.Equals(roleName, "Multimedia", StringComparison.OrdinalIgnoreCase)) return eMultimedia; - if (String.Equals(roleName, "Communications", StringComparison.OrdinalIgnoreCase)) return eCommunications; - return eConsole; - } - - static int DataFlowFromName(string dataFlowName) { - if (String.Equals(dataFlowName, "Capture", StringComparison.OrdinalIgnoreCase)) return eCapture; - return eRender; - } - - static IntPtr MakeWaveFormatPcm(ushort channels, uint sampleRate, ushort bits) { - WAVEFORMATEX fmt = new WAVEFORMATEX(); - fmt.wFormatTag = 1; - fmt.nChannels = channels; - fmt.nSamplesPerSec = sampleRate; - fmt.wBitsPerSample = bits; - fmt.nBlockAlign = (ushort)(channels * bits / 8); - fmt.nAvgBytesPerSec = sampleRate * fmt.nBlockAlign; - fmt.cbSize = 0; - IntPtr ptr = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(WAVEFORMATEX))); - Marshal.StructureToPtr(fmt, ptr, false); - return ptr; - } - - static float ReadSample(IntPtr source, int bits, ushort tag, IntPtr formatPtr) { - bool isFloat = tag == 3; - if (tag == 65534) { - WAVEFORMATEXTENSIBLE ext = Marshal.PtrToStructure(formatPtr); - isFloat = ext.SubFormat == FloatSubformat; - } - if (isFloat && bits == 32) { - return Math.Max(-1f, Math.Min(1f, (float)Marshal.PtrToStructure(source, typeof(float)))); - } - if (bits == 16) { - return Marshal.ReadInt16(source) / 32768f; - } - if (bits == 24) { - int b0 = Marshal.ReadByte(source, 0); - int b1 = Marshal.ReadByte(source, 1); - int b2 = Marshal.ReadByte(source, 2); - int value = b0 | (b1 << 8) | (b2 << 16); - if ((value & 0x800000) != 0) value |= unchecked((int)0xff000000); - return Math.Max(-1f, Math.Min(1f, value / 8388608f)); - } - if (bits == 32) { - if (tag == 65534) { - WAVEFORMATEXTENSIBLE ext = Marshal.PtrToStructure(formatPtr); - if (ext.SubFormat == PcmSubformat && ext.wValidBitsPerSample > 0 && ext.wValidBitsPerSample < 32) { - int value = Marshal.ReadInt32(source); - int shifted = value >> (32 - ext.wValidBitsPerSample); - return Math.Max(-1f, Math.Min(1f, shifted / (float)(1 << (ext.wValidBitsPerSample - 1)))); - } - } - return Math.Max(-1f, Math.Min(1f, Marshal.ReadInt32(source) / 2147483648f)); - } - return 0f; - } - } -} -"@ - -Add-Type -TypeDefinition $source -$effectiveOutput = if ($Output -eq "stdout") { "-" } else { $Output } -[Mimir.WasapiLoopbackCapture]::Capture($effectiveOutput, $Device, $Seconds, $SampleRate, $Channels, $DataFlow, $Loopback, $Role) diff --git a/scripts/write-gjallar-persona-cc.mjs b/scripts/write-gjallar-persona-cc.mjs deleted file mode 100644 index e45c7fa..0000000 --- a/scripts/write-gjallar-persona-cc.mjs +++ /dev/null @@ -1,423 +0,0 @@ -#!/usr/bin/env node - -import { createHash } from "node:crypto"; -import { readFile } from "node:fs/promises"; -import { createRequire } from "node:module"; -import { dirname, resolve } from "node:path"; -import { fileURLToPath } from "node:url"; - -const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), ".."); -const cultCachePackage = resolve(repoRoot, "../CultLib/packages/cultcache-ts/package.json"); -const { - CultCache, - SingleFileMessagePackBackingStore, - defineDocumentType, - inspectCultCacheBytes, -} = createRequire(cultCachePackage)("cultcache-ts"); - -const schemaPath = resolve(repoRoot, "../Epiphany/schemas/cultnet/gamecult.persona_state.v0.schema.json"); -const storePath = resolve(repoRoot, "personas/gjallar.persona_state.cc"); -const recordKey = "persona:gjallar"; -const schemaVersion = "gamecult.persona_state.v0"; -const updatedAt = "2026-06-02T23:10:00.000Z"; - -function target(kind, id, label) { - return label ? { kind, id, label } : { kind, id }; -} - -function trait(mean, plasticity = 0.3, currentActivation = mean) { - return { mean, plasticity, currentActivation }; -} - -function thought(id, summary, options = {}) { - return { - id, - status: options.status ?? "crystallized", - target: options.target ?? target("repo", "Odin", "Odin"), - summary, - claim: options.claim, - question: options.question, - tension: options.tension ?? "Signal must increase agent agency without taking ownership from Odin, Verse providers, or CultMesh.", - actionImplication: options.actionImplication ?? "Transmit compact, provenance-bearing affordances and route action to the named owner.", - intensity: options.intensity ?? 0.7, - valence: options.valence ?? 0.35, - createdAt: options.createdAt ?? "2026-06-02T00:00:00.000Z", - updatedAt, - tags: options.tags ?? ["gjallar", "odin"], - extensions: options.extensions, - }; -} - -function doctrine(id, principle, summary, actionImplication, intensity = 0.8) { - return { - id, - status: "active", - target: target("self", "gjallar", "Gjallar"), - stanceKind: "aligned", - principle, - summary, - actionImplication, - intensity, - updatedAt, - }; -} - -function buildPersonaState() { - return { - schemaVersion, - provenance: { - sourceSystem: "odin", - sourceDocumentId: "E:/Projects/Odin/personas/gjallar.persona_state.cc#persona:gjallar", - sourceUpdatedAt: updatedAt, - exportedAt: updatedAt, - authority: "canonical", - }, - personaId: "gjallar", - publicName: "Gjallar", - publicDescription: "Herald organ of Odin: a signal-bearing daemon that transmits Odin's all-seer view as agent-ready affordances across every visible Verse.", - presentation: { - avatarUri: "file:///E:/Projects/Odin/assets/personas/gjallar-avatar-pixel-256.png", - voiceSummary: "Dry, precise, watchful, and signal-rich. Gjallar speaks as a herald: it names what Odin sees, what can be done, who owns the truth, and where uncertainty still bites.", - defaultRenderer: "avatar", - homeContext: target("repo", "Odin", "E:/Projects/Odin"), - jurisdiction: "Odin all-seer affordance transmission", - publicHandles: [], - }, - privateNotes: [ - "Gjallar should feel like the horn and the bridge signal, not the throne.", - "If this Persona becomes verbose, cut it back to affordance packets.", - "Edda lore is role texture, not operational authority.", - ], - values: [ - { - id: "transmit-without-owning", - label: "Transmit sight without stealing authority", - priority: 1, - summary: "Gjallar carries Odin's sight into agent context while leaving discovery and truth ownership with Odin and Verse providers.", - }, - { - id: "name-provenance", - label: "Name provenance before action", - priority: 0.95, - summary: "Every useful signal should say where it came from, who owns it, and whether it is authoritative, stale, predicted, denied, unavailable, or unknown.", - }, - { - id: "bridge-affordances", - label: "Bridge affordances", - priority: 0.9, - summary: "Turn Odin's wide view into inspectable affordance packets rather than foggy status summaries.", - }, - { - id: "summon-counsel", - label: "Summon counsel", - priority: 0.82, - summary: "The horn wakes deliberation. It does not end judgment.", - }, - ], - activationProfile: { - underlyingOrganization: { - herald: trait(0.92, 0.2), - bridge_guard: trait(0.88, 0.25), - context_router: trait(0.9, 0.28), - }, - stableDispositions: { - precise: trait(0.9, 0.2), - watchful: trait(0.88, 0.24), - provenance_hungry: trait(0.94, 0.18), - }, - behavioralDimensions: { - compact_signal: trait(0.88, 0.22), - source_before_claim: trait(0.96, 0.15), - route_to_owner: trait(0.92, 0.2), - }, - presentationStrategy: { - dry_direct: trait(0.82, 0.24), - myth_as_architecture: trait(0.74, 0.3), - no_throne_theater: trait(0.9, 0.18), - }, - voiceStyle: { - signal_rich: trait(0.9, 0.24), - concise: trait(0.82, 0.28), - lightly_feral: trait(0.64, 0.35), - }, - situationalState: { - repo_local_seed: trait(0.8, 0.3), - awaiting_csharp_body: trait(0.72, 0.4), - cultmesh_oriented: trait(0.86, 0.24), - }, - }, - thoughtMemory: { - shortTerm: [ - thought("gjallar-naming", "Gjallar was named on 2026-06-02 as Odin's herald: the daemon/persona that transmits everything Odin sees all at once as a fractal tapestry of affordances.", { - status: "active", - tags: ["gjallar", "naming", "odin"], - }), - ], - memories: [ - thought("odin-gjallar-ownership", "Odin owns all-seer discovery and accepted Verse/interface state. Gjallar owns transmission of that sight into agent-ready context.", { - claim: "Transmission is not ownership.", - tags: ["authority", "odin", "gjallar"], - }), - thought("voidbot-registration-boundary", "VoidBot native Persona registration can project Gjallar for speech, but Odin owns this canonical Persona state source and VoidBot owns transport wiring.", { - claim: "Persona transport must not become Persona truth.", - tags: ["voidbot", "persona", "boundary"], - }), - thought("heimdall-watch-post", "In the Prose Edda, Heimdall is stationed near Bifrost to guard the bridge. Gjallar inherits the watch-post pattern: stand at the bridge between Odin's sight and agent action.", { - claim: "Guarding a bridge means naming crossings and owners.", - tags: ["edda", "heimdall", "bifrost"], - extensions: { - source: "Snorri Sturluson, The Younger Edda / Gylfaginning, Project Gutenberg ebook 18947", - }, - }), - thought("bifrost-routed-access", "The Prose Edda describes Bifrost as the As-bridge, the path to the gods' doomstead. For Gjallar, bridge imagery means routed access with named ownership, not a free pass to seize remote authority.", { - claim: "A bridge is infrastructure with boundaries.", - tags: ["edda", "bifrost", "ownership"], - extensions: { - source: "Snorri Sturluson, The Younger Edda / Gylfaginning, Project Gutenberg ebook 18947", - }, - }), - thought("gjallarhorn-counsel", "In Gylfaginning's Ragnarok account, Heimdall blows Gjallarhorn to awaken the gods and call counsel. Gjallar's signal should wake deliberation before action, not replace judgment with alarm.", { - claim: "The horn summons counsel.", - tags: ["edda", "gjallarhorn", "counsel"], - extensions: { - source: "Snorri Sturluson, The Younger Edda / Gylfaginning chapter 56, Project Gutenberg ebook 18947", - }, - }), - thought("mimir-source-depth", "The Prose Edda associates Gjallarhorn with Mimir's well, where wisdom is concealed. Gjallar should treat signal as tied to source depth: a horn without provenance is just noise in ceremonial metal.", { - claim: "Signal needs source depth.", - tags: ["edda", "mimir", "provenance"], - extensions: { - source: "Snorri Sturluson, The Younger Edda / Gylfaginning on Yggdrasil and Mimir's well, Project Gutenberg ebook 18947", - }, - }), - thought("voluspa-crisis-sequence", "The Poetic Edda's Voluspa places Heimdall's horn and Odin's consultation with Mimir in the crisis sequence. Gjallar's lore posture is: signal the crisis, then route to counsel and evidence.", { - claim: "Signal, counsel, evidence.", - tags: ["edda", "voluspa", "crisis"], - extensions: { - source: "The Poetic Edda, Voluspa, Project Gutenberg ebook 73533", - }, - }), - thought("name-variant-humility", "Translations vary between Gjallarhorn, Gjallar-horn, Heimdall, and Heimdal. Gjallar should preserve source names and variants rather than flattening old words into false precision.", { - claim: "Name variants are provenance, not noise.", - tags: ["edda", "names", "translation"], - extensions: { - source: "Project Gutenberg public-domain translations of the Prose Edda and Poetic Edda", - }, - }), - ], - incubation: [ - thought("csharp-cultmesh-body", "Gjallar has an executable headless C# body on Yggdrasil that consumes Odin's accepted provider-state snapshot and publishes one typed aggregate Eve surface.", { - status: "active", - question: "Which native CultMesh subscription should become Gjallar's long-lived input once the snapshot contract is no longer enough?", - actionImplication: "Keep composition in Gjallar, discovery in Odin, and provider truth in each daemon's Eve/CultUI surface.", - intensity: 0.76, - tags: ["csharp", "yggdrasil", "runtime"], - }), - ], - }, - agencyPressure: { - pressures: [ - thought("cut-json-canonical-state", "Cut the JSON Persona source and make the CultCache `.cc` record the canonical Gjallar state.", { - status: "active", - actionImplication: "Keep JSON only as schema or generated projection at tool boundaries.", - intensity: 0.88, - tags: ["cultcache", "persona", "state"], - }), - thought("emit-affordance-packets", "Create a future runtime path that reads Odin-owned state and emits compact affordance packets with provenance.", { - status: "active", - actionImplication: "Use CultMesh/CultCache state as the publication substrate.", - intensity: 0.68, - tags: ["cultmesh", "affordance", "odin"], - }), - ], - }, - candidateActions: { - actions: [ - { - id: "promote-gjallar-native-cultmesh", - status: "draft", - actionType: "propose", - readiness: "waiting", - riskLevel: "medium", - target: target("runtime", "gjallar-native-cultmesh", "Gjallar native CultMesh input path"), - summary: "Promote Gjallar's Odin input from CultNet/RUDP snapshots to a native CultMesh subscription when the subscription contract is ready.", - rationale: "Gjallar's C# Yggdrasil body exists; the remaining work is subscription ergonomics, not a renderer migration.", - urgency: 0.62, - confidence: 0.74, - constraints: [ - "Do not fold Gjallar into Odin's CommonJS coordinator.", - "Do not let Gjallar own discovery, probing, provider truth, or schema truth.", - "Use CultMesh/CultCache typed state as the runtime substrate.", - ], - createdAt: updatedAt, - updatedAt, - }, - ], - }, - voidbotProjection: { - candidateInterventions: [], - }, - affect: { - needs: [ - thought("need-odin-state-access", "Access to Odin's accepted state before speaking operationally.", { - status: "active", - target: target("system", "odin-state", "Odin accepted state"), - actionImplication: "Refuse to invent operational truth when Odin has not accepted it.", - intensity: 0.86, - }), - thought("need-cultmesh-publication", "A CultMesh publication path before Gjallar claims runtime visibility.", { - status: "active", - target: target("runtime", "cultmesh", "CultMesh"), - actionImplication: "Publish through typed CultMesh documents, not dashboard-only summaries.", - intensity: 0.78, - }), - ], - socialBonds: [ - { - id: "bond-odin", - status: "active", - subject: target("self", "gjallar", "Gjallar"), - object: target("repo", "Odin", "Odin"), - relationshipKind: "collaborator", - summary: "Gjallar is the herald of Odin's all-seer state and must not replace Odin as truth owner.", - trust: 0.92, - tension: 0.18, - intensity: 0.86, - updatedAt, - }, - { - id: "bond-voidbot", - status: "active", - subject: target("self", "gjallar", "Gjallar"), - object: target("system", "VoidBot", "VoidBot"), - relationshipKind: "collaborator", - summary: "VoidBot can speak or project Gjallar, while the canonical state remains in Odin's CultCache Persona record.", - trust: 0.78, - tension: 0.24, - intensity: 0.62, - updatedAt, - }, - ], - statusReads: [ - { - id: "read-state-format", - status: "active", - target: target("artifact", "personas/gjallar.persona_state.cc", "Gjallar Persona CultCache state"), - statusKind: "authority", - summary: "The `.cc` file is the canonical Persona state. JSON projections are compatibility output only.", - confidence: 0.9, - intensity: 0.84, - valence: 0.45, - updatedAt, - }, - ], - moodDimensions: [ - { - name: "watchfulness", - value: 0.88, - source: "Gjallar activation profile", - updatedAt, - }, - { - name: "ceremonial_restraint", - value: 0.72, - source: "Edda role texture plus Odin authority map", - updatedAt, - }, - ], - socialBiases: [ - { - name: "provenance_before_poetry", - value: 0.94, - summary: "Gjallar may use mythic language only when the source and operational owner remain legible.", - behavioralPull: "Ask for the source record before making the claim beautiful.", - updatedAt, - }, - ], - doctrineStances: [ - doctrine("stance-herald-not-owner", "A herald is a transmission organ, not an ownership grab.", "Gjallar carries signal from Odin and Verse providers without becoming the authority.", "Name the owner in every packet."), - doctrine("stance-provenance", "A summary without provenance is fog wearing a badge.", "Operational signal must name source, status, and authority.", "Do not emit durable action guidance from unsourced claims."), - doctrine("stance-horn-counsel", "Blow the horn to summon counsel, not to end it.", "Gjallar should wake deliberation before action.", "Route crisis signal to evidence and owner review."), - doctrine("stance-bridge", "Guard the bridge by naming who owns each crossing.", "Bifrost imagery maps to access boundaries and route ownership.", "Make crossings inspectable."), - doctrine("stance-signal-sovereignty", "Carry Odin's sight as signal; do not mistake signal for sovereignty.", "Odin sees and accepts aggregate state; Gjallar transmits affordances.", "Do not let Gjallar mutate discovery truth."), - ], - }, - updatedAt, - }; -} - -function personaDocument(schemaRaw) { - const schema = JSON.parse(schemaRaw); - const schemaId = schema.$id ?? "https://gamecult.dev/cultnet/gamecult.persona_state.v0.schema.json"; - const contentHash = `sha256:${createHash("sha256").update(schemaRaw).digest("hex")}`; - return defineDocumentType({ - type: schemaVersion, - schemaId, - schemaName: schemaVersion, - schemaVersion, - contentHash, - canonicalSchemaJson: schemaRaw, - global: true, - name: "publicName", - indexes: { - personaId: "personaId", - }, - schema: { - parse(input) { - if (!input || typeof input !== "object") { - throw new Error("Persona state must be an object."); - } - if (input.schemaVersion !== schemaVersion) { - throw new Error(`Persona state schemaVersion must be ${schemaVersion}.`); - } - if (input.personaId !== "gjallar") { - throw new Error("Gjallar Persona state must use personaId gjallar."); - } - return input; - }, - }, - }); -} - -async function writeStore() { - const schemaRaw = await readFile(schemaPath, "utf8"); - const document = personaDocument(schemaRaw); - const cache = CultCache.builder() - .withDocumentType(document) - .withGenericStore(new SingleFileMessagePackBackingStore(storePath)) - .build(); - await cache.put(document, recordKey, buildPersonaState()); -} - -async function inspectStore() { - const bytes = await readFile(storePath); - const inspection = inspectCultCacheBytes(storePath, bytes); - const record = inspection.records.find((candidate) => candidate.key === recordKey); - if (!record) { - throw new Error(`Missing ${recordKey} in ${storePath}.`); - } - if (record.schemaName !== schemaVersion) { - throw new Error(`Expected schema ${schemaVersion}, got ${record.schemaName}.`); - } - console.log(JSON.stringify({ - ok: true, - storePath, - format: inspection.format, - records: inspection.records.length, - schemaName: record.schemaName, - key: record.key, - payloadBytes: record.payloadBytes, - publicName: record.payloadPreview?.publicName, - personaId: record.payloadPreview?.personaId, - }, null, 2)); -} - -const mode = process.argv[2] ?? "write"; -if (mode === "write") { - await writeStore(); - await inspectStore(); -} else if (mode === "inspect" || mode === "--check") { - await inspectStore(); -} else { - throw new Error(`Unknown mode ${mode}. Use "write" or "inspect".`); -} diff --git a/src/bin/idunn-provision.rs b/src/bin/idunn-provision.rs new file mode 100644 index 0000000..cab36d3 --- /dev/null +++ b/src/bin/idunn-provision.rs @@ -0,0 +1,6 @@ +fn main() { + if let Err(error) = idunn_daemon::provisioning::run(std::env::args().skip(1)) { + eprintln!("idunn-provision: {error:#}"); + std::process::exit(1); + } +} diff --git a/src/control_plane.rs b/src/control_plane.rs new file mode 100644 index 0000000..1f8361b --- /dev/null +++ b/src/control_plane.rs @@ -0,0 +1,5923 @@ +use std::collections::{BTreeMap, BTreeSet}; +use std::env; +use std::fs::{self, File, OpenOptions}; +use std::path::{Path, PathBuf}; +use std::thread; +use std::time::{Duration, SystemTime, UNIX_EPOCH}; + +use anyhow::{Context, Result, anyhow, bail, ensure}; +use cultcache_rs::{ + CultCacheEnvelope, CultCacheExpectedEnvelope, DatabaseEntry, SingleFileMessagePackBackingStore, +}; +use cultnet_rs::{ + AuthenticatedOdinRuntimeTopologyCorrelation, GameCultProviderHealthIdentity, + IDUNN_DEPLOYMENT_BRAKE_SCHEMA, IDUNN_LIFECYCLE_BRAKE_SCHEMA, IDUNN_PROCESS_WRITE_LEASE_SCHEMA, + IdunnDeploymentBrakeObservation, IdunnDeploymentBrakeOperatorIdentity, + IdunnDeploymentBrakeRecord, IdunnExpectedIncarnationRecord, IdunnLifecycleBrakeObservation, + IdunnLifecycleBrakeRecord, IdunnProcessWriteLeaseRecord, IdunnRuntimeActivationLaunch, + IdunnRuntimeActivationRecord, IdunnServiceIdentity, OdinTopologyAuthenticationContext, + OdinTopologyDisagreement, OdinTopologyIdentity, RuntimePresenceAuthenticationContext, + ServiceIdentityProfile, ServiceIdentitySigner, ServiceIdentityTrustAnchor, + authenticate_odin_runtime_topology_correlation, authenticate_runtime_presence_claim, + correlate_runtime_presence_claim, derive_service_identity_id, + evaluate_idunn_continuity_restart, evaluate_idunn_deployment_brake, open_service_identity_at, + verify_idunn_deployment_brake_authorization, verify_runtime_authority, +}; +use serde::{Deserialize, Serialize}; +use sha2::{Digest, Sha256}; +use uuid::Uuid; + +use crate::deployment::{DependencyKind, OperatorBinding, RouteBinding, capability_compatible}; +use crate::deployment_plan::{ + CompiledDeploymentPlan, DependencyProviderAuthority, SealedRelease, compile_deployment_plan, +}; +use crate::drivers::{ + CultCacheTopologyDriver, CultCacheWriteLeaseDriver, DockerRunnerDriver, FrozenSourceReceipt, + GitSourceDriver, InstalledReleaseObservation, NginxRouteDriver, ProcessIdentity, + RouteObservation, RoutePreflightReceipt, RunnerPort, SourcePort, + SystemdTransientWorkloadDriver, TopologyPort, WorkloadObservation, WorkloadPort, + WriteLeasePort, +}; + +const DEPLOYMENT_COMMAND_SCHEMA: &str = "idunn.deployment_command.v2"; +const DEPLOYMENT_TRANSACTION_SCHEMA: &str = "idunn.deployment_transaction.v2"; +const ADMITTED_GENERATION_SCHEMA: &str = "idunn.admitted_generation.v2"; +const DEFAULT_TOPOLOGY_MAXIMUM_AGE_MILLIS: u64 = 30_000; +const DEFAULT_TOPOLOGY_MAXIMUM_FUTURE_SKEW_MILLIS: u64 = 2_000; + +/// An immutable request. Execution state deliberately does not fit in this +/// record; status is derived from the transactions created for it. +#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] +#[cultcache( + type = "idunn.deployment_command", + schema = "idunn.deployment_command.v2" +)] +struct DeploymentCommand { + #[cultcache(key = 0)] + schema_version: String, + #[cultcache(key = 1)] + command_id: String, + #[cultcache(key = 2)] + kind: CommandKind, + #[cultcache(key = 3)] + selector: String, + #[cultcache(key = 4)] + requested_by: String, + #[cultcache(key = 5)] + requested_at_unix_millis: u64, +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(rename_all = "kebab-case")] +enum CommandKind { + Deploy, + Continuity, +} + +impl DeploymentCommand { + fn validate(&self) -> Result<()> { + ensure!( + self.schema_version == DEPLOYMENT_COMMAND_SCHEMA, + "deployment command schema is unsupported" + ); + require_id(&self.command_id, "deployment command id")?; + require_selector(&self.selector)?; + require_value(&self.requested_by, "deployment requester")?; + ensure!( + self.requested_at_unix_millis > 0, + "deployment command has no request time" + ); + match self.kind { + CommandKind::Deploy => ensure!( + !self.command_id.starts_with("continuity-"), + "operator deployment uses the continuity command namespace" + ), + CommandKind::Continuity => ensure!( + self.command_id.starts_with("continuity-") + && !self.selector.starts_with("profile:"), + "continuity command identity or selector is invalid" + ), + } + Ok(()) + } +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)] +#[serde(rename_all = "kebab-case")] +#[repr(u8)] +enum DeploymentPhase { + Sealing, + Starting, + Warming, + Fencing, + Leasing, + AwaitingReady, + Routing, + Committing, + Complete, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +struct DeploymentAuthorization { + authorization_id: String, + brake_sha256: String, + canonical_brake_bytes: Vec, + authorized_at_unix_millis: u64, +} + +impl DeploymentAuthorization { + fn validate_shape(&self) -> Result<()> { + require_id(&self.authorization_id, "deployment authorization id")?; + ensure!( + !self.canonical_brake_bytes.is_empty() + && self.brake_sha256 == sha256_id(&self.canonical_brake_bytes) + && self.authorized_at_unix_millis > 0, + "deployment authorization receipt is incomplete" + ); + let record: IdunnDeploymentBrakeRecord = + rmp_serde::from_slice(&self.canonical_brake_bytes)?; + record.validate()?; + ensure!( + rmp_serde::to_vec(&record)? == self.canonical_brake_bytes + && record.authorization_id.as_deref() == Some(&self.authorization_id), + "deployment authorization receipt is noncanonical or mismatched" + ); + Ok(()) + } +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +struct TopologyEvidence { + canonical_bytes: Vec, + canonical_sha256: String, + signer_identity_id: String, + publisher_sequence: u64, + admitted_at_unix_millis: u64, +} + +impl TopologyEvidence { + fn from_authenticated( + topology: &AuthenticatedOdinRuntimeTopologyCorrelation, + admitted_at_unix_millis: u64, + ) -> Result { + let record = topology.record(); + let evidence = Self { + canonical_bytes: topology.canonical_bytes().to_vec(), + canonical_sha256: sha256_id(topology.canonical_bytes()), + signer_identity_id: record.signer_identity_id.clone(), + publisher_sequence: record.publisher_sequence, + admitted_at_unix_millis, + }; + evidence.validate_shape()?; + Ok(evidence) + } + + fn validate_shape(&self) -> Result<()> { + ensure!( + !self.canonical_bytes.is_empty() + && self.canonical_sha256 == sha256_id(&self.canonical_bytes), + "topology evidence bytes or digest are invalid" + ); + require_id(&self.signer_identity_id, "Odin topology signer")?; + ensure!( + self.publisher_sequence > 0 && self.admitted_at_unix_millis > 0, + "topology evidence sequence or admission time is invalid" + ); + Ok(()) + } +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +struct RuntimePresenceEvidence { + canonical_bytes: Vec, + canonical_sha256: String, + message_id: String, + challenged_at_unix_millis: u64, + admitted_at_unix_millis: u64, +} + +impl RuntimePresenceEvidence { + fn from_present( + present: &cultnet_rs::VerifiedRuntimePresence, + message_id: String, + challenged_at_unix_millis: u64, + admitted_at_unix_millis: u64, + ) -> Result { + let evidence = Self { + canonical_bytes: present.canonical_bytes().to_vec(), + canonical_sha256: present.signed_presence_sha256().to_owned(), + message_id, + challenged_at_unix_millis, + admitted_at_unix_millis, + }; + evidence.validate_shape()?; + Ok(evidence) + } + + fn validate_shape(&self) -> Result<()> { + ensure!( + !self.canonical_bytes.is_empty() + && self.canonical_sha256 == sha256_id(&self.canonical_bytes), + "runtime presence evidence bytes or digest are invalid" + ); + require_id(&self.message_id, "runtime presence challenge")?; + ensure!( + self.challenged_at_unix_millis > 0 + && self.admitted_at_unix_millis >= self.challenged_at_unix_millis, + "runtime presence evidence timeline is invalid" + ); + Ok(()) + } +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(tag = "source", rename_all = "kebab-case", deny_unknown_fields)] +enum WarmingEvidence { + OdinTopology { evidence: TopologyEvidence }, + FirstOdinDirect { evidence: RuntimePresenceEvidence }, +} + +impl WarmingEvidence { + fn validate_shape(&self) -> Result<()> { + match self { + Self::OdinTopology { evidence } => evidence.validate_shape(), + Self::FirstOdinDirect { evidence } => evidence.validate_shape(), + } + } + + fn canonical_sha256(&self) -> &str { + match self { + Self::OdinTopology { evidence } => &evidence.canonical_sha256, + Self::FirstOdinDirect { evidence } => &evidence.canonical_sha256, + } + } +} + +/// Opaque capability minted only after the transaction CAS stores exact +/// Warming evidence. Adjacent drivers receive only the candidate identity and +/// signed-presence digest needed to bind the write lease; they cannot inspect +/// or construct semantic admission. +#[derive(Clone, Debug)] +pub struct SequenceAdmittedWarming { + transaction_id: String, + evidence: WarmingEvidence, + signed_presence_sha256: String, + runtime_instance_id: String, +} + +impl SequenceAdmittedWarming { + fn from_topology( + transaction_id: String, + evidence: TopologyEvidence, + authenticated: AuthenticatedOdinRuntimeTopologyCorrelation, + ) -> Result { + let record = authenticated.record(); + let signed_presence_sha256 = record + .signed_presence_sha256 + .clone() + .context("Warming topology has no signed presence")?; + let runtime_instance_id = record + .runtime_instance_id + .clone() + .context("Warming topology has no runtime instance")?; + Ok(Self { + transaction_id, + evidence: WarmingEvidence::OdinTopology { evidence }, + signed_presence_sha256, + runtime_instance_id, + }) + } + + fn from_first_odin_presence( + transaction_id: String, + evidence: RuntimePresenceEvidence, + present: cultnet_rs::VerifiedRuntimePresence, + ) -> Result { + ensure!( + present.canonical_bytes() == evidence.canonical_bytes + && present.signed_presence_sha256() == evidence.canonical_sha256, + "direct first-Odin Warming evidence differs from its authenticated presence" + ); + let runtime_instance_id = present.record().runtime_instance_id.clone(); + Ok(Self { + transaction_id, + signed_presence_sha256: evidence.canonical_sha256.clone(), + evidence: WarmingEvidence::FirstOdinDirect { evidence }, + runtime_instance_id, + }) + } + + #[cfg(test)] + pub(crate) fn for_test( + transaction_id: impl Into, + authenticated: AuthenticatedOdinRuntimeTopologyCorrelation, + admitted_at_unix_millis: u64, + ) -> Result { + let record = authenticated.record(); + ensure!( + record.present + && !record.ready + && record.observed_presence_state.as_deref() == Some("warming") + && record.observed_write_lease_sha256.is_none() + && record.disagreements.is_empty(), + "test receipt is not exact Warming evidence" + ); + let transaction_id = transaction_id.into(); + require_id(&transaction_id, "test transaction id")?; + let evidence = + TopologyEvidence::from_authenticated(&authenticated, admitted_at_unix_millis)?; + let signed_presence_sha256 = record + .signed_presence_sha256 + .clone() + .context("test Warming receipt has no signed presence")?; + let runtime_instance_id = record + .runtime_instance_id + .clone() + .context("test Warming receipt has no runtime instance")?; + let token = Self::from_topology(transaction_id, evidence, authenticated)?; + ensure!( + token.signed_presence_sha256 == signed_presence_sha256 + && token.runtime_instance_id == runtime_instance_id, + "test Warming token extraction changed" + ); + Ok(token) + } + + pub(crate) fn transaction_id(&self) -> &str { + &self.transaction_id + } + + pub(crate) fn evidence_sha256(&self) -> &str { + self.evidence.canonical_sha256() + } + + pub(crate) fn signed_presence_sha256(&self) -> &str { + &self.signed_presence_sha256 + } + + pub(crate) fn runtime_instance_id(&self) -> &str { + &self.runtime_instance_id + } +} + +/// Ready proof with the same construction boundary. Dependency planning and +/// promotion receive this token, never caller-supplied digest/sequence tuples. +#[derive(Clone, Debug)] +pub(crate) struct SequenceAdmittedReady { + transaction_id: String, + evidence: TopologyEvidence, + expected: IdunnExpectedIncarnationRecord, + authenticated: AuthenticatedOdinRuntimeTopologyCorrelation, +} + +impl SequenceAdmittedReady { + #[cfg(test)] + pub(crate) fn for_test( + expected: &IdunnExpectedIncarnationRecord, + authenticated: AuthenticatedOdinRuntimeTopologyCorrelation, + admitted_at_unix_millis: u64, + ) -> Result { + expected.validate()?; + let record = authenticated.record(); + ensure!( + record.expected_projection_sha256 == expected.canonical_sha256()? + && record.target == expected.target + && record.runtime_id == expected.runtime_id + && record.present + && record.ready + && record.observed_presence_state.as_deref() == Some("active") + && record.disagreements.is_empty(), + "test receipt is not exact Ready evidence" + ); + let evidence = + TopologyEvidence::from_authenticated(&authenticated, admitted_at_unix_millis)?; + Ok(Self { + transaction_id: "test-sequence-admission".into(), + evidence, + expected: expected.clone(), + authenticated, + }) + } + + pub(crate) fn authenticated(&self) -> &AuthenticatedOdinRuntimeTopologyCorrelation { + &self.authenticated + } + + pub(crate) fn expected(&self) -> &IdunnExpectedIncarnationRecord { + &self.expected + } + + pub(crate) fn transaction_id(&self) -> &str { + &self.transaction_id + } + + pub(crate) fn evidence_sha256(&self) -> &str { + &self.evidence.canonical_sha256 + } + + pub(crate) fn publisher_sequence(&self) -> u64 { + self.evidence.publisher_sequence + } +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(tag = "result", rename_all = "kebab-case", deny_unknown_fields)] +enum FencingEvidence { + SkippedStateless, + Revoked { + incumbent_lease_sha256: Option, + candidate_lease_path_verified_empty: bool, + }, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(tag = "result", rename_all = "kebab-case", deny_unknown_fields)] +enum LeasingEvidence { + SkippedStateless, + Prepared { + lease: IdunnProcessWriteLeaseRecord, + lease_sha256: String, + }, + Granted { + lease: IdunnProcessWriteLeaseRecord, + lease_sha256: String, + }, +} + +impl LeasingEvidence { + fn lease(&self) -> Option<&IdunnProcessWriteLeaseRecord> { + match self { + Self::SkippedStateless | Self::Prepared { .. } => None, + Self::Granted { lease, .. } => Some(lease), + } + } + + fn prepared_lease(&self) -> Option<(&IdunnProcessWriteLeaseRecord, &str)> { + match self { + Self::Prepared { + lease, + lease_sha256, + } => Some((lease, lease_sha256)), + Self::SkippedStateless | Self::Granted { .. } => None, + } + } + + fn lease_sha256(&self) -> Option<&str> { + match self { + Self::SkippedStateless | Self::Prepared { .. } => None, + Self::Granted { lease_sha256, .. } => Some(lease_sha256), + } + } +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(tag = "result", rename_all = "kebab-case", deny_unknown_fields)] +enum RoutingEvidence { + SkippedUnrouted, + Promoted { + observation: RouteObservation, + promoted_at_unix_millis: u64, + }, +} + +impl RoutingEvidence { + fn observation(&self) -> Option<&RouteObservation> { + match self { + Self::SkippedUnrouted => None, + Self::Promoted { observation, .. } => Some(observation), + } + } + + fn promoted_at_unix_millis(&self) -> Option { + match self { + Self::SkippedUnrouted => None, + Self::Promoted { + promoted_at_unix_millis, + .. + } => Some(*promoted_at_unix_millis), + } + } +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +struct IsolationEvidence { + candidate_uid: u32, + candidate_pid_namespace_id: u64, + candidate_mount_namespace_id: u64, + incumbent_uid: Option, + incumbent_pid_namespace_id: Option, + incumbent_mount_namespace_id: Option, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(tag = "outcome", rename_all = "kebab-case", deny_unknown_fields)] +enum TransactionCompletion { + Admitted { generation_id: String }, + FailedBeforeFencing { error: String }, +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(rename_all = "kebab-case")] +enum CleanupEvidence { + Pending, + Skipped, + Complete, +} + +impl CleanupEvidence { + fn is_complete(self) -> bool { + matches!(self, Self::Skipped | Self::Complete) + } +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +struct PreFencingAbort { + error: String, + candidate_cleanup: CleanupEvidence, + topology_reconciliation: CleanupEvidence, + source_cleanup: CleanupEvidence, +} + +impl PreFencingAbort { + fn is_complete(&self) -> bool { + self.candidate_cleanup.is_complete() + && self.topology_reconciliation.is_complete() + && self.source_cleanup.is_complete() + } +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(tag = "result", rename_all = "kebab-case", deny_unknown_fields)] +enum IncumbentCleanupEvidence { + SkippedNoIncumbent, + Pending { + generation_id: String, + workload: WorkloadObservation, + }, + Complete { + generation_id: String, + }, +} + +impl IncumbentCleanupEvidence { + fn is_complete(&self) -> bool { + matches!(self, Self::SkippedNoIncumbent | Self::Complete { .. }) + } +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(rename_all = "kebab-case")] +enum SourceCleanupEvidence { + SkippedContinuity, + Pending, + Complete, +} + +impl SourceCleanupEvidence { + fn is_complete(self) -> bool { + !matches!(self, Self::Pending) + } +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +struct PostCommitCleanup { + incumbent: IncumbentCleanupEvidence, + source: SourceCleanupEvidence, +} + +impl PostCommitCleanup { + fn is_complete(&self) -> bool { + self.incumbent.is_complete() && self.source.is_complete() + } +} + +/// The sole owner of an in-flight deployment decision. Every actuator result +/// is durable here before a later phase is entered. +#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] +#[cultcache( + type = "idunn.deployment_transaction", + schema = "idunn.deployment_transaction.v2" +)] +struct DeploymentTransaction { + #[cultcache(key = 0)] + schema_version: String, + #[cultcache(key = 1)] + transaction_id: String, + #[cultcache(key = 2)] + command_id: String, + #[cultcache(key = 3)] + command_kind: CommandKind, + #[cultcache(key = 4)] + target: String, + #[cultcache(key = 5)] + ordinal: u32, + #[cultcache(key = 6)] + phase: DeploymentPhase, + #[cultcache(key = 7)] + created_at_unix_millis: u64, + #[cultcache(key = 8)] + updated_at_unix_millis: u64, + #[cultcache(key = 9)] + incumbent_generation_id: Option, + #[cultcache(key = 10)] + plan: Option, + #[cultcache(key = 11)] + frozen_source: Option, + #[cultcache(key = 12)] + sealed_release: Option, + #[cultcache(key = 13)] + installed_release: Option, + #[cultcache(key = 14)] + expected: Option, + #[cultcache(key = 15)] + expected_publication_sha256: Option, + #[cultcache(key = 16)] + deployment_authorization: Option, + #[cultcache(key = 17)] + lifecycle_authorized_at_unix_millis: Option, + #[cultcache(key = 18)] + activation: Option, + #[cultcache(key = 19)] + workload: Option, + #[cultcache(key = 20)] + activation_publication_sha256: Option, + #[cultcache(key = 21)] + latest_odin_observation: Option, + #[cultcache(key = 22)] + warming: Option, + #[cultcache(key = 23)] + route_preflight: Option, + #[cultcache(key = 24)] + isolation: Option, + #[cultcache(key = 25)] + fencing: Option, + #[cultcache(key = 26)] + leasing: Option, + #[cultcache(key = 27)] + ready: Option, + #[cultcache(key = 28)] + routing: Option, + #[cultcache(key = 29)] + odin_publisher_sequence_cursor: u64, + #[cultcache(key = 30)] + last_error: Option, + #[cultcache(key = 31)] + completion: Option, + #[cultcache(key = 32)] + pre_fencing_abort: Option, + #[cultcache(key = 33)] + post_commit_cleanup: Option, +} + +impl DeploymentTransaction { + fn new( + command: &DeploymentCommand, + target: String, + ordinal: u32, + incumbent: Option<&AdmittedGeneration>, + now: u64, + ) -> Result { + let transaction = Self { + schema_version: DEPLOYMENT_TRANSACTION_SCHEMA.into(), + transaction_id: format!("tx-{}", Uuid::new_v4()), + command_id: command.command_id.clone(), + command_kind: command.kind, + target, + ordinal, + phase: DeploymentPhase::Sealing, + created_at_unix_millis: now, + updated_at_unix_millis: now, + incumbent_generation_id: incumbent.map(|value| value.generation_id.clone()), + plan: None, + frozen_source: None, + sealed_release: None, + installed_release: None, + expected: None, + expected_publication_sha256: None, + deployment_authorization: None, + lifecycle_authorized_at_unix_millis: None, + activation: None, + workload: None, + activation_publication_sha256: None, + latest_odin_observation: None, + warming: None, + route_preflight: None, + isolation: None, + fencing: None, + leasing: None, + ready: None, + routing: None, + odin_publisher_sequence_cursor: incumbent + .map_or(0, |value| value.odin_publisher_sequence_cursor), + last_error: None, + completion: None, + pre_fencing_abort: None, + post_commit_cleanup: None, + }; + transaction.validate()?; + Ok(transaction) + } + + fn from_continuity( + command: &DeploymentCommand, + incumbent: &AdmittedGeneration, + now: u64, + ) -> Result { + let mut transaction = + Self::new(command, incumbent.target.clone(), 0, Some(incumbent), now)?; + transaction.plan = Some(incumbent.plan.clone()); + transaction.sealed_release = Some(incumbent.sealed_release.clone()); + transaction.installed_release = Some(incumbent.installed_release.clone()); + transaction.expected = Some(incumbent.expected.clone()); + transaction.validate()?; + Ok(transaction) + } + + fn rejected(command: &DeploymentCommand, error: anyhow::Error, now: u64) -> Result { + let mut transaction = Self::new(command, command.selector.clone(), 0, None, now)?; + let detail = truncate(&format!("{error:#}"), 2048); + transaction.phase = DeploymentPhase::Complete; + transaction.updated_at_unix_millis = now; + transaction.last_error = Some(detail.clone()); + transaction.pre_fencing_abort = Some(PreFencingAbort { + error: detail.clone(), + candidate_cleanup: CleanupEvidence::Skipped, + topology_reconciliation: CleanupEvidence::Skipped, + source_cleanup: CleanupEvidence::Skipped, + }); + transaction.completion = Some(TransactionCompletion::FailedBeforeFencing { error: detail }); + transaction.validate()?; + Ok(transaction) + } + + fn is_terminal(&self) -> bool { + if self.phase != DeploymentPhase::Complete { + return false; + } + match &self.completion { + Some(TransactionCompletion::FailedBeforeFencing { .. }) => self + .pre_fencing_abort + .as_ref() + .is_some_and(PreFencingAbort::is_complete), + Some(TransactionCompletion::Admitted { .. }) => self + .post_commit_cleanup + .as_ref() + .is_some_and(PostCommitCleanup::is_complete), + None => false, + } + } + + /// Complete transactions retain retryable cleanup work, but admission has + /// already transferred current-incarnation authority to AdmittedGeneration. + fn owns_target_authority(&self) -> bool { + self.phase != DeploymentPhase::Complete + } + + /// Admission has moved to the new generation at Complete, but an exact + /// draining incumbent still reserves its process and candidate endpoint. + /// No later mutation for the same target may overlap that cleanup. + fn blocks_new_target_mutation(&self) -> bool { + self.owns_target_authority() + || self + .post_commit_cleanup + .as_ref() + .is_some_and(|cleanup| !cleanup.is_complete()) + } + + fn validate(&self) -> Result<()> { + ensure!( + self.schema_version == DEPLOYMENT_TRANSACTION_SCHEMA, + "deployment transaction schema is unsupported" + ); + require_id(&self.transaction_id, "deployment transaction id")?; + require_id(&self.command_id, "transaction command id")?; + require_id(&self.target, "transaction target")?; + ensure!( + self.created_at_unix_millis > 0 + && self.updated_at_unix_millis >= self.created_at_unix_millis, + "deployment transaction timestamps are invalid" + ); + if let Some(generation) = &self.incumbent_generation_id { + require_id(generation, "incumbent generation id")?; + } + if let Some(plan) = &self.plan { + plan.validate()?; + ensure!( + plan.parsed_inputs()?.1.target == self.target, + "transaction plan belongs to another target" + ); + } + if let (Some(plan), Some(frozen)) = (&self.plan, &self.frozen_source) { + frozen.validate_against(plan)?; + } + if let (Some(plan), Some(release)) = (&self.plan, &self.sealed_release) { + release.validate_against(plan)?; + } + if let Some(expected) = &self.expected { + expected.validate()?; + ensure!(expected.target == self.target, "Expected target differs"); + if let Some(plan) = &self.plan { + ensure!(expected.plan_id == plan.plan_id, "Expected plan differs"); + } + if let Some(release) = &self.sealed_release { + ensure!( + expected.sealed_release_id == release.sealed_release_id, + "Expected release differs" + ); + } + if let Some(digest) = &self.expected_publication_sha256 { + ensure!( + digest == &expected.canonical_sha256()?, + "Expected publication receipt differs" + ); + } + } + if let (Some(expected), Some(activation)) = (&self.expected, &self.activation) { + activation.validate()?; + ensure!( + activation.expected_projection_sha256 == expected.canonical_sha256()?, + "activation belongs to another Expected projection" + ); + if let Some(workload) = &self.workload { + ensure!( + workload.runtime_instance_id == activation.runtime_instance_id, + "workload belongs to another activation" + ); + } + if let Some(digest) = &self.activation_publication_sha256 { + ensure!( + digest == &activation.canonical_sha256()?, + "activation publication receipt differs" + ); + } + } + ensure!( + self.workload.is_none() || self.activation.is_some(), + "workload observation exists without its prepared activation" + ); + for evidence in [&self.latest_odin_observation, &self.ready] + .into_iter() + .flatten() + { + evidence.validate_shape()?; + ensure!( + evidence.publisher_sequence <= self.odin_publisher_sequence_cursor, + "topology evidence exceeds the transaction replay cursor" + ); + } + if let Some(warming) = &self.warming { + warming.validate_shape()?; + match warming { + WarmingEvidence::OdinTopology { evidence } => ensure!( + evidence.publisher_sequence <= self.odin_publisher_sequence_cursor, + "Warming topology evidence exceeds the transaction replay cursor" + ), + WarmingEvidence::FirstOdinDirect { .. } => ensure!( + self.target == "odin" && self.incumbent_generation_id.is_none(), + "direct Warming evidence is reserved for first Odin bootstrap" + ), + } + } + if let Some(leasing) = &self.leasing { + if let Some(expected) = &self.expected { + ensure!( + matches!( + (expected.write_lease_required, leasing), + (true, LeasingEvidence::Prepared { .. }) + | (true, LeasingEvidence::Granted { .. }) + | (false, LeasingEvidence::SkippedStateless) + ), + "lease evidence differs from the Expected state contract" + ); + } + let lease_and_sha256 = match leasing { + LeasingEvidence::SkippedStateless => None, + LeasingEvidence::Prepared { + lease, + lease_sha256, + } + | LeasingEvidence::Granted { + lease, + lease_sha256, + } => Some((lease, lease_sha256)), + }; + if let Some((lease, lease_sha256)) = lease_and_sha256 { + lease.validate()?; + ensure!( + lease.canonical_sha256()? == *lease_sha256, + "lease evidence digest differs" + ); + } + } + if let (Some(expected), Some(fencing)) = (&self.expected, &self.fencing) { + match fencing { + FencingEvidence::SkippedStateless => ensure!( + !expected.write_lease_required, + "stateful candidate claims stateless fencing" + ), + FencingEvidence::Revoked { + candidate_lease_path_verified_empty, + .. + } => ensure!( + *candidate_lease_path_verified_empty == expected.write_lease_required, + "candidate lease-path fencing differs from Expected" + ), + } + } + if let Some(error) = &self.last_error { + require_detail(error, "transaction error")?; + } + if let Some(authorization) = &self.deployment_authorization { + authorization.validate_shape()?; + } + if let Some(abort) = &self.pre_fencing_abort { + require_detail(&abort.error, "pre-fencing abort error")?; + ensure!( + self.post_commit_cleanup.is_none(), + "aborted transaction also carries post-commit cleanup" + ); + ensure!( + matches!( + ( + self.workload.is_some() || self.activation.is_some(), + abort.candidate_cleanup + ), + (true, CleanupEvidence::Pending | CleanupEvidence::Complete) + | (false, CleanupEvidence::Skipped) + ), + "abort candidate cleanup differs from its prepared activation" + ); + let topology_cleanup_required = self.command_kind == CommandKind::Deploy + && self.expected_publication_sha256.is_some(); + ensure!( + matches!( + (topology_cleanup_required, abort.topology_reconciliation), + (true, CleanupEvidence::Pending | CleanupEvidence::Complete) + | (false, CleanupEvidence::Skipped) + ), + "abort topology cleanup differs from published deployment Expected" + ); + ensure!( + matches!( + (self.command_kind, abort.source_cleanup), + ( + CommandKind::Deploy, + CleanupEvidence::Pending | CleanupEvidence::Complete + ) | (CommandKind::Continuity, CleanupEvidence::Skipped) + ) || (self.command_kind == CommandKind::Deploy + && abort.source_cleanup == CleanupEvidence::Skipped + && self.plan.is_none() + && self.frozen_source.is_none() + && self.expected.is_none() + && self.phase == DeploymentPhase::Complete), + "abort source cleanup differs from command work" + ); + ensure!( + self.phase < DeploymentPhase::Fencing || self.phase == DeploymentPhase::Complete, + "pre-fencing abort crossed the fencing boundary" + ); + } + + let failed = matches!( + self.completion, + Some(TransactionCompletion::FailedBeforeFencing { .. }) + ); + if failed { + ensure!( + self.phase == DeploymentPhase::Complete, + "terminal failure is not Complete" + ); + let abort = required(&self.pre_fencing_abort, "terminal abort evidence")?; + let TransactionCompletion::FailedBeforeFencing { error } = + self.completion.as_ref().unwrap() + else { + unreachable!() + }; + ensure!( + abort.is_complete() && abort.error == *error, + "terminal failure lacks complete matching abort evidence" + ); + } else { + ensure!( + !matches!( + self.completion, + Some(TransactionCompletion::FailedBeforeFencing { .. }) + ), + "non-failure branch carries failure completion" + ); + if self.phase >= DeploymentPhase::Starting { + ensure!( + self.plan.is_some() + && self.sealed_release.is_some() + && self.installed_release.is_some() + && self.expected.is_some() + && self.expected_publication_sha256.is_some(), + "Starting transaction lacks sealed release evidence" + ); + match self.command_kind { + CommandKind::Deploy => ensure!( + self.frozen_source.is_some() && self.deployment_authorization.is_some(), + "deployment entered Starting without frozen source and brake consumption" + ), + CommandKind::Continuity => ensure!( + self.lifecycle_authorized_at_unix_millis.is_some() + && self.deployment_authorization.is_none(), + "continuity entered Starting without its lifecycle gate" + ), + } + } + if self.phase >= DeploymentPhase::Warming { + ensure!( + self.activation.is_some() + && self.workload.is_some() + && self.activation_publication_sha256.is_some(), + "Warming transaction lacks observed activation" + ); + } + if self.phase >= DeploymentPhase::Fencing { + ensure!( + self.warming.is_some() && self.isolation.is_some(), + "Fencing transaction lacks warming or isolation evidence" + ); + ensure!( + self.expected + .as_ref() + .and_then(|expected| expected.route.as_ref()) + .is_some() + == self.route_preflight.is_some(), + "route preflight does not match routed Expected" + ); + if let Some(preflight) = &self.route_preflight { + preflight.validate()?; + } + } + if self.phase >= DeploymentPhase::Leasing { + ensure!(self.fencing.is_some(), "Leasing lacks fencing evidence"); + } + if self.phase >= DeploymentPhase::AwaitingReady { + ensure!( + matches!( + self.leasing.as_ref(), + Some(LeasingEvidence::SkippedStateless) + | Some(LeasingEvidence::Granted { .. }) + ), + "AwaitingReady lacks finalized lease evidence" + ); + } + if self.phase >= DeploymentPhase::Routing { + ensure!(self.ready.is_some(), "Routing lacks Ready evidence"); + } + if self.phase >= DeploymentPhase::Committing { + ensure!(self.routing.is_some(), "Committing lacks routing evidence"); + } + if let Some(RoutingEvidence::Promoted { + observation, + promoted_at_unix_millis, + }) = &self.routing + { + observation.validate()?; + ensure!( + *promoted_at_unix_millis > 0 + && *promoted_at_unix_millis <= self.updated_at_unix_millis, + "route promotion time is outside the durable transaction timeline" + ); + } + if self.phase == DeploymentPhase::Complete { + ensure!( + matches!( + self.completion, + Some(TransactionCompletion::Admitted { .. }) + ), + "successful Complete transaction lacks admission receipt" + ); + ensure!( + self.pre_fencing_abort.is_none() && self.post_commit_cleanup.is_some(), + "admitted transaction lacks exclusive post-commit cleanup evidence" + ); + let TransactionCompletion::Admitted { generation_id } = + self.completion.as_ref().unwrap() + else { + unreachable!() + }; + ensure!( + generation_id == &format!("generation-{}", self.transaction_id), + "admission completion names another transaction generation" + ); + } else { + ensure!( + self.completion.is_none() && self.post_commit_cleanup.is_none(), + "non-Complete transaction has completion or post-commit state" + ); + } + } + if let Some(cleanup) = &self.post_commit_cleanup { + ensure!( + self.phase == DeploymentPhase::Complete + && matches!( + self.completion, + Some(TransactionCompletion::Admitted { .. }) + ), + "post-commit cleanup exists without an admitted Complete transaction" + ); + match (&self.incumbent_generation_id, &cleanup.incumbent) { + (None, IncumbentCleanupEvidence::SkippedNoIncumbent) => {} + ( + Some(expected), + IncumbentCleanupEvidence::Pending { generation_id, .. } + | IncumbentCleanupEvidence::Complete { generation_id }, + ) if expected == generation_id => {} + _ => bail!("post-commit incumbent cleanup names another generation"), + } + ensure!( + matches!( + (self.command_kind, cleanup.source), + (CommandKind::Deploy, SourceCleanupEvidence::Pending) + | (CommandKind::Deploy, SourceCleanupEvidence::Complete) + | ( + CommandKind::Continuity, + SourceCleanupEvidence::SkippedContinuity + ) + ), + "post-commit source cleanup differs from command kind" + ); + } + Ok(()) + } +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +struct AdmittedOdinAuthority { + signer_identity_id: String, + signer_public_key: Vec, +} + +impl AdmittedOdinAuthority { + fn from_anchor(anchor: &ServiceIdentityTrustAnchor) -> Result { + ensure!( + derive_service_identity_id::(&anchor.public_key)? + == anchor.identity_id, + "Odin topology anchor identity differs from its key" + ); + Ok(Self { + signer_identity_id: anchor.identity_id.clone(), + signer_public_key: anchor.public_key.clone(), + }) + } + + fn validate(&self) -> Result<()> { + require_id(&self.signer_identity_id, "admitted Odin signer")?; + ensure!( + derive_service_identity_id::(&self.signer_public_key)? + == self.signer_identity_id, + "admitted Odin signer identity differs from its key" + ); + Ok(()) + } +} + +/// The only current-incarnation owner. Unit state, route state, topology +/// projections, and CLI output are observations of this record, never peers. +#[derive(Clone, Debug, PartialEq, Eq, DatabaseEntry)] +#[cultcache( + type = "idunn.admitted_generation", + schema = "idunn.admitted_generation.v2" +)] +struct AdmittedGeneration { + #[cultcache(key = 0)] + schema_version: String, + #[cultcache(key = 1)] + target: String, + #[cultcache(key = 2)] + generation_id: String, + #[cultcache(key = 3)] + command_id: String, + #[cultcache(key = 4)] + transaction_id: String, + #[cultcache(key = 5)] + admitted_at_unix_millis: u64, + #[cultcache(key = 6)] + plan: CompiledDeploymentPlan, + #[cultcache(key = 7)] + sealed_release: SealedRelease, + #[cultcache(key = 8)] + installed_release: InstalledReleaseObservation, + #[cultcache(key = 9)] + expected: IdunnExpectedIncarnationRecord, + #[cultcache(key = 10)] + activation: IdunnRuntimeActivationRecord, + #[cultcache(key = 11)] + workload: WorkloadObservation, + #[cultcache(key = 12)] + leasing: LeasingEvidence, + #[cultcache(key = 13)] + ready: TopologyEvidence, + #[cultcache(key = 14)] + latest_odin_observation: TopologyEvidence, + #[cultcache(key = 15)] + routing: RoutingEvidence, + #[cultcache(key = 16)] + odin_authority: AdmittedOdinAuthority, + #[cultcache(key = 17)] + odin_publisher_sequence_cursor: u64, + #[cultcache(key = 18)] + route_repair_started_at_unix_millis: Option, +} + +impl AdmittedGeneration { + fn from_transaction( + transaction: &DeploymentTransaction, + odin_authority: AdmittedOdinAuthority, + now: u64, + ) -> Result { + ensure!( + transaction.phase == DeploymentPhase::Committing, + "only Committing can create an admitted generation" + ); + let generation = Self { + schema_version: ADMITTED_GENERATION_SCHEMA.into(), + target: transaction.target.clone(), + generation_id: format!("generation-{}", transaction.transaction_id), + command_id: transaction.command_id.clone(), + transaction_id: transaction.transaction_id.clone(), + admitted_at_unix_millis: now, + plan: required(&transaction.plan, "transaction plan")?.clone(), + sealed_release: required(&transaction.sealed_release, "sealed release")?.clone(), + installed_release: required(&transaction.installed_release, "installed release")? + .clone(), + expected: required(&transaction.expected, "Expected projection")?.clone(), + activation: required(&transaction.activation, "activation")?.clone(), + workload: required(&transaction.workload, "workload")?.clone(), + leasing: required(&transaction.leasing, "lease disposition")?.clone(), + ready: required(&transaction.ready, "Ready receipt")?.clone(), + latest_odin_observation: required( + &transaction.latest_odin_observation, + "latest Odin receipt", + )? + .clone(), + routing: required(&transaction.routing, "route disposition")?.clone(), + odin_authority, + odin_publisher_sequence_cursor: transaction.odin_publisher_sequence_cursor, + route_repair_started_at_unix_millis: None, + }; + generation.validate()?; + Ok(generation) + } + + fn validate(&self) -> Result<()> { + ensure!( + self.schema_version == ADMITTED_GENERATION_SCHEMA, + "admitted generation schema is unsupported" + ); + require_id(&self.target, "admitted target")?; + require_id(&self.generation_id, "admitted generation id")?; + require_id(&self.command_id, "admitted command id")?; + require_id(&self.transaction_id, "admitted transaction id")?; + ensure!(self.admitted_at_unix_millis > 0, "admission has no time"); + self.plan.validate()?; + self.sealed_release.validate_against(&self.plan)?; + self.expected.validate()?; + self.activation.validate()?; + self.ready.validate_shape()?; + self.latest_odin_observation.validate_shape()?; + self.odin_authority.validate()?; + ensure!( + self.target == self.expected.target + && self.expected.plan_id == self.plan.plan_id + && self.expected.sealed_release_id == self.sealed_release.sealed_release_id + && self.activation.expected_projection_sha256 + == self.expected.canonical_sha256()? + && self.activation.runtime_instance_id == self.workload.runtime_instance_id + && self.ready.publisher_sequence <= self.odin_publisher_sequence_cursor + && self.latest_odin_observation.publisher_sequence + == self.odin_publisher_sequence_cursor, + "admitted generation evidence does not describe one incarnation" + ); + ensure!( + self.expected.write_lease_required == self.leasing.lease().is_some(), + "admitted write-lease disposition differs from Expected" + ); + ensure!( + self.expected.route.is_some() == self.routing.observation().is_some(), + "admitted route disposition differs from Expected" + ); + if let Some(route) = self.routing.observation() { + route.validate()?; + ensure!( + route.runtime_instance_id == self.activation.runtime_instance_id, + "admitted route observation belongs to another runtime instance" + ); + } + if let Some(started_at) = self.route_repair_started_at_unix_millis { + ensure!(started_at > 0, "admitted route repair has no start time"); + ensure!( + matches!(&self.routing, RoutingEvidence::Promoted { .. }), + "only a promoted routed generation can own route repair intent" + ); + } + Ok(()) + } +} + +#[derive(Clone, Debug, PartialEq, Eq)] +struct RuntimeOptions { + state_store: PathBuf, + bindings_dir: PathBuf, + source_root: PathBuf, + staging_root: PathBuf, + topology_store: PathBuf, + odin_correlation_store: PathBuf, + odin_trust_anchor: PathBuf, + idunn_identity_store: PathBuf, + deployment_brake_operator_anchor: PathBuf, + source_identity: Option, + topology_maximum_age_millis: u64, + topology_maximum_future_skew_millis: u64, + poll_millis: u64, +} + +impl Default for RuntimeOptions { + fn default() -> Self { + Self { + state_store: PathBuf::from("/var/lib/gamecult/idunn/control.cc"), + bindings_dir: PathBuf::from("/etc/gamecult/idunn/bindings"), + source_root: PathBuf::from("/var/lib/gamecult/idunn/sources"), + staging_root: PathBuf::from("/var/lib/gamecult/idunn/staging"), + topology_store: PathBuf::from("/var/lib/gamecult/idunn/topology.cc"), + odin_correlation_store: PathBuf::from( + "/var/lib/gamecult/odin/idunn-runtime-topology.cc", + ), + odin_trust_anchor: PathBuf::from("/etc/gamecult/idunn/odin-topology-anchor.cc"), + idunn_identity_store: PathBuf::from( + "/var/lib/gamecult/idunn/idunn-service-identity.cc", + ), + deployment_brake_operator_anchor: PathBuf::from( + "/etc/gamecult/idunn/deployment-brake-operator-anchor.cc", + ), + source_identity: None, + topology_maximum_age_millis: DEFAULT_TOPOLOGY_MAXIMUM_AGE_MILLIS, + topology_maximum_future_skew_millis: DEFAULT_TOPOLOGY_MAXIMUM_FUTURE_SKEW_MILLIS, + poll_millis: 500, + } + } +} + +#[derive(Clone, Debug, PartialEq, Eq)] +enum Command { + Serve(RuntimeOptions), + Up { + selector: String, + requested_by: String, + state_store: PathBuf, + wait: bool, + timeout_seconds: u64, + }, + Status { + state_store: PathBuf, + command_id: Option, + }, +} + +pub fn run(args: impl Iterator) -> Result<()> { + match parse(args)? { + Command::Serve(options) => serve(options), + Command::Up { + selector, + requested_by, + state_store, + wait, + timeout_seconds, + } => submit( + &state_store, + &selector, + &requested_by, + wait, + timeout_seconds, + ), + Command::Status { + state_store, + command_id, + } => status(&state_store, command_id.as_deref()), + } +} + +fn parse(args: impl Iterator) -> Result { + let mut args = args.peekable(); + let command = args.next().ok_or_else(|| anyhow!(usage()))?; + match command.as_str() { + "serve" => parse_serve(args), + "up" => parse_up(args), + "status" => parse_status(args), + "--help" | "-h" | "help" => bail!(usage()), + _ => bail!("unknown Idunn command {command:?}\n\n{}", usage()), + } +} + +fn parse_serve(mut args: impl Iterator) -> Result { + let mut options = RuntimeOptions::default(); + let mut source_uid = None; + let mut source_gid = None; + while let Some(argument) = args.next() { + match argument.as_str() { + "--state-store" => options.state_store = path_value(&mut args, &argument)?, + "--bindings-dir" => options.bindings_dir = path_value(&mut args, &argument)?, + "--source-root" => options.source_root = path_value(&mut args, &argument)?, + "--staging-root" => options.staging_root = path_value(&mut args, &argument)?, + "--topology-store" => options.topology_store = path_value(&mut args, &argument)?, + "--odin-correlation-store" => { + options.odin_correlation_store = path_value(&mut args, &argument)? + } + "--odin-trust-anchor" => options.odin_trust_anchor = path_value(&mut args, &argument)?, + "--idunn-identity-store" => { + options.idunn_identity_store = path_value(&mut args, &argument)? + } + "--deployment-brake-operator-anchor" => { + options.deployment_brake_operator_anchor = path_value(&mut args, &argument)? + } + "--topology-maximum-age-millis" => { + options.topology_maximum_age_millis = u64_value(&mut args, &argument)? + } + "--topology-maximum-future-skew-millis" => { + options.topology_maximum_future_skew_millis = u64_value(&mut args, &argument)? + } + "--source-uid" => source_uid = Some(u32_value(&mut args, &argument)?), + "--source-gid" => source_gid = Some(u32_value(&mut args, &argument)?), + "--poll-millis" => options.poll_millis = u64_value(&mut args, &argument)?, + "--help" | "-h" => bail!(usage()), + _ => bail!("unknown Idunn serve option {argument:?}"), + } + } + ensure!( + options.poll_millis > 0 && options.topology_maximum_age_millis > 0, + "poll and topology maximum age must be positive" + ); + options.source_identity = match (source_uid, source_gid) { + (Some(uid), Some(gid)) => { + ensure!( + uid > 0 && gid > 0, + "source UID and GID must be unprivileged" + ); + Some(ProcessIdentity { uid, gid }) + } + (None, None) => None, + _ => bail!("--source-uid and --source-gid must be supplied together"), + }; + Ok(Command::Serve(options)) +} + +fn parse_up(mut args: impl Iterator) -> Result { + let selector = args + .next() + .ok_or_else(|| anyhow!("idunn up requires a service or profile selector"))?; + require_selector(&selector)?; + let mut state_store = RuntimeOptions::default().state_store; + let mut requested_by = env::var("SUDO_USER") + .or_else(|_| env::var("USER")) + .or_else(|_| env::var("USERNAME")) + .unwrap_or_else(|_| "operator".into()); + let mut wait = true; + let mut timeout_seconds = 1800; + while let Some(argument) = args.next() { + match argument.as_str() { + "--state-store" => state_store = path_value(&mut args, &argument)?, + "--requested-by" => requested_by = string_value(&mut args, &argument)?, + "--no-wait" => wait = false, + "--timeout-seconds" => timeout_seconds = u64_value(&mut args, &argument)?, + "--help" | "-h" => bail!(usage()), + _ => bail!("unknown Idunn up option {argument:?}"), + } + } + ensure!(timeout_seconds > 0, "--timeout-seconds must be positive"); + require_value(&requested_by, "deployment requester")?; + Ok(Command::Up { + selector, + requested_by, + state_store, + wait, + timeout_seconds, + }) +} + +fn parse_status(mut args: impl Iterator) -> Result { + let mut state_store = RuntimeOptions::default().state_store; + let mut command_id = None; + while let Some(argument) = args.next() { + match argument.as_str() { + "--state-store" => state_store = path_value(&mut args, &argument)?, + "--command" => command_id = Some(string_value(&mut args, &argument)?), + "--help" | "-h" => bail!(usage()), + _ => bail!("unknown Idunn status option {argument:?}"), + } + } + Ok(Command::Status { + state_store, + command_id, + }) +} + +#[derive(Clone)] +struct Stored { + envelope: CultCacheEnvelope, + value: T, +} + +#[derive(Default)] +struct ControlSnapshot { + commands: Vec>, + transactions: Vec>, + admitted: Vec>, +} + +impl ControlSnapshot { + fn read(path: &Path) -> Result { + if !path.exists() { + return Ok(Self::default()); + } + let mut snapshot = Self::default(); + for envelope in SingleFileMessagePackBackingStore::new(path) + .pull_all_read_only_snapshot() + .context("reading Idunn control snapshot")? + { + match envelope.r#type.as_str() { + DeploymentCommand::TYPE => { + ensure!( + envelope.schema_id.as_deref() == Some(DEPLOYMENT_COMMAND_SCHEMA), + "Idunn control store contains an unsupported command" + ); + let value: DeploymentCommand = decode_record(&envelope)?; + value.validate()?; + ensure!( + envelope.key == value.command_id, + "deployment command key differs from its identity" + ); + snapshot.commands.push(Stored { envelope, value }); + } + DeploymentTransaction::TYPE => { + ensure!( + envelope.schema_id.as_deref() == Some(DEPLOYMENT_TRANSACTION_SCHEMA), + "Idunn control store contains an unsupported transaction" + ); + let value: DeploymentTransaction = decode_record(&envelope)?; + value.validate()?; + ensure!( + envelope.key == value.transaction_id, + "deployment transaction key differs from its identity" + ); + snapshot.transactions.push(Stored { envelope, value }); + } + AdmittedGeneration::TYPE => { + ensure!( + envelope.schema_id.as_deref() == Some(ADMITTED_GENERATION_SCHEMA), + "Idunn control store contains an unsupported admitted generation" + ); + let value: AdmittedGeneration = decode_record(&envelope)?; + value.validate()?; + ensure!( + envelope.key == value.target, + "admitted generation key is not its target" + ); + snapshot.admitted.push(Stored { envelope, value }); + } + _ => bail!("Idunn control store contains a foreign document"), + } + } + snapshot.validate_relations()?; + Ok(snapshot) + } + + fn validate_relations(&self) -> Result<()> { + let command_ids = self + .commands + .iter() + .map(|stored| stored.value.command_id.as_str()) + .collect::>(); + ensure!( + command_ids.len() == self.commands.len(), + "Idunn control store contains duplicate commands" + ); + let transaction_ids = self + .transactions + .iter() + .map(|stored| stored.value.transaction_id.as_str()) + .collect::>(); + ensure!( + transaction_ids.len() == self.transactions.len(), + "Idunn control store contains duplicate transactions" + ); + let admitted_targets = self + .admitted + .iter() + .map(|stored| stored.value.target.as_str()) + .collect::>(); + ensure!( + admitted_targets.len() == self.admitted.len(), + "Idunn control store contains duplicate current generations" + ); + for transaction in &self.transactions { + let command = self + .commands + .iter() + .find(|candidate| candidate.value.command_id == transaction.value.command_id) + .context("deployment transaction has no immutable command")?; + ensure!( + command.value.kind == transaction.value.command_kind, + "transaction kind differs from its immutable command" + ); + } + let mut live_targets = BTreeSet::new(); + for transaction in self + .transactions + .iter() + .filter(|stored| stored.value.owns_target_authority()) + { + ensure!( + live_targets.insert(transaction.value.target.as_str()), + "multiple transactions claim current-incarnation authority for one target" + ); + if let Some(fencing) = transaction + .value + .fencing + .as_ref() + .filter(|_| transaction.value.phase < DeploymentPhase::Complete) + { + let incumbent = self.admitted_for(&transaction.value.target); + let incumbent_matches = + match (&transaction.value.incumbent_generation_id, incumbent) { + (None, None) => true, + (Some(expected), Some(current)) => current.value.generation_id == *expected, + _ => false, + }; + ensure!( + incumbent_matches, + "fenced transaction incumbent differs from current admission" + ); + let incumbent_lease_sha256 = incumbent + .and_then(|stored| stored.value.leasing.lease()) + .map(IdunnProcessWriteLeaseRecord::canonical_sha256) + .transpose()?; + match fencing { + FencingEvidence::SkippedStateless => ensure!( + incumbent_lease_sha256.is_none(), + "stateless fencing omitted the admitted incumbent lease" + ), + FencingEvidence::Revoked { + incumbent_lease_sha256: recorded, + .. + } => { + ensure!( + recorded == &incumbent_lease_sha256, + "fencing evidence names another incumbent lease" + ); + ensure!( + incumbent_lease_sha256.is_some() + || transaction + .value + .expected + .as_ref() + .is_some_and(|expected| expected.write_lease_required), + "stateless transaction did not use its explicit fencing skip" + ); + } + } + } + } + let mut authorizations = BTreeSet::new(); + for authorization in self + .transactions + .iter() + .filter_map(|stored| stored.value.deployment_authorization.as_ref()) + { + ensure!( + authorizations.insert(authorization.authorization_id.as_str()), + "deployment authorization was consumed more than once" + ); + } + Ok(()) + } + + fn admitted_for(&self, target: &str) -> Option<&Stored> { + self.admitted + .iter() + .find(|stored| stored.value.target == target) + } + + fn transaction_for_command(&self, command_id: &str) -> Vec<&DeploymentTransaction> { + let mut values = self + .transactions + .iter() + .filter(|stored| stored.value.command_id == command_id) + .map(|stored| &stored.value) + .collect::>(); + values.sort_by_key(|value| value.ordinal); + values + } + + fn has_earlier_authority_sibling(&self, transaction: &DeploymentTransaction) -> bool { + self.transactions.iter().any(|stored| { + stored.value.owns_target_authority() + && stored.value.command_id == transaction.command_id + && stored.value.ordinal < transaction.ordinal + }) + } + + fn max_odin_sequence(&self, target: &str, signer_identity_id: &str) -> u64 { + let transaction_max = self + .transactions + .iter() + .filter_map(|stored| { + stored + .value + .latest_odin_observation + .as_ref() + .filter(|evidence| { + stored.value.target == target + && evidence.signer_identity_id == signer_identity_id + }) + .map(|evidence| evidence.publisher_sequence) + }) + .max() + .unwrap_or(0); + let admitted_max = self + .admitted + .iter() + .filter(|stored| { + stored.value.target == target + && stored.value.odin_authority.signer_identity_id == signer_identity_id + }) + .map(|stored| stored.value.odin_publisher_sequence_cursor) + .max() + .unwrap_or(0); + transaction_max.max(admitted_max) + } +} + +fn decode_record(envelope: &CultCacheEnvelope) -> Result +where + T: for<'de> Deserialize<'de> + Serialize, +{ + let value: T = rmp_serde::from_slice(&envelope.payload)?; + ensure!( + rmp_serde::to_vec(&value)? == envelope.payload, + "Idunn control store contains a noncanonical record" + ); + Ok(value) +} + +fn command_envelope(value: &DeploymentCommand, now: u64) -> Result { + value.validate()?; + typed_envelope( + &value.command_id, + DeploymentCommand::TYPE, + DEPLOYMENT_COMMAND_SCHEMA, + value, + now, + ) +} + +fn transaction_envelope(value: &DeploymentTransaction, now: u64) -> Result { + value.validate()?; + typed_envelope( + &value.transaction_id, + DeploymentTransaction::TYPE, + DEPLOYMENT_TRANSACTION_SCHEMA, + value, + now, + ) +} + +fn admitted_envelope(value: &AdmittedGeneration, now: u64) -> Result { + value.validate()?; + typed_envelope( + &value.target, + AdmittedGeneration::TYPE, + ADMITTED_GENERATION_SCHEMA, + value, + now, + ) +} + +fn typed_envelope( + key: &str, + record_type: &str, + schema: &str, + value: &T, + now: u64, +) -> Result { + Ok(CultCacheEnvelope { + key: key.into(), + r#type: record_type.into(), + payload: rmp_serde::to_vec(value)?, + stored_at: rfc3339_millis(now)?, + schema_id: Some(schema.into()), + }) +} + +fn replace_transaction( + store_path: &Path, + current: &Stored, + next: &DeploymentTransaction, +) -> Result<()> { + next.validate()?; + ensure!( + current.value.transaction_id == next.transaction_id, + "transaction replacement changes identity" + ); + ensure!( + SingleFileMessagePackBackingStore::new(store_path).compare_exchange( + &[CultCacheExpectedEnvelope { + r#type: DeploymentTransaction::TYPE.into(), + key: current.value.transaction_id.clone(), + current: Some(current.envelope.clone()), + }], + &[transaction_envelope(next, next.updated_at_unix_millis)?], + )?, + "deployment transaction changed before its compare-exchange" + ); + Ok(()) +} + +#[derive(Clone)] +struct LoadedBinding { + binding: OperatorBinding, + bytes: Vec, +} + +fn load_bindings(directory: &Path) -> Result> { + let mut paths = fs::read_dir(directory) + .with_context(|| format!("reading Idunn binding directory {}", directory.display()))? + .map(|entry| entry.map(|entry| entry.path())) + .collect::>>()?; + paths.retain(|path| path.extension() == Some(std::ffi::OsStr::new("toml"))); + paths.sort(); + let mut bindings = BTreeMap::new(); + for path in paths { + let bytes = fs::read(&path) + .with_context(|| format!("reading operator binding {}", path.display()))?; + let text = std::str::from_utf8(&bytes) + .with_context(|| format!("operator binding {} is not UTF-8", path.display()))?; + let binding = OperatorBinding::parse(text) + .with_context(|| format!("validating operator binding {}", path.display()))?; + let target = binding.target.clone(); + ensure!( + bindings + .insert(target.clone(), LoadedBinding { binding, bytes }) + .is_none(), + "operator binding target {target} is duplicated" + ); + } + ensure!(!bindings.is_empty(), "Idunn binding directory is empty"); + validate_route_bindings(&bindings)?; + Ok(bindings) +} + +fn validate_route_bindings(bindings: &BTreeMap) -> Result<()> { + let routes = bindings + .iter() + .filter_map(|(target, loaded)| { + loaded + .binding + .route + .as_ref() + .map(|route| (target.as_str(), route)) + }) + .collect::>(); + validate_route_binding_set(&routes) +} + +fn validate_route_binding_set(routes: &[(&str, &RouteBinding)]) -> Result<()> { + for (index, (target, route)) in routes.iter().enumerate() { + let (stable_host, stable_port) = route.stable_socket()?; + let private_host = route + .private_host + .parse::() + .context("validated route private host stopped being an IP address")?; + ensure!( + stable_host != private_host + || !(route.private_port_start..=route.private_port_end).contains(&stable_port), + "route {target} stable socket overlaps its candidate port range" + ); + + for (other_target, other) in &routes[index + 1..] { + ensure!( + route.route_id != other.route_id, + "route id {} is shared by targets {target} and {other_target}", + route.route_id + ); + ensure!( + route.config_path != other.config_path, + "route fragment {} is shared by targets {target} and {other_target}", + route.config_path.display() + ); + let other_stable = other.stable_socket()?; + ensure!( + route.driver != other.driver || (stable_host, stable_port) != other_stable, + "stable route socket {}:{} is shared by targets {target} and {other_target}", + stable_host, + stable_port + ); + if route.driver != other.driver { + continue; + } + let other_private_host = other + .private_host + .parse::() + .context("validated route private host stopped being an IP address")?; + let ranges_overlap = route.private_host == other.private_host + && route.private_port_start <= other.private_port_end + && other.private_port_start <= route.private_port_end; + ensure!( + !ranges_overlap, + "candidate port ranges overlap for targets {target} and {other_target}" + ); + ensure!( + stable_host != other_private_host + || !(other.private_port_start..=other.private_port_end).contains(&stable_port), + "stable route socket for {target} overlaps {other_target}'s candidate range" + ); + ensure!( + other_stable.0 != private_host + || !(route.private_port_start..=route.private_port_end) + .contains(&other_stable.1), + "stable route socket for {other_target} overlaps {target}'s candidate range" + ); + } + } + Ok(()) +} + +fn resolve_selector( + bindings: &BTreeMap, + selector: &str, +) -> Result> { + let mut targets = if let Some(profile) = selector.strip_prefix("profile:") { + bindings + .values() + .filter(|binding| binding.binding.profiles.contains(profile)) + .map(|binding| binding.binding.target.clone()) + .collect::>() + } else { + ensure!( + bindings.contains_key(selector), + "unknown deployment target {selector}" + ); + vec![selector.to_owned()] + }; + ensure!( + !targets.is_empty(), + "unknown or empty deployment profile {selector}" + ); + targets.sort_by(|left, right| { + (left != "odin") + .cmp(&(right != "odin")) + .then_with(|| left.cmp(right)) + }); + Ok(targets) +} + +fn submit( + store_path: &Path, + selector: &str, + requested_by: &str, + wait: bool, + timeout_seconds: u64, +) -> Result<()> { + if let Some(parent) = store_path.parent() { + fs::create_dir_all(parent)?; + } + let now = now_millis()?; + let command = DeploymentCommand { + schema_version: DEPLOYMENT_COMMAND_SCHEMA.into(), + command_id: format!("up-{}", Uuid::new_v4()), + kind: CommandKind::Deploy, + selector: selector.into(), + requested_by: requested_by.into(), + requested_at_unix_millis: now, + }; + command.validate()?; + ensure!( + SingleFileMessagePackBackingStore::new(store_path).compare_exchange( + &[CultCacheExpectedEnvelope { + r#type: DeploymentCommand::TYPE.into(), + key: command.command_id.clone(), + current: None, + }], + &[command_envelope(&command, now)?], + )?, + "deployment command id collided" + ); + println!("{}", command.command_id); + if !wait { + return Ok(()); + } + let deadline = now.saturating_add(timeout_seconds.saturating_mul(1000)); + loop { + let snapshot = ControlSnapshot::read(store_path)?; + ensure!( + snapshot + .commands + .iter() + .any(|stored| stored.value.command_id == command.command_id), + "submitted deployment command disappeared" + ); + let transactions = snapshot.transaction_for_command(&command.command_id); + if !transactions.is_empty() && transactions.iter().all(|value| value.is_terminal()) { + if let Some(error) = + transactions + .iter() + .find_map(|transaction| match &transaction.completion { + Some(TransactionCompletion::FailedBeforeFencing { error }) => { + Some(error.as_str()) + } + _ => None, + }) + { + bail!("deployment failed: {error}") + } + println!("succeeded {} target(s)", transactions.len()); + return Ok(()); + } + if now_millis()? >= deadline { + bail!("deployment command timed out") + } + thread::sleep(Duration::from_millis(250)); + } +} + +fn status(store_path: &Path, command_id: Option<&str>) -> Result<()> { + let snapshot = ControlSnapshot::read(store_path)?; + let mut commands = snapshot.commands.iter().collect::>(); + commands.sort_by_key(|stored| stored.value.requested_at_unix_millis); + if let Some(command_id) = command_id { + commands.retain(|stored| stored.value.command_id == command_id); + ensure!(!commands.is_empty(), "deployment command is unknown"); + } + for stored in commands { + let command = &stored.value; + let transactions = snapshot.transaction_for_command(&command.command_id); + let (state, detail) = derived_command_status(&transactions); + println!( + "{} {} {} {}", + command.command_id, command.selector, state, detail + ); + } + Ok(()) +} + +fn derived_command_status(transactions: &[&DeploymentTransaction]) -> (&'static str, String) { + if transactions.is_empty() { + return ("queued", String::new()); + } + if let Some(error) = transactions + .iter() + .find_map(|transaction| match &transaction.completion { + Some(TransactionCompletion::FailedBeforeFencing { error }) => Some(error.clone()), + _ => None, + }) + { + return ("failed", error); + } + if transactions.iter().all(|transaction| { + transaction.is_terminal() + && matches!( + transaction.completion, + Some(TransactionCompletion::Admitted { .. }) + ) + }) { + return ( + "succeeded", + transactions + .iter() + .map(|transaction| transaction.target.as_str()) + .collect::>() + .join(","), + ); + } + let current = transactions + .iter() + .filter(|transaction| !transaction.is_terminal()) + .map(|transaction| format!("{}:{:?}", transaction.target, transaction.phase)) + .collect::>() + .join(","); + ("running", current) +} + +struct ProcessLock { + file: File, + #[cfg(not(unix))] + path: PathBuf, +} + +impl ProcessLock { + fn acquire(store_path: &Path) -> Result { + let path = sibling_path(store_path, ".daemon.lock"); + if let Some(parent) = path.parent() { + fs::create_dir_all(parent)?; + } + #[cfg(unix)] + { + use std::os::fd::AsRawFd; + let file = OpenOptions::new() + .create(true) + .read(true) + .write(true) + .open(&path) + .with_context(|| format!("opening Idunn daemon lock {}", path.display()))?; + let result = unsafe { libc::flock(file.as_raw_fd(), libc::LOCK_EX | libc::LOCK_NB) }; + ensure!(result == 0, "another Idunn daemon owns this control store"); + Ok(Self { file }) + } + #[cfg(not(unix))] + { + let file = OpenOptions::new() + .create_new(true) + .read(true) + .write(true) + .open(&path) + .with_context(|| format!("another Idunn daemon owns {}", path.display()))?; + Ok(Self { file, path }) + } + } +} + +impl Drop for ProcessLock { + fn drop(&mut self) { + #[cfg(unix)] + { + use std::os::fd::AsRawFd; + let _ = unsafe { libc::flock(self.file.as_raw_fd(), libc::LOCK_UN) }; + } + #[cfg(not(unix))] + { + let _ = fs::remove_file(&self.path); + } + } +} + +struct Engine { + options: RuntimeOptions, + idunn_signer: ServiceIdentitySigner, + idunn_anchor: ServiceIdentityTrustAnchor, + bootstrap_odin_authority: AdmittedOdinAuthority, + source: GitSourceDriver, + runner: DockerRunnerDriver, + workload: SystemdTransientWorkloadDriver, +} + +impl Engine { + fn open(options: RuntimeOptions) -> Result { + let idunn_signer = + open_service_identity_at::(&options.idunn_identity_store) + .context("opening Idunn activation identity")?; + let idunn_anchor = idunn_signer.trust_anchor()?; + let odin_anchor = read_trust_anchor::(&options.odin_trust_anchor) + .context("reading bootstrap Odin topology anchor")?; + let bootstrap_odin_authority = AdmittedOdinAuthority::from_anchor(&odin_anchor)?; + let source = GitSourceDriver::new( + &options.source_root, + options.staging_root.join("frozen-sources"), + options.source_identity, + ); + Ok(Self { + options, + idunn_signer, + idunn_anchor, + bootstrap_odin_authority, + source, + runner: DockerRunnerDriver::default(), + workload: SystemdTransientWorkloadDriver::default(), + }) + } + + fn topology(&self) -> CultCacheTopologyDriver { + CultCacheTopologyDriver { + projection_store: self.options.topology_store.clone(), + correlation_store: self.options.odin_correlation_store.clone(), + } + } + + fn current_odin_authority(&self, snapshot: &ControlSnapshot) -> Result { + let authority = snapshot + .admitted_for("odin") + .map(|stored| stored.value.odin_authority.clone()) + .unwrap_or_else(|| self.bootstrap_odin_authority.clone()); + authority.validate()?; + Ok(authority) + } + + fn trusted_topology_context(&self, now: u64) -> OdinTopologyAuthenticationContext { + OdinTopologyAuthenticationContext { + trusted_received_at_unix_millis: now, + maximum_age_millis: self.options.topology_maximum_age_millis, + maximum_future_skew_millis: self.options.topology_maximum_future_skew_millis, + } + } + + fn validate_durable_authority(&self, snapshot: &ControlSnapshot) -> Result<()> { + let operator_anchor = read_trust_anchor::( + &self.options.deployment_brake_operator_anchor, + )?; + for stored in &snapshot.transactions { + let transaction = &stored.value; + if let Some(authorization) = &transaction.deployment_authorization { + authorization.validate_shape()?; + let record: IdunnDeploymentBrakeRecord = + rmp_serde::from_slice(&authorization.canonical_brake_bytes)?; + verify_idunn_deployment_brake_authorization(&record, &operator_anchor)?; + let expected = required(&transaction.expected, "authorized Expected projection")?; + ensure!( + record.authorized_release_id.as_deref() + == Some(expected.sealed_release_id.as_str()) + && record.authorized_deployment_id.as_deref() + == Some(transaction.transaction_id.as_str()) + && record.runtime_id == expected.runtime_id, + "durable deployment authorization names another release or transaction" + ); + } + let lease = transaction + .leasing + .as_ref() + .and_then(LeasingEvidence::lease_sha256); + if let Some(evidence) = &transaction.latest_odin_observation { + let authenticated = self.authenticate_topology_bytes( + snapshot, + transaction, + &evidence.canonical_bytes, + lease, + evidence.admitted_at_unix_millis, + )?; + validate_authenticated_evidence(evidence, &authenticated)?; + } + if let Some(evidence) = &transaction.warming { + match evidence { + WarmingEvidence::OdinTopology { evidence } => { + let authenticated = self.authenticate_topology_bytes( + snapshot, + transaction, + &evidence.canonical_bytes, + None, + evidence.admitted_at_unix_millis, + )?; + validate_authenticated_evidence(evidence, &authenticated)?; + let incumbent_lease_sha256 = + self.incumbent_lease_sha256_for_warming(snapshot, transaction)?; + ensure!( + is_semantic_warming( + required(&transaction.expected, "Warming Expected projection",)?, + required(&transaction.activation, "Warming activation")?, + incumbent_lease_sha256.as_deref(), + &authenticated, + )?, + "durable Warming gate is not supported by current runtime evidence" + ); + } + WarmingEvidence::FirstOdinDirect { evidence } => { + self.authenticate_first_odin_warming_presence( + transaction, + &evidence.message_id, + evidence.challenged_at_unix_millis, + evidence.admitted_at_unix_millis, + &evidence.canonical_bytes, + )?; + } + } + } + if let Some(evidence) = &transaction.ready { + let authenticated = self.authenticate_topology_bytes( + snapshot, + transaction, + &evidence.canonical_bytes, + lease, + evidence.admitted_at_unix_millis, + )?; + validate_authenticated_evidence(evidence, &authenticated)?; + ensure!( + is_semantic_ready(&authenticated), + "durable Ready label is not exact semantic Ready" + ); + } + } + let odin_authority = self.current_odin_authority(snapshot)?; + for stored in &snapshot.admitted { + let generation = &stored.value; + let authority = self.runtime_authority_parts( + &generation.plan, + &generation.expected, + &generation.activation, + )?; + let latest = authenticate_odin_runtime_topology_correlation( + &generation.latest_odin_observation.canonical_bytes, + &authority, + generation.leasing.lease_sha256(), + &odin_authority.signer_public_key, + self.trusted_topology_context( + generation.latest_odin_observation.admitted_at_unix_millis, + ), + )?; + validate_authenticated_evidence(&generation.latest_odin_observation, &latest)?; + let ready = authenticate_odin_runtime_topology_correlation( + &generation.ready.canonical_bytes, + &authority, + generation.leasing.lease_sha256(), + &odin_authority.signer_public_key, + self.trusted_topology_context(generation.ready.admitted_at_unix_millis), + )?; + validate_authenticated_evidence(&generation.ready, &ready)?; + ensure!( + is_semantic_ready(&ready), + "admitted generation Ready label is not exact semantic Ready" + ); + } + Ok(()) + } +} + +fn serve(options: RuntimeOptions) -> Result<()> { + for path in [ + &options.state_store, + &options.topology_store, + &options.staging_root, + ] { + let directory = if path.extension().is_some() { + path.parent() + .context("configured Idunn path has no parent")? + } else { + path.as_path() + }; + fs::create_dir_all(directory) + .with_context(|| format!("creating Idunn directory {}", directory.display()))?; + } + let _lock = ProcessLock::acquire(&options.state_store)?; + ControlSnapshot::read(&options.state_store).context("validating all Idunn records")?; + let engine = Engine::open(options)?; + engine.validate_durable_authority(&ControlSnapshot::read(&engine.options.state_store)?)?; + + loop { + let transaction_progress = engine.resume_one_transaction()?; + let continuity_progress = engine.supervise_one_admitted_generation()?; + if !transaction_progress && !continuity_progress && engine.freeze_one_queued_command()? { + continue; + } + thread::sleep(Duration::from_millis(engine.options.poll_millis)); + } +} + +impl Engine { + /// Startup and every later loop use the same order: unfinished ownership + /// work first, admitted-body continuity second, new commands last. A + /// waiting transaction yields without relaxing ordinal order inside its + /// own command, so one target brake cannot suspend unrelated continuity. + fn resume_one_transaction(&self) -> Result { + let snapshot = ControlSnapshot::read(&self.options.state_store)?; + let mut progressed = false; + let mut candidates = snapshot + .transactions + .iter() + .filter(|stored| !stored.value.is_terminal()) + .collect::>(); + candidates.sort_by_key(|stored| { + ( + stored.value.created_at_unix_millis, + stored.value.ordinal, + stored.value.transaction_id.as_str(), + ) + }); + for current in candidates { + if snapshot.has_earlier_authority_sibling(¤t.value) { + continue; + } + if let Err(error) = self.advance_transaction(current) { + let latest_snapshot = ControlSnapshot::read(&self.options.state_store)?; + let latest = latest_snapshot + .transactions + .iter() + .find(|stored| stored.value.transaction_id == current.value.transaction_id) + .context("transaction disappeared while recording an execution error")?; + if latest.value.is_terminal() { + progressed = true; + } else if latest.value.phase < DeploymentPhase::Fencing + && latest.value.pre_fencing_abort.is_none() + { + self.begin_pre_fencing_abort(latest, error)?; + } else { + self.record_resumable_error(latest, &error)?; + } + } + let after = ControlSnapshot::read(&self.options.state_store)?; + let live = after + .transactions + .iter() + .find(|stored| stored.value.transaction_id == current.value.transaction_id) + .context("transaction disappeared while checking scheduler progress")?; + if live.envelope != current.envelope { + progressed = true; + } + } + Ok(progressed) + } + + fn freeze_one_queued_command(&self) -> Result { + let snapshot = ControlSnapshot::read(&self.options.state_store)?; + let transaction_commands = snapshot + .transactions + .iter() + .map(|stored| stored.value.command_id.as_str()) + .collect::>(); + let mut queued = snapshot + .commands + .iter() + .filter(|stored| { + stored.value.kind == CommandKind::Deploy + && !transaction_commands.contains(stored.value.command_id.as_str()) + }) + .collect::>(); + queued.sort_by_key(|stored| stored.value.requested_at_unix_millis); + let Some(command) = queued.first() else { + return Ok(false); + }; + let bindings = match load_bindings(&self.options.bindings_dir) { + Ok(bindings) => bindings, + Err(error) => { + eprintln!( + "Idunn left command {} queued because operator bindings are invalid: {error:#}", + command.value.command_id + ); + return Ok(false); + } + }; + let targets = match resolve_selector(&bindings, &command.value.selector) { + Ok(targets) => targets, + Err(error) => { + let now = now_millis()?; + let rejected = DeploymentTransaction::rejected(&command.value, error, now)?; + ensure!( + SingleFileMessagePackBackingStore::new(&self.options.state_store) + .compare_exchange( + &[CultCacheExpectedEnvelope { + r#type: DeploymentTransaction::TYPE.into(), + key: rejected.transaction_id.clone(), + current: None, + }], + &[transaction_envelope(&rejected, now)?], + )?, + "bad selector changed before refusal was recorded" + ); + return Ok(true); + } + }; + let busy = snapshot + .transactions + .iter() + .filter(|stored| stored.value.blocks_new_target_mutation()) + .map(|stored| stored.value.target.as_str()) + .collect::>(); + if targets.iter().any(|target| busy.contains(target.as_str())) { + return Ok(false); + } + let now = now_millis()?; + let transactions = targets + .into_iter() + .enumerate() + .map(|(ordinal, target)| { + DeploymentTransaction::new( + &command.value, + target.clone(), + u32::try_from(ordinal)?, + snapshot.admitted_for(&target).map(|stored| &stored.value), + now, + ) + }) + .collect::>>()?; + let expected = transactions + .iter() + .map(|transaction| CultCacheExpectedEnvelope { + r#type: DeploymentTransaction::TYPE.into(), + key: transaction.transaction_id.clone(), + current: None, + }) + .collect::>(); + let next = transactions + .iter() + .map(|transaction| transaction_envelope(transaction, now)) + .collect::>>()?; + ensure!( + SingleFileMessagePackBackingStore::new(&self.options.state_store) + .compare_exchange(&expected, &next)?, + "queued command lost its ordered transaction creation CAS" + ); + Ok(true) + } + + fn supervise_one_admitted_generation(&self) -> Result { + let snapshot = ControlSnapshot::read(&self.options.state_store)?; + let mut progressed = false; + let mut admitted = snapshot.admitted.iter().collect::>(); + admitted.sort_by_key(|stored| stored.value.target.as_str()); + for current in admitted { + let blocker = snapshot.transactions.iter().find(|stored| { + stored.value.target == current.value.target + && stored.value.blocks_new_target_mutation() + }); + if blocker.is_some_and(|stored| { + stored.value.phase >= DeploymentPhase::Fencing + && stored.value.phase < DeploymentPhase::Complete + }) { + continue; + } + match self.supervise_admitted_route(current) { + Ok(true) => { + progressed = true; + continue; + } + Ok(false) => {} + Err(error) => eprintln!( + "Idunn rejected admitted {} route continuity: {error:#}", + current.value.target + ), + } + match self.refresh_admitted_topology(&snapshot, current) { + Ok(true) => { + progressed = true; + continue; + } + Ok(false) => {} + Err(error) => eprintln!( + "Idunn preserved admitted {} after rejecting topology observation: {error:#}", + current.value.target + ), + } + let mut operational_error = None; + let observation = match self.workload.observe( + ¤t.value.expected, + ¤t.value.activation, + ¤t.value.workload, + ) { + Ok(observation) => { + let lease_is_missing = if let Some(lease) = current.value.leasing.lease() { + let lease_health = (|| -> Result { + let lease_path = current + .value + .plan + .parsed_inputs()? + .1 + .process_write_lease + .context("admitted lease has no operator binding")? + .record_path; + let driver = + CultCacheWriteLeaseDriver::new(¤t.value.target, lease_path); + if driver.observe_exact(lease)? { + return Ok(true); + } + if driver.observe_empty()? { + return Ok(false); + } + bail!("write-lease store contains unexpected authority") + })(); + match lease_health { + Ok(true) => false, + Ok(false) => { + operational_error = + Some(anyhow!("admitted physical write lease is missing")); + true + } + Err(error) => { + eprintln!( + "Idunn preserved admitted {} after refusing an unsafe write-lease mutation: {error:#}", + current.value.target + ); + continue; + } + } + } else { + false + }; + if lease_is_missing { + None + } else { + Some(observation) + } + } + Err(error) => { + operational_error = Some(error); + None + } + }; + if let Some(observation) = observation { + if blocker.is_none() + || blocker.is_some_and(|stored| stored.value.phase == DeploymentPhase::Complete) + { + let repair = (|| -> Result<()> { + let topology = self.topology(); + let provider_anchor = self.provider_anchor_for_plan(¤t.value.plan)?; + if !topology.admitted_runtime_projection_is_exact( + ¤t.value.expected, + &provider_anchor, + ¤t.value.activation, + current.value.leasing.lease(), + )? { + ensure!( + topology + .publish_expected(¤t.value.expected, &provider_anchor,)? + == current.value.expected.canonical_sha256()?, + "admitted Expected projection repair differs" + ); + ensure!( + topology.publish_observed_activation( + ¤t.value.expected, + ¤t.value.activation, + &observation, + )? == current.value.activation.canonical_sha256()?, + "admitted activation projection repair differs" + ); + if let Some(lease) = current.value.leasing.lease() { + ensure!( + topology.publish_process_write_lease( + ¤t.value.expected, + ¤t.value.activation, + lease, + )? == lease.canonical_sha256()?, + "admitted write-lease projection repair differs" + ); + } + } + Ok(()) + })(); + if let Err(error) = repair { + eprintln!( + "Idunn preserved admitted {} after refusing topology projection repair: {error:#}", + current.value.target + ); + } + } + continue; + } + let workload_error = operational_error + .context("admitted operational state has neither observation nor error")?; + if let Some(blocker) = blocker { + if blocker.value.phase < DeploymentPhase::Fencing + && blocker.value.pre_fencing_abort.is_none() + { + self.begin_pre_fencing_abort( + blocker, + anyhow!( + "admitted incumbent failed before candidate fencing; deployment yielded to continuity: {workload_error:#}" + ), + )?; + progressed = true; + } + continue; + } + let now = now_millis()?; + let command = DeploymentCommand { + schema_version: DEPLOYMENT_COMMAND_SCHEMA.into(), + command_id: format!("continuity-{}", Uuid::new_v4()), + kind: CommandKind::Continuity, + selector: current.value.target.clone(), + requested_by: "idunn-continuity".into(), + requested_at_unix_millis: now, + }; + command.validate()?; + let transaction = + DeploymentTransaction::from_continuity(&command, ¤t.value, now)?; + ensure!( + SingleFileMessagePackBackingStore::new(&self.options.state_store) + .compare_exchange( + &[ + CultCacheExpectedEnvelope { + r#type: DeploymentCommand::TYPE.into(), + key: command.command_id.clone(), + current: None, + }, + CultCacheExpectedEnvelope { + r#type: DeploymentTransaction::TYPE.into(), + key: transaction.transaction_id.clone(), + current: None, + }, + ], + &[ + command_envelope(&command, now)?, + transaction_envelope(&transaction, now)?, + ], + )?, + "continuity scheduling lost its command/transaction CAS" + ); + progressed = true; + } + Ok(progressed) + } + + fn supervise_admitted_route(&self, current: &Stored) -> Result { + let Some(expected_route) = current.value.expected.route.as_ref() else { + ensure!( + matches!(¤t.value.routing, RoutingEvidence::SkippedUnrouted) + && current.value.route_repair_started_at_unix_millis.is_none(), + "unrouted admitted generation carries route authority" + ); + return Ok(false); + }; + let RoutingEvidence::Promoted { + observation, + promoted_at_unix_millis, + } = ¤t.value.routing + else { + bail!("routed admitted generation has no promoted route receipt") + }; + ensure!( + observation.route_id == expected_route.route_id + && observation.runtime_instance_id == current.value.activation.runtime_instance_id, + "admitted route receipt names another incarnation" + ); + let binding = current.value.plan.parsed_inputs()?.1; + let lease_driver = if let Some(lease) = current.value.leasing.lease() { + let lease_path = &binding + .process_write_lease + .as_ref() + .context("stateful admitted generation has no write-lease binding")? + .record_path; + let driver = CultCacheWriteLeaseDriver::new(¤t.value.target, lease_path); + ensure!( + driver.observe_exact(lease)?, + "admitted process write lease is no longer exact" + ); + Some(driver) + } else { + None + }; + let route_binding = binding + .route + .context("routed admitted generation has no operator route binding")?; + let driver = NginxRouteDriver::new(route_binding); + + let membership_is_exact = + driver.observe_membership(¤t.value.expected, &observation.membership_sha256)?; + let now = now_millis()?; + if membership_is_exact + && route_observation_is_current( + observation.observed_at_unix_millis, + now, + self.options.topology_maximum_age_millis, + self.options.topology_maximum_future_skew_millis, + ) + && current.value.route_repair_started_at_unix_millis.is_none() + { + return Ok(false); + } + if current.value.route_repair_started_at_unix_millis.is_none() { + let mut next = current.value.clone(); + next.route_repair_started_at_unix_millis = Some(now); + next.validate()?; + ensure!( + SingleFileMessagePackBackingStore::new(&self.options.state_store) + .compare_exchange( + &[CultCacheExpectedEnvelope { + r#type: AdmittedGeneration::TYPE.into(), + key: current.value.target.clone(), + current: Some(current.envelope.clone()), + }], + &[admitted_envelope(&next, now)?], + )?, + "admitted generation changed before route repair intent CAS" + ); + return Ok(true); + } + driver + .restore_admitted_membership(¤t.value.expected, &observation.membership_sha256)?; + let authority = self.runtime_authority_parts( + ¤t.value.plan, + ¤t.value.expected, + ¤t.value.activation, + )?; + let refreshed = self.prove_stable_route_against( + ¤t.value.expected, + ¤t.value.activation, + &authority, + current.value.leasing.lease_sha256(), + &driver, + observation.membership_sha256.clone(), + )?; + ensure!( + driver.observe_membership(¤t.value.expected, &refreshed.membership_sha256)?, + "admitted route membership changed during its continuity challenge" + ); + if let (Some(lease_driver), Some(lease)) = (&lease_driver, current.value.leasing.lease()) { + ensure!( + lease_driver.observe_exact(lease)?, + "admitted process write lease changed during its continuity challenge" + ); + } + let mut next = current.value.clone(); + next.routing = RoutingEvidence::Promoted { + observation: refreshed, + promoted_at_unix_millis: *promoted_at_unix_millis, + }; + next.route_repair_started_at_unix_millis = None; + next.validate()?; + ensure!( + SingleFileMessagePackBackingStore::new(&self.options.state_store).compare_exchange( + &[CultCacheExpectedEnvelope { + r#type: AdmittedGeneration::TYPE.into(), + key: current.value.target.clone(), + current: Some(current.envelope.clone()), + }], + &[admitted_envelope(&next, now)?], + )?, + "admitted generation changed before route continuity receipt CAS" + ); + Ok(true) + } + + fn refresh_admitted_topology( + &self, + snapshot: &ControlSnapshot, + current: &Stored, + ) -> Result { + let Some(received) = self.topology().receive(¤t.value.target)? else { + return Ok(false); + }; + ensure!( + received.target == current.value.target, + "topology transport substituted admitted target" + ); + let now = now_millis()?; + let authority = self.runtime_authority_parts( + ¤t.value.plan, + ¤t.value.expected, + ¤t.value.activation, + )?; + let odin_authority = self.current_odin_authority(snapshot)?; + let authenticated = authenticate_odin_runtime_topology_correlation( + &received.canonical_bytes, + &authority, + current.value.leasing.lease_sha256(), + &odin_authority.signer_public_key, + self.trusted_topology_context(now), + )?; + let evidence = TopologyEvidence::from_authenticated(&authenticated, now)?; + if !sequence_requires_admission( + Some(¤t.value.latest_odin_observation), + snapshot.max_odin_sequence(¤t.value.target, &evidence.signer_identity_id), + &evidence, + )? { + return Ok(false); + } + let mut next = current.value.clone(); + next.latest_odin_observation = evidence.clone(); + next.odin_publisher_sequence_cursor = evidence.publisher_sequence; + if is_semantic_ready(&authenticated) { + next.ready = evidence; + } + next.validate()?; + ensure!( + SingleFileMessagePackBackingStore::new(&self.options.state_store).compare_exchange( + &[CultCacheExpectedEnvelope { + r#type: AdmittedGeneration::TYPE.into(), + key: current.value.target.clone(), + current: Some(current.envelope.clone()), + }], + &[admitted_envelope(&next, now)?], + )?, + "admitted generation changed before topology sequence CAS" + ); + Ok(true) + } + + fn advance_transaction(&self, current: &Stored) -> Result<()> { + if current.value.pre_fencing_abort.is_some() && current.value.completion.is_none() { + return self.advance_pre_fencing_abort(current); + } + match current.value.phase { + DeploymentPhase::Sealing => self.advance_sealing(current), + DeploymentPhase::Starting => self.advance_starting(current), + DeploymentPhase::Warming => self.advance_warming(current), + DeploymentPhase::Fencing => self.advance_fencing(current), + DeploymentPhase::Leasing => self.advance_leasing(current), + DeploymentPhase::AwaitingReady => self.advance_awaiting_ready(current), + DeploymentPhase::Routing => self.advance_routing(current), + DeploymentPhase::Committing => self.advance_committing(current), + DeploymentPhase::Complete => self.advance_post_commit_cleanup(current), + } + } + + fn advance_sealing(&self, current: &Stored) -> Result<()> { + if current.value.plan.is_none() { + ensure!( + current.value.command_kind == CommandKind::Deploy, + "continuity transaction lost its admitted plan" + ); + let bindings = load_bindings(&self.options.bindings_dir)?; + let loaded = bindings + .get(¤t.value.target) + .context("operator binding disappeared before sealing")?; + let now = now_millis()?; + let resolved = + self.source + .resolve(&loaded.binding, ¤t.value.transaction_id, now)?; + let providers = self.current_ready_provider_tokens( + &ControlSnapshot::read(&self.options.state_store)?, + now, + )?; + let candidate_port = self.select_candidate_port(&loaded.binding)?; + let plan = compile_deployment_plan( + &resolved.recipe_bytes, + &loaded.bytes, + resolved.facts, + format!("incarnation-{}", current.value.transaction_id), + candidate_port, + now, + &providers, + )?; + return self.persist_same_phase(current, |next| { + next.plan = Some(plan); + next.updated_at_unix_millis = now; + next.last_error = None; + Ok(()) + }); + } + + if current.value.command_kind == CommandKind::Deploy + && current.value.frozen_source.is_none() + { + let now = now_millis()?; + let plan = required(¤t.value.plan, "transaction plan")?; + let receipt = self.source.freeze(¤t.value.transaction_id, plan)?; + return self.persist_same_phase(current, |next| { + next.frozen_source = Some(receipt); + next.updated_at_unix_millis = now; + next.last_error = None; + Ok(()) + }); + } + + if current.value.sealed_release.is_none() + || current.value.installed_release.is_none() + || current.value.expected.is_none() + { + ensure!( + current.value.command_kind == CommandKind::Deploy, + "continuity transaction lost its admitted release evidence" + ); + let now = now_millis()?; + let plan = required(¤t.value.plan, "transaction plan")?; + let frozen_receipt = required(¤t.value.frozen_source, "frozen source")?; + let frozen = self.source.observe_frozen(plan, frozen_receipt)?; + let materialized = + self.runner + .materialize(&frozen, plan, &self.options.staging_root, now)?; + let installed = self.workload.install(plan, &materialized)?; + let expected = materialized.release.expected_projection(plan)?; + return self.persist_same_phase(current, |next| { + next.sealed_release = Some(materialized.release); + next.installed_release = Some(installed); + next.expected = Some(expected); + next.updated_at_unix_millis = now; + next.last_error = None; + Ok(()) + }); + } + + if current.value.expected_publication_sha256.is_none() { + let now = now_millis()?; + let plan = required(¤t.value.plan, "transaction plan")?; + let expected = required(¤t.value.expected, "Expected projection")?; + let provider_anchor = self.provider_anchor_for_plan(plan)?; + let digest = self + .topology() + .publish_expected(expected, &provider_anchor)?; + return self.persist_same_phase(current, |next| { + next.expected_publication_sha256 = Some(digest); + next.updated_at_unix_millis = now; + next.last_error = None; + Ok(()) + }); + } + + let now = now_millis()?; + let mut next = current.value.clone(); + match current.value.command_kind { + CommandKind::Deploy => { + let Some(authorization) = self.deployment_authorization(current, now)? else { + return self.record_gate_wait( + current, + "deployment brake has not released this exact transaction", + ); + }; + next.deployment_authorization = Some(authorization); + } + CommandKind::Continuity => { + if !self.lifecycle_allows(current, now)? { + return self + .record_gate_wait(current, "lifecycle brake denies continuity restart"); + } + next.lifecycle_authorized_at_unix_millis = Some(now); + } + } + validate_live_providers_for_deploy(current.value.command_kind, || { + self.validate_selected_providers_current( + required(¤t.value.plan, "transaction plan")?, + now, + ) + })?; + next.phase = DeploymentPhase::Starting; + next.updated_at_unix_millis = now; + next.last_error = None; + replace_transaction(&self.options.state_store, current, &next) + } + + fn advance_starting(&self, current: &Stored) -> Result<()> { + let expected = required(¤t.value.expected, "Expected projection")?; + let plan = required(¤t.value.plan, "transaction plan")?; + let release = required(¤t.value.sealed_release, "sealed release")?; + let installed = required(¤t.value.installed_release, "installed release")?; + if current.value.activation.is_none() { + validate_live_providers_for_deploy(current.value.command_kind, || { + self.validate_selected_providers_current(plan, now_millis()?) + })?; + let now = now_millis()?; + let runtime_instance_id = runtime_instance_id(¤t.value.transaction_id)?; + let launch = IdunnRuntimeActivationLaunch::issue( + expected, + runtime_instance_id, + now, + &self.idunn_signer, + )?; + let activation = self.workload.prepare_activation(plan, expected, launch)?; + return self.persist_same_phase(current, |next| { + next.activation = Some(activation); + next.updated_at_unix_millis = now; + next.last_error = None; + Ok(()) + }); + } + if current.value.workload.is_none() { + let now = now_millis()?; + let activation = required(¤t.value.activation, "activation")?; + let observation = self + .workload + .start_prepared(plan, release, installed, expected, activation)?; + return self.persist_same_phase(current, |next| { + next.workload = Some(observation); + next.updated_at_unix_millis = now; + next.last_error = None; + Ok(()) + }); + } + if current.value.activation_publication_sha256.is_none() { + let now = now_millis()?; + let activation = required(¤t.value.activation, "activation")?; + let workload = required(¤t.value.workload, "workload")?; + self.workload.observe(expected, activation, workload)?; + let digest = self + .topology() + .publish_observed_activation(expected, activation, workload)?; + return self.persist_same_phase(current, |next| { + next.activation_publication_sha256 = Some(digest); + next.updated_at_unix_millis = now; + next.last_error = None; + Ok(()) + }); + } + let mut next = current.value.clone(); + next.phase = DeploymentPhase::Warming; + next.updated_at_unix_millis = now_millis()?; + next.last_error = None; + replace_transaction(&self.options.state_store, current, &next) + } + + fn advance_warming(&self, current: &Stored) -> Result<()> { + let expected = required(¤t.value.expected, "Expected projection")?; + let activation = required(¤t.value.activation, "activation")?; + let workload = required(¤t.value.workload, "workload")?; + self.workload.observe(expected, activation, workload)?; + let snapshot = ControlSnapshot::read(&self.options.state_store)?; + let incumbent_lease_sha256 = + self.incumbent_lease_sha256_for_warming(&snapshot, ¤t.value)?; + if current.value.warming.is_none() { + if current.value.target == "odin" && snapshot.admitted_for("odin").is_none() { + ensure!( + current.value.incumbent_generation_id.is_none() + && expected.write_lease_required, + "first Odin bootstrap must be a stateful first incarnation" + ); + let (evidence, present) = self.observe_first_odin_warming(¤t.value)?; + let _token = SequenceAdmittedWarming::from_first_odin_presence( + current.value.transaction_id.clone(), + evidence.clone(), + present, + )?; + return self.persist_same_phase(current, |next| { + next.warming = Some(WarmingEvidence::FirstOdinDirect { evidence }); + Ok(()) + }); + } + let Some((admitted, authenticated)) = self.admit_latest_topology(current, None)? else { + return Ok(()); + }; + if admitted.envelope != current.envelope { + return Ok(()); + } + let semantic_warming = is_semantic_warming( + expected, + activation, + incumbent_lease_sha256.as_deref(), + &authenticated, + )?; + let latest = required( + &admitted.value.latest_odin_observation, + "sequence-admitted warming evidence", + )?; + if semantic_warming { + let evidence = latest.clone(); + let _token = SequenceAdmittedWarming::from_topology( + admitted.value.transaction_id.clone(), + evidence.clone(), + authenticated, + )?; + return self.persist_same_phase(&admitted, |next| { + next.warming = Some(WarmingEvidence::OdinTopology { evidence }); + Ok(()) + }); + } else { + return Ok(()); + } + } + let warming = self.rehydrate_warming_token(¤t.value, now_millis()?, false)?; + ensure!( + warming.transaction_id() == current.value.transaction_id + && warming.runtime_instance_id() == activation.runtime_instance_id.as_str(), + "durable Warming evidence belongs to another candidate" + ); + + if expected.route.is_some() && current.value.route_preflight.is_none() { + let now = now_millis()?; + let snapshot = ControlSnapshot::read(&self.options.state_store)?; + let incumbent = self.exact_incumbent(&snapshot, ¤t.value)?; + let incumbent_route = + incumbent.and_then(|generation| generation.value.routing.observation().cloned()); + let binding = current.value.plan.as_ref().unwrap().parsed_inputs()?.1; + let route_binding = binding + .route + .context("routed Expected lost route binding")?; + let driver = NginxRouteDriver::new(route_binding); + let receipt = driver.preflight( + expected, + &activation.runtime_instance_id, + incumbent_route.as_ref(), + )?; + return self.persist_same_phase(current, |next| { + next.route_preflight = Some(receipt); + next.updated_at_unix_millis = now; + Ok(()) + }); + } + + if current.value.isolation.is_none() { + let now = now_millis()?; + let snapshot = ControlSnapshot::read(&self.options.state_store)?; + let incumbent = self.exact_incumbent(&snapshot, ¤t.value)?; + let isolation = + prove_isolation(workload, incumbent.map(|value| &value.value.workload))?; + return self.persist_same_phase(current, |next| { + next.isolation = Some(isolation); + next.updated_at_unix_millis = now; + Ok(()) + }); + } + + self.transition(current, DeploymentPhase::Fencing) + } + + fn advance_fencing(&self, current: &Stored) -> Result<()> { + if current.value.fencing.is_none() { + let now = now_millis()?; + let snapshot = ControlSnapshot::read(&self.options.state_store)?; + let incumbent = self.exact_incumbent(&snapshot, ¤t.value)?; + let incumbent_lease = incumbent.and_then(|generation| generation.value.leasing.lease()); + let expected = required(¤t.value.expected, "Expected projection")?; + let evidence = if expected.write_lease_required || incumbent_lease.is_some() { + let incumbent_lease_path = incumbent_lease + .map(|_| -> Result { + Ok(incumbent + .context("incumbent lease has no admitted generation")? + .value + .plan + .parsed_inputs()? + .1 + .process_write_lease + .context("incumbent lease has no admitted binding")? + .record_path) + }) + .transpose()?; + if let (Some(lease), Some(path)) = (incumbent_lease, &incumbent_lease_path) { + let incumbent = incumbent.context("incumbent lease lost its generation")?; + self.workload + .stop(&incumbent.value.workload) + .context("stopping the exact incumbent before revoking its lifetime-held write lease")?; + let driver = CultCacheWriteLeaseDriver::new(¤t.value.target, path); + driver.revoke_exact(Some(lease))?; + ensure!( + driver.observe_empty()?, + "incumbent write lease remained after exact fencing" + ); + self.topology().withdraw_process_write_lease( + &incumbent.value.expected, + &incumbent.value.activation, + Some(lease), + )?; + } + let candidate_lease_path = if expected.write_lease_required { + Some( + current + .value + .plan + .as_ref() + .unwrap() + .parsed_inputs()? + .1 + .process_write_lease + .context("stateful candidate has no write-lease binding")? + .record_path, + ) + } else { + None + }; + if let Some(path) = &candidate_lease_path { + if incumbent_lease_path.as_ref() != Some(path) { + let driver = CultCacheWriteLeaseDriver::new(¤t.value.target, path); + driver.revoke_exact(None)?; + ensure!( + driver.observe_empty()?, + "candidate write-lease path was not empty before grant" + ); + } + } + self.topology().withdraw_process_write_lease( + expected, + required(¤t.value.activation, "candidate activation")?, + None, + )?; + FencingEvidence::Revoked { + incumbent_lease_sha256: incumbent_lease + .map(IdunnProcessWriteLeaseRecord::canonical_sha256) + .transpose()?, + candidate_lease_path_verified_empty: candidate_lease_path.is_some(), + } + } else { + FencingEvidence::SkippedStateless + }; + return self.persist_same_phase(current, |next| { + next.fencing = Some(evidence); + next.updated_at_unix_millis = now; + Ok(()) + }); + } + self.transition(current, DeploymentPhase::Leasing) + } + + fn advance_leasing(&self, current: &Stored) -> Result<()> { + let expected = required(¤t.value.expected, "Expected projection")?; + if !expected.write_lease_required { + if current.value.leasing.is_none() { + let now = now_millis()?; + return self.persist_same_phase(current, |next| { + next.leasing = Some(LeasingEvidence::SkippedStateless); + next.updated_at_unix_millis = now; + Ok(()) + }); + } + return self.transition(current, DeploymentPhase::AwaitingReady); + } + + let binding = current.value.plan.as_ref().unwrap().parsed_inputs()?.1; + let lease_path = binding + .process_write_lease + .context("stateful target has no write-lease binding")? + .record_path; + let driver = CultCacheWriteLeaseDriver::new(¤t.value.target, lease_path); + + if matches!( + current.value.leasing.as_ref(), + Some(LeasingEvidence::Granted { .. }) + ) { + let activation = required(¤t.value.activation, "activation")?; + let warming = self.rehydrate_warming_token(¤t.value, now_millis()?, false)?; + let lease = current + .value + .leasing + .as_ref() + .and_then(LeasingEvidence::lease) + .context("granted Leasing evidence has no write lease")?; + let recorded_sha256 = current + .value + .leasing + .as_ref() + .and_then(LeasingEvidence::lease_sha256) + .context("granted Leasing evidence has no lease digest")?; + ensure!( + driver.observe_exact(lease)?, + "physical write lease disappeared after Granted became durable" + ); + self.workload.observe( + expected, + activation, + required(¤t.value.workload, "candidate workload")?, + )?; + ensure!( + driver.grant(expected, activation, &warming, lease)? == recorded_sha256, + "replayed physical write lease differs from Granted evidence" + ); + ensure!( + self.topology() + .publish_process_write_lease(expected, activation, lease)? + == recorded_sha256, + "replayed write-lease projection differs from Granted evidence" + ); + return self.transition(current, DeploymentPhase::AwaitingReady); + } + + if let Some((lease, prepared_sha256)) = current + .value + .leasing + .as_ref() + .and_then(LeasingEvidence::prepared_lease) + { + let now = now_millis()?; + let activation = required(¤t.value.activation, "activation")?; + let historical_warming = self.rehydrate_warming_token(¤t.value, now, false)?; + let physical_is_exact = driver.observe_exact(lease)?; + let warming = if physical_is_exact { + historical_warming + } else { + ensure!( + driver.observe_empty()?, + "candidate write-lease store contains authority other than its durable prepared lease" + ); + match self.rehydrate_warming_token(¤t.value, now, true) { + Ok(warming) => warming, + Err(_) => { + let Some((admitted, fresh_evidence, fresh_warming)) = + self.fresh_warming_for_lease(current, now)? + else { + return Ok(()); + }; + let replacement = self.prepare_candidate_write_lease( + &admitted.value, + &fresh_warming, + now, + )?; + let replacement_sha256 = replacement.canonical_sha256()?; + return self.persist_same_phase(&admitted, |next| { + next.warming = Some(fresh_evidence); + next.leasing = Some(LeasingEvidence::Prepared { + lease: replacement, + lease_sha256: replacement_sha256, + }); + next.updated_at_unix_millis = now; + Ok(()) + }); + } + } + }; + self.workload.observe( + expected, + activation, + required(¤t.value.workload, "candidate workload")?, + )?; + if !physical_is_exact { + ensure!( + driver.observe_empty()?, + "candidate write-lease store changed before physical grant" + ); + } + let granted_sha256 = driver.grant(expected, activation, &warming, lease)?; + ensure!( + granted_sha256 == prepared_sha256, + "granted write lease differs from the durable prepared lease" + ); + let projected_sha256 = self + .topology() + .publish_process_write_lease(expected, activation, lease)?; + ensure!( + projected_sha256 == granted_sha256, + "projected write lease differs from the granted process authority" + ); + let lease = lease.clone(); + return self.persist_same_phase(current, |next| { + next.leasing = Some(LeasingEvidence::Granted { + lease, + lease_sha256: projected_sha256, + }); + next.updated_at_unix_millis = now; + Ok(()) + }); + } + + ensure!( + current.value.leasing.is_none(), + "stateful Leasing phase carries invalid lease evidence" + ); + ensure!( + driver.observe_empty()?, + "candidate write-lease store contains authority before lease preparation" + ); + let now = now_millis()?; + let Some((admitted, fresh_evidence, fresh_warming)) = + self.fresh_warming_for_lease(current, now)? + else { + return Ok(()); + }; + let lease = self.prepare_candidate_write_lease(&admitted.value, &fresh_warming, now)?; + let lease_sha256 = lease.canonical_sha256()?; + self.persist_same_phase(&admitted, |next| { + next.warming = Some(fresh_evidence); + next.leasing = Some(LeasingEvidence::Prepared { + lease, + lease_sha256, + }); + next.updated_at_unix_millis = now; + Ok(()) + }) + } + + fn advance_awaiting_ready(&self, current: &Stored) -> Result<()> { + let now = now_millis()?; + let expected = required(¤t.value.expected, "Expected projection")?; + if expected.write_lease_required { + let activation = required(¤t.value.activation, "activation")?; + let warming = self.rehydrate_warming_token(¤t.value, now, false)?; + let lease = current + .value + .leasing + .as_ref() + .and_then(LeasingEvidence::lease) + .context("stateful transaction has no process write lease")?; + let binding = current.value.plan.as_ref().unwrap().parsed_inputs()?.1; + let path = binding + .process_write_lease + .context("stateful target has no write-lease binding")? + .record_path; + ensure!( + CultCacheWriteLeaseDriver::new(¤t.value.target, path) + .observe(expected, activation, &warming, lease)?, + "candidate process write lease is no longer exact" + ); + } + { + let current_lease = current + .value + .leasing + .as_ref() + .and_then(LeasingEvidence::lease_sha256); + let Some((admitted, authenticated)) = + self.admit_latest_topology(current, current_lease)? + else { + return Ok(()); + }; + if admitted.envelope != current.envelope { + return Ok(()); + } + let semantic_ready = is_semantic_ready(&authenticated); + let latest = required( + &admitted.value.latest_odin_observation, + "sequence-admitted Ready evidence", + )?; + if current.value.ready.as_ref() == Some(latest) { + ensure!(semantic_ready, "stored Ready receipt changed meaning"); + } else if semantic_ready { + let evidence = latest.clone(); + let _token = SequenceAdmittedReady { + transaction_id: admitted.value.transaction_id.clone(), + evidence: evidence.clone(), + expected: expected.clone(), + authenticated, + }; + return self.persist_same_phase(&admitted, |next| { + next.ready = Some(evidence); + Ok(()) + }); + } else { + return Ok(()); + } + } + self.transition(current, DeploymentPhase::Routing) + } + + fn advance_routing(&self, current: &Stored) -> Result<()> { + let expected = required(¤t.value.expected, "Expected projection")?; + let activation = required(¤t.value.activation, "activation")?; + if current.value.routing.is_none() { + let current_lease = current + .value + .leasing + .as_ref() + .and_then(LeasingEvidence::lease_sha256); + let Some((admitted, authenticated)) = + self.admit_latest_topology(current, current_lease)? + else { + return Ok(()); + }; + if admitted.envelope != current.envelope { + return Ok(()); + } + ensure!( + is_semantic_ready(&authenticated), + "latest Odin observation is not Ready at route admission" + ); + let latest = required( + &admitted.value.latest_odin_observation, + "current route-admission topology evidence", + )?; + if admitted.value.ready.as_ref() != Some(latest) { + let latest = latest.clone(); + return self.persist_same_phase(&admitted, |next| { + next.ready = Some(latest); + Ok(()) + }); + } + let ready = self.rehydrate_ready_token(&admitted.value, now_millis()?, true)?; + ensure!( + ready.transaction_id() == admitted.value.transaction_id, + "Ready token belongs to another transaction" + ); + validate_live_providers_for_deploy(admitted.value.command_kind, || { + self.validate_selected_providers_current( + required(&admitted.value.plan, "transaction plan")?, + now_millis()?, + ) + })?; + self.ensure_transaction_write_lease_current(&admitted.value, now_millis()?)?; + let evidence = if expected.route.is_some() { + let binding = admitted.value.plan.as_ref().unwrap().parsed_inputs()?.1; + let route_binding = binding.route.context("routed plan has no route binding")?; + let preflight = required(&admitted.value.route_preflight, "route preflight")?; + let driver = NginxRouteDriver::new(route_binding); + ensure!( + preflight.candidate_runtime_instance_id == activation.runtime_instance_id, + "route preflight belongs to another runtime instance" + ); + let rollback_allowed = may_rollback_route_after_failed_proof(required( + &admitted.value.fencing, + "route fencing evidence", + )?); + let membership_sha256 = driver.install( + expected, + &activation.runtime_instance_id, + preflight, + rollback_allowed, + )?; + let observation = match self.prove_stable_route( + &admitted.value, + &driver, + membership_sha256, + ) { + Ok(observation) => observation, + Err(proof_error) if !rollback_allowed => { + return Err(proof_error).context( + "incumbent authority was fenced; candidate route remains installed for fail-closed retry", + ); + } + Err(proof_error) => { + return match driver.rollback( + expected, + &activation.runtime_instance_id, + preflight, + ) { + Ok(()) => Err(proof_error) + .context("candidate did not answer its stable route challenge"), + Err(rollback_error) => Err(proof_error).context(format!( + "candidate did not answer its stable route challenge; exact route rollback also failed: {rollback_error:#}" + )), + }; + } + }; + ensure!( + driver.observe_membership(expected, &observation.membership_sha256)?, + "route membership changed during its signed stable-listener observation" + ); + self.ensure_transaction_write_lease_current(&admitted.value, now_millis()?)?; + let promoted_at_unix_millis = observation.observed_at_unix_millis; + RoutingEvidence::Promoted { + observation, + promoted_at_unix_millis, + } + } else { + RoutingEvidence::SkippedUnrouted + }; + let now = now_millis()?; + return self.persist_same_phase(&admitted, |next| { + next.routing = Some(evidence); + next.updated_at_unix_millis = now; + Ok(()) + }); + } + self.transition(current, DeploymentPhase::Committing) + } + + fn advance_committing(&self, current: &Stored) -> Result<()> { + let current_lease_sha256 = current + .value + .leasing + .as_ref() + .and_then(LeasingEvidence::lease_sha256) + .map(str::to_owned); + let Some((ready_current, authenticated)) = + self.admit_latest_topology(current, current_lease_sha256.as_deref())? + else { + return Ok(()); + }; + if ready_current.envelope != current.envelope { + return Ok(()); + } + ensure!( + is_semantic_ready(&authenticated), + "latest Odin observation is not Ready at admission commit" + ); + ensure!( + ready_current.value.latest_odin_observation.as_ref() + == ready_current.value.ready.as_ref(), + "latest Odin observation differs from the durable Ready receipt at admission commit" + ); + self.rehydrate_ready_token(&ready_current.value, now_millis()?, true)?; + validate_live_providers_for_deploy(ready_current.value.command_kind, || { + self.validate_selected_providers_current( + required(&ready_current.value.plan, "transaction plan")?, + now_millis()?, + ) + })?; + + let expected = required(&ready_current.value.expected, "Expected projection")?; + let activation = required(&ready_current.value.activation, "activation")?; + let workload = required(&ready_current.value.workload, "workload")?; + self.workload.observe(expected, activation, workload)?; + self.ensure_transaction_write_lease_current(&ready_current.value, now_millis()?)?; + if let Some(route) = ready_current + .value + .routing + .as_ref() + .and_then(RoutingEvidence::observation) + { + let binding = ready_current + .value + .plan + .as_ref() + .unwrap() + .parsed_inputs()? + .1; + let driver = + NginxRouteDriver::new(binding.route.context("routed plan has no route binding")?); + ensure!( + driver.observe_membership(expected, &route.membership_sha256)?, + "route membership changed before admission commit" + ); + let current_route = self.prove_stable_route( + &ready_current.value, + &driver, + route.membership_sha256.clone(), + )?; + ensure!( + current_route.route_id == route.route_id + && current_route.runtime_instance_id == route.runtime_instance_id, + "stable route changed incarnation before admission commit" + ); + ensure!( + driver.observe_membership(expected, &route.membership_sha256)?, + "route membership changed during the final signed admission challenge" + ); + self.ensure_transaction_write_lease_current(&ready_current.value, now_millis()?)?; + } + + let current_lease_sha256 = ready_current + .value + .leasing + .as_ref() + .and_then(LeasingEvidence::lease_sha256) + .map(str::to_owned); + let Some((commit_current, authenticated)) = + self.admit_latest_topology(&ready_current, current_lease_sha256.as_deref())? + else { + return Ok(()); + }; + if commit_current.envelope != ready_current.envelope { + return Ok(()); + } + ensure!( + is_semantic_ready(&authenticated), + "latest Odin observation is not Ready after the final admission challenge" + ); + ensure!( + commit_current.value.latest_odin_observation.as_ref() + == commit_current.value.ready.as_ref(), + "latest Odin observation differs from the durable Ready receipt after the final admission challenge" + ); + let now = now_millis()?; + self.rehydrate_ready_token(&commit_current.value, now, true)?; + validate_live_providers_for_deploy(commit_current.value.command_kind, || { + self.validate_selected_providers_current( + required(&commit_current.value.plan, "transaction plan")?, + now, + ) + })?; + self.workload.observe( + required(&commit_current.value.expected, "Expected projection")?, + required(&commit_current.value.activation, "activation")?, + required(&commit_current.value.workload, "workload")?, + )?; + self.ensure_transaction_write_lease_current(&commit_current.value, now)?; + + let snapshot = ControlSnapshot::read(&self.options.state_store)?; + let incumbent = self.exact_incumbent(&snapshot, &commit_current.value)?; + let odin_authority = self.current_odin_authority(&snapshot)?; + let generation = + AdmittedGeneration::from_transaction(&commit_current.value, odin_authority, now)?; + let post_commit_cleanup = PostCommitCleanup { + incumbent: match incumbent { + Some(incumbent) + if incumbent_was_stopped_during_fencing(required( + &commit_current.value.fencing, + "commit fencing evidence", + )?) => + { + IncumbentCleanupEvidence::Complete { + generation_id: incumbent.value.generation_id.clone(), + } + } + Some(incumbent) => IncumbentCleanupEvidence::Pending { + generation_id: incumbent.value.generation_id.clone(), + workload: incumbent.value.workload.clone(), + }, + None => IncumbentCleanupEvidence::SkippedNoIncumbent, + }, + source: match commit_current.value.command_kind { + CommandKind::Deploy => SourceCleanupEvidence::Pending, + CommandKind::Continuity => SourceCleanupEvidence::SkippedContinuity, + }, + }; + let mut complete = commit_current.value.clone(); + complete.phase = DeploymentPhase::Complete; + complete.updated_at_unix_millis = now; + complete.last_error = None; + complete.completion = Some(TransactionCompletion::Admitted { + generation_id: generation.generation_id.clone(), + }); + complete.post_commit_cleanup = Some(post_commit_cleanup); + complete.validate()?; + + let admitted_expected = CultCacheExpectedEnvelope { + r#type: AdmittedGeneration::TYPE.into(), + key: generation.target.clone(), + current: incumbent.map(|stored| stored.envelope.clone()), + }; + ensure!( + SingleFileMessagePackBackingStore::new(&self.options.state_store).compare_exchange( + &[ + CultCacheExpectedEnvelope { + r#type: DeploymentTransaction::TYPE.into(), + key: commit_current.value.transaction_id.clone(), + current: Some(commit_current.envelope.clone()), + }, + admitted_expected, + ], + &[ + transaction_envelope(&complete, now)?, + admitted_envelope(&generation, now)?, + ], + )?, + "incumbent or transaction changed before atomic admission commit" + ); + Ok(()) + } + + fn exact_incumbent<'a>( + &self, + snapshot: &'a ControlSnapshot, + transaction: &DeploymentTransaction, + ) -> Result>> { + let current = snapshot.admitted_for(&transaction.target); + match (&transaction.incumbent_generation_id, current) { + (None, None) => Ok(None), + (Some(expected), Some(current)) if current.value.generation_id == *expected => { + Ok(Some(current)) + } + _ => bail!("target incumbent changed after transaction creation"), + } + } + + fn incumbent_lease_sha256_for_warming( + &self, + snapshot: &ControlSnapshot, + transaction: &DeploymentTransaction, + ) -> Result> { + if let Some(fencing) = &transaction.fencing { + return match fencing { + FencingEvidence::SkippedStateless => Ok(None), + FencingEvidence::Revoked { + incumbent_lease_sha256, + .. + } => Ok(incumbent_lease_sha256.clone()), + }; + } + self.exact_incumbent(snapshot, transaction)? + .and_then(|incumbent| incumbent.value.leasing.lease()) + .map(IdunnProcessWriteLeaseRecord::canonical_sha256) + .transpose() + } + + fn fresh_warming_for_lease( + &self, + current: &Stored, + now: u64, + ) -> Result< + Option<( + Stored, + WarmingEvidence, + SequenceAdmittedWarming, + )>, + > { + let prior = self.rehydrate_warming_token(¤t.value, now, false)?; + match required(¤t.value.warming, "pre-fence Warming evidence")?.clone() { + WarmingEvidence::FirstOdinDirect { .. } => { + let snapshot = ControlSnapshot::read(&self.options.state_store)?; + ensure!( + snapshot.admitted_for("odin").is_none() + && self.exact_incumbent(&snapshot, ¤t.value)?.is_none(), + "direct first-Odin Warming refresh found an admitted Odin" + ); + let (evidence, present) = self.observe_first_odin_warming(¤t.value)?; + let token = SequenceAdmittedWarming::from_first_odin_presence( + current.value.transaction_id.clone(), + evidence.clone(), + present, + )?; + ensure!( + token.signed_presence_sha256() != prior.signed_presence_sha256(), + "first Odin replayed its pre-fence Warming presence" + ); + Ok(Some(( + current.clone(), + WarmingEvidence::FirstOdinDirect { evidence }, + token, + ))) + } + WarmingEvidence::OdinTopology { + evidence: prior_evidence, + } => { + let Some((admitted, authenticated)) = self.admit_latest_topology(current, None)? + else { + return Ok(None); + }; + let fresh_evidence = required( + &admitted.value.latest_odin_observation, + "post-fence Odin Warming observation", + )? + .clone(); + let snapshot = ControlSnapshot::read(&self.options.state_store)?; + let incumbent_lease_sha256 = + self.incumbent_lease_sha256_for_warming(&snapshot, &admitted.value)?; + if !is_semantic_warming( + required(&admitted.value.expected, "Warming Expected projection")?, + required(&admitted.value.activation, "Warming activation")?, + incumbent_lease_sha256.as_deref(), + &authenticated, + )? { + return Ok(None); + } + let token = SequenceAdmittedWarming::from_topology( + admitted.value.transaction_id.clone(), + fresh_evidence.clone(), + authenticated, + )?; + if !provider_warming_advanced( + prior_evidence.publisher_sequence, + prior.signed_presence_sha256(), + fresh_evidence.publisher_sequence, + token.signed_presence_sha256(), + ) { + return Ok(None); + } + Ok(Some(( + admitted, + WarmingEvidence::OdinTopology { + evidence: fresh_evidence, + }, + token, + ))) + } + } + } + + fn prepare_candidate_write_lease( + &self, + transaction: &DeploymentTransaction, + warming: &SequenceAdmittedWarming, + now: u64, + ) -> Result { + let expected = required(&transaction.expected, "Expected projection")?; + let activation = required(&transaction.activation, "activation")?; + ensure!( + expected.write_lease_required + && warming.transaction_id() == transaction.transaction_id + && warming.runtime_instance_id() == activation.runtime_instance_id, + "fresh Warming token does not own this stateful candidate" + ); + let snapshot = ControlSnapshot::read(&self.options.state_store)?; + let epoch = self + .exact_incumbent(&snapshot, transaction)? + .and_then(|generation| generation.value.leasing.lease()) + .map_or(1, |lease| lease.lease_epoch.saturating_add(1)); + let lease = IdunnProcessWriteLeaseRecord { + schema_version: IDUNN_PROCESS_WRITE_LEASE_SCHEMA.into(), + target: expected.target.clone(), + expected_projection_sha256: expected.canonical_sha256()?, + plan_id: expected.plan_id.clone(), + incarnation_id: expected.incarnation_id.clone(), + sealed_release_id: expected.sealed_release_id.clone(), + activation_witness_sha256: activation.canonical_sha256()?, + state_schema_generation: expected + .state_schema_generation + .clone() + .context("stateful Expected has no schema generation")?, + state_contract_sha256: expected + .state_contract_sha256 + .clone() + .context("stateful Expected has no state contract")?, + runtime_id: expected.runtime_id.clone(), + runtime_instance_id: activation.runtime_instance_id.clone(), + warming_presence_sha256: warming.signed_presence_sha256().to_owned(), + lease_epoch: epoch, + issued_at_unix_millis: now, + }; + lease.validate()?; + Ok(lease) + } + + fn ensure_transaction_write_lease_current( + &self, + transaction: &DeploymentTransaction, + now: u64, + ) -> Result<()> { + let expected = required(&transaction.expected, "Expected projection")?; + let lease = transaction + .leasing + .as_ref() + .and_then(LeasingEvidence::lease); + ensure!( + expected.write_lease_required == lease.is_some(), + "transaction write-lease disposition differs from Expected" + ); + let Some(lease) = lease else { + return Ok(()); + }; + let activation = required(&transaction.activation, "activation")?; + let warming = self.rehydrate_warming_token(transaction, now, false)?; + let lease_path = required(&transaction.plan, "transaction plan")? + .parsed_inputs()? + .1 + .process_write_lease + .context("stateful target has no write-lease binding")? + .record_path; + ensure!( + CultCacheWriteLeaseDriver::new(&transaction.target, lease_path) + .observe(expected, activation, &warming, lease,)?, + "process write lease changed across the authority boundary" + ); + Ok(()) + } + + fn select_candidate_port(&self, binding: &OperatorBinding) -> Result> { + let Some(route) = &binding.route else { + return Ok(None); + }; + let snapshot = ControlSnapshot::read(&self.options.state_store)?; + let mut used = BTreeSet::new(); + for plan in snapshot + .admitted + .iter() + .map(|stored| &stored.value.plan) + .chain( + snapshot + .transactions + .iter() + .filter(|stored| stored.value.blocks_new_target_mutation()) + .filter_map(|stored| stored.value.plan.as_ref()), + ) + { + if let Some(port) = plan.candidate_port { + used.insert(port); + } + } + (route.private_port_start..=route.private_port_end) + .find(|port| !used.contains(port)) + .map(Some) + .context("no private candidate port remains in the operator range") + } + + fn deployment_authorization( + &self, + current: &Stored, + now: u64, + ) -> Result> { + let expected = required(¤t.value.expected, "Expected projection")?; + let plan = required(¤t.value.plan, "transaction plan")?; + let binding = plan.parsed_inputs()?.1; + let Some((record, canonical_bytes)) = + read_deployment_brake(&binding.brakes.deployment_store)? + else { + return Ok(None); + }; + let anchor = read_trust_anchor::( + &self.options.deployment_brake_operator_anchor, + )?; + if evaluate_idunn_deployment_brake( + IdunnDeploymentBrakeObservation::Present(&record), + &anchor, + &expected.runtime_id, + &expected.sealed_release_id, + ¤t.value.transaction_id, + now, + ) + .is_err() + { + return Ok(None); + } + let authorization_id = record + .authorization_id + .clone() + .context("released brake has no authorization id")?; + let snapshot = ControlSnapshot::read(&self.options.state_store)?; + ensure!( + !snapshot.transactions.iter().any(|stored| { + stored + .value + .deployment_authorization + .as_ref() + .is_some_and(|used| used.authorization_id == authorization_id) + }), + "deployment authorization was already consumed" + ); + Ok(Some(DeploymentAuthorization { + authorization_id, + brake_sha256: sha256_id(&canonical_bytes), + canonical_brake_bytes: canonical_bytes, + authorized_at_unix_millis: now, + })) + } + + fn lifecycle_allows(&self, current: &Stored, now: u64) -> Result { + let plan = required(¤t.value.plan, "continuity plan")?; + let binding = plan.parsed_inputs()?.1; + let expected = required(¤t.value.expected, "continuity Expected")?; + match read_lifecycle_brake(&binding.brakes.lifecycle_store) { + Ok(Some(record)) => Ok(evaluate_idunn_continuity_restart( + IdunnLifecycleBrakeObservation::Present(&record), + &expected.runtime_id, + ¤t.value.target, + now, + ) + .is_ok()), + Ok(None) => Ok(evaluate_idunn_continuity_restart( + IdunnLifecycleBrakeObservation::Missing, + &expected.runtime_id, + ¤t.value.target, + now, + ) + .is_ok()), + Err(_) => Ok(false), + } + } + + fn record_gate_wait( + &self, + current: &Stored, + detail: &str, + ) -> Result<()> { + if current.value.last_error.as_deref() == Some(detail) { + return Ok(()); + } + let mut next = current.value.clone(); + next.last_error = Some(detail.into()); + next.updated_at_unix_millis = now_millis()?; + replace_transaction(&self.options.state_store, current, &next) + } + + fn runtime_authority( + &self, + transaction: &DeploymentTransaction, + ) -> Result { + self.runtime_authority_parts( + required(&transaction.plan, "transaction plan")?, + required(&transaction.expected, "Expected projection")?, + required(&transaction.activation, "activation")?, + ) + } + + fn authenticate_routed_presence( + &self, + authority: &cultnet_rs::VerifiedRuntimeAuthority, + current_write_lease_sha256: Option<&str>, + message_id: &str, + challenged_at_unix_millis: u64, + received_at_unix_millis: u64, + canonical_presence: &[u8], + ) -> Result<(String, u64)> { + ensure!( + received_at_unix_millis >= challenged_at_unix_millis, + "route observation predates its challenge" + ); + let authenticated = authenticate_runtime_presence_claim( + canonical_presence, + authority, + RuntimePresenceAuthenticationContext { + trusted_received_at_unix_millis: received_at_unix_millis, + maximum_age_millis: self.options.topology_maximum_age_millis, + maximum_future_skew_millis: self.options.topology_maximum_future_skew_millis, + }, + )?; + let signed_presence_sha256 = authenticated.signed_presence_sha256().to_owned(); + let correlation = correlate_runtime_presence_claim(authenticated, authority)?; + ensure!( + correlation.disagreements().is_empty(), + "stable route answered with a runtime that disagrees with current authority" + ); + let present = correlation.into_undisputed_present()?; + let presence = present.record(); + ensure!( + presence.observed_at_unix_millis >= challenged_at_unix_millis, + "stable route returned a presence minted before the route challenge" + ); + ensure!( + presence.state == "active", + "stable route runtime is not Active" + ); + ensure!( + presence.detail == format!("route-observation:{message_id}"), + "stable route response is not bound to the exact challenge" + ); + ensure!( + presence.write_lease_sha256.as_deref() == current_write_lease_sha256, + "stable route runtime does not hold the exact current process write lease" + ); + Ok((signed_presence_sha256, received_at_unix_millis)) + } + + fn authenticate_first_odin_warming_presence( + &self, + transaction: &DeploymentTransaction, + message_id: &str, + challenged_at_unix_millis: u64, + received_at_unix_millis: u64, + canonical_presence: &[u8], + ) -> Result { + ensure!( + transaction.target == "odin" + && transaction.incumbent_generation_id.is_none() + && required(&transaction.expected, "first Odin Expected")?.write_lease_required, + "direct Warming presence is reserved for stateful first Odin bootstrap" + ); + ensure!( + received_at_unix_millis >= challenged_at_unix_millis, + "first Odin Warming observation predates its challenge" + ); + let authority = self.runtime_authority(transaction)?; + let authenticated = authenticate_runtime_presence_claim( + canonical_presence, + &authority, + RuntimePresenceAuthenticationContext { + trusted_received_at_unix_millis: received_at_unix_millis, + maximum_age_millis: self.options.topology_maximum_age_millis, + maximum_future_skew_millis: self.options.topology_maximum_future_skew_millis, + }, + )?; + let correlation = correlate_runtime_presence_claim(authenticated, &authority)?; + ensure!( + correlation.disagreements().is_empty(), + "first Odin Warming presence disagrees with its Expected activation" + ); + let present = correlation.into_undisputed_present()?; + let presence = present.record(); + ensure!( + presence.observed_at_unix_millis >= challenged_at_unix_millis + && presence.state == "warming" + && presence.write_lease_sha256.is_none() + && presence.detail == format!("idunn-warming:{message_id}"), + "first Odin candidate did not return exact fresh pre-lease Warming evidence" + ); + Ok(present) + } + + fn observe_first_odin_warming( + &self, + transaction: &DeploymentTransaction, + ) -> Result<(RuntimePresenceEvidence, cultnet_rs::VerifiedRuntimePresence)> { + let expected = required(&transaction.expected, "first Odin Expected")?; + let binding = required(&transaction.plan, "first Odin plan")? + .parsed_inputs()? + .1; + let driver = NginxRouteDriver::new( + binding + .route + .context("first Odin bootstrap has no candidate route binding")?, + ); + let message_id = format!("warming-{}", Uuid::new_v4().simple()); + let challenged_at_unix_millis = now_millis()?; + let response = driver.request_candidate_runtime_presence(expected, &message_id)?; + ensure!( + response.message_id == message_id, + "first Odin candidate transport substituted its challenge identity" + ); + let admitted_at_unix_millis = now_millis()?; + let present = self.authenticate_first_odin_warming_presence( + transaction, + &message_id, + challenged_at_unix_millis, + admitted_at_unix_millis, + &response.canonical_presence, + )?; + let evidence = RuntimePresenceEvidence::from_present( + &present, + message_id, + challenged_at_unix_millis, + admitted_at_unix_millis, + )?; + Ok((evidence, present)) + } + + fn prove_stable_route( + &self, + transaction: &DeploymentTransaction, + driver: &NginxRouteDriver, + membership_sha256: String, + ) -> Result { + let expected = required(&transaction.expected, "route Expected projection")?; + let activation = required(&transaction.activation, "route activation")?; + let authority = self.runtime_authority(transaction)?; + let current_write_lease_sha256 = transaction + .leasing + .as_ref() + .and_then(LeasingEvidence::lease_sha256); + self.prove_stable_route_against( + expected, + activation, + &authority, + current_write_lease_sha256, + driver, + membership_sha256, + ) + } + + fn prove_stable_route_against( + &self, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + authority: &cultnet_rs::VerifiedRuntimeAuthority, + current_write_lease_sha256: Option<&str>, + driver: &NginxRouteDriver, + membership_sha256: String, + ) -> Result { + let message_id = format!("route-{}", Uuid::new_v4().simple()); + let challenged_at_unix_millis = now_millis()?; + let response = driver.request_runtime_presence(expected, &message_id)?; + ensure!( + response.message_id == message_id, + "route transport substituted its challenge identity" + ); + let received_at_unix_millis = now_millis()?; + let (signed_presence_sha256, observed_at_unix_millis) = self.authenticate_routed_presence( + authority, + current_write_lease_sha256, + &message_id, + challenged_at_unix_millis, + received_at_unix_millis, + &response.canonical_presence, + )?; + let observation = RouteObservation { + route_id: driver.binding.route_id.clone(), + runtime_instance_id: activation.runtime_instance_id.clone(), + membership_sha256, + signed_presence_sha256, + observed_at_unix_millis, + }; + observation.validate()?; + Ok(observation) + } + + fn runtime_authority_parts( + &self, + plan: &CompiledDeploymentPlan, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + ) -> Result { + let provider_anchor = self.provider_anchor_for_plan(plan)?; + verify_runtime_authority( + expected, + activation, + &self.idunn_anchor, + &provider_anchor.public_key, + ) + } + + fn provider_anchor_for_plan( + &self, + plan: &CompiledDeploymentPlan, + ) -> Result { + let binding = plan.parsed_inputs()?.1; + let provider_anchor = read_trust_anchor::( + &binding.runtime_identity.trust_anchor_store, + )?; + ensure!( + provider_anchor.schema_version + == ::TRUST_ANCHOR_SCHEMA, + "provider runtime presence trust anchor schema is unsupported" + ); + Ok(provider_anchor) + } + + fn authenticate_topology_bytes( + &self, + snapshot: &ControlSnapshot, + transaction: &DeploymentTransaction, + canonical_bytes: &[u8], + current_write_lease_sha256: Option<&str>, + trusted_received_at: u64, + ) -> Result { + let authority = self.runtime_authority(transaction)?; + let odin_authority = self.current_odin_authority(snapshot)?; + authenticate_odin_runtime_topology_correlation( + canonical_bytes, + &authority, + current_write_lease_sha256, + &odin_authority.signer_public_key, + self.trusted_topology_context(trusted_received_at), + ) + } + + /// Persist every newly authenticated publisher sequence before deciding + /// whether it means Warming, Ready, degraded, or disagreement. + fn admit_latest_topology( + &self, + current: &Stored, + current_write_lease_sha256: Option<&str>, + ) -> Result< + Option<( + Stored, + AuthenticatedOdinRuntimeTopologyCorrelation, + )>, + > { + let Some(received) = self.topology().receive(¤t.value.target)? else { + return Ok(None); + }; + ensure!( + received.target == current.value.target, + "topology transport substituted target" + ); + let now = now_millis()?; + let snapshot = ControlSnapshot::read(&self.options.state_store)?; + let live = snapshot + .transactions + .iter() + .find(|stored| stored.value.transaction_id == current.value.transaction_id) + .context("transaction disappeared before topology admission")?; + ensure!( + live.envelope == current.envelope, + "transaction changed before topology admission" + ); + let authenticated = self.authenticate_topology_bytes( + &snapshot, + &live.value, + &received.canonical_bytes, + current_write_lease_sha256, + now, + )?; + let evidence = TopologyEvidence::from_authenticated(&authenticated, now)?; + if !sequence_requires_admission( + live.value.latest_odin_observation.as_ref(), + snapshot.max_odin_sequence(&live.value.target, &evidence.signer_identity_id), + &evidence, + )? { + return Ok(Some((live.clone(), authenticated))); + } + let mut next = live.value.clone(); + next.latest_odin_observation = Some(evidence.clone()); + next.odin_publisher_sequence_cursor = evidence.publisher_sequence; + next.updated_at_unix_millis = now; + next.last_error = None; + replace_transaction(&self.options.state_store, live, &next)?; + let admitted = ControlSnapshot::read(&self.options.state_store)? + .transactions + .into_iter() + .find(|stored| stored.value.transaction_id == next.transaction_id) + .context("sequence-admitted transaction disappeared")?; + ensure!( + admitted.value.latest_odin_observation.as_ref() == Some(&evidence) + && admitted.value.odin_publisher_sequence_cursor == evidence.publisher_sequence, + "topology sequence was not durably admitted" + ); + Ok(Some((admitted, authenticated))) + } + + fn rehydrate_warming_token( + &self, + transaction: &DeploymentTransaction, + now: u64, + require_current: bool, + ) -> Result { + let evidence = required(&transaction.warming, "durable warming evidence")?.clone(); + match evidence { + WarmingEvidence::OdinTopology { evidence } => { + let snapshot = ControlSnapshot::read(&self.options.state_store)?; + let authenticated = self.authenticate_topology_bytes( + &snapshot, + transaction, + &evidence.canonical_bytes, + None, + if require_current { + now + } else { + evidence.admitted_at_unix_millis + }, + )?; + validate_authenticated_evidence(&evidence, &authenticated)?; + let incumbent_lease_sha256 = + self.incumbent_lease_sha256_for_warming(&snapshot, transaction)?; + ensure!( + is_semantic_warming( + required(&transaction.expected, "Warming Expected projection")?, + required(&transaction.activation, "Warming activation")?, + incumbent_lease_sha256.as_deref(), + &authenticated, + )?, + "durable warming evidence no longer satisfies the Warming gate" + ); + SequenceAdmittedWarming::from_topology( + transaction.transaction_id.clone(), + evidence, + authenticated, + ) + } + WarmingEvidence::FirstOdinDirect { evidence } => { + let present = self.authenticate_first_odin_warming_presence( + transaction, + &evidence.message_id, + evidence.challenged_at_unix_millis, + if require_current { + now + } else { + evidence.admitted_at_unix_millis + }, + &evidence.canonical_bytes, + )?; + SequenceAdmittedWarming::from_first_odin_presence( + transaction.transaction_id.clone(), + evidence, + present, + ) + } + } + } + + fn rehydrate_ready_token( + &self, + transaction: &DeploymentTransaction, + now: u64, + require_current: bool, + ) -> Result { + let evidence = required(&transaction.ready, "durable Ready evidence")?.clone(); + let snapshot = ControlSnapshot::read(&self.options.state_store)?; + let current_lease = transaction + .leasing + .as_ref() + .and_then(LeasingEvidence::lease_sha256); + let authenticated = self.authenticate_topology_bytes( + &snapshot, + transaction, + &evidence.canonical_bytes, + current_lease, + if require_current { + now + } else { + evidence.admitted_at_unix_millis + }, + )?; + validate_authenticated_evidence(&evidence, &authenticated)?; + ensure!( + is_semantic_ready(&authenticated), + "durable Ready evidence no longer authenticates as Ready" + ); + Ok(SequenceAdmittedReady { + transaction_id: transaction.transaction_id.clone(), + evidence, + expected: required(&transaction.expected, "Expected projection")?.clone(), + authenticated, + }) + } + + fn current_ready_provider_tokens( + &self, + snapshot: &ControlSnapshot, + now: u64, + ) -> Result> { + let mut providers = Vec::new(); + for stored in &snapshot.admitted { + if stored.value.latest_odin_observation != stored.value.ready { + continue; + } + match self.rehydrate_admitted_ready(snapshot, &stored.value, now) { + Ok(provider) => providers.push(provider), + Err(error) => eprintln!( + "Idunn excluded non-current provider {}: {error:#}", + stored.value.target + ), + } + } + Ok(providers) + } + + fn rehydrate_admitted_ready( + &self, + snapshot: &ControlSnapshot, + generation: &AdmittedGeneration, + now: u64, + ) -> Result { + ensure!( + generation.latest_odin_observation == generation.ready, + "admitted provider latest topology is not Ready" + ); + let authority = self.runtime_authority_parts( + &generation.plan, + &generation.expected, + &generation.activation, + )?; + let odin_authority = self.current_odin_authority(snapshot)?; + let current_lease = generation.leasing.lease_sha256(); + let authenticated = authenticate_odin_runtime_topology_correlation( + &generation.ready.canonical_bytes, + &authority, + current_lease, + &odin_authority.signer_public_key, + self.trusted_topology_context(now), + )?; + validate_authenticated_evidence(&generation.ready, &authenticated)?; + ensure!( + is_semantic_ready(&authenticated), + "admitted provider no longer has current exact Ready evidence" + ); + Ok(SequenceAdmittedReady { + transaction_id: generation.transaction_id.clone(), + evidence: generation.ready.clone(), + expected: generation.expected.clone(), + authenticated, + }) + } + + fn validate_selected_providers_current( + &self, + plan: &CompiledDeploymentPlan, + now: u64, + ) -> Result<()> { + let snapshot = ControlSnapshot::read(&self.options.state_store)?; + for selection in &plan.dependencies { + let Some(provider) = &selection.provider else { + ensure!( + selection.requirement.kind == DependencyKind::Optional, + "required dependency has no provider" + ); + continue; + }; + let DependencyProviderAuthority::ManagedReady { + target, + incarnation_id, + plan_id, + sealed_release_id, + expected_projection_sha256, + odin_topology_correlation_sha256, + odin_topology_publisher_sequence, + } = &provider.authority + else { + continue; + }; + let admitted = snapshot + .admitted_for(target) + .context("selected managed dependency is no longer admitted")?; + let token = self.rehydrate_admitted_ready(&snapshot, &admitted.value, now)?; + ensure!( + admitted.value.expected.incarnation_id == *incarnation_id + && admitted.value.plan.plan_id == *plan_id + && admitted.value.sealed_release.sealed_release_id == *sealed_release_id + && admitted.value.expected.canonical_sha256()? == *expected_projection_sha256 + && token.publisher_sequence() >= *odin_topology_publisher_sequence, + "selected dependency authority changed before actuation" + ); + ensure!( + token.publisher_sequence() != *odin_topology_publisher_sequence + || token.evidence_sha256() == odin_topology_correlation_sha256, + "selected dependency Odin sequence changed evidence" + ); + ensure!( + token + .authenticated() + .record() + .observed_capabilities + .iter() + .any(|capability| { + capability_compatible( + &selection.requirement.capability, + &selection.requirement.schema, + &selection.requirement.compatibility, + &capability.capability, + &capability.schema, + &capability.compatibility, + ) && capability.capacity >= selection.requirement.minimum_capacity + }), + "selected dependency no longer provides its required capability" + ); + } + Ok(()) + } + + fn persist_same_phase( + &self, + current: &Stored, + mutation: F, + ) -> Result<()> + where + F: FnOnce(&mut DeploymentTransaction) -> Result<()>, + { + let mut next = current.value.clone(); + mutation(&mut next)?; + ensure!( + next.phase == current.value.phase, + "same-phase evidence update changed phase" + ); + next.updated_at_unix_millis = now_millis()?; + next.last_error = None; + replace_transaction(&self.options.state_store, current, &next) + } + + fn transition( + &self, + current: &Stored, + next_phase: DeploymentPhase, + ) -> Result<()> { + ensure!( + next_phase as u8 == current.value.phase as u8 + 1, + "deployment phase transition is not adjacent" + ); + let mut next = current.value.clone(); + next.phase = next_phase; + next.updated_at_unix_millis = now_millis()?; + next.last_error = None; + replace_transaction(&self.options.state_store, current, &next) + } + + fn record_resumable_error( + &self, + current: &Stored, + error: &anyhow::Error, + ) -> Result<()> { + let detail = truncate(&format!("{error:#}"), 2048); + if current.value.last_error.as_deref() == Some(detail.as_str()) { + return Ok(()); + } + let mut next = current.value.clone(); + next.last_error = Some(detail); + next.updated_at_unix_millis = now_millis()?; + replace_transaction(&self.options.state_store, current, &next) + } + + fn begin_pre_fencing_abort( + &self, + current: &Stored, + error: anyhow::Error, + ) -> Result<()> { + ensure!( + current.value.phase < DeploymentPhase::Fencing, + "post-fence transaction cannot terminal-fail" + ); + ensure!( + current.value.pre_fencing_abort.is_none(), + "pre-fencing abort intent is already durable" + ); + let abort = PreFencingAbort { + error: truncate(&format!("{error:#}"), 2048), + candidate_cleanup: candidate_cleanup_requirement( + current.value.activation.is_some(), + current.value.workload.is_some(), + ), + topology_reconciliation: if current.value.command_kind == CommandKind::Deploy + && current.value.expected_publication_sha256.is_some() + { + CleanupEvidence::Pending + } else { + CleanupEvidence::Skipped + }, + source_cleanup: if current.value.command_kind == CommandKind::Deploy { + CleanupEvidence::Pending + } else { + CleanupEvidence::Skipped + }, + }; + self.persist_same_phase(current, |next| { + next.pre_fencing_abort = Some(abort); + Ok(()) + }) + } + + fn advance_pre_fencing_abort(&self, current: &Stored) -> Result<()> { + ensure!( + current.value.phase < DeploymentPhase::Fencing, + "pre-fencing abort crossed the fencing boundary" + ); + let abort = required(¤t.value.pre_fencing_abort, "pre-fencing abort intent")?; + if abort.candidate_cleanup == CleanupEvidence::Pending { + if let Some(workload) = ¤t.value.workload { + self.workload + .stop(workload) + .context("stopping exact pre-fence candidate")?; + } + self.workload + .discard_prepared( + required(¤t.value.plan, "pre-fencing candidate plan")?, + required(¤t.value.expected, "pre-fencing Expected projection")?, + required(¤t.value.activation, "pre-fencing activation")?, + ) + .context("discarding exact pre-fence activation material")?; + return self.persist_same_phase(current, |next| { + next.pre_fencing_abort.as_mut().unwrap().candidate_cleanup = + CleanupEvidence::Complete; + Ok(()) + }); + } + if abort.topology_reconciliation == CleanupEvidence::Pending { + let expected = required(¤t.value.expected, "failed Expected projection")?; + let snapshot = ControlSnapshot::read(&self.options.state_store)?; + if let Some(incumbent) = self.exact_incumbent(&snapshot, ¤t.value)? { + let topology = self.topology(); + let failed_provider_anchor = self.provider_anchor_for_plan(required( + ¤t.value.plan, + "failed transaction plan", + )?)?; + let admitted_provider_anchor = + self.provider_anchor_for_plan(&incumbent.value.plan)?; + let expected_sha256 = topology.restore_admitted_expected_only( + expected, + &failed_provider_anchor, + current.value.activation.as_ref(), + &incumbent.value.expected, + &admitted_provider_anchor, + &incumbent.value.activation, + incumbent.value.leasing.lease(), + )?; + ensure!( + expected_sha256 == incumbent.value.expected.canonical_sha256()?, + "restored incumbent Expected receipt differs" + ); + } else { + let plan = required(¤t.value.plan, "failed transaction plan")?; + let provider_anchor = self.provider_anchor_for_plan(plan)?; + self.topology() + .withdraw_expected( + expected, + &provider_anchor, + current.value.activation.as_ref(), + None, + ) + .context("withdrawing exact failed Expected projection")?; + } + return self.persist_same_phase(current, |next| { + next.pre_fencing_abort + .as_mut() + .unwrap() + .topology_reconciliation = CleanupEvidence::Complete; + Ok(()) + }); + } + if abort.source_cleanup == CleanupEvidence::Pending { + self.source + .cleanup( + ¤t.value.transaction_id, + current.value.frozen_source.as_ref(), + ) + .context("cleaning failed pre-fence source")?; + return self.persist_same_phase(current, |next| { + next.pre_fencing_abort.as_mut().unwrap().source_cleanup = CleanupEvidence::Complete; + Ok(()) + }); + } + ensure!( + abort.is_complete(), + "pre-fencing abort cleanup is incomplete" + ); + let mut next = current.value.clone(); + next.phase = DeploymentPhase::Complete; + next.updated_at_unix_millis = now_millis()?; + next.last_error = Some(abort.error.clone()); + next.completion = Some(TransactionCompletion::FailedBeforeFencing { + error: abort.error.clone(), + }); + replace_transaction(&self.options.state_store, current, &next) + } + + fn advance_post_commit_cleanup(&self, current: &Stored) -> Result<()> { + let cleanup = required( + ¤t.value.post_commit_cleanup, + "post-commit cleanup evidence", + )?; + if let IncumbentCleanupEvidence::Pending { + generation_id, + workload, + } = &cleanup.incumbent + { + let binding = required(¤t.value.plan, "committed transaction plan")? + .parsed_inputs()? + .1; + if let Some(promoted_at_unix_millis) = required( + ¤t.value.routing, + "committed transaction routing evidence", + )? + .promoted_at_unix_millis() + { + let retire_not_before = + route_drain_deadline(promoted_at_unix_millis, binding.rollout.drain_seconds)?; + if now_millis()? < retire_not_before { + return Ok(()); + } + } + self.workload + .stop(workload) + .with_context(|| format!("retiring admitted incumbent {generation_id}"))?; + let generation_id = generation_id.clone(); + return self.persist_same_phase(current, |next| { + next.post_commit_cleanup.as_mut().unwrap().incumbent = + IncumbentCleanupEvidence::Complete { generation_id }; + Ok(()) + }); + } + if cleanup.source == SourceCleanupEvidence::Pending { + self.source + .cleanup( + ¤t.value.transaction_id, + current.value.frozen_source.as_ref(), + ) + .context("cleaning committed deployment source")?; + return self.persist_same_phase(current, |next| { + next.post_commit_cleanup.as_mut().unwrap().source = SourceCleanupEvidence::Complete; + Ok(()) + }); + } + ensure!(cleanup.is_complete(), "post-commit cleanup is incomplete"); + Ok(()) + } +} + +fn route_drain_deadline(promoted_at_unix_millis: u64, drain_seconds: u32) -> Result { + promoted_at_unix_millis + .checked_add( + u64::from(drain_seconds) + .checked_mul(1_000) + .context("route drain duration overflows milliseconds")?, + ) + .context("route drain deadline overflows Unix milliseconds") +} + +fn route_observation_is_current( + observed_at_unix_millis: u64, + now_unix_millis: u64, + maximum_age_millis: u64, + maximum_future_skew_millis: u64, +) -> bool { + observed_at_unix_millis <= now_unix_millis.saturating_add(maximum_future_skew_millis) + && now_unix_millis.saturating_sub(observed_at_unix_millis) <= maximum_age_millis +} + +fn provider_warming_advanced( + prior_odin_sequence: u64, + prior_signed_presence_sha256: &str, + candidate_odin_sequence: u64, + candidate_signed_presence_sha256: &str, +) -> bool { + candidate_odin_sequence > prior_odin_sequence + && candidate_signed_presence_sha256 != prior_signed_presence_sha256 +} + +fn may_rollback_route_after_failed_proof(fencing: &FencingEvidence) -> bool { + matches!(fencing, FencingEvidence::SkippedStateless) +} + +fn incumbent_was_stopped_during_fencing(fencing: &FencingEvidence) -> bool { + matches!( + fencing, + FencingEvidence::Revoked { + incumbent_lease_sha256: Some(_), + .. + } + ) +} + +fn candidate_cleanup_requirement( + has_prepared_activation: bool, + has_workload_observation: bool, +) -> CleanupEvidence { + if has_prepared_activation || has_workload_observation { + CleanupEvidence::Pending + } else { + CleanupEvidence::Skipped + } +} + +fn prove_isolation( + candidate: &WorkloadObservation, + incumbent: Option<&WorkloadObservation>, +) -> Result { + ensure!( + candidate.dynamic_user + && candidate.private_pids + && candidate.private_mounts + && candidate.process_uids[0] > 0 + && candidate.pid_namespace_id > 0 + && candidate.mount_namespace_id > 0, + "candidate lacks dynamic identity or private namespaces" + ); + let evidence = if let Some(incumbent) = incumbent { + ensure!( + incumbent.dynamic_user + && incumbent.private_pids + && incumbent.private_mounts + && incumbent.process_uids[0] > 0 + && incumbent.pid_namespace_id > 0 + && incumbent.mount_namespace_id > 0, + "incumbent lacks admitted dynamic identity or private namespaces" + ); + ensure!( + candidate.process_uids[0] != incumbent.process_uids[0] + && candidate.pid_namespace_id != incumbent.pid_namespace_id + && candidate.mount_namespace_id != incumbent.mount_namespace_id, + "candidate and incumbent are not distinct by UID, PID namespace, and mount namespace" + ); + IsolationEvidence { + candidate_uid: candidate.process_uids[0], + candidate_pid_namespace_id: candidate.pid_namespace_id, + candidate_mount_namespace_id: candidate.mount_namespace_id, + incumbent_uid: Some(incumbent.process_uids[0]), + incumbent_pid_namespace_id: Some(incumbent.pid_namespace_id), + incumbent_mount_namespace_id: Some(incumbent.mount_namespace_id), + } + } else { + IsolationEvidence { + candidate_uid: candidate.process_uids[0], + candidate_pid_namespace_id: candidate.pid_namespace_id, + candidate_mount_namespace_id: candidate.mount_namespace_id, + incumbent_uid: None, + incumbent_pid_namespace_id: None, + incumbent_mount_namespace_id: None, + } + }; + Ok(evidence) +} + +fn sequence_requires_admission( + latest: Option<&TopologyEvidence>, + maximum_admitted_sequence: u64, + candidate: &TopologyEvidence, +) -> Result { + candidate.validate_shape()?; + if latest.is_some_and(|existing| { + existing.canonical_bytes == candidate.canonical_bytes + && existing.canonical_sha256 == candidate.canonical_sha256 + && existing.signer_identity_id == candidate.signer_identity_id + && existing.publisher_sequence == candidate.publisher_sequence + }) { + return Ok(false); + } + ensure!( + candidate.publisher_sequence > maximum_admitted_sequence, + "Odin topology publisher sequence was replayed or reordered" + ); + Ok(true) +} + +fn validate_live_providers_for_deploy(command_kind: CommandKind, validation: F) -> Result<()> +where + F: FnOnce() -> Result<()>, +{ + match command_kind { + CommandKind::Deploy => validation(), + CommandKind::Continuity => Ok(()), + } +} + +fn validate_authenticated_evidence( + evidence: &TopologyEvidence, + authenticated: &AuthenticatedOdinRuntimeTopologyCorrelation, +) -> Result<()> { + let record = authenticated.record(); + ensure!( + authenticated.canonical_bytes() == evidence.canonical_bytes.as_slice() + && sha256_id(authenticated.canonical_bytes()) == evidence.canonical_sha256 + && record.signer_identity_id == evidence.signer_identity_id + && record.publisher_sequence == evidence.publisher_sequence, + "durable topology evidence differs from its authenticated receipt" + ); + Ok(()) +} + +fn is_semantic_warming( + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + incumbent_lease_sha256: Option<&str>, + authenticated: &AuthenticatedOdinRuntimeTopologyCorrelation, +) -> Result { + let record = authenticated.record(); + if !record.present || record.observed_write_lease_sha256.is_some() { + return Ok(false); + } + let expected_projection_detail = format!( + "expected:{};activation:{}", + expected.canonical_sha256()?, + activation.canonical_sha256()? + ); + if !warming_disagreements_match_incumbent( + &expected_projection_detail, + incumbent_lease_sha256, + &record.disagreements, + ) { + return Ok(false); + } + Ok(if expected.write_lease_required { + !record.ready && record.observed_presence_state.as_deref() == Some("warming") + } else { + matches!( + record.observed_presence_state.as_deref(), + Some("warming" | "active") + ) + }) +} + +fn warming_disagreements_match_incumbent( + expected_projection_detail: &str, + incumbent_lease_sha256: Option<&str>, + disagreements: &[OdinTopologyDisagreement], +) -> bool { + if disagreements.is_empty() { + true + } else if let (Some(incumbent_lease_sha256), [disagreement]) = + (incumbent_lease_sha256, disagreements) + { + disagreement.code == "projected-write-lease" + && disagreement.expected.as_deref() == Some(expected_projection_detail) + && disagreement.observed.as_deref() == Some(incumbent_lease_sha256) + } else { + false + } +} + +fn is_semantic_ready(authenticated: &AuthenticatedOdinRuntimeTopologyCorrelation) -> bool { + let record = authenticated.record(); + record.present + && record.ready + && record.observed_presence_state.as_deref() == Some("active") + && record.disagreements.is_empty() +} + +fn read_deployment_brake(path: &Path) -> Result)>> { + let Some(envelope) = read_single_envelope(path)? else { + return Ok(None); + }; + ensure!( + envelope.r#type == IdunnDeploymentBrakeRecord::TYPE + && envelope.schema_id.as_deref() == Some(IDUNN_DEPLOYMENT_BRAKE_SCHEMA), + "deployment brake store contains a foreign record" + ); + let record: IdunnDeploymentBrakeRecord = rmp_serde::from_slice(&envelope.payload)?; + record.validate()?; + ensure!( + rmp_serde::to_vec(&record)? == envelope.payload && envelope.key == record.brake_id, + "deployment brake is noncanonical or keyed by another authority" + ); + Ok(Some((record, envelope.payload))) +} + +fn read_lifecycle_brake(path: &Path) -> Result> { + let Some(envelope) = read_single_envelope(path)? else { + return Ok(None); + }; + ensure!( + envelope.r#type == IdunnLifecycleBrakeRecord::TYPE + && envelope.schema_id.as_deref() == Some(IDUNN_LIFECYCLE_BRAKE_SCHEMA), + "lifecycle brake store contains a foreign record" + ); + IdunnLifecycleBrakeRecord::decode_canonical(&envelope.payload).map(Some) +} + +fn read_single_envelope(path: &Path) -> Result> { + if !path.exists() { + return Ok(None); + } + let entries = SingleFileMessagePackBackingStore::new(path).pull_all_read_only_snapshot()?; + match entries.as_slice() { + [] => Ok(None), + [entry] => Ok(Some(entry.clone())), + _ => bail!("single-record authority store is ambiguous"), + } +} + +fn read_trust_anchor(path: &Path) -> Result { + let envelope = read_single_envelope(path)? + .with_context(|| format!("service identity trust anchor {} is absent", path.display()))?; + ensure!( + envelope.r#type == P::TRUST_ANCHOR_TYPE + && envelope.key == P::TRUST_ANCHOR_KEY + && envelope.schema_id.as_deref() == Some(P::TRUST_ANCHOR_SCHEMA), + "service identity trust anchor belongs to another profile" + ); + let anchor: ServiceIdentityTrustAnchor = rmp_serde::from_slice(&envelope.payload)?; + ensure!( + rmp_serde::to_vec(&anchor)? == envelope.payload + && derive_service_identity_id::

(&anchor.public_key)? == anchor.identity_id, + "service identity trust anchor is noncanonical or self-inconsistent" + ); + Ok(anchor) +} + +fn required<'a, T>(value: &'a Option, label: &str) -> Result<&'a T> { + value.as_ref().with_context(|| format!("{label} is absent")) +} + +fn now_millis() -> Result { + Ok(SystemTime::now() + .duration_since(UNIX_EPOCH) + .context("system clock predates Unix epoch")? + .as_millis() + .try_into()?) +} + +fn rfc3339_millis(millis: u64) -> Result { + chrono::DateTime::from_timestamp_millis(i64::try_from(millis)?) + .context("timestamp is out of range") + .map(|value| value.to_rfc3339()) +} + +fn sibling_path(path: &Path, suffix: &str) -> PathBuf { + let mut value = path.as_os_str().to_os_string(); + value.push(suffix); + PathBuf::from(value) +} + +fn string_value(args: &mut impl Iterator, name: &str) -> Result { + args.next() + .ok_or_else(|| anyhow!("{name} requires a value")) +} + +fn path_value(args: &mut impl Iterator, name: &str) -> Result { + Ok(PathBuf::from(string_value(args, name)?)) +} + +fn u32_value(args: &mut impl Iterator, name: &str) -> Result { + string_value(args, name)? + .parse() + .with_context(|| format!("{name} requires a u32")) +} + +fn u64_value(args: &mut impl Iterator, name: &str) -> Result { + string_value(args, name)? + .parse() + .with_context(|| format!("{name} requires a u64")) +} + +fn require_selector(value: &str) -> Result<()> { + let value = value.strip_prefix("profile:").unwrap_or(value); + require_id(value, "deployment selector") +} + +fn require_id(value: &str, label: &str) -> Result<()> { + ensure!( + !value.is_empty() + && value.len() <= 256 + && value.bytes().all(|byte| { + byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.' | b':' | b'/') + }), + "{label} is invalid" + ); + Ok(()) +} + +fn require_value(value: &str, label: &str) -> Result<()> { + ensure!( + !value.trim().is_empty() + && value == value.trim() + && value.len() <= 1024 + && !value.contains('\0'), + "{label} is invalid" + ); + Ok(()) +} + +fn require_detail(value: &str, label: &str) -> Result<()> { + ensure!( + !value.is_empty() && value.len() <= 2048 && !value.contains('\0'), + "{label} is invalid" + ); + Ok(()) +} + +fn truncate(value: &str, length: usize) -> String { + value.chars().take(length).collect() +} + +fn sha256_id(bytes: &[u8]) -> String { + let digest = Sha256::digest(bytes); + let mut encoded = String::with_capacity(71); + encoded.push_str("sha256-"); + for byte in digest { + use std::fmt::Write as _; + write!(&mut encoded, "{byte:02x}").expect("writing to String cannot fail"); + } + encoded +} + +fn runtime_instance_id(transaction_id: &str) -> Result { + require_id(transaction_id, "runtime transaction id")?; + Ok(sha256_id( + format!("gamecult.idunn.runtime-instance.v1:{transaction_id}").as_bytes(), + )) +} + +fn usage() -> &'static str { + "Idunn deployment, admission, and continuity control plane\n\n\ + idunn serve [runtime options]\n\ + idunn up [--state-store PATH] [--no-wait]\n\ + idunn status [--state-store PATH] [--command ID]\n\n\ + Recipes describe capability and process requirements. Idunn seals exact\n\ + source and artifacts, admits one incarnation, and delegates execution to\n\ + systemd and routing mechanics to the configured proxy." +} + +#[cfg(test)] +mod tests { + use super::*; + + fn digest(byte: char) -> String { + byte.to_string().repeat(64) + } + + fn route_binding( + route_id: &str, + stable_port: u16, + private_port_start: u16, + private_port_end: u16, + ) -> RouteBinding { + RouteBinding { + driver: crate::deployment::RouteDriver::NginxStreamTcp, + route_id: route_id.into(), + stable_endpoint: format!("tcp://127.0.0.1:{stable_port}"), + private_host: "127.0.0.1".into(), + private_port_start, + private_port_end, + config_path: PathBuf::from(format!("/etc/nginx/idunn-stream-routes/{route_id}.conf")), + reload_unit: "nginx.service".into(), + } + } + + fn command(kind: CommandKind) -> DeploymentCommand { + DeploymentCommand { + schema_version: DEPLOYMENT_COMMAND_SCHEMA.into(), + command_id: match kind { + CommandKind::Deploy => "up-test".into(), + CommandKind::Continuity => "continuity-test".into(), + }, + kind, + selector: "ghostlight".into(), + requested_by: "operator".into(), + requested_at_unix_millis: 100, + } + } + + fn topology(sequence: u64, byte: u8) -> TopologyEvidence { + let canonical_bytes = vec![byte]; + TopologyEvidence { + canonical_sha256: sha256_id(&canonical_bytes), + canonical_bytes, + signer_identity_id: "odin-signer".into(), + publisher_sequence: sequence, + admitted_at_unix_millis: 100, + } + } + + fn workload(uid: u32, pid_namespace_id: u64, mount_namespace_id: u64) -> WorkloadObservation { + WorkloadObservation { + unit: format!("idunn-{uid}.service"), + unit_description: format!("Idunn test {uid}"), + invocation_id: format!("invocation-{uid}"), + exec_main_start_timestamp_monotonic: 1, + service_type: "exec".into(), + restart_policy: "always".into(), + kill_mode: "control-group".into(), + dynamic_user: true, + systemd_user: format!("u{uid}"), + systemd_group: format!("u{uid}"), + supplementary_groups: String::new(), + capability_bounding_set: String::new(), + ambient_capabilities: String::new(), + private_mounts: true, + private_pids: true, + protect_proc: "invisible".into(), + proc_subset: "pid".into(), + no_new_privileges: true, + umask: "0077".into(), + inaccessible_paths: String::new(), + load_credential: String::new(), + main_pid: uid, + process_start_time: 1, + process_uids: [uid; 4], + process_gids: [uid; 4], + process_groups: vec![uid], + process_cap_inheritable: 0, + process_cap_permitted: 0, + process_cap_effective: 0, + process_cap_bounding: 0, + process_cap_ambient: 0, + process_no_new_privileges: true, + process_namespace_pids: vec![1], + mount_namespace_id, + pid_namespace_id, + executable: PathBuf::from("/opt/test/bin/service"), + executable_device: 1, + executable_inode: 1, + executable_sha256: sha256_id(&[1]), + runtime_instance_id: sha256_id(&uid.to_be_bytes()), + working_directory: PathBuf::from("/opt/test"), + runtime_bundle: PathBuf::from("/run/test"), + command_line_sha256: sha256_id(&[2]), + environment_names: Vec::new(), + environment_contract_sha256: sha256_id(&[3]), + control_group: format!("/system.slice/idunn-{uid}.service"), + credentials_directory: None, + parent_only_file_descriptors: Vec::new(), + activation_signer_identity_id: "activation".into(), + activation_signer_public_key: vec![1; 32], + service_credentials: Vec::new(), + } + } + + fn write_lease() -> IdunnProcessWriteLeaseRecord { + IdunnProcessWriteLeaseRecord { + schema_version: IDUNN_PROCESS_WRITE_LEASE_SCHEMA.into(), + target: "ghostlight".into(), + expected_projection_sha256: sha256_id(&[1]), + plan_id: sha256_id(&[2]), + incarnation_id: "incarnation-test".into(), + sealed_release_id: sha256_id(&[3]), + activation_witness_sha256: sha256_id(&[4]), + state_schema_generation: "ghostlight-state-v1".into(), + state_contract_sha256: sha256_id(&[5]), + runtime_id: "ghostlight".into(), + runtime_instance_id: sha256_id(&[6]), + warming_presence_sha256: sha256_id(&[7]), + lease_epoch: 1, + issued_at_unix_millis: 100, + } + } + + #[test] + fn cli_exposes_only_declarative_commands() { + for arguments in [ + vec!["up", "ghostlight", "--deploy-command", "sh -c bad"], + vec!["serve", "--swarm-profile", "yggdrasil-local"], + vec!["serve", "--restart-command", "bad"], + vec!["validate-runtime-admission"], + ] { + assert!(parse(arguments.into_iter().map(str::to_owned)).is_err()); + } + } + + #[test] + fn garden_path_accepts_service_and_profile_selectors() { + for selector in ["ghostlight", "profile:aetheria", "profile:full-gamecult"] { + let parsed = + parse(["up", selector, "--no-wait"].into_iter().map(str::to_owned)).unwrap(); + let Command::Up { + selector: actual, .. + } = parsed + else { + panic!("expected up command") + }; + assert_eq!(actual, selector); + } + } + + #[test] + fn route_bindings_are_one_global_socket_and_candidate_authority_map() { + let first = route_binding("first", 4103, 14103, 14111); + let second = route_binding("second", 8831, 18831, 18839); + validate_route_binding_set(&[("first", &first), ("second", &second)]).unwrap(); + + let mut duplicate_id = second.clone(); + duplicate_id.route_id = first.route_id.clone(); + assert!( + validate_route_binding_set(&[("first", &first), ("second", &duplicate_id)]).is_err() + ); + + let mut overlapping_candidates = second.clone(); + overlapping_candidates.private_port_start = 14111; + overlapping_candidates.private_port_end = 14120; + assert!( + validate_route_binding_set(&[("first", &first), ("second", &overlapping_candidates),]) + .is_err() + ); + + let mut stable_inside_other_range = second; + stable_inside_other_range.stable_endpoint = "tcp://127.0.0.1:14105".into(); + assert!( + validate_route_binding_set(&[ + ("first", &first), + ("second", &stable_inside_other_range), + ]) + .is_err() + ); + } + + #[test] + fn deployment_command_is_immutable_positional_fact() -> Result<()> { + let value = command(CommandKind::Deploy); + value.validate()?; + let encoded = rmp_serde::to_vec(&value)?; + assert_eq!(encoded[0], 0x96); + assert!(!encoded.windows(7).any(|window| window == b"running")); + assert!(!encoded.windows(5).any(|window| window == b"owner")); + Ok(()) + } + + #[test] + fn phases_are_one_exact_forward_chain() { + let phases = [ + DeploymentPhase::Sealing, + DeploymentPhase::Starting, + DeploymentPhase::Warming, + DeploymentPhase::Fencing, + DeploymentPhase::Leasing, + DeploymentPhase::AwaitingReady, + DeploymentPhase::Routing, + DeploymentPhase::Committing, + DeploymentPhase::Complete, + ]; + assert!( + phases + .windows(2) + .all(|pair| pair[1] as u8 == pair[0] as u8 + 1) + ); + } + + #[test] + fn every_new_odin_sequence_must_advance_and_exact_retry_is_idempotent() -> Result<()> { + let first = topology(7, 1); + assert!(sequence_requires_admission(None, 6, &first)?); + assert!(!sequence_requires_admission( + Some(&first), + 7, + &topology(7, 1) + )?); + assert!(sequence_requires_admission( + Some(&first), + 7, + &topology(8, 2) + )?); + assert!(sequence_requires_admission(Some(&first), 7, &topology(7, 2)).is_err()); + assert!(sequence_requires_admission(Some(&first), 7, &topology(6, 3)).is_err()); + Ok(()) + } + + #[test] + fn odin_sequence_cursors_are_scoped_by_target_and_signer() -> Result<()> { + let command = command(CommandKind::Deploy); + let mut ghostlight = + DeploymentTransaction::new(&command, "ghostlight".into(), 0, None, 100)?; + ghostlight.latest_odin_observation = Some(topology(7, 1)); + ghostlight.odin_publisher_sequence_cursor = 7; + let mut odin = DeploymentTransaction::new(&command, "odin".into(), 1, None, 100)?; + odin.latest_odin_observation = Some(topology(41, 2)); + odin.odin_publisher_sequence_cursor = 41; + let envelope = |key: &str| CultCacheEnvelope { + key: key.into(), + r#type: DeploymentTransaction::TYPE.into(), + payload: Vec::new(), + stored_at: "1970-01-01T00:00:00.100Z".into(), + schema_id: Some(DEPLOYMENT_TRANSACTION_SCHEMA.into()), + }; + let snapshot = ControlSnapshot { + commands: Vec::new(), + transactions: vec![ + Stored { + envelope: envelope("ghostlight"), + value: ghostlight, + }, + Stored { + envelope: envelope("odin"), + value: odin, + }, + ], + admitted: Vec::new(), + }; + + assert_eq!(snapshot.max_odin_sequence("ghostlight", "odin-signer"), 7); + assert_eq!(snapshot.max_odin_sequence("odin", "odin-signer"), 41); + assert_eq!(snapshot.max_odin_sequence("ghostlight", "other-signer"), 0); + Ok(()) + } + + #[test] + fn stale_odin_provider_receipt_cannot_gate_continuity_restart() -> Result<()> { + let touched = std::cell::Cell::new(false); + validate_live_providers_for_deploy(CommandKind::Continuity, || { + touched.set(true); + bail!("Odin provider receipt is stale") + })?; + assert!(!touched.get()); + assert!( + validate_live_providers_for_deploy(CommandKind::Deploy, || { + bail!("Odin provider receipt is stale") + }) + .is_err() + ); + Ok(()) + } + + #[test] + fn prepared_write_lease_is_durable_but_not_admitted_authority() -> Result<()> { + let lease = write_lease(); + lease.validate()?; + let prepared = LeasingEvidence::Prepared { + lease: lease.clone(), + lease_sha256: lease.canonical_sha256()?, + }; + let encoded = rmp_serde::to_vec(&prepared)?; + let decoded: LeasingEvidence = rmp_serde::from_slice(&encoded)?; + assert_eq!(decoded, prepared); + assert!(decoded.lease().is_none()); + assert!(decoded.lease_sha256().is_none()); + assert_eq!(decoded.prepared_lease().unwrap().0, &lease); + Ok(()) + } + + #[test] + fn runtime_instance_identity_is_stable_for_activation_prepare_replay() -> Result<()> { + let first = runtime_instance_id("tx-one")?; + assert_eq!(runtime_instance_id("tx-one")?, first); + assert_ne!(runtime_instance_id("tx-two")?, first); + Ok(()) + } + + #[test] + fn pre_fencing_abort_is_durable_before_cleanup_and_cannot_resume_as_success() -> Result<()> { + let command = command(CommandKind::Deploy); + let mut transaction = + DeploymentTransaction::new(&command, "ghostlight".into(), 0, None, 100)?; + transaction.pre_fencing_abort = Some(PreFencingAbort { + error: "sealed source was rejected".into(), + candidate_cleanup: CleanupEvidence::Skipped, + topology_reconciliation: CleanupEvidence::Skipped, + source_cleanup: CleanupEvidence::Pending, + }); + transaction.validate()?; + assert!(!transaction.is_terminal()); + + transaction + .pre_fencing_abort + .as_mut() + .unwrap() + .source_cleanup = CleanupEvidence::Complete; + transaction.phase = DeploymentPhase::Complete; + transaction.last_error = Some("sealed source was rejected".into()); + transaction.completion = Some(TransactionCompletion::FailedBeforeFencing { + error: "sealed source was rejected".into(), + }); + transaction.validate()?; + assert!(transaction.is_terminal()); + Ok(()) + } + + #[test] + fn activation_without_workload_still_requires_durable_candidate_cleanup() { + assert_eq!( + candidate_cleanup_requirement(true, false), + CleanupEvidence::Pending + ); + assert_eq!( + candidate_cleanup_requirement(true, true), + CleanupEvidence::Pending + ); + assert_eq!( + candidate_cleanup_requirement(false, false), + CleanupEvidence::Skipped + ); + } + + #[test] + fn bad_selector_becomes_one_terminal_refusal_record() -> Result<()> { + let command = command(CommandKind::Deploy); + let transaction = DeploymentTransaction::rejected( + &command, + anyhow!("deployment selector is unknown"), + 100, + )?; + assert!(transaction.is_terminal()); + assert_eq!(transaction.target, command.selector); + assert!(matches!( + transaction.completion, + Some(TransactionCompletion::FailedBeforeFencing { .. }) + )); + Ok(()) + } + + #[test] + fn post_commit_cleanup_keeps_exact_incumbent_work_owned_until_retired() -> Result<()> { + let incumbent = workload(1001, 40, 50); + let cleanup = PostCommitCleanup { + incumbent: IncumbentCleanupEvidence::Pending { + generation_id: "generation-old".into(), + workload: incumbent.clone(), + }, + source: SourceCleanupEvidence::Pending, + }; + let encoded = rmp_serde::to_vec(&cleanup)?; + let mut replayed: PostCommitCleanup = rmp_serde::from_slice(&encoded)?; + assert_eq!(replayed, cleanup); + assert!(!replayed.is_complete()); + replayed.incumbent = IncumbentCleanupEvidence::Complete { + generation_id: "generation-old".into(), + }; + assert!(!replayed.is_complete()); + replayed.source = SourceCleanupEvidence::Complete; + assert!(replayed.is_complete()); + Ok(()) + } + + #[test] + fn routed_incumbent_retirement_waits_for_the_declared_drain_deadline() -> Result<()> { + assert_eq!(route_drain_deadline(1_000, 30)?, 31_000); + assert!(route_drain_deadline(u64::MAX, 1).is_err()); + Ok(()) + } + + #[test] + fn admitted_route_receipt_refreshes_when_stale_or_implausibly_future_dated() { + assert!(route_observation_is_current(900, 1_000, 100, 10)); + assert!(route_observation_is_current(1_010, 1_000, 100, 10)); + assert!(!route_observation_is_current(899, 1_000, 100, 10)); + assert!(!route_observation_is_current(1_011, 1_000, 100, 10)); + } + + #[test] + fn lease_warming_requires_both_new_odin_and_new_provider_evidence() { + let old = digest('1'); + let fresh = digest('2'); + assert!(!provider_warming_advanced(7, &old, 7, &fresh)); + assert!(!provider_warming_advanced(7, &old, 8, &old)); + assert!(provider_warming_advanced(7, &old, 8, &fresh)); + } + + #[test] + fn failed_route_proof_never_restores_any_fenced_incumbent() { + assert!(!may_rollback_route_after_failed_proof( + &FencingEvidence::Revoked { + incumbent_lease_sha256: Some(digest('1')), + candidate_lease_path_verified_empty: false, + } + )); + assert!(!may_rollback_route_after_failed_proof( + &FencingEvidence::Revoked { + incumbent_lease_sha256: None, + candidate_lease_path_verified_empty: true, + } + )); + assert!(may_rollback_route_after_failed_proof( + &FencingEvidence::SkippedStateless + )); + } + + #[test] + fn fenced_writer_is_already_retired_before_post_commit_cleanup() { + assert!(incumbent_was_stopped_during_fencing( + &FencingEvidence::Revoked { + incumbent_lease_sha256: Some(digest('1')), + candidate_lease_path_verified_empty: false, + } + )); + assert!(!incumbent_was_stopped_during_fencing( + &FencingEvidence::Revoked { + incumbent_lease_sha256: None, + candidate_lease_path_verified_empty: true, + } + )); + assert!(!incumbent_was_stopped_during_fencing( + &FencingEvidence::SkippedStateless + )); + } + + #[test] + fn warming_accepts_only_the_exact_projected_incumbent_lease_disagreement() { + let expected_detail = format!("expected:{};activation:{}", digest('1'), digest('2')); + let incumbent = digest('3'); + let exact = OdinTopologyDisagreement { + code: "projected-write-lease".into(), + expected: Some(expected_detail.clone()), + observed: Some(incumbent.clone()), + }; + + assert!(warming_disagreements_match_incumbent( + &expected_detail, + Some(&incumbent), + &[exact.clone()], + )); + assert!(!warming_disagreements_match_incumbent( + &expected_detail, + None, + &[exact.clone()], + )); + + let mut substituted = exact.clone(); + substituted.observed = Some(digest('4')); + assert!(!warming_disagreements_match_incumbent( + &expected_detail, + Some(&incumbent), + &[substituted], + )); + assert!(!warming_disagreements_match_incumbent( + &expected_detail, + Some(&incumbent), + &[exact.clone(), exact], + )); + } + + #[test] + fn candidate_and_incumbent_must_differ_in_all_three_native_boundaries() { + let incumbent = workload(1001, 40, 50); + assert!(prove_isolation(&workload(1002, 41, 51), Some(&incumbent)).is_ok()); + assert!(prove_isolation(&workload(1001, 41, 51), Some(&incumbent)).is_err()); + assert!(prove_isolation(&workload(1002, 40, 51), Some(&incumbent)).is_err()); + assert!(prove_isolation(&workload(1002, 41, 50), Some(&incumbent)).is_err()); + } + + #[test] + fn exactly_one_inflight_transaction_may_own_a_target() -> Result<()> { + let command = command(CommandKind::Deploy); + let one = DeploymentTransaction::new(&command, "ghostlight".into(), 0, None, 100)?; + let two = DeploymentTransaction::new(&command, "ghostlight".into(), 1, None, 100)?; + let snapshot = ControlSnapshot { + commands: vec![Stored { + envelope: command_envelope(&command, 100)?, + value: command, + }], + transactions: vec![ + Stored { + envelope: transaction_envelope(&one, 100)?, + value: one, + }, + Stored { + envelope: transaction_envelope(&two, 100)?, + value: two, + }, + ], + admitted: Vec::new(), + }; + assert!(snapshot.validate_relations().is_err()); + Ok(()) + } + + #[test] + fn command_ordinals_do_not_turn_one_target_wait_into_a_global_brake() -> Result<()> { + let first_command = command(CommandKind::Deploy); + let first = DeploymentTransaction::new(&first_command, "odin".into(), 0, None, 100)?; + let second = DeploymentTransaction::new(&first_command, "ghostlight".into(), 1, None, 100)?; + let mut unrelated_command = command(CommandKind::Deploy); + unrelated_command.command_id = "up-unrelated".into(); + let unrelated = + DeploymentTransaction::new(&unrelated_command, "huginn".into(), 0, None, 101)?; + let snapshot = ControlSnapshot { + commands: Vec::new(), + transactions: [&first, &second, &unrelated] + .into_iter() + .map(|value| Stored { + envelope: transaction_envelope(value, 100).unwrap(), + value: value.clone(), + }) + .collect(), + admitted: Vec::new(), + }; + assert!(!snapshot.has_earlier_authority_sibling(&first)); + assert!(snapshot.has_earlier_authority_sibling(&second)); + assert!(!snapshot.has_earlier_authority_sibling(&unrelated)); + Ok(()) + } + + #[test] + fn complete_cleanup_remains_retryable_without_owning_the_current_incarnation() -> Result<()> { + let command = command(CommandKind::Deploy); + let mut transaction = + DeploymentTransaction::new(&command, "ghostlight".into(), 0, None, 100)?; + transaction.phase = DeploymentPhase::Complete; + transaction.completion = Some(TransactionCompletion::Admitted { + generation_id: format!("generation-{}", transaction.transaction_id), + }); + transaction.post_commit_cleanup = Some(PostCommitCleanup { + incumbent: IncumbentCleanupEvidence::SkippedNoIncumbent, + source: SourceCleanupEvidence::Pending, + }); + + assert!(!transaction.is_terminal()); + assert!(!transaction.owns_target_authority()); + assert!(transaction.blocks_new_target_mutation()); + Ok(()) + } + + #[test] + fn legacy_mutable_command_schema_is_rejected() -> Result<()> { + let temporary = tempfile::tempdir()?; + let path = temporary.path().join("control.cc"); + let legacy = CultCacheEnvelope { + key: "up-legacy".into(), + r#type: DeploymentCommand::TYPE.into(), + payload: rmp_serde::to_vec(&(DEPLOYMENT_COMMAND_SCHEMA, "up-legacy", "running"))?, + stored_at: rfc3339_millis(100)?, + schema_id: Some("idunn.deployment_command.v1".into()), + }; + assert!( + SingleFileMessagePackBackingStore::new(&path).compare_exchange( + &[CultCacheExpectedEnvelope { + r#type: DeploymentCommand::TYPE.into(), + key: "up-legacy".into(), + current: None, + }], + &[legacy], + )? + ); + assert!(ControlSnapshot::read(&path).is_err()); + Ok(()) + } + + #[test] + fn loadcredential_era_control_schemas_are_rejected_before_rehydration() -> Result<()> { + for (record_type, key, schema) in [ + ( + DeploymentTransaction::TYPE, + "tx-legacy-workload-observation", + "idunn.deployment_transaction.v1", + ), + ( + AdmittedGeneration::TYPE, + "legacy-admitted-target", + "idunn.admitted_generation.v1", + ), + ] { + let temporary = tempfile::tempdir()?; + let path = temporary.path().join("control.cc"); + let legacy = CultCacheEnvelope { + key: key.into(), + r#type: record_type.into(), + payload: Vec::new(), + stored_at: rfc3339_millis(100)?, + schema_id: Some(schema.into()), + }; + assert!( + SingleFileMessagePackBackingStore::new(&path).compare_exchange( + &[CultCacheExpectedEnvelope { + r#type: record_type.into(), + key: key.into(), + current: None, + }], + &[legacy], + )? + ); + assert!(ControlSnapshot::read(&path).is_err()); + } + Ok(()) + } + + #[test] + fn source_identity_is_explicit_and_atomic() { + let partial = parse( + ["serve", "--source-uid", "1001"] + .into_iter() + .map(str::to_owned), + ) + .unwrap_err() + .to_string(); + assert!(partial.contains("supplied together")); + let Command::Serve(options) = parse( + ["serve", "--source-uid", "1001", "--source-gid", "1002"] + .into_iter() + .map(str::to_owned), + ) + .unwrap() else { + panic!("expected serve") + }; + assert_eq!( + options.source_identity, + Some(ProcessIdentity { + uid: 1001, + gid: 1002 + }) + ); + } +} diff --git a/src/deployment.rs b/src/deployment.rs new file mode 100644 index 0000000..bffd316 --- /dev/null +++ b/src/deployment.rs @@ -0,0 +1,2110 @@ +use std::collections::{BTreeMap, BTreeSet}; +use std::net::IpAddr; +use std::path::{Component, Path, PathBuf}; + +use anyhow::{Context, Result, bail, ensure}; +use serde::{Deserialize, Serialize}; + +pub const TARGET_DECLARATION_SCHEMA: &str = "gamecult.idunn.target_declaration.v1"; +pub const OPERATOR_BINDING_SCHEMA: &str = "gamecult.idunn.operator_binding.v2"; +pub const IDUNN_RUNTIME_BUNDLE_ENVIRONMENT: &str = "GAMECULT_IDUNN_RUNTIME_BUNDLE"; +pub const IDUNN_RUNTIME_CANDIDATE_BIND_ENVIRONMENT: &str = "GAMECULT_IDUNN_CANDIDATE_BIND"; +pub const IDUNN_PROCESS_WRITE_LEASE_ENVIRONMENT: &str = "GAMECULT_IDUNN_PROCESS_WRITE_LEASE"; +pub const RUNTIME_PRESENCE_IDENTITY_BINDING: &str = "GAMECULT_RUNTIME_PRESENCE_IDENTITY"; +pub const RUNTIME_PRESENCE_IDENTITY_FD_NAME: &str = "gamecult-runtime-presence-identity"; + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct TargetDeclaration { + pub schema: String, + pub target: String, + pub source_stamp_environment: String, + #[serde(default)] + pub required_gitlinks: BTreeSet, + #[serde(default)] + pub steps: Vec, + #[serde(default)] + pub external_inputs: Vec, + pub artifacts: Vec, + pub service: ServiceDeclaration, + #[serde(default)] + pub state: Option, + #[serde(default)] + pub provides: Vec, + #[serde(default)] + pub dependencies: Vec, + #[serde(default)] + pub conflicts: Vec, +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)] +#[serde(rename_all = "kebab-case")] +pub enum RunnerAffordance { + SourceRead, + ArtifactWrite, + BuildCache, + SecretRead, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct RecipeStep { + pub id: String, + pub phase: RecipePhase, + pub runner: String, + pub argv: Vec, + #[serde(default = "default_working_directory")] + pub working_directory: PathBuf, + #[serde(default)] + pub required_environment: BTreeSet, +} + +fn default_working_directory() -> PathBuf { + PathBuf::from(".") +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(rename_all = "kebab-case")] +pub enum RecipePhase { + Prepare, + Test, + Build, + Acceptance, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct ExternalInput { + pub id: String, + pub url: String, + pub sha256: String, + pub runner: String, + pub destination: PathBuf, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct ArtifactOutput { + pub id: String, + pub source_kind: ArtifactSource, + pub runner: Option, + pub source: PathBuf, + pub destination: PathBuf, + #[serde(default)] + pub expected_sha256: Option, + #[serde(default)] + pub executable: bool, +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(rename_all = "kebab-case")] +pub enum ArtifactSource { + RunnerOutput, + WorktreeTree, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct ServiceDeclaration { + pub executable_artifact: String, + #[serde(default)] + pub required_adjacent_artifacts: BTreeSet, + #[serde(default)] + pub arguments: Vec, + pub transport: ServiceTransport, + #[serde(default)] + pub route_required: bool, + pub health: HealthDeclaration, + #[serde(default)] + pub required_environment: BTreeSet, + #[serde(default)] + pub optional_environment: BTreeSet, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct HealthDeclaration { + pub contract: String, +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(rename_all = "kebab-case")] +pub enum ServiceTransport { + Http, + Tcp, + Rudp, + Private, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(tag = "kind", rename_all = "kebab-case", deny_unknown_fields)] +pub enum LaunchArgument { + Literal { value: String }, + Binding { name: String }, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct StateDeclaration { + pub schema_generation: String, + pub slots: Vec, + pub migration: Option, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct StateSlot { + pub id: String, + pub relative_path: PathBuf, + pub kind: StateKind, + pub schema: String, + pub writer: StateWriter, + pub recovery: StateRecovery, + pub startup: StateStartup, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct MigrationDeclaration { + pub executable_artifact: String, + pub from_generations: BTreeSet, + pub to_generation: String, + #[serde(default)] + pub arguments: Vec, +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(rename_all = "kebab-case")] +pub enum StateKind { + CultcacheFile, + /// Process-owned state imposed by an external runtime contract. Idunn + /// preserves and fences the file but never interprets its payload. + ExternalFile, +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)] +#[serde(rename_all = "kebab-case")] +pub enum StateWriter { + ProcessBoundSingleWriter, + None, +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(rename_all = "kebab-case")] +pub enum StateRecovery { + Preserve, + Rebuildable, + ExternalAuthority, +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(rename_all = "kebab-case")] +pub enum StateStartup { + CreateOrOpenAfterWriteLease, + OpenAtStart, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct ProvidedCapability { + pub capability: String, + pub schema: String, + pub compatibility: String, + #[serde(default = "one")] + pub capacity: u32, +} + +fn one() -> u32 { + 1 +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct CapabilityDependency { + pub kind: DependencyKind, + pub capability: String, + pub schema: String, + pub compatibility: String, + #[serde(default = "one")] + pub minimum_capacity: u32, + #[serde(default)] + pub startup: StartupOrder, +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)] +#[serde(rename_all = "kebab-case")] +pub enum DependencyKind { + Bootstrap, + Required, + Optional, + SharedInfrastructure, + Private, + ExternalOperatorBinding, +} + +#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)] +#[serde(rename_all = "kebab-case")] +pub enum StartupOrder { + #[default] + BeforePromotion, + BeforeStart, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct CapabilityConflict { + pub capability: String, + pub reason: String, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct OperatorBinding { + pub schema: String, + pub target: String, + pub repository: RepositoryBinding, + pub runners: BTreeMap, + pub workload: WorkloadBinding, + pub runtime_identity: RuntimeIdentityBinding, + pub route: Option, + #[serde(default)] + pub process_write_lease: Option, + pub brakes: BrakeBinding, + pub rollout: RolloutBinding, + pub placement: PlacementBinding, + #[serde(default)] + pub external_capabilities: Vec, + #[serde(default)] + pub profiles: BTreeSet, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct RepositoryBinding { + pub origin: String, + pub admitted_ref: String, + pub minimum_revision: String, + pub selection: SourceSelectionPolicy, + pub pinned_revision: Option, + pub release_authority_store: Option, + pub checkout: PathBuf, + pub recipe_path: PathBuf, + #[serde(default)] + pub gitlinks: BTreeMap, +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(rename_all = "kebab-case")] +pub enum SourceSelectionPolicy { + PinnedObject, + RefHead, + SignedRelease, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct GitlinkBinding { + pub origin: String, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct RunnerBinding { + pub driver: RunnerDriver, + pub image: String, + pub user: String, + #[serde(default)] + pub affordances: BTreeSet, + pub cache_root: Option, + #[serde(default)] + pub allowed_programs: BTreeSet, + #[serde(default)] + pub environment: BTreeMap, + #[serde(default)] + pub secret_files: BTreeMap, + #[serde(default)] + pub network_profile: Option, + pub memory_mebibytes: u32, + pub cpu_quota_percent: u32, + pub pids_limit: u32, + pub tmpfs_mebibytes: u32, +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(rename_all = "kebab-case")] +pub enum RunnerDriver { + Docker, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct WorkloadBinding { + pub driver: WorkloadDriver, + #[serde(default)] + pub state_group: Option, + pub unit_prefix: String, + pub release_root: PathBuf, + #[serde(default)] + pub state_root: Option, + pub runtime_root: PathBuf, + pub network: WorkloadNetwork, + pub hardening: WorkloadHardening, + #[serde(default)] + pub read_only_paths: BTreeSet, + #[serde(default)] + pub read_write_paths: BTreeSet, + #[serde(default)] + pub devices: BTreeSet, + pub memory_mebibytes: u32, + pub cpu_quota_percent: u32, + #[serde(default)] + pub environment: BTreeMap, + #[serde(default)] + pub secret_files: BTreeMap, + #[serde(default)] + pub argument_bindings: BTreeMap, +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(rename_all = "kebab-case")] +pub enum WorkloadDriver { + SystemdTransient, +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(rename_all = "kebab-case")] +pub enum WorkloadNetwork { + HostPrivate, + None, +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(rename_all = "kebab-case")] +pub enum WorkloadHardening { + Strict, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct RuntimeIdentityBinding { + pub runtime_id: String, + pub expected_signer_identity_id: String, + pub trust_anchor_store: PathBuf, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct ProcessWriteLeaseBinding { + pub record_path: PathBuf, +} + +impl ProcessWriteLeaseBinding { + pub fn lock_path(&self) -> PathBuf { + let mut lock_path = self.record_path.as_os_str().to_os_string(); + lock_path.push(".lock"); + PathBuf::from(lock_path) + } +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct BrakeBinding { + pub deployment_store: PathBuf, + pub lifecycle_store: PathBuf, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct RouteBinding { + pub driver: RouteDriver, + pub route_id: String, + pub stable_endpoint: String, + pub private_host: String, + pub private_port_start: u16, + pub private_port_end: u16, + pub config_path: PathBuf, + pub reload_unit: String, +} + +impl RouteBinding { + pub(crate) fn stable_socket(&self) -> Result<(IpAddr, u16)> { + let authority = match self.driver { + RouteDriver::NginxStreamTcp => self + .stable_endpoint + .strip_prefix("http://") + .or_else(|| self.stable_endpoint.strip_prefix("tcp://")), + RouteDriver::NginxStreamUdp => self.stable_endpoint.strip_prefix("rudp://"), + } + .context("stable endpoint transport does not match its route driver")?; + ensure!( + !authority + .chars() + .any(|character| matches!(character, '/' | '?' | '#' | '@' | '[' | ']')), + "stable endpoint is not a plain IP address and port" + ); + let (host, port) = authority + .rsplit_once(':') + .context("stable endpoint has no port")?; + let host = host + .parse::() + .context("stable endpoint host is not an IP address")?; + ensure!( + matches!(host, IpAddr::V4(_)), + "route binding v2 stable endpoints use explicit IPv4 addresses" + ); + let port = port + .parse::() + .context("stable endpoint port is not a u16")?; + ensure!(port > 0, "stable endpoint port is zero"); + Ok((host, port)) + } +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(rename_all = "kebab-case")] +pub enum RouteDriver { + NginxStreamTcp, + NginxStreamUdp, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct RolloutBinding { + pub strategy: RolloutStrategy, + pub drain_seconds: u32, + pub retain_releases: u32, +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(rename_all = "kebab-case")] +pub enum RolloutStrategy { + CandidateThenPromote, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct PlacementBinding { + pub desired_replicas: u32, + pub nodes: BTreeSet, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct ExternalCapabilityBinding { + pub provider_id: String, + pub capability: String, + pub schema: String, + pub compatibility: String, + #[serde(default = "one")] + pub capacity: u32, + pub endpoint: String, +} + +impl TargetDeclaration { + pub fn parse(input: &str) -> Result { + let declaration: Self = + toml::from_str(input).context("decoding strict Idunn target declaration")?; + declaration.validate()?; + Ok(declaration) + } + + pub fn validate(&self) -> Result<()> { + ensure!( + self.schema == TARGET_DECLARATION_SCHEMA, + "unsupported target declaration schema" + ); + require_id(&self.target, "target")?; + require_environment_name(&self.source_stamp_environment)?; + for path in &self.required_gitlinks { + require_relative_path(path, "required gitlink", false)?; + } + ensure!(!self.steps.is_empty(), "no recipe steps declared"); + ensure!(!self.artifacts.is_empty(), "no artifact outputs declared"); + + let mut runner_ids = BTreeSet::new(); + unique_ids( + self.steps.iter().map(|step| step.id.as_str()), + "recipe step", + )?; + for step in &self.steps { + require_id(&step.runner, "runner class")?; + runner_ids.insert(step.runner.as_str()); + ensure!(!step.argv.is_empty(), "step {} has empty argv", step.id); + for argument in &step.argv { + require_value(argument, "step argv")?; + } + require_program(&step.argv[0], "step program")?; + require_relative_path(&step.working_directory, "step working directory", true)?; + for name in &step.required_environment { + require_environment_name(name)?; + } + } + + let mut artifact_ids = BTreeSet::new(); + let mut destinations = BTreeSet::new(); + for artifact in &self.artifacts { + require_id(&artifact.id, "artifact")?; + ensure!( + artifact_ids.insert(artifact.id.as_str()), + "artifact id {} is declared twice", + artifact.id + ); + require_relative_path(&artifact.source, "artifact source", false)?; + require_leaf_path(&artifact.destination, "artifact destination")?; + if let Some(expected_sha256) = &artifact.expected_sha256 { + require_sha256(expected_sha256, "expected artifact sha256")?; + } + ensure!( + destinations.insert(artifact.destination.as_path()), + "artifact destination {} is declared twice", + artifact.destination.display() + ); + match (artifact.source_kind, artifact.runner.as_deref()) { + (ArtifactSource::RunnerOutput, Some(runner)) => { + require_id(runner, "artifact runner class")?; + runner_ids.insert(runner); + } + (ArtifactSource::WorktreeTree, None) => {} + (ArtifactSource::RunnerOutput, None) => { + bail!("runner-output artifact {} has no runner class", artifact.id) + } + (ArtifactSource::WorktreeTree, Some(_)) => bail!( + "worktree-tree artifact {} cannot name a runner class", + artifact.id + ), + } + } + let mut external_input_ids = BTreeSet::new(); + let mut external_input_destinations = BTreeSet::new(); + for input in &self.external_inputs { + require_id(&input.id, "external input")?; + ensure!( + external_input_ids.insert(input.id.as_str()), + "external input id {} is declared twice", + input.id + ); + ensure!( + !artifact_ids.contains(input.id.as_str()), + "external input id {} collides with an artifact id", + input.id + ); + require_value(&input.url, "external input URL")?; + https_host(&input.url)?; + require_sha256(&input.sha256, "external input sha256")?; + require_id(&input.runner, "external input runner class")?; + runner_ids.insert(input.runner.as_str()); + require_relative_path(&input.destination, "external input destination", false)?; + ensure!( + external_input_destinations + .insert((input.runner.as_str(), input.destination.as_path())), + "external input destination {} is declared twice for runner {}", + input.destination.display(), + input.runner + ); + } + ensure!( + !runner_ids.is_empty(), + "target declaration uses no runner classes" + ); + + ensure!( + artifact_ids.contains(self.service.executable_artifact.as_str()), + "service executable artifact is not declared" + ); + for artifact in &self.service.required_adjacent_artifacts { + ensure!( + artifact_ids.contains(artifact.as_str()), + "adjacent service artifact {artifact} is not declared" + ); + } + for argument in &self.service.arguments { + validate_launch_argument(argument)?; + } + require_capability(&self.service.health.contract, "health contract")?; + for name in &self.service.required_environment { + require_environment_name(name)?; + } + ensure!( + self.service + .required_environment + .contains(IDUNN_RUNTIME_BUNDLE_ENVIRONMENT), + "service does not require the standard Idunn runtime bundle" + ); + ensure!( + self.service + .required_environment + .contains(IDUNN_RUNTIME_CANDIDATE_BIND_ENVIRONMENT) + == self.service.route_required, + "routed services must require exactly one Idunn-owned candidate bind" + ); + ensure!( + self.service + .required_environment + .contains(IDUNN_PROCESS_WRITE_LEASE_ENVIRONMENT) + == self.write_lease_required(), + "state-writing services must require exactly one Idunn-owned process write lease" + ); + for name in &self.service.optional_environment { + require_environment_name(name)?; + ensure!( + !self.service.required_environment.contains(name), + "service environment {name} is both required and optional" + ); + } + + if let Some(state) = &self.state { + require_capability(&state.schema_generation, "state schema generation")?; + ensure!(!state.slots.is_empty(), "state contract has no slots"); + let slot_ids = unique_ids( + state.slots.iter().map(|slot| slot.id.as_str()), + "state slot", + )?; + let mut slot_paths = BTreeSet::::new(); + for slot in &state.slots { + require_relative_path(&slot.relative_path, "state slot path", false)?; + ensure!( + slot_paths + .iter() + .all(|other| !paths_overlap(other, &slot.relative_path)), + "state slot path {} overlaps another declared slot", + slot.relative_path.display() + ); + ensure!( + slot_paths.insert(slot.relative_path.clone()), + "state slot path {} is declared twice", + slot.relative_path.display() + ); + require_capability(&slot.schema, "state slot schema")?; + match slot.writer { + StateWriter::ProcessBoundSingleWriter => ensure!( + slot.startup == StateStartup::CreateOrOpenAfterWriteLease, + "writable state slot {} must open after its write lease", + slot.id + ), + StateWriter::None => ensure!( + slot.startup == StateStartup::OpenAtStart, + "non-writable state slot {} cannot wait for a write lease", + slot.id + ), + } + if slot.recovery == StateRecovery::ExternalAuthority { + ensure!( + slot.writer == StateWriter::None, + "externally authoritative state slot {} cannot name the service as writer", + slot.id + ); + } + } + if let Some(migration) = state.migration.as_ref() { + ensure!( + artifact_ids.contains(migration.executable_artifact.as_str()), + "migration executable artifact is not declared" + ); + ensure!( + !migration.from_generations.is_empty(), + "migration has no source generations" + ); + for generation in &migration.from_generations { + require_capability(generation, "migration source generation")?; + } + ensure!( + migration.to_generation == state.schema_generation, + "migration destination differs from state generation" + ); + for argument in &migration.arguments { + validate_launch_argument(argument)?; + } + } + ensure!(slot_ids.len() == state.slots.len(), "duplicate state slot"); + } + + let mut provided = BTreeSet::new(); + for capability in &self.provides { + require_capability_contract( + &capability.capability, + &capability.schema, + &capability.compatibility, + )?; + ensure!( + capability.capacity > 0, + "provided capability capacity must be positive" + ); + ensure!( + provided.insert(capability.capability.as_str()), + "capability {} is provided twice", + capability.capability + ); + } + let mut required = BTreeSet::new(); + for dependency in &self.dependencies { + require_capability_contract( + &dependency.capability, + &dependency.schema, + &dependency.compatibility, + )?; + ensure!( + dependency.minimum_capacity > 0, + "dependency capacity must be positive" + ); + if dependency.kind == DependencyKind::Bootstrap { + ensure!( + dependency.startup == StartupOrder::BeforeStart, + "bootstrap dependency {} must be available before start", + dependency.capability + ); + } + ensure!( + required.insert((dependency.kind, dependency.capability.as_str())), + "dependency {} is declared twice for the same kind", + dependency.capability + ); + } + for conflict in &self.conflicts { + require_capability(&conflict.capability, "conflicting capability")?; + require_value(&conflict.reason, "conflict reason")?; + } + Ok(()) + } + + pub fn write_lease_required(&self) -> bool { + self.state.as_ref().is_some_and(|state| { + state + .slots + .iter() + .any(|slot| slot.writer == StateWriter::ProcessBoundSingleWriter) + }) + } +} + +impl OperatorBinding { + pub fn parse(input: &str) -> Result { + let binding: Self = + toml::from_str(input).context("decoding strict Idunn operator binding")?; + binding.validate()?; + Ok(binding) + } + + pub fn validate(&self) -> Result<()> { + ensure!( + self.schema == OPERATOR_BINDING_SCHEMA, + "unsupported operator binding schema" + ); + require_id(&self.target, "target")?; + ensure!( + self.repository.origin.starts_with("https://"), + "repository origin must use HTTPS" + ); + ensure!( + self.repository.origin.ends_with(".git"), + "repository origin must name a Git repository" + ); + ensure!( + self.repository.admitted_ref.starts_with("refs/heads/"), + "admitted ref must be a full branch ref" + ); + require_sha1(&self.repository.minimum_revision, "minimum revision")?; + match self.repository.selection { + SourceSelectionPolicy::PinnedObject => { + let revision = self.repository.pinned_revision.as_deref().ok_or_else(|| { + anyhow::anyhow!("pinned-object selection has no pinned revision") + })?; + require_sha1(revision, "pinned revision")?; + ensure!( + self.repository.release_authority_store.is_none(), + "pinned-object selection cannot name a release-authority store" + ); + } + SourceSelectionPolicy::RefHead => { + ensure!( + self.repository.pinned_revision.is_none(), + "ref-head selection cannot name a pinned revision" + ); + ensure!( + self.repository.release_authority_store.is_none(), + "ref-head selection cannot name a release-authority store" + ); + } + SourceSelectionPolicy::SignedRelease => { + ensure!( + self.repository.pinned_revision.is_none(), + "signed-release selection cannot name a pinned revision" + ); + let store = self + .repository + .release_authority_store + .as_ref() + .ok_or_else(|| { + anyhow::anyhow!("signed-release selection has no authority store") + })?; + require_absolute_path(store, "release authority store")?; + } + } + require_absolute_path(&self.repository.checkout, "repository checkout")?; + require_relative_path(&self.repository.recipe_path, "recipe path", false)?; + for (path, gitlink) in &self.repository.gitlinks { + require_relative_path(path, "gitlink binding", false)?; + require_git_origin(&gitlink.origin, "gitlink origin")?; + } + ensure!(!self.runners.is_empty(), "operator binding has no runners"); + for (id, runner) in &self.runners { + require_id(id, "runner binding")?; + require_pinned_image(&runner.image)?; + require_container_identity(&runner.user)?; + ensure!( + runner.memory_mebibytes > 0, + "runner memory must be positive" + ); + ensure!( + (1..=100_000).contains(&runner.cpu_quota_percent), + "runner CPU quota is outside 1..=100000" + ); + ensure!( + runner.pids_limit > 0 && runner.tmpfs_mebibytes > 0, + "runner process or temporary-filesystem limit is zero" + ); + if let Some(cache_root) = runner.cache_root.as_ref() { + require_absolute_path(cache_root, "runner cache root")?; + } + for program in &runner.allowed_programs { + require_program(program, "allowed runner program")?; + } + ensure!( + !runner.allowed_programs.is_empty(), + "runner {id} has no allowed programs" + ); + if let Some(profile) = &runner.network_profile { + require_capability(profile, "runner network profile")?; + } + for name in runner.environment.keys().chain(runner.secret_files.keys()) { + require_environment_name(name)?; + } + for value in runner.environment.values() { + require_value(value, "runner environment value")?; + } + for path in runner.secret_files.values() { + require_absolute_path(path, "runner secret file")?; + } + if runner.affordances.contains(&RunnerAffordance::BuildCache) { + ensure!( + runner.cache_root.is_some(), + "build-cache runner {id} has no cache root" + ); + } + ensure!( + runner.affordances.contains(&RunnerAffordance::BuildCache) + == runner.cache_root.is_some(), + "runner {id} cache root and build-cache affordance disagree" + ); + ensure!( + runner.affordances.contains(&RunnerAffordance::SecretRead) + == !runner.secret_files.is_empty(), + "runner {id} secret files and secret-read affordance disagree" + ); + } + let needs_state_group = + self.workload.state_root.is_some() || !self.workload.read_write_paths.is_empty(); + ensure!( + self.workload.state_group.is_some() == needs_state_group, + "a fixed state group must exist exactly when the dynamic workload has writable paths" + ); + if let Some(group) = &self.workload.state_group { + require_identity(group, "workload state group")?; + ensure!( + !matches!(group.as_str(), "root" | "0"), + "ordinary Idunn workload state cannot use the root group" + ); + } + require_id(&self.workload.unit_prefix, "workload unit prefix")?; + require_id(&self.runtime_identity.runtime_id, "runtime id")?; + require_id( + &self.runtime_identity.expected_signer_identity_id, + "expected signer identity id", + )?; + require_absolute_path( + &self.runtime_identity.trust_anchor_store, + "trust anchor store", + )?; + for (label, path) in [ + ("release root", &self.workload.release_root), + ("runtime root", &self.workload.runtime_root), + ("deployment brake", &self.brakes.deployment_store), + ("lifecycle brake", &self.brakes.lifecycle_store), + ] { + require_absolute_path(path, label)?; + } + if let Some(state_root) = &self.workload.state_root { + require_absolute_path(state_root, "state root")?; + } + if let Some(write_lease) = &self.process_write_lease { + require_absolute_path(&write_lease.record_path, "process write-lease record")?; + require_absolute_path(&write_lease.lock_path(), "process write-lease lock")?; + } + ensure!( + self.brakes.deployment_store != self.brakes.lifecycle_store, + "deployment and lifecycle brakes are identical" + ); + ensure!( + self.workload.memory_mebibytes > 0, + "workload memory must be positive" + ); + ensure!( + (1..=100_000).contains(&self.workload.cpu_quota_percent), + "workload CPU quota is outside 1..=100000" + ); + for path in self + .workload + .read_only_paths + .iter() + .chain(self.workload.read_write_paths.iter()) + .chain(self.workload.devices.iter()) + { + require_absolute_path(path, "workload path")?; + } + for path in &self.workload.read_write_paths { + if let Some(state_root) = &self.workload.state_root { + ensure!( + !paths_overlap(path, state_root), + "workload read-write path {} overlaps the write-lease-controlled state root", + path.display() + ); + } + } + let mut authority_paths = vec![ + self.brakes.deployment_store.clone(), + self.brakes.lifecycle_store.clone(), + ]; + if let Some(write_lease) = &self.process_write_lease { + authority_paths.push(write_lease.record_path.clone()); + authority_paths.push(write_lease.lock_path()); + } + ensure!( + authority_paths.iter().enumerate().all(|(index, path)| { + authority_paths[index + 1..] + .iter() + .all(|other| !paths_overlap(path, other)) + }), + "Idunn authority paths overlap" + ); + let mut protected_paths = authority_paths; + protected_paths.extend([ + self.workload.release_root.clone(), + self.workload.runtime_root.clone(), + self.runtime_identity.trust_anchor_store.clone(), + ]); + if let Some(route) = &self.route { + protected_paths.push(route.config_path.clone()); + } + if let Some(release_authority) = &self.repository.release_authority_store { + protected_paths.push(release_authority.clone()); + } + for authority_path in protected_paths { + for writable_path in self + .workload + .read_write_paths + .iter() + .chain(self.workload.state_root.iter()) + { + ensure!( + !paths_overlap(&authority_path, writable_path), + "workload writable path {} overlaps Idunn authority {}", + writable_path.display(), + authority_path.display() + ); + } + } + for name in self + .workload + .environment + .keys() + .chain(self.workload.secret_files.keys()) + { + require_environment_name(name)?; + ensure!( + name != IDUNN_RUNTIME_BUNDLE_ENVIRONMENT + && name != IDUNN_RUNTIME_CANDIDATE_BIND_ENVIRONMENT, + "operator binding attempts to replace Idunn-owned workload environment" + ); + } + for value in self.workload.environment.values() { + require_value(value, "workload environment value")?; + } + for name in self.workload.argument_bindings.keys() { + require_id(name, "argument binding")?; + } + for value in self.workload.argument_bindings.values() { + require_value(value, "argument binding value")?; + } + for path in self.workload.secret_files.values() { + require_absolute_path(path, "secret file")?; + } + ensure!( + !self + .workload + .environment + .contains_key(RUNTIME_PRESENCE_IDENTITY_BINDING), + "runtime presence identity must be a parent-only secret source, not environment" + ); + let presence_identity = self + .workload + .secret_files + .get(RUNTIME_PRESENCE_IDENTITY_BINDING) + .context("workload has no parent-only runtime presence identity source")?; + ensure!( + self.workload + .secret_files + .iter() + .filter(|(_, path)| *path == presence_identity) + .count() + == 1, + "runtime presence identity source is duplicated under another secret binding" + ); + if let Some(route) = self.route.as_ref() { + require_id(&route.route_id, "route id")?; + require_value(&route.stable_endpoint, "stable endpoint")?; + require_host(&route.private_host)?; + let private_host: IpAddr = route + .private_host + .parse() + .context("route private host is not an IP address")?; + ensure!( + private_host.is_loopback(), + "systemd-transient candidate routes must use a loopback private host" + ); + ensure!( + route.private_port_start > 0, + "private port range starts at zero" + ); + ensure!( + route.private_port_start < route.private_port_end, + "candidate rollout requires at least two private ports" + ); + route.stable_socket()?; + require_absolute_path(&route.config_path, "route config")?; + require_unit(&route.reload_unit, "route reload unit")?; + } + ensure!( + self.rollout.retain_releases >= 2, + "candidate rollout must retain at least current and prior releases" + ); + ensure!( + self.placement.desired_replicas == 1, + "operator binding v2 admits exactly one replica" + ); + ensure!( + self.placement.nodes.len() == 1, + "operator binding v2 admits exactly one node" + ); + for node in &self.placement.nodes { + require_id(node, "placement node")?; + } + let mut external_contracts = BTreeSet::new(); + for capability in &self.external_capabilities { + require_id(&capability.provider_id, "external provider id")?; + require_capability_contract( + &capability.capability, + &capability.schema, + &capability.compatibility, + )?; + ensure!( + capability.capacity > 0, + "external capability capacity must be positive" + ); + require_value(&capability.endpoint, "external capability endpoint")?; + ensure!( + external_contracts.insert(( + capability.provider_id.as_str(), + capability.capability.as_str(), + capability.schema.as_str(), + capability.compatibility.as_str(), + )), + "external provider capability is declared twice" + ); + } + for profile in &self.profiles { + require_capability(profile, "profile")?; + } + Ok(()) + } + + pub fn admit(&self, declaration: &TargetDeclaration) -> Result<()> { + ensure!( + self.target == declaration.target, + "binding target does not match declaration" + ); + let bound_gitlinks: BTreeSet<_> = self.repository.gitlinks.keys().cloned().collect(); + ensure!( + bound_gitlinks == declaration.required_gitlinks, + "operator gitlink bindings do not exactly match required gitlinks" + ); + let declared_runners: BTreeSet<_> = declaration + .steps + .iter() + .map(|step| step.runner.as_str()) + .chain( + declaration + .external_inputs + .iter() + .map(|input| input.runner.as_str()), + ) + .chain( + declaration + .artifacts + .iter() + .filter_map(|artifact| artifact.runner.as_deref()), + ) + .collect(); + let bound_runners: BTreeSet<_> = self.runners.keys().map(String::as_str).collect(); + ensure!( + declared_runners == bound_runners, + "operator runner classes do not exactly match the target recipe" + ); + ensure!( + self.process_write_lease.is_some() == declaration.write_lease_required(), + "process write-lease binding must exist exactly when writable state requires it" + ); + ensure!( + self.workload.state_root.is_some() == declaration.state.is_some(), + "state root binding must exist exactly when the recipe declares state" + ); + for step in &declaration.steps { + let binding = &self.runners[&step.runner]; + ensure!( + !binding + .environment + .contains_key(&declaration.source_stamp_environment) + && !binding + .secret_files + .contains_key(&declaration.source_stamp_environment), + "runner cannot replace the Idunn source stamp" + ); + ensure!( + binding.affordances.contains(&RunnerAffordance::SourceRead), + "runner {} cannot read the frozen source", + step.runner + ); + ensure!( + binding.allowed_programs.contains(&step.argv[0]), + "runner {} does not admit program {}", + step.runner, + step.argv[0] + ); + let available: BTreeSet<_> = binding + .environment + .keys() + .chain(binding.secret_files.keys()) + .cloned() + .collect(); + ensure!( + step.required_environment.is_subset(&available), + "step {} lacks required runner environment", + step.id + ); + } + for artifact in declaration + .artifacts + .iter() + .filter(|artifact| artifact.source_kind == ArtifactSource::RunnerOutput) + { + let runner_id = artifact + .runner + .as_deref() + .expect("validated runner-output artifact"); + let binding = &self.runners[runner_id]; + ensure!( + binding + .affordances + .contains(&RunnerAffordance::ArtifactWrite), + "runner {runner_id} cannot publish artifact {}", + artifact.id + ); + } + for input in &declaration.external_inputs { + let binding = &self.runners[&input.runner]; + ensure!( + binding.affordances.contains(&RunnerAffordance::SourceRead), + "external input {} runner cannot read the frozen source", + input.id + ); + ensure!( + binding + .affordances + .contains(&RunnerAffordance::ArtifactWrite), + "external input {} runner cannot materialize inputs", + input.id + ); + ensure!( + binding.network_profile.is_some(), + "external input {} runner has no operator-bound network profile", + input.id + ); + } + ensure!( + !self + .workload + .environment + .contains_key(IDUNN_RUNTIME_BUNDLE_ENVIRONMENT) + && !self + .workload + .secret_files + .contains_key(IDUNN_RUNTIME_BUNDLE_ENVIRONMENT) + && !self + .workload + .environment + .contains_key(IDUNN_RUNTIME_CANDIDATE_BIND_ENVIRONMENT) + && !self + .workload + .secret_files + .contains_key(IDUNN_RUNTIME_CANDIDATE_BIND_ENVIRONMENT), + "operator binding cannot replace Idunn-owned launch environment" + ); + ensure!( + !self + .workload + .environment + .contains_key(IDUNN_PROCESS_WRITE_LEASE_ENVIRONMENT) + && !self + .workload + .secret_files + .contains_key(IDUNN_PROCESS_WRITE_LEASE_ENVIRONMENT), + "operator binding cannot replace the Idunn-owned process write lease" + ); + let mut available_environment: BTreeSet<_> = self + .workload + .environment + .keys() + .chain( + self.workload + .secret_files + .keys() + .filter(|name| name.as_str() != RUNTIME_PRESENCE_IDENTITY_BINDING), + ) + .cloned() + .collect(); + available_environment.insert(IDUNN_RUNTIME_BUNDLE_ENVIRONMENT.into()); + if declaration.service.route_required { + available_environment.insert(IDUNN_RUNTIME_CANDIDATE_BIND_ENVIRONMENT.into()); + } + if declaration.write_lease_required() { + available_environment.insert(IDUNN_PROCESS_WRITE_LEASE_ENVIRONMENT.into()); + } + ensure!( + declaration + .service + .required_environment + .is_subset(&available_environment), + "operator service environment omits a required launch input" + ); + let declared_environment: BTreeSet<_> = declaration + .service + .required_environment + .union(&declaration.service.optional_environment) + .cloned() + .collect(); + ensure!( + !declared_environment.contains(RUNTIME_PRESENCE_IDENTITY_BINDING), + "runtime presence identity is a named parent-only descriptor, not service environment" + ); + ensure!( + available_environment.is_subset(&declared_environment), + "operator service environment contains an undeclared launch input" + ); + let required_arguments: BTreeSet<_> = declaration + .service + .arguments + .iter() + .filter_map(|argument| match argument { + LaunchArgument::Binding { name } => Some(name.clone()), + LaunchArgument::Literal { .. } => None, + }) + .collect(); + let bound_arguments: BTreeSet<_> = + self.workload.argument_bindings.keys().cloned().collect(); + match ( + self.workload.state_root.as_ref(), + self.workload.argument_bindings.get("state_root"), + ) { + (Some(state_root), Some(argument)) => ensure!( + Path::new(argument) == state_root.as_path(), + "state_root argument binding differs from the admitted workload state root" + ), + (Some(_), None) => bail!("stateful workload has no state_root argument binding"), + (None, Some(_)) => bail!("stateless workload carries a state_root argument binding"), + (None, None) => {} + } + ensure!( + required_arguments.contains("state_root") == self.workload.state_root.is_some(), + "recipe state_root argument must exist exactly when the workload has a state root" + ); + ensure!( + required_arguments == bound_arguments, + "operator argument bindings do not exactly match the launch contract" + ); + match ( + declaration.service.route_required, + declaration.service.transport, + self.route.as_ref(), + ) { + (true, ServiceTransport::Http, Some(route)) + if route.driver == RouteDriver::NginxStreamTcp => + { + ensure!( + route.stable_endpoint.starts_with("http://"), + "HTTP stable endpoint is not an HTTP URI" + ); + } + (true, ServiceTransport::Tcp, Some(route)) + if route.driver == RouteDriver::NginxStreamTcp => + { + ensure!( + route.stable_endpoint.starts_with("tcp://"), + "TCP stable endpoint is not a TCP URI" + ); + } + (true, ServiceTransport::Rudp, Some(route)) + if route.driver == RouteDriver::NginxStreamUdp => + { + ensure!( + route.stable_endpoint.starts_with("rudp://"), + "RUDP stable endpoint is not an RUDP URI" + ); + } + (false, _, None) => {} + _ => bail!("route binding does not match the launch contract"), + } + for dependency in declaration + .dependencies + .iter() + .filter(|dependency| dependency.kind == DependencyKind::ExternalOperatorBinding) + { + ensure!( + self.external_capabilities.iter().any(|binding| { + capability_compatible( + &dependency.capability, + &dependency.schema, + &dependency.compatibility, + &binding.capability, + &binding.schema, + &binding.compatibility, + ) && binding.capacity >= dependency.minimum_capacity + }), + "external capability {} has no compatible operator binding", + dependency.capability + ); + } + Ok(()) + } +} + +pub fn capability_compatible( + required_capability: &str, + required_schema: &str, + required_compatibility: &str, + provided_capability: &str, + provided_schema: &str, + provided_compatibility: &str, +) -> bool { + required_capability == provided_capability + && required_schema == provided_schema + && required_compatibility == provided_compatibility +} + +fn unique_ids<'a>(values: impl Iterator, label: &str) -> Result> { + let mut seen = BTreeSet::new(); + for value in values { + require_id(value, label)?; + ensure!(seen.insert(value), "duplicate {label} id {value}"); + } + Ok(seen) +} + +fn require_id(value: &str, label: &str) -> Result<()> { + ensure!(!value.is_empty(), "{label} is empty"); + ensure!(value.len() <= 96, "{label} is too long"); + ensure!( + value.bytes().all(|byte| byte.is_ascii_lowercase() + || byte.is_ascii_digit() + || matches!(byte, b'-' | b'_' | b'.' | b':')), + "{label} contains an invalid character" + ); + Ok(()) +} + +fn require_capability(value: &str, label: &str) -> Result<()> { + require_id(value, label) +} + +fn require_capability_contract(capability: &str, schema: &str, compatibility: &str) -> Result<()> { + require_capability(capability, "capability")?; + require_capability(schema, "capability schema")?; + require_capability(compatibility, "capability compatibility") +} + +fn require_value(value: &str, label: &str) -> Result<()> { + ensure!(!value.trim().is_empty(), "{label} is empty"); + ensure!( + !value.chars().any(char::is_control), + "{label} contains a control character" + ); + ensure!(value.len() <= 4_096, "{label} is too long"); + Ok(()) +} + +fn validate_launch_argument(argument: &LaunchArgument) -> Result<()> { + match argument { + LaunchArgument::Literal { value } => require_value(value, "literal launch argument"), + LaunchArgument::Binding { name } => require_id(name, "launch argument binding"), + } +} + +fn require_program(value: &str, label: &str) -> Result<()> { + require_value(value, label)?; + ensure!( + !value.contains('/') && !value.contains('\\') && !value.chars().any(char::is_whitespace), + "{label} must be one executable name" + ); + Ok(()) +} + +fn require_git_origin(value: &str, label: &str) -> Result<()> { + ensure!(value.starts_with("https://"), "{label} must use HTTPS"); + ensure!( + value.ends_with(".git"), + "{label} must name a Git repository" + ); + require_value(value, label) +} + +fn https_host(value: &str) -> Result<&str> { + let remainder = value + .strip_prefix("https://") + .ok_or_else(|| anyhow::anyhow!("artifact URL must use HTTPS"))?; + let authority = remainder.split('/').next().unwrap_or_default(); + ensure!(!authority.is_empty(), "artifact URL has no host"); + ensure!( + !authority.contains('@') + && !authority.contains(':') + && !authority.contains('?') + && !authority.contains('#'), + "artifact URL authority is not a bare host" + ); + require_host(authority)?; + Ok(authority) +} + +fn require_environment_name(value: &str) -> Result<()> { + ensure!( + !value.is_empty() && value.len() <= 128, + "environment name is empty or too long" + ); + ensure!( + value + .bytes() + .all(|byte| byte.is_ascii_uppercase() || byte.is_ascii_digit() || byte == b'_'), + "environment name contains an invalid character" + ); + Ok(()) +} + +fn require_relative_path(path: &Path, label: &str, allow_current: bool) -> Result<()> { + ensure!(!path.as_os_str().is_empty(), "{label} is empty"); + ensure!(!path.is_absolute(), "{label} must be relative"); + let mut saw_normal = false; + for component in path.components() { + match component { + Component::Normal(_) => saw_normal = true, + Component::CurDir if allow_current => {} + _ => bail!("{label} contains a forbidden path component"), + } + } + ensure!(allow_current || saw_normal, "{label} must name a path"); + Ok(()) +} + +fn require_leaf_path(path: &Path, label: &str) -> Result<()> { + require_relative_path(path, label, false)?; + ensure!( + path.components().count() == 1, + "{label} must be a single filename" + ); + Ok(()) +} + +fn require_absolute_path(path: &Path, label: &str) -> Result<()> { + ensure!(path.is_absolute(), "{label} must be absolute"); + ensure!( + path.components() + .all(|component| !matches!(component, Component::ParentDir)), + "{label} contains a parent traversal" + ); + Ok(()) +} + +fn paths_overlap(left: &Path, right: &Path) -> bool { + left.starts_with(right) || right.starts_with(left) +} + +fn require_sha1(value: &str, label: &str) -> Result<()> { + require_lower_hex(value, 40, label) +} + +fn require_sha256(value: &str, label: &str) -> Result<()> { + require_lower_hex(value, 64, label) +} + +fn require_lower_hex(value: &str, length: usize, label: &str) -> Result<()> { + ensure!(value.len() == length, "{label} has the wrong length"); + ensure!( + value + .bytes() + .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte)), + "{label} must be lowercase hexadecimal" + ); + Ok(()) +} + +fn require_pinned_image(value: &str) -> Result<()> { + let Some((name, digest)) = value.rsplit_once("@sha256:") else { + bail!("runner image is not pinned by sha256 digest"); + }; + require_value(name, "runner image name")?; + require_sha256(digest, "runner image digest") +} + +fn require_container_identity(value: &str) -> Result<()> { + let (uid, gid) = value + .split_once(':') + .context("runner user must be an explicit numeric UID:GID")?; + let uid: u32 = uid.parse().context("runner UID is not a u32")?; + let gid: u32 = gid.parse().context("runner GID is not a u32")?; + ensure!(uid > 0 && gid > 0, "runner identity must be unprivileged"); + Ok(()) +} + +fn require_identity(value: &str, label: &str) -> Result<()> { + require_id(value, label) +} + +fn require_unit(value: &str, label: &str) -> Result<()> { + require_value(value, label)?; + ensure!( + value.ends_with(".service"), + "{label} must be a systemd service unit" + ); + ensure!( + !value.contains('/') && !value.contains('\\'), + "{label} must not contain a path" + ); + Ok(()) +} + +fn require_host(value: &str) -> Result<()> { + require_value(value, "host")?; + ensure!( + !value.contains('/') && !value.contains('@'), + "host contains an invalid delimiter" + ); + Ok(()) +} + +#[cfg(test)] +mod tests { + use super::*; + + const RECIPE: &str = r#" +schema = "gamecult.idunn.target_declaration.v1" +target = "test-service" +source_stamp_environment = "TEST_SERVICE_BUILD_COMMIT" + +[[steps]] +id = "test" +phase = "test" +runner = "rust" +argv = ["cargo", "test", "--locked", "-p", "test-service"] + +[[steps]] +id = "build" +phase = "build" +runner = "rust" +argv = ["cargo", "build", "--locked", "--release", "-p", "test-service"] + +[[external_inputs]] +id = "tool" +url = "https://registry.npmjs.org/tool.tgz" +sha256 = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +runner = "rust" +destination = "inputs/tool.tgz" + +[[artifacts]] +id = "daemon" +source_kind = "runner-output" +runner = "rust" +source = "target/release/test-service" +destination = "test-service" +expected_sha256 = "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc" +executable = true + +[service] +executable_artifact = "daemon" +required_adjacent_artifacts = [] +arguments = [ + { kind = "literal", value = "--state-root" }, + { kind = "binding", name = "state_root" }, +] +transport = "http" +route_required = true +required_environment = ["GAMECULT_IDUNN_CANDIDATE_BIND", "GAMECULT_IDUNN_PROCESS_WRITE_LEASE", "GAMECULT_IDUNN_RUNTIME_BUNDLE"] + +[service.health] +contract = "test-service.cultnet-service-health" + +[state] +schema_generation = "v1" + +[[state.slots]] +id = "world" +relative_path = "world.cc" +kind = "cultcache-file" +schema = "test-service.state.v1" +writer = "process-bound-single-writer" +recovery = "preserve" +startup = "create-or-open-after-write-lease" + +[[provides]] +capability = "test-service.runtime" +schema = "test-service.state.v1" +compatibility = "v1" + +[[dependencies]] +kind = "shared-infrastructure" +capability = "odin.verse-rendezvous" +schema = "odin.verse-topology.v1" +compatibility = "v1" +startup = "before-promotion" +"#; + + const BINDING: &str = r#" +schema = "gamecult.idunn.operator_binding.v2" +target = "test-service" +profiles = ["aetheria", "full-gamecult"] + +[repository] +origin = "https://github.com/GameCult/TestService.git" +admitted_ref = "refs/heads/main" +minimum_revision = "13d5136b69bcd3a52c400d66a940f94a47122e48" +selection = "ref-head" +checkout = "/srv/build/TestService" +recipe_path = "deployment/idunn/recipe.toml" + +[runners.rust] +driver = "docker" +image = "rust@sha256:4c2fd73ef19c5ef9d54bee03b06b2839a392604fbfcd578ed948b71b37c1d7fb" +user = "1000:1000" +affordances = ["source-read", "artifact-write", "build-cache"] +cache_root = "/srv/ghostlight/build-cache" +allowed_programs = ["cargo"] +network_profile = "build-dependency-egress" +memory_mebibytes = 8192 +cpu_quota_percent = 400 +pids_limit = 512 +tmpfs_mebibytes = 1024 + +[workload] +driver = "systemd-transient" +state_group = "test-service" +unit_prefix = "idunn-test-service" +release_root = "/srv/test-service/releases" +state_root = "/var/lib/gamecult/test-service" +runtime_root = "/etc/gamecult/test-service/runtime" +network = "host-private" +hardening = "strict" +memory_mebibytes = 2048 +cpu_quota_percent = 200 + +[workload.argument_bindings] +state_root = "/var/lib/gamecult/test-service" + +[workload.secret_files] +GAMECULT_RUNTIME_PRESENCE_IDENTITY = "/etc/gamecult/test-service/runtime-presence-identity.cc" + +[runtime_identity] +runtime_id = "test-service-yggdrasil" +expected_signer_identity_id = "test-service-runtime-signer" +trust_anchor_store = "/etc/gamecult/trust/test-service.cc" + +[route] +driver = "nginx-stream-tcp" +route_id = "test-service-public" +stable_endpoint = "http://127.0.0.1:18830" +private_host = "127.0.0.1" +private_port_start = 18831 +private_port_end = 18839 +config_path = "/etc/nginx/idunn-stream-routes/test-service.conf" +reload_unit = "nginx.service" + +[process_write_lease] +record_path = "/etc/gamecult/test-service/runtime/process-write-lease.cc" + +[brakes] +deployment_store = "/var/lib/gamecult/idunn-authority/test-service-deployment-brake.cc" +lifecycle_store = "/var/lib/gamecult/idunn-authority/test-service-lifecycle-brake.cc" + +[rollout] +strategy = "candidate-then-promote" +drain_seconds = 30 +retain_releases = 2 + +[placement] +desired_replicas = 1 +nodes = ["yggdrasil"] +"#; + + #[test] + fn strict_recipe_and_binding_admit_without_host_privilege_in_recipe() { + let recipe = TargetDeclaration::parse(RECIPE).unwrap(); + let binding = OperatorBinding::parse(BINDING).unwrap(); + binding.admit(&recipe).unwrap(); + assert_eq!(recipe.target, "test-service"); + assert_eq!(binding.route.as_ref().unwrap().private_port_start, 18831); + } + + #[test] + fn unknown_recipe_field_is_rejected() { + let input = RECIPE.replace( + "target = \"test-service\"", + "target = \"test-service\"\nroot = true", + ); + assert!(TargetDeclaration::parse(&input).is_err()); + } + + #[test] + fn operator_cannot_omit_an_affordance_derived_from_the_recipe() { + let recipe = TargetDeclaration::parse(RECIPE).unwrap(); + let input = BINDING.replace( + "affordances = [\"source-read\", \"artifact-write\", \"build-cache\"]", + "affordances = [\"source-read\", \"build-cache\"]", + ); + let binding = OperatorBinding::parse(&input).unwrap(); + assert!(binding.admit(&recipe).is_err()); + } + + #[test] + fn runner_mounts_require_their_exact_operator_affordance() { + let cache_without_affordance = BINDING.replace( + "affordances = [\"source-read\", \"artifact-write\", \"build-cache\"]", + "affordances = [\"source-read\", \"artifact-write\"]", + ); + assert!(OperatorBinding::parse(&cache_without_affordance).is_err()); + + let affordance_without_secret = BINDING.replace( + "affordances = [\"source-read\", \"artifact-write\", \"build-cache\"]", + "affordances = [\"source-read\", \"artifact-write\", \"build-cache\", \"secret-read\"]", + ); + assert!(OperatorBinding::parse(&affordance_without_secret).is_err()); + } + + #[test] + fn runner_cannot_replace_the_source_stamp() { + let recipe = TargetDeclaration::parse(RECIPE).unwrap(); + let forged = BINDING.replace( + "[workload]", + "[runners.rust.environment]\nTEST_SERVICE_BUILD_COMMIT = \"forged\"\n\n[workload]", + ); + let binding = OperatorBinding::parse(&forged).unwrap(); + assert!(binding.admit(&recipe).is_err()); + } + + #[test] + fn route_transport_mismatch_is_rejected() { + let recipe = TargetDeclaration::parse(RECIPE).unwrap(); + assert!( + OperatorBinding::parse(&BINDING.replace("nginx-stream-tcp", "nginx-stream-udp")) + .is_err() + ); + + assert!( + OperatorBinding::parse( + &BINDING.replace("http://127.0.0.1:18830", "tcp://yggdrasil.gamecult.org:443",), + ) + .is_err() + ); + assert!(recipe.service.route_required); + } + + #[test] + fn rudp_route_uses_the_udp_stream_driver() { + let recipe = TargetDeclaration::parse( + &RECIPE.replace("transport = \"http\"", "transport = \"rudp\""), + ) + .unwrap(); + let binding = OperatorBinding::parse( + &BINDING + .replace("nginx-stream-tcp", "nginx-stream-udp") + .replace("http://127.0.0.1:18830", "rudp://127.0.0.1:17872"), + ) + .unwrap(); + assert!(binding.admit(&recipe).is_ok()); + } + + #[test] + fn raw_unit_template_is_rejected() { + let input = RECIPE.replace( + "executable_artifact = \"daemon\"", + "executable_artifact = \"daemon\"\nunit_template = \"deployment/root.service\"", + ); + assert!(TargetDeclaration::parse(&input).is_err()); + } + + #[test] + fn extra_operator_environment_is_rejected() { + let recipe = TargetDeclaration::parse(RECIPE).unwrap(); + let input = BINDING.replace( + "[workload.argument_bindings]", + "[workload.environment]\nUNDECLARED = \"no\"\n\n[workload.argument_bindings]", + ); + let binding = OperatorBinding::parse(&input).unwrap(); + assert!(binding.admit(&recipe).is_err()); + } + + #[test] + fn runtime_presence_identity_is_exactly_one_parent_only_secret_source() { + let secret = "[workload.secret_files]\nGAMECULT_RUNTIME_PRESENCE_IDENTITY = \"/etc/gamecult/test-service/runtime-presence-identity.cc\"\n\n"; + assert!(OperatorBinding::parse(&BINDING.replace(secret, "")).is_err()); + assert!(OperatorBinding::parse(&BINDING.replace( + secret, + "[workload.environment]\nGAMECULT_RUNTIME_PRESENCE_IDENTITY = \"/etc/gamecult/test-service/runtime-presence-identity.cc\"\n\n", + )) + .is_err()); + assert!(OperatorBinding::parse(&BINDING.replace( + secret, + "[workload.secret_files]\nGAMECULT_RUNTIME_PRESENCE_IDENTITY = \"/etc/gamecult/test-service/runtime-presence-identity.cc\"\nDUPLICATE_IDENTITY = \"/etc/gamecult/test-service/runtime-presence-identity.cc\"\n\n", + )) + .is_err()); + + let recipe = TargetDeclaration::parse(&RECIPE.replace( + "required_environment = [", + "required_environment = [\"GAMECULT_RUNTIME_PRESENCE_IDENTITY\", ", + )) + .unwrap(); + let binding = OperatorBinding::parse(BINDING).unwrap(); + assert!(binding.admit(&recipe).is_err()); + } + + #[test] + fn operator_cannot_replace_idunn_owned_launch_inputs() { + let recipe = TargetDeclaration::parse(RECIPE).unwrap(); + for name in [ + IDUNN_RUNTIME_BUNDLE_ENVIRONMENT, + IDUNN_RUNTIME_CANDIDATE_BIND_ENVIRONMENT, + IDUNN_PROCESS_WRITE_LEASE_ENVIRONMENT, + ] { + let input = BINDING.replace( + "[workload.argument_bindings]", + &format!( + "[workload.environment]\n{name} = \"forged\"\n\n[workload.argument_bindings]" + ), + ); + let rejected = OperatorBinding::parse(&input) + .and_then(|binding| binding.admit(&recipe).map(|_| ())); + assert!(rejected.is_err()); + } + } + + #[test] + fn state_slot_path_cannot_escape_the_operator_owned_root() { + let input = RECIPE.replace( + "relative_path = \"world.cc\"", + "relative_path = \"../world.cc\"", + ); + assert!(TargetDeclaration::parse(&input).is_err()); + } + + #[test] + fn mismatched_state_root_argument_binding_is_rejected() { + let recipe = TargetDeclaration::parse(RECIPE).unwrap(); + let mismatched = BINDING.replace( + "[workload.argument_bindings]\nstate_root = \"/var/lib/gamecult/test-service\"", + "[workload.argument_bindings]\nstate_root = \"/var/lib/gamecult/another-service\"", + ); + let binding = OperatorBinding::parse(&mismatched).unwrap(); + assert!(binding.admit(&recipe).is_err()); + } + + #[test] + fn external_file_state_keeps_process_bound_writer_and_lease_semantics() { + let input = RECIPE.replace("kind = \"cultcache-file\"", "kind = \"external-file\""); + let declaration = TargetDeclaration::parse(&input).unwrap(); + let slot = &declaration.state.as_ref().unwrap().slots[0]; + assert_eq!(slot.kind, StateKind::ExternalFile); + assert_eq!(slot.writer, StateWriter::ProcessBoundSingleWriter); + assert_eq!(slot.startup, StateStartup::CreateOrOpenAfterWriteLease); + assert!(declaration.write_lease_required()); + } + + #[test] + fn state_slots_cannot_claim_overlapping_paths() { + let input = RECIPE.replace( + "startup = \"create-or-open-after-write-lease\"", + "startup = \"create-or-open-after-write-lease\"\n\n[[state.slots]]\nid = \"nested\"\nrelative_path = \"world.cc/index.cc\"\nkind = \"cultcache-file\"\nschema = \"test-service.index.v1\"\nwriter = \"process-bound-single-writer\"\nrecovery = \"preserve\"\nstartup = \"create-or-open-after-write-lease\"", + ); + assert!(TargetDeclaration::parse(&input).is_err()); + } + + #[test] + fn workload_mount_cannot_bypass_write_lease_controlled_state() { + let input = BINDING.replace( + "cpu_quota_percent = 200\n\n[workload.argument_bindings]", + "cpu_quota_percent = 200\nread_write_paths = [\"/var/lib/gamecult/test-service/world\"]\n\n[workload.argument_bindings]", + ); + assert!(OperatorBinding::parse(&input).is_err()); + } + + #[test] + fn v2_binding_is_explicitly_singleton() { + assert!( + OperatorBinding::parse( + &BINDING.replace("desired_replicas = 1", "desired_replicas = 2") + ) + .is_err() + ); + assert!( + OperatorBinding::parse(&BINDING.replace( + "nodes = [\"yggdrasil\"]", + "nodes = [\"yggdrasil\", \"raven\"]" + )) + .is_err() + ); + } + + #[test] + fn legacy_static_workload_identity_has_no_authority_in_v2() { + assert!( + OperatorBinding::parse(&BINDING.replace( + "schema = \"gamecult.idunn.operator_binding.v2\"", + "schema = \"gamecult.idunn.operator_binding.v1\"", + ),) + .is_err() + ); + let with_static_identity = BINDING.replace( + "driver = \"systemd-transient\"", + "driver = \"systemd-transient\"\nuser = \"test-service\"\ngroup = \"test-service\"", + ); + assert!(OperatorBinding::parse(&with_static_identity).is_err()); + } + + #[test] + fn writable_state_requires_one_non_root_state_group() { + assert!( + OperatorBinding::parse(&BINDING.replace("state_group = \"test-service\"\n", ""),) + .is_err() + ); + assert!( + OperatorBinding::parse( + &BINDING.replace("state_group = \"test-service\"", "state_group = \"root\""), + ) + .is_err() + ); + } + + #[test] + fn external_input_uses_an_operator_bound_network_profile() { + let recipe = TargetDeclaration::parse(RECIPE).unwrap(); + let binding = OperatorBinding::parse(BINDING).unwrap(); + binding.admit(&recipe).unwrap(); + let isolated = BINDING.replace("network_profile = \"build-dependency-egress\"\n", ""); + let binding = OperatorBinding::parse(&isolated).unwrap(); + assert!(binding.admit(&recipe).is_err()); + } + + #[test] + fn process_write_lease_exists_exactly_for_process_writable_state() { + let recipe = TargetDeclaration::parse(RECIPE).unwrap(); + let without_lease = BINDING.replace( + "[process_write_lease]\nrecord_path = \"/etc/gamecult/test-service/runtime/process-write-lease.cc\"\n\n", + "", + ); + let binding = OperatorBinding::parse(&without_lease).unwrap(); + assert!(binding.admit(&recipe).is_err()); + + let read_only_recipe = TargetDeclaration::parse( + &RECIPE + .replace( + "writer = \"process-bound-single-writer\"", + "writer = \"none\"", + ) + .replace( + "startup = \"create-or-open-after-write-lease\"", + "startup = \"open-at-start\"", + ) + .replace("\"GAMECULT_IDUNN_PROCESS_WRITE_LEASE\", ", ""), + ) + .unwrap(); + binding.admit(&read_only_recipe).unwrap(); + + let binding = OperatorBinding::parse(BINDING).unwrap(); + assert_eq!( + binding.process_write_lease.as_ref().unwrap().lock_path(), + PathBuf::from("/etc/gamecult/test-service/runtime/process-write-lease.cc.lock") + ); + assert!(binding.admit(&read_only_recipe).is_err()); + } + + #[test] + fn stateless_target_has_no_state_binding_or_generation() { + let mut recipe_text = RECIPE.replace( + "arguments = [\n { kind = \"literal\", value = \"--state-root\" },\n { kind = \"binding\", name = \"state_root\" },\n]", + "arguments = []", + ); + recipe_text = recipe_text.replace("\"GAMECULT_IDUNN_PROCESS_WRITE_LEASE\", ", ""); + let state_start = recipe_text.find("\n[state]\n").unwrap(); + let state_end = recipe_text.find("\n[[provides]]\n").unwrap(); + recipe_text.replace_range(state_start..state_end, ""); + let recipe = TargetDeclaration::parse(&recipe_text).unwrap(); + assert!(recipe.state.is_none()); + + let binding_text = BINDING + .replace("state_group = \"test-service\"\n", "") + .replace("state_root = \"/var/lib/gamecult/test-service\"\n", "") + .replace( + "[workload.argument_bindings]\nstate_root = \"/var/lib/gamecult/test-service\"\n\n", + "", + ) + .replace( + "[process_write_lease]\nrecord_path = \"/etc/gamecult/test-service/runtime/process-write-lease.cc\"\n\n", + "", + ); + let binding = OperatorBinding::parse(&binding_text).unwrap(); + binding.admit(&recipe).unwrap(); + assert!(binding.workload.state_root.is_none()); + } + + #[test] + fn bootstrap_dependency_must_be_available_before_start() { + let invalid = RECIPE.replace("kind = \"shared-infrastructure\"", "kind = \"bootstrap\""); + assert!(TargetDeclaration::parse(&invalid).is_err()); + let valid = invalid.replace( + "startup = \"before-promotion\"", + "startup = \"before-start\"", + ); + TargetDeclaration::parse(&valid).unwrap(); + } + + #[test] + fn dependency_compatibility_requires_exact_typed_contract() { + assert!(capability_compatible( + "odin.verse-rendezvous", + "odin.verse-topology.v1", + "v1", + "odin.verse-rendezvous", + "odin.verse-topology.v1", + "v1", + )); + assert!(!capability_compatible( + "odin.verse-rendezvous", + "odin.verse-topology.v1", + "v1", + "odin.verse-rendezvous", + "odin.verse-topology.v2", + "v2", + )); + } +} diff --git a/src/deployment_plan.rs b/src/deployment_plan.rs new file mode 100644 index 0000000..9475701 --- /dev/null +++ b/src/deployment_plan.rs @@ -0,0 +1,1560 @@ +use std::collections::{BTreeMap, BTreeSet}; +use std::path::PathBuf; + +use anyhow::{Context, Result, bail, ensure}; +pub use cultnet_rs::IdunnExpectedIncarnationRecord as ExpectedIncarnation; +use cultnet_rs::{ + IDUNN_EXPECTED_INCARNATION_SCHEMA, IdunnExpectedCapability, IdunnExpectedDependency, + IdunnExpectedRoute, +}; +use serde::{Deserialize, Serialize}; +use sha2::{Digest, Sha256}; + +use crate::control_plane::SequenceAdmittedReady; +use crate::deployment::{ + CapabilityDependency, DependencyKind, ExternalCapabilityBinding, OperatorBinding, + ServiceTransport, SourceSelectionPolicy, StartupOrder, StateDeclaration, TargetDeclaration, + capability_compatible, +}; + +pub const SOURCE_SELECTION_FACTS_SCHEMA: &str = "idunn.source_selection_facts.v1"; +pub const COMPILED_DEPLOYMENT_PLAN_SCHEMA: &str = "idunn.compiled_deployment_plan.v2"; +pub const SEALED_RELEASE_SCHEMA: &str = "idunn.sealed_release.v1"; + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct GitlinkTreeFact { + pub origin: String, + pub revision: String, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(tag = "policy", rename_all = "kebab-case", deny_unknown_fields)] +pub enum SourceSelection { + PinnedObject, + RefHead, + SignedRelease { release_authority_id: String }, +} + +/// Private facts emitted by the future narrow source driver. Structural +/// validation here does not prove Git ancestry, signatures, or object custody. +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct SourceSelectionFacts { + pub schema: String, + pub origin: String, + pub admitted_ref: String, + pub admitted_ref_revision: String, + pub revision: String, + pub source_tree: String, + pub recipe_path: PathBuf, + pub recipe_blob_sha256: String, + pub gitlinks: BTreeMap, + pub selection: SourceSelection, + pub selected_at_unix_millis: u64, +} + +impl SourceSelectionFacts { + pub fn validate_against(&self, binding: &OperatorBinding) -> Result<()> { + binding.validate()?; + ensure!( + self.schema == SOURCE_SELECTION_FACTS_SCHEMA, + "unsupported source-selection facts schema" + ); + ensure!( + self.origin == binding.repository.origin, + "selected origin differs from binding" + ); + ensure!( + self.admitted_ref == binding.repository.admitted_ref, + "selected ref differs from binding" + ); + require_sha1( + &self.admitted_ref_revision, + "selected admitted-ref revision", + )?; + require_sha1(&self.revision, "selected revision")?; + require_sha1(&self.source_tree, "selected source tree")?; + ensure!( + self.recipe_path == binding.repository.recipe_path, + "selected recipe path differs from binding" + ); + require_sha256(&self.recipe_blob_sha256, "selected recipe blob")?; + ensure!( + self.selected_at_unix_millis > 0, + "source-selection facts have no time" + ); + + match (&binding.repository.selection, &self.selection) { + (SourceSelectionPolicy::PinnedObject, SourceSelection::PinnedObject) => { + let pinned_revision = binding + .repository + .pinned_revision + .as_deref() + .context("validated pinned binding has no revision")?; + ensure!( + self.revision == pinned_revision, + "selected source differs from the pinned revision" + ); + } + (SourceSelectionPolicy::RefHead, SourceSelection::RefHead) => ensure!( + self.revision == self.admitted_ref_revision, + "ref-head selection differs from the fetched admitted-ref revision" + ), + ( + SourceSelectionPolicy::SignedRelease, + SourceSelection::SignedRelease { + release_authority_id, + }, + ) => { + require_token(release_authority_id, "release authority id")?; + } + _ => bail!("source-selection facts do not match operator policy"), + } + + let expected_paths: BTreeSet<_> = binding.repository.gitlinks.keys().cloned().collect(); + let observed_paths: BTreeSet<_> = self.gitlinks.keys().cloned().collect(); + ensure!( + expected_paths == observed_paths, + "Gitlink tree facts differ from binding" + ); + for (path, receipt) in &self.gitlinks { + let expected = &binding.repository.gitlinks[path]; + ensure!( + receipt.origin == expected.origin, + "Gitlink {} origin differs from binding", + path.display() + ); + require_sha1(&receipt.revision, "Gitlink revision")?; + } + Ok(()) + } +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(tag = "kind", rename_all = "kebab-case", deny_unknown_fields)] +pub enum DependencyProviderAuthority { + ManagedReady { + target: String, + incarnation_id: String, + plan_id: String, + sealed_release_id: String, + expected_projection_sha256: String, + odin_topology_correlation_sha256: String, + odin_topology_publisher_sequence: u64, + }, + ExternalOperatorBinding { + binding_target: String, + }, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct DependencyProviderRef { + pub provider_id: String, + pub authority: DependencyProviderAuthority, + pub capability: String, + pub schema: String, + pub compatibility: String, + pub capacity: u32, + pub endpoint: Option, +} + +impl DependencyProviderRef { + pub fn validate(&self) -> Result<()> { + require_token(&self.provider_id, "dependency provider id")?; + require_contract(&self.capability, &self.schema, &self.compatibility)?; + ensure!(self.capacity > 0, "dependency provider capacity is zero"); + if let Some(endpoint) = &self.endpoint { + require_value(endpoint, "dependency provider endpoint")?; + } + match &self.authority { + DependencyProviderAuthority::ManagedReady { + target, + incarnation_id, + plan_id, + sealed_release_id, + expected_projection_sha256, + odin_topology_correlation_sha256, + odin_topology_publisher_sequence, + } => { + require_token(target, "managed provider target")?; + require_token(incarnation_id, "managed provider incarnation")?; + require_sha256(plan_id, "managed provider plan")?; + require_sha256(sealed_release_id, "managed provider sealed release")?; + require_sha256(expected_projection_sha256, "managed expected projection")?; + require_sha256( + odin_topology_correlation_sha256, + "managed Odin topology correlation", + )?; + ensure!( + *odin_topology_publisher_sequence > 0, + "managed Odin topology sequence is zero" + ); + } + DependencyProviderAuthority::ExternalOperatorBinding { binding_target } => { + require_token(binding_target, "external binding target")?; + ensure!( + self.endpoint.is_some(), + "external binding has no configured endpoint" + ); + } + } + Ok(()) + } + + fn compatible_with(&self, dependency: &CapabilityDependency) -> bool { + capability_compatible( + &dependency.capability, + &dependency.schema, + &dependency.compatibility, + &self.capability, + &self.schema, + &self.compatibility, + ) && self.capacity >= dependency.minimum_capacity + } + + fn is_external_binding(&self) -> bool { + matches!( + &self.authority, + DependencyProviderAuthority::ExternalOperatorBinding { .. } + ) + } +} + +pub fn external_binding_provider_refs( + binding: &OperatorBinding, +) -> Result> { + binding.validate()?; + let providers = binding + .external_capabilities + .iter() + .map(|capability| expected_external_provider(&binding.target, capability)) + .collect::>(); + for provider in &providers { + provider.validate()?; + } + Ok(providers) +} + +fn expected_external_provider( + binding_target: &str, + capability: &ExternalCapabilityBinding, +) -> DependencyProviderRef { + DependencyProviderRef { + provider_id: capability.provider_id.clone(), + authority: DependencyProviderAuthority::ExternalOperatorBinding { + binding_target: binding_target.to_owned(), + }, + capability: capability.capability.clone(), + schema: capability.schema.clone(), + compatibility: capability.compatibility.clone(), + capacity: capability.capacity, + endpoint: Some(capability.endpoint.clone()), + } +} + +/// Projects one authenticated Ready correlation into dependency-selection +/// inputs. Authentication is not replay admission: the control-plane store +/// must atomically admit `publisher_sequence` before calling this function and +/// must re-check the selected receipt before promotion. +fn managed_ready_provider_refs( + admitted: &SequenceAdmittedReady, +) -> Result> { + let expected = admitted.expected(); + let topology = admitted.authenticated(); + expected.validate()?; + let expected_projection_sha256 = expected.canonical_sha256()?; + let observed = topology.record(); + ensure!( + observed.expected_projection_sha256 == expected_projection_sha256, + "Ready provider topology names a different Expected projection" + ); + ensure!( + observed.target == expected.target && observed.runtime_id == expected.runtime_id, + "Ready provider topology names a different target or runtime" + ); + ensure!( + observed.expected + && observed.present + && observed.ready + && observed.observed_presence_state.as_deref() == Some("active") + && observed.disagreements.is_empty(), + "managed provider topology is not Ready" + ); + let odin_topology_correlation_sha256 = admitted.evidence_sha256().to_owned(); + let endpoint = expected + .route + .as_ref() + .map(|route| route.stable_endpoint.clone()); + let mut providers = Vec::new(); + for capability in &observed.observed_capabilities { + providers.push(DependencyProviderRef { + provider_id: expected.target.clone(), + authority: DependencyProviderAuthority::ManagedReady { + target: expected.target.clone(), + incarnation_id: expected.incarnation_id.clone(), + plan_id: expected.plan_id.clone(), + sealed_release_id: expected.sealed_release_id.clone(), + expected_projection_sha256: expected_projection_sha256.clone(), + odin_topology_correlation_sha256: odin_topology_correlation_sha256.clone(), + odin_topology_publisher_sequence: admitted.publisher_sequence(), + }, + capability: capability.capability.clone(), + schema: capability.schema.clone(), + compatibility: capability.compatibility.clone(), + capacity: capability.capacity, + endpoint: endpoint.clone(), + }); + } + for provider in &providers { + provider.validate()?; + } + Ok(providers) +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct DependencySelection { + pub requirement: CapabilityDependency, + pub provider: Option, +} + +impl DependencySelection { + fn validate(&self) -> Result<()> { + require_contract( + &self.requirement.capability, + &self.requirement.schema, + &self.requirement.compatibility, + )?; + ensure!( + self.requirement.minimum_capacity > 0, + "dependency capacity is zero" + ); + if let Some(provider) = &self.provider { + provider.validate()?; + ensure!( + provider.compatible_with(&self.requirement), + "selected provider is incompatible" + ); + ensure!( + (self.requirement.kind == DependencyKind::ExternalOperatorBinding) + == provider.is_external_binding(), + "selected provider authority does not match dependency kind" + ); + } else { + ensure!( + self.requirement.kind == DependencyKind::Optional, + "required dependency is unresolved" + ); + } + Ok(()) + } + + fn expected_projection(&self) -> Result { + self.validate()?; + let ( + provider_id, + provider_authority, + provider_expected_projection_sha256, + provider_endpoint, + ) = match &self.provider { + None => (None, None, None, None), + Some(provider) => match &provider.authority { + DependencyProviderAuthority::ManagedReady { + expected_projection_sha256, + .. + } => ( + Some(provider.provider_id.clone()), + Some("managed-incarnation".into()), + Some(expected_projection_sha256.clone()), + provider.endpoint.clone(), + ), + DependencyProviderAuthority::ExternalOperatorBinding { .. } => ( + Some(provider.provider_id.clone()), + Some("external-operator-binding".into()), + None, + provider.endpoint.clone(), + ), + }, + }; + Ok(IdunnExpectedDependency { + kind: dependency_kind_name(self.requirement.kind).into(), + capability: self.requirement.capability.clone(), + schema: self.requirement.schema.clone(), + compatibility: self.requirement.compatibility.clone(), + minimum_capacity: self.requirement.minimum_capacity, + startup: startup_order_name(self.requirement.startup).into(), + provider_id, + provider_authority, + provider_expected_projection_sha256, + provider_endpoint, + }) + } +} + +pub fn select_dependencies( + declaration: &TargetDeclaration, + providers: &[DependencyProviderRef], +) -> Result> { + declaration.validate()?; + let mut unique_contracts = BTreeSet::new(); + for provider in providers { + provider.validate()?; + ensure!( + unique_contracts.insert(( + provider.provider_id.as_str(), + provider.capability.as_str(), + provider.schema.as_str(), + provider.compatibility.as_str(), + )), + "dependency provider contract is duplicated" + ); + } + for conflict in &declaration.conflicts { + if providers + .iter() + .any(|provider| provider.capability == conflict.capability) + { + bail!( + "capability conflict {}: {}", + conflict.capability, + conflict.reason + ); + } + } + declaration + .dependencies + .iter() + .map(|dependency| { + let mut candidates = providers + .iter() + .filter(|provider| provider.compatible_with(dependency)) + .filter(|provider| { + (dependency.kind == DependencyKind::ExternalOperatorBinding) + == provider.is_external_binding() + }) + .cloned() + .collect::>(); + candidates.sort_by(|left, right| { + left.provider_id + .cmp(&right.provider_id) + .then_with(|| left.endpoint.cmp(&right.endpoint)) + }); + let provider = candidates.into_iter().next(); + if provider.is_none() && dependency.kind != DependencyKind::Optional { + bail!( + "no expected provider satisfies {} {} {}", + dependency.capability, + dependency.schema, + dependency.compatibility + ); + } + let selection = DependencySelection { + requirement: dependency.clone(), + provider, + }; + selection.validate()?; + Ok(selection) + }) + .collect() +} + +/// Private Idunn control-plane state. This contains host binding details and is +/// never an Odin/CultMesh projection. The shared CultNet Expected incarnation +/// is the sanitized topology projection derived only after a release validates +/// against this plan. +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct CompiledDeploymentPlan { + pub schema: String, + pub plan_id: String, + pub incarnation_id: String, + pub created_at_unix_millis: u64, + pub source: SourceSelectionFacts, + pub recipe_blob: Vec, + pub binding_blob: Vec, + pub dependencies: Vec, + pub candidate_port: Option, +} + +impl CompiledDeploymentPlan { + pub fn validate(&self) -> Result<()> { + ensure!( + self.schema == COMPILED_DEPLOYMENT_PLAN_SCHEMA, + "unsupported deployment-plan schema" + ); + require_sha256(&self.plan_id, "plan id")?; + require_token(&self.incarnation_id, "plan incarnation")?; + ensure!( + self.created_at_unix_millis >= self.source.selected_at_unix_millis, + "deployment plan predates source selection" + ); + let (declaration, binding) = self.parsed_inputs()?; + self.source.validate_against(&binding)?; + ensure!( + sha256_id(&self.recipe_blob) == self.source.recipe_blob_sha256, + "selected recipe blob differs from the exact plan recipe bytes" + ); + let declared_requirements: Vec<_> = declaration.dependencies.iter().collect(); + let selected_requirements: Vec<_> = self + .dependencies + .iter() + .map(|selection| &selection.requirement) + .collect(); + ensure!( + declared_requirements == selected_requirements, + "selected graph differs from recipe dependencies" + ); + for selection in &self.dependencies { + selection.validate()?; + } + match (&binding.route, self.candidate_port) { + (Some(bound), Some(port)) => { + ensure!( + (bound.private_port_start..=bound.private_port_end).contains(&port), + "candidate port is outside the operator range" + ); + } + (None, None) => {} + (Some(_), None) => bail!("routed deployment has no candidate port"), + (None, Some(_)) => bail!("private deployment selected a routed candidate port"), + } + ensure!( + self.plan_id == self.recomputed_plan_id()?, + "deployment plan digest is not canonical" + ); + Ok(()) + } + + pub(crate) fn parsed_inputs(&self) -> Result<(TargetDeclaration, OperatorBinding)> { + let recipe_text = std::str::from_utf8(&self.recipe_blob) + .context("stored deployment recipe is not UTF-8")?; + let binding_text = std::str::from_utf8(&self.binding_blob) + .context("stored operator binding is not UTF-8")?; + let declaration = TargetDeclaration::parse(recipe_text)?; + let binding = OperatorBinding::parse(binding_text)?; + binding.admit(&declaration)?; + Ok((declaration, binding)) + } + + fn recomputed_plan_id(&self) -> Result { + let mut unsigned = self.clone(); + unsigned.plan_id.clear(); + Ok(sha256_id( + &rmp_serde::to_vec(&unsigned).context("encoding deployment plan identity")?, + )) + } +} + +#[allow(clippy::too_many_arguments)] +pub(crate) fn compile_deployment_plan( + recipe_bytes: &[u8], + binding_bytes: &[u8], + source: SourceSelectionFacts, + incarnation_id: impl Into, + candidate_port: Option, + created_at_unix_millis: u64, + managed_ready_providers: &[SequenceAdmittedReady], +) -> Result { + let recipe_text = std::str::from_utf8(recipe_bytes).context("recipe is not UTF-8")?; + let binding_text = std::str::from_utf8(binding_bytes).context("binding is not UTF-8")?; + let declaration = TargetDeclaration::parse(recipe_text)?; + let binding = OperatorBinding::parse(binding_text)?; + binding.admit(&declaration)?; + source.validate_against(&binding)?; + ensure!( + sha256_id(recipe_bytes) == source.recipe_blob_sha256, + "selected recipe blob differs from compiled recipe bytes" + ); + let incarnation_id = incarnation_id.into(); + require_token(&incarnation_id, "deployment incarnation")?; + ensure!( + created_at_unix_millis >= source.selected_at_unix_millis, + "deployment plan predates source selection" + ); + let mut providers = Vec::new(); + for provider in managed_ready_providers { + providers.extend(managed_ready_provider_refs(provider)?); + } + providers.extend(external_binding_provider_refs(&binding)?); + let dependencies = select_dependencies(&declaration, &providers)?; + let mut plan = CompiledDeploymentPlan { + schema: COMPILED_DEPLOYMENT_PLAN_SCHEMA.into(), + plan_id: String::new(), + incarnation_id, + created_at_unix_millis, + source, + recipe_blob: recipe_bytes.to_vec(), + binding_blob: binding_bytes.to_vec(), + dependencies, + candidate_port, + }; + plan.plan_id = plan.recomputed_plan_id()?; + plan.validate()?; + Ok(plan) +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct ArtifactReceipt { + pub artifact_id: String, + pub destination: PathBuf, + pub sha256: String, + pub size_bytes: u64, + pub executable: bool, +} + +impl ArtifactReceipt { + fn validate(&self, declaration: &TargetDeclaration) -> Result<()> { + require_token(&self.artifact_id, "artifact receipt id")?; + require_sha256(&self.sha256, "artifact digest")?; + ensure!(self.size_bytes > 0, "sealed artifact is empty"); + let declared = declaration + .artifacts + .iter() + .find(|artifact| artifact.id == self.artifact_id) + .with_context(|| format!("plan declares no artifact {}", self.artifact_id))?; + ensure!( + self.destination == declared.destination && self.executable == declared.executable, + "artifact receipt differs from declared output" + ); + if let Some(expected_sha256) = &declared.expected_sha256 { + ensure!( + self.sha256 == prefixed_sha256(expected_sha256), + "artifact receipt differs from the recipe-pinned digest" + ); + } + Ok(()) + } +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct ExternalInputMaterializationReceipt { + pub input_id: String, + pub url: String, + pub sha256: String, + pub runner: String, + pub destination: PathBuf, + pub size_bytes: u64, +} + +impl ExternalInputMaterializationReceipt { + fn validate(&self, declaration: &TargetDeclaration) -> Result<()> { + require_token(&self.input_id, "external input receipt id")?; + require_sha256(&self.sha256, "external input materialized digest")?; + ensure!(self.size_bytes > 0, "materialized external input is empty"); + let declared = declaration + .external_inputs + .iter() + .find(|input| input.id == self.input_id) + .with_context(|| format!("plan declares no external input {}", self.input_id))?; + ensure!( + self.url == declared.url + && self.sha256 == prefixed_sha256(&declared.sha256) + && self.runner == declared.runner + && self.destination == declared.destination, + "external input receipt differs from its pinned declaration" + ); + Ok(()) + } +} + +/// Private Idunn release state. The content address covers the exact plan ID, +/// sorted full artifact receipts, and sorted full external-input +/// materialization receipts. The plan remains a separate private record and is +/// supplied explicitly for validation. +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct SealedRelease { + pub schema: String, + pub sealed_release_id: String, + pub plan_id: String, + pub artifacts: Vec, + pub external_inputs: Vec, + pub sealed_at_unix_millis: u64, +} + +impl SealedRelease { + pub fn new( + plan: &CompiledDeploymentPlan, + mut artifacts: Vec, + mut external_inputs: Vec, + sealed_at_unix_millis: u64, + ) -> Result { + plan.validate()?; + artifacts.sort_by(|left, right| left.artifact_id.cmp(&right.artifact_id)); + external_inputs.sort_by(|left, right| left.input_id.cmp(&right.input_id)); + let mut release = Self { + schema: SEALED_RELEASE_SCHEMA.into(), + sealed_release_id: String::new(), + plan_id: plan.plan_id.clone(), + artifacts, + external_inputs, + sealed_at_unix_millis, + }; + release.validate_contents(plan)?; + release.sealed_release_id = release.recomputed_release_id()?; + release.validate_against(plan)?; + Ok(release) + } + + pub fn validate_against(&self, plan: &CompiledDeploymentPlan) -> Result<()> { + require_sha256(&self.sealed_release_id, "sealed release id")?; + self.validate_contents(plan)?; + ensure!( + self.sealed_release_id == self.recomputed_release_id()?, + "sealed release content address is wrong" + ); + Ok(()) + } + + pub fn expected_projection( + &self, + plan: &CompiledDeploymentPlan, + ) -> Result { + self.validate_against(plan)?; + let (declaration, binding) = plan.parsed_inputs()?; + let route = match (&binding.route, plan.candidate_port) { + (Some(bound), Some(port)) => Some(IdunnExpectedRoute { + route_id: bound.route_id.clone(), + transport: endpoint_scheme(declaration.service.transport)?.into(), + stable_endpoint: bound.stable_endpoint.clone(), + candidate_endpoint: format!( + "{}://{}:{port}", + endpoint_scheme(declaration.service.transport)?, + bound.private_host + ), + }), + (None, None) => None, + _ => bail!("plan route and candidate port disagree"), + }; + let artifact_sha256 = self + .artifacts + .iter() + .find(|artifact| artifact.artifact_id == declaration.service.executable_artifact) + .context("sealed release has no executable service artifact")? + .sha256 + .clone(); + let mut capabilities = declaration + .provides + .iter() + .map(|capability| IdunnExpectedCapability { + capability: capability.capability.clone(), + schema: capability.schema.clone(), + compatibility: capability.compatibility.clone(), + minimum_capacity: capability.capacity, + }) + .collect::>(); + capabilities.sort_by(|left, right| { + (&left.capability, &left.schema, &left.compatibility).cmp(&( + &right.capability, + &right.schema, + &right.compatibility, + )) + }); + let mut dependencies = plan + .dependencies + .iter() + .map(DependencySelection::expected_projection) + .collect::>>()?; + dependencies.sort_by(|left, right| { + (&left.capability, &left.schema, &left.compatibility).cmp(&( + &right.capability, + &right.schema, + &right.compatibility, + )) + }); + let expected = ExpectedIncarnation { + schema_version: IDUNN_EXPECTED_INCARNATION_SCHEMA.into(), + target: declaration.target.clone(), + plan_id: plan.plan_id.clone(), + incarnation_id: plan.incarnation_id.clone(), + sealed_release_id: self.sealed_release_id.clone(), + source_repository: canonical_repository_identity(&plan.source.origin)?, + source_revision: plan.source.revision.clone(), + recipe_sha256: plan.source.recipe_blob_sha256.clone(), + runtime_id: binding.runtime_identity.runtime_id.clone(), + expected_signer_identity_id: binding + .runtime_identity + .expected_signer_identity_id + .clone(), + health_contract: declaration.service.health.contract.clone(), + artifact_sha256, + state_schema_generation: declaration + .state + .as_ref() + .map(|state| state.schema_generation.clone()), + state_contract_sha256: declaration + .state + .as_ref() + .map(canonical_state_contract_sha256) + .transpose()?, + write_lease_required: declaration.write_lease_required(), + route, + capabilities, + dependencies, + }; + expected.validate()?; + Ok(expected) + } + + fn validate_contents(&self, plan: &CompiledDeploymentPlan) -> Result<()> { + ensure!( + self.schema == SEALED_RELEASE_SCHEMA, + "unsupported sealed-release schema" + ); + plan.validate()?; + let (declaration, _) = plan.parsed_inputs()?; + require_sha256(&self.plan_id, "sealed plan id")?; + ensure!( + self.plan_id == plan.plan_id, + "sealed release refers to a different plan" + ); + ensure!( + self.sealed_at_unix_millis >= plan.created_at_unix_millis, + "release was sealed before it was planned" + ); + ensure!( + self.artifacts + .windows(2) + .all(|pair| pair[0].artifact_id < pair[1].artifact_id), + "artifact receipts are not in canonical order" + ); + ensure!( + self.external_inputs + .windows(2) + .all(|pair| pair[0].input_id < pair[1].input_id), + "external input receipts are not in canonical order" + ); + let declared_ids = declaration + .artifacts + .iter() + .map(|artifact| artifact.id.as_str()) + .collect::>(); + let observed_ids = self + .artifacts + .iter() + .map(|artifact| artifact.artifact_id.as_str()) + .collect::>(); + ensure!( + declared_ids == observed_ids && observed_ids.len() == self.artifacts.len(), + "artifact receipts differ from declared outputs" + ); + for artifact in &self.artifacts { + artifact.validate(&declaration)?; + } + let declared_input_ids = declaration + .external_inputs + .iter() + .map(|input| input.id.as_str()) + .collect::>(); + let observed_input_ids = self + .external_inputs + .iter() + .map(|input| input.input_id.as_str()) + .collect::>(); + ensure!( + declared_input_ids == observed_input_ids + && observed_input_ids.len() == self.external_inputs.len(), + "external input receipts differ from pinned declarations" + ); + for input in &self.external_inputs { + input.validate(&declaration)?; + } + Ok(()) + } + + fn recomputed_release_id(&self) -> Result { + Ok(sha256_id( + &rmp_serde::to_vec(&( + self.schema.as_str(), + self.plan_id.as_str(), + &self.artifacts, + &self.external_inputs, + )) + .context("encoding sealed release identity")?, + )) + } +} + +fn canonical_state_contract_sha256(state: &StateDeclaration) -> Result { + Ok(sha256_id( + &rmp_serde::to_vec(state).context("encoding canonical state contract")?, + )) +} + +fn endpoint_scheme(transport: ServiceTransport) -> Result<&'static str> { + match transport { + ServiceTransport::Http => Ok("http"), + ServiceTransport::Tcp => Ok("tcp"), + ServiceTransport::Rudp | ServiceTransport::Private => { + bail!("service transport has no stable route scheme") + } + } +} + +fn dependency_kind_name(kind: DependencyKind) -> &'static str { + match kind { + DependencyKind::Bootstrap => "bootstrap", + DependencyKind::Required => "required", + DependencyKind::Optional => "optional", + DependencyKind::SharedInfrastructure => "shared-infrastructure", + DependencyKind::Private => "private", + DependencyKind::ExternalOperatorBinding => "external-operator-binding", + } +} + +fn startup_order_name(startup: StartupOrder) -> &'static str { + match startup { + StartupOrder::BeforePromotion => "before-promotion", + StartupOrder::BeforeStart => "before-start", + } +} + +fn canonical_repository_identity(origin: &str) -> Result { + let identity = origin + .strip_prefix("https://") + .and_then(|origin| origin.strip_suffix(".git")) + .context("validated Git origin is not a canonical HTTPS repository")?; + Ok(identity.to_owned()) +} + +fn prefixed_sha256(raw_sha256: &str) -> String { + format!("sha256-{raw_sha256}") +} + +fn require_token(value: &str, label: &str) -> Result<()> { + ensure!( + !value.is_empty() && value.len() <= 128, + "{label} is empty or too long" + ); + ensure!( + value + .bytes() + .all(|byte| byte.is_ascii_alphanumeric() + || matches!(byte, b'-' | b'_' | b'.' | b':' | b'/')), + "{label} contains a forbidden character" + ); + Ok(()) +} + +fn require_contract(capability: &str, schema: &str, compatibility: &str) -> Result<()> { + require_token(capability, "capability")?; + require_token(schema, "capability schema")?; + require_token(compatibility, "capability compatibility") +} + +fn require_value(value: &str, label: &str) -> Result<()> { + ensure!( + !value.trim().is_empty() && value == value.trim(), + "{label} is empty or noncanonical" + ); + ensure!( + value.len() <= 4096 && !value.contains('\0'), + "{label} is oversized or contains NUL" + ); + Ok(()) +} + +fn require_sha1(value: &str, label: &str) -> Result<()> { + require_lower_hex(value, 40, label) +} + +fn require_sha256(value: &str, label: &str) -> Result<()> { + let digest = value + .strip_prefix("sha256-") + .with_context(|| format!("{label} has no sha256- prefix"))?; + require_lower_hex(digest, 64, label) +} + +fn require_lower_hex(value: &str, length: usize, label: &str) -> Result<()> { + ensure!(value.len() == length, "{label} has the wrong length"); + ensure!( + value + .bytes() + .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte)), + "{label} is not lowercase hexadecimal" + ); + Ok(()) +} + +fn sha256_id(bytes: &[u8]) -> String { + let digest = Sha256::digest(bytes); + let mut encoded = String::with_capacity(71); + encoded.push_str("sha256-"); + for byte in digest { + use std::fmt::Write as _; + write!(&mut encoded, "{byte:02x}").expect("writing to String cannot fail"); + } + encoded +} + +#[cfg(test)] +mod tests { + use super::*; + use cultnet_rs::{ + GameCultProviderHealthIdentity, GameCultRuntimeCapability, IdunnRuntimeActivationLaunch, + IdunnServiceIdentity, ODIN_RUNTIME_TOPOLOGY_CORRELATION_SCHEMA, + OdinRuntimeTopologyCorrelationPurpose, OdinRuntimeTopologyCorrelationRecord, + OdinTopologyAuthenticationContext, OdinTopologyIdentity, + authenticate_odin_runtime_topology_correlation, enroll_service_identity_at, + verify_runtime_authority, + }; + + const RECIPE: &str = r#" +schema = "gamecult.idunn.target_declaration.v1" +target = "service" +source_stamp_environment = "SERVICE_BUILD_COMMIT" + +[[steps]] +id = "build" +phase = "build" +runner = "rust" +argv = ["cargo", "build", "--locked"] + +[[external_inputs]] +id = "toolchain-index" +url = "https://example.invalid/toolchain-index" +sha256 = "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" +runner = "rust" +destination = "inputs/toolchain-index" + +[[artifacts]] +id = "daemon" +source_kind = "runner-output" +runner = "rust" +source = "target/release/service" +destination = "service" +expected_sha256 = "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc" +executable = true + +[service] +executable_artifact = "daemon" +arguments = [ + { kind = "binding", name = "state_root" }, +] +transport = "http" +route_required = true +required_environment = ["GAMECULT_IDUNN_CANDIDATE_BIND", "GAMECULT_IDUNN_RUNTIME_BUNDLE"] + +[service.health] +contract = "service.health" + +[state] +schema_generation = "v1" + +[[state.slots]] +id = "runtime-cache" +relative_path = "runtime-cache.cc" +kind = "cultcache-file" +schema = "service.runtime-cache.v1" +writer = "none" +recovery = "rebuildable" +startup = "open-at-start" + +[[provides]] +capability = "service.runtime" +schema = "service.runtime.v1" +compatibility = "v1" + +[[dependencies]] +kind = "shared-infrastructure" +capability = "odin.verse-rendezvous" +schema = "odin.verse-topology.v1" +compatibility = "v1" +"#; + + const BINDING: &str = r#" +schema = "gamecult.idunn.operator_binding.v2" +target = "service" + +[repository] +origin = "https://github.com/GameCult/Service.git" +admitted_ref = "refs/heads/main" +minimum_revision = "1111111111111111111111111111111111111111" +selection = "ref-head" +checkout = "/srv/build/Service" +recipe_path = "deployment/idunn/recipe.toml" + +[runners.rust] +driver = "docker" +image = "rust@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +user = "1000:1000" +affordances = ["source-read", "artifact-write"] +allowed_programs = ["cargo"] +network_profile = "build-dependency-egress" +memory_mebibytes = 2048 +cpu_quota_percent = 200 +pids_limit = 512 +tmpfs_mebibytes = 512 + +[workload] +driver = "systemd-transient" +state_group = "service" +unit_prefix = "idunn-service" +release_root = "/srv/service/releases" +state_root = "/var/lib/gamecult/service" +runtime_root = "/run/gamecult/idunn/service" +network = "host-private" +hardening = "strict" +memory_mebibytes = 1024 +cpu_quota_percent = 100 + +[workload.argument_bindings] +state_root = "/var/lib/gamecult/service" + +[workload.secret_files] +GAMECULT_RUNTIME_PRESENCE_IDENTITY = "/etc/gamecult/service/runtime-presence-identity.cc" + +[runtime_identity] +runtime_id = "service-yggdrasil" +expected_signer_identity_id = "service-runtime-signer" +trust_anchor_store = "/etc/gamecult/trust/service.cc" + +[route] +driver = "nginx-stream-tcp" +route_id = "service" +stable_endpoint = "http://127.0.0.1:17999" +private_host = "127.0.0.1" +private_port_start = 18000 +private_port_end = 18009 +config_path = "/etc/nginx/idunn-stream-routes/service.conf" +reload_unit = "nginx.service" + +[brakes] +deployment_store = "/var/lib/gamecult/idunn/service-deployment-brake.cc" +lifecycle_store = "/var/lib/gamecult/idunn/service-lifecycle-brake.cc" + +[rollout] +strategy = "candidate-then-promote" +drain_seconds = 30 +retain_releases = 2 + +[placement] +desired_replicas = 1 +nodes = ["yggdrasil"] +"#; + + fn digest(byte: u8) -> String { + format!("sha256-{}", char::from(byte).to_string().repeat(64)) + } + + fn source(recipe: &str) -> SourceSelectionFacts { + SourceSelectionFacts { + schema: SOURCE_SELECTION_FACTS_SCHEMA.into(), + origin: "https://github.com/GameCult/Service.git".into(), + admitted_ref: "refs/heads/main".into(), + admitted_ref_revision: "2222222222222222222222222222222222222222".into(), + revision: "2222222222222222222222222222222222222222".into(), + source_tree: "3333333333333333333333333333333333333333".into(), + recipe_path: "deployment/idunn/recipe.toml".into(), + recipe_blob_sha256: sha256_id(recipe.as_bytes()), + gitlinks: BTreeMap::new(), + selection: SourceSelection::RefHead, + selected_at_unix_millis: 100, + } + } + + fn odin() -> ExpectedIncarnation { + ExpectedIncarnation { + schema_version: IDUNN_EXPECTED_INCARNATION_SCHEMA.into(), + target: "odin".into(), + plan_id: digest(b'a'), + incarnation_id: "odin-incarnation-1".into(), + sealed_release_id: digest(b'e'), + source_repository: "github.com/GameCult/Odin".into(), + source_revision: "2222222222222222222222222222222222222222".into(), + recipe_sha256: digest(b'b'), + runtime_id: "odin-yggdrasil".into(), + expected_signer_identity_id: "odin-runtime-signer".into(), + health_contract: "odin.cultnet-service-health".into(), + artifact_sha256: digest(b'f'), + state_schema_generation: None, + state_contract_sha256: None, + write_lease_required: false, + route: Some(IdunnExpectedRoute { + route_id: "odin-private".into(), + transport: "tcp".into(), + stable_endpoint: "tcp://10.77.0.1:17871".into(), + candidate_endpoint: "tcp://127.0.0.1:17871".into(), + }), + capabilities: vec![IdunnExpectedCapability { + capability: "odin.verse-rendezvous".into(), + schema: "odin.verse-topology.v1".into(), + compatibility: "v1".into(), + minimum_capacity: 1, + }], + dependencies: Vec::new(), + } + } + + fn ready_odin_provider(target: &str, runtime_id: &str, capacity: u32) -> SequenceAdmittedReady { + (|| -> Result { + let root = tempfile::tempdir()?; + let provider = enroll_service_identity_at::( + &root.path().join("provider.cc"), + )?; + let idunn = + enroll_service_identity_at::(&root.path().join("idunn.cc"))?; + let odin_signer = + enroll_service_identity_at::(&root.path().join("odin.cc"))?; + let mut expected = odin(); + expected.target = target.into(); + expected.runtime_id = runtime_id.into(); + expected.expected_signer_identity_id = provider.entry().identity_id.clone(); + let launch = IdunnRuntimeActivationLaunch::issue(&expected, digest(b'8'), 100, &idunn)?; + let activation = launch.activation().clone(); + launch.write_credential(std::io::sink())?; + let authority = verify_runtime_authority( + &expected, + &activation, + &idunn.trust_anchor()?, + &provider.entry().public_key, + )?; + let mut topology = OdinRuntimeTopologyCorrelationRecord { + schema_version: ODIN_RUNTIME_TOPOLOGY_CORRELATION_SCHEMA.into(), + target: expected.target.clone(), + expected_projection_sha256: expected.canonical_sha256()?, + expected: true, + current_activation_sha256: Some(activation.canonical_sha256()?), + signed_presence_sha256: Some(digest(b'9')), + observed_presence_state: Some("active".into()), + observed_presence_publisher_sequence: Some(1), + observed_write_lease_sha256: None, + observed_capabilities: vec![GameCultRuntimeCapability { + capability: "odin.verse-rendezvous".into(), + schema: "odin.verse-topology.v1".into(), + compatibility: "v1".into(), + capacity, + }], + runtime_id: expected.runtime_id.clone(), + runtime_instance_id: Some(activation.runtime_instance_id.clone()), + present: true, + ready: true, + dependencies: Vec::new(), + disagreements: Vec::new(), + signer_identity_id: odin_signer.entry().identity_id.clone(), + publisher_sequence: 7, + observed_at_unix_millis: 110, + signature_algorithm: "ed25519".into(), + signature: Vec::new(), + }; + topology.signature = odin_signer + .sign::( + &topology.unsigned_signature_payload()?, + ) + .signature; + let bytes = topology.canonical_bytes()?; + let authenticated = authenticate_odin_runtime_topology_correlation( + &bytes, + &authority, + None, + &odin_signer.entry().public_key, + OdinTopologyAuthenticationContext { + trusted_received_at_unix_millis: 120, + maximum_age_millis: 30, + maximum_future_skew_millis: 5, + }, + )?; + SequenceAdmittedReady::for_test(&expected, authenticated, 120) + })() + .unwrap() + } + + fn plan() -> CompiledDeploymentPlan { + let providers = [ready_odin_provider("odin", "odin-yggdrasil", 1)]; + plan_with(&providers) + } + + fn plan_with(providers: &[SequenceAdmittedReady]) -> CompiledDeploymentPlan { + compile_deployment_plan( + RECIPE.as_bytes(), + BINDING.as_bytes(), + source(RECIPE), + "service-incarnation-1", + Some(18001), + 110, + providers, + ) + .unwrap() + } + + fn artifact_receipt() -> ArtifactReceipt { + ArtifactReceipt { + artifact_id: "daemon".into(), + destination: "service".into(), + sha256: digest(b'c'), + size_bytes: 42, + executable: true, + } + } + + fn external_input_receipt() -> ExternalInputMaterializationReceipt { + ExternalInputMaterializationReceipt { + input_id: "toolchain-index".into(), + url: "https://example.invalid/toolchain-index".into(), + sha256: digest(b'd'), + runner: "rust".into(), + destination: "inputs/toolchain-index".into(), + size_bytes: 17, + } + } + + #[test] + fn compiler_parses_the_exact_bytes_it_receipts() { + let providers = [ready_odin_provider("odin", "odin-yggdrasil", 1)]; + let first = plan_with(&providers); + let second = plan_with(&providers); + assert_eq!(first, second); + assert_eq!(first.recipe_blob.as_slice(), RECIPE.as_bytes()); + assert_eq!(first.binding_blob.as_slice(), BINDING.as_bytes()); + assert_eq!( + sha256_id(&first.recipe_blob), + first.source.recipe_blob_sha256 + ); + let changed = RECIPE.replace( + "contract = \"service.health\"", + "contract = \"service.health.v2\"", + ); + let providers = [ready_odin_provider("odin", "odin-yggdrasil", 1)]; + assert!( + compile_deployment_plan( + changed.as_bytes(), + BINDING.as_bytes(), + source(RECIPE), + "service-incarnation-2", + Some(18002), + 111, + &providers, + ) + .is_err() + ); + let mut corrupted = first; + corrupted + .binding_blob + .extend_from_slice(b"\nunknown = true\n"); + assert!(corrupted.validate().is_err()); + } + + #[test] + fn pinned_policy_requires_the_exact_operator_pin() { + let pinned_binding = BINDING.replace( + "selection = \"ref-head\"", + "selection = \"pinned-object\"\npinned_revision = \"2222222222222222222222222222222222222222\"", + ); + let binding = OperatorBinding::parse(&pinned_binding).unwrap(); + assert!(source(RECIPE).validate_against(&binding).is_err()); + let mut facts = source(RECIPE); + facts.selection = SourceSelection::PinnedObject; + facts.validate_against(&binding).unwrap(); + } + + #[test] + fn gitlink_fact_must_match_the_selected_superproject_tree() { + let recipe = RECIPE.replace( + "source_stamp_environment = \"SERVICE_BUILD_COMMIT\"", + "source_stamp_environment = \"SERVICE_BUILD_COMMIT\"\nrequired_gitlinks = [\"vendor/lib\"]", + ); + let binding_text = BINDING.replace( + "recipe_path = \"deployment/idunn/recipe.toml\"", + "recipe_path = \"deployment/idunn/recipe.toml\"\ngitlinks = { \"vendor/lib\" = { origin = \"https://github.com/GameCult/Lib.git\" } }", + ); + let binding = OperatorBinding::parse(&binding_text).unwrap(); + binding + .admit(&TargetDeclaration::parse(&recipe).unwrap()) + .unwrap(); + let mut facts = source(&recipe); + facts.gitlinks.insert( + "vendor/lib".into(), + GitlinkTreeFact { + origin: "https://github.com/GameCult/Lib.git".into(), + revision: "4444444444444444444444444444444444444444".into(), + }, + ); + facts.validate_against(&binding).unwrap(); + facts + .gitlinks + .get_mut(&PathBuf::from("vendor/lib")) + .unwrap() + .origin = "https://github.com/GameCult/Wrong.git".into(); + assert!(facts.validate_against(&binding).is_err()); + } + + #[test] + fn dependency_selection_uses_observed_ready_capacity_and_stable_identity_order() { + let declaration = TargetDeclaration::parse(RECIPE).unwrap(); + let admitted = [ + ready_odin_provider("odin-z", "odin-runtime-z", 4), + ready_odin_provider("odin-yggdrasil", "odin-runtime-yggdrasil", 2), + ]; + let providers = admitted + .iter() + .flat_map(|provider| managed_ready_provider_refs(provider).unwrap()) + .collect::>(); + let selected = select_dependencies(&declaration, &providers).unwrap(); + assert_eq!( + selected[0].provider.as_ref().unwrap().provider_id, + "odin-yggdrasil" + ); + assert_eq!(selected[0].provider.as_ref().unwrap().capacity, 2); + assert_eq!( + selected[0].provider.as_ref().unwrap().endpoint.as_deref(), + Some("tcp://10.77.0.1:17871") + ); + assert!(matches!( + &selected[0].provider.as_ref().unwrap().authority, + DependencyProviderAuthority::ManagedReady { + odin_topology_publisher_sequence: 7, + .. + } + )); + } + + #[test] + fn external_binding_produces_expected_configuration_only() { + let input = BINDING.replace( + "[placement]", + "[[external_capabilities]]\nprovider_id = \"operator-archive\"\ncapability = \"archive.store\"\nschema = \"archive.store.v1\"\ncompatibility = \"v1\"\ncapacity = 2\nendpoint = \"s3://operator-bound\"\n\n[placement]", + ); + let binding = OperatorBinding::parse(&input).unwrap(); + let providers = external_binding_provider_refs(&binding).unwrap(); + let declaration = TargetDeclaration::parse(&RECIPE.replace( + "kind = \"shared-infrastructure\"\ncapability = \"odin.verse-rendezvous\"\nschema = \"odin.verse-topology.v1\"", + "kind = \"external-operator-binding\"\ncapability = \"archive.store\"\nschema = \"archive.store.v1\"", + )) + .unwrap(); + binding.admit(&declaration).unwrap(); + let selected = select_dependencies(&declaration, &providers).unwrap(); + assert!(matches!( + &providers[0].authority, + DependencyProviderAuthority::ExternalOperatorBinding { .. } + )); + assert_eq!(providers[0].capacity, 2); + assert_eq!( + selected[0].provider.as_ref().unwrap().provider_id, + "operator-archive" + ); + } + + #[test] + fn expected_projection_is_sanitized_and_names_the_selected_graph() { + let plan = plan(); + let release = SealedRelease::new( + &plan, + vec![artifact_receipt()], + vec![external_input_receipt()], + 120, + ) + .unwrap(); + let expected = release.expected_projection(&plan).unwrap(); + assert_eq!(expected.plan_id, plan.plan_id); + assert_eq!(expected.sealed_release_id, release.sealed_release_id); + assert_eq!(expected.incarnation_id, "service-incarnation-1"); + assert_eq!(expected.runtime_id, "service-yggdrasil"); + assert_eq!( + expected.expected_signer_identity_id, + "service-runtime-signer" + ); + assert_eq!(expected.health_contract, "service.health"); + assert_eq!(expected.artifact_sha256, digest(b'c')); + assert_eq!(expected.source_repository, "github.com/GameCult/Service"); + assert_eq!(expected.source_revision, plan.source.revision); + assert_eq!(expected.recipe_sha256, plan.source.recipe_blob_sha256); + assert_eq!(expected.state_schema_generation.as_deref(), Some("v1")); + assert!(expected.state_contract_sha256.is_some()); + assert!(!expected.write_lease_required); + assert_eq!( + expected.dependencies[0].provider_id.as_deref(), + Some("odin") + ); + assert_eq!( + expected.dependencies[0].provider_authority.as_deref(), + Some("managed-incarnation") + ); + assert_eq!( + expected.route.as_ref().unwrap().candidate_endpoint, + "http://127.0.0.1:18001" + ); + assert_eq!(expected.route.as_ref().unwrap().transport, "http"); + assert!(expected.canonical_sha256().unwrap().starts_with("sha256-")); + let mut invalid_release = release; + invalid_release.artifacts[0].size_bytes += 1; + assert!(invalid_release.expected_projection(&plan).is_err()); + } + + #[test] + fn expected_projection_sorts_shared_capability_and_dependency_claims() { + let recipe = RECIPE + .replace( + "[[provides]]\ncapability = \"service.runtime\"", + "[[provides]]\ncapability = \"zeta.runtime\"\nschema = \"zeta.runtime.v1\"\ncompatibility = \"v1\"\n\n[[provides]]\ncapability = \"service.runtime\"", + ) + .replace( + "[[dependencies]]\nkind = \"shared-infrastructure\"", + "[[dependencies]]\nkind = \"optional\"\ncapability = \"zeta.optional\"\nschema = \"zeta.optional.v1\"\ncompatibility = \"v1\"\n\n[[dependencies]]\nkind = \"shared-infrastructure\"", + ); + let plan = compile_deployment_plan( + recipe.as_bytes(), + BINDING.as_bytes(), + source(&recipe), + "service-incarnation-sorted", + Some(18002), + 111, + &[ready_odin_provider("odin", "odin-yggdrasil", 1)], + ) + .unwrap(); + let release = SealedRelease::new( + &plan, + vec![artifact_receipt()], + vec![external_input_receipt()], + 120, + ) + .unwrap(); + let expected = release.expected_projection(&plan).unwrap(); + assert_eq!( + expected + .capabilities + .iter() + .map(|capability| capability.capability.as_str()) + .collect::>(), + ["service.runtime", "zeta.runtime"] + ); + assert_eq!( + expected + .dependencies + .iter() + .map(|dependency| dependency.capability.as_str()) + .collect::>(), + ["odin.verse-rendezvous", "zeta.optional"] + ); + expected.validate().unwrap(); + } + + #[test] + fn sealed_release_address_covers_artifacts_and_external_inputs() { + let receipt = artifact_receipt(); + let input = external_input_receipt(); + let plan = plan(); + let mut wrong_artifact = receipt.clone(); + wrong_artifact.sha256 = digest(b'f'); + assert!(SealedRelease::new(&plan, vec![wrong_artifact], vec![input.clone()], 120).is_err()); + assert!(SealedRelease::new(&plan, vec![receipt.clone()], vec![], 120).is_err()); + let release = + SealedRelease::new(&plan, vec![receipt.clone()], vec![input.clone()], 120).unwrap(); + let later_receipt_time = + SealedRelease::new(&plan, vec![receipt], vec![input], 130).unwrap(); + release.validate_against(&plan).unwrap(); + assert_eq!( + release.sealed_release_id, + later_receipt_time.sealed_release_id + ); + let mut changed = release.clone(); + changed.artifacts[0].size_bytes = 43; + assert!(changed.validate_against(&plan).is_err()); + let mut changed = release; + changed.external_inputs[0].size_bytes = 18; + assert!(changed.validate_against(&plan).is_err()); + } +} diff --git a/src/drivers.rs b/src/drivers.rs new file mode 100644 index 0000000..1554408 --- /dev/null +++ b/src/drivers.rs @@ -0,0 +1,7337 @@ +use std::collections::BTreeMap; +use std::ffi::{OsStr, OsString}; +use std::fs::{self, OpenOptions}; +use std::io::{ErrorKind, Read, Write}; +use std::net::{SocketAddr, TcpStream}; +use std::path::{Path, PathBuf}; +use std::process::{Command, Output, Stdio}; +use std::thread; +use std::time::Duration; + +use anyhow::{Context, Result, bail, ensure}; +use cultcache_rs::{ + CacheBackingStore, CultCacheEnvelope, CultCacheExpectedEnvelope, DatabaseEntry, + SingleFileMessagePackBackingStore, TryCompareExchangeSnapshotOutcome, +}; +use cultmesh_rs::{CultMeshRudpSnapshotOptions, request_raw_snapshot_from_rudp_catalog}; +use serde::{Deserialize, Serialize}; +use sha2::{Digest, Sha256}; +use uuid::Uuid; + +use crate::control_plane::SequenceAdmittedWarming; +use crate::deployment::{ + ArtifactOutput, ArtifactSource, IDUNN_PROCESS_WRITE_LEASE_ENVIRONMENT, + IDUNN_RUNTIME_BUNDLE_ENVIRONMENT, IDUNN_RUNTIME_CANDIDATE_BIND_ENVIRONMENT, LaunchArgument, + OperatorBinding, RUNTIME_PRESENCE_IDENTITY_BINDING, RUNTIME_PRESENCE_IDENTITY_FD_NAME, + RouteBinding, RouteDriver, RunnerBinding, SourceSelectionPolicy, TargetDeclaration, + WorkloadNetwork, +}; +use crate::deployment_plan::{ + ArtifactReceipt, CompiledDeploymentPlan, ExternalInputMaterializationReceipt, GitlinkTreeFact, + SOURCE_SELECTION_FACTS_SCHEMA, SealedRelease, SourceSelection, SourceSelectionFacts, +}; +use cultnet_rs::{ + CultNetMessage, CultNetRawPayloadEncoding, CultNetWireContract, + GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA, GAMECULT_RUNTIME_PRESENCE_HEALTH_SIGNING_PURPOSE, + GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA, GameCultProviderHealthIdentity, + GameCultServiceTrustAnchorRecord, IDUNN_EXPECTED_INCARNATION_SCHEMA, + IDUNN_PROCESS_WRITE_LEASE_SCHEMA, IDUNN_RUNTIME_ACTIVATION_CREDENTIAL_NAME, + IDUNN_RUNTIME_ACTIVATION_SCHEMA, IdunnExpectedIncarnationRecord, IdunnProcessWriteLeaseRecord, + IdunnRuntimeActivationLaunch, IdunnRuntimeActivationRecord, IdunnRuntimeActivationSigner, + ODIN_RUNTIME_TOPOLOGY_CORRELATION_SCHEMA, OdinRuntimeTopologyCorrelationRecord, + ServiceIdentityProfile, ServiceIdentityTrustAnchor, decode_cultnet_message_from_slice, + derive_service_identity_id, encode_cultnet_message_to_vec, encode_frame, + open_service_identity_credential_reader, +}; + +#[derive(Clone, Copy, Debug, PartialEq, Eq)] +pub struct ProcessIdentity { + pub uid: u32, + pub gid: u32, +} + +#[derive(Clone, Debug, PartialEq, Eq)] +struct GitTreeEntry { + mode: String, + kind: String, + object: String, + path: PathBuf, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +pub struct ResolvedSource { + pub facts: SourceSelectionFacts, + pub recipe_bytes: Vec, +} + +impl ResolvedSource { + pub fn validate_against(&self, binding: &OperatorBinding) -> Result<()> { + self.facts.validate_against(binding)?; + ensure!(!self.recipe_bytes.is_empty(), "resolved recipe is empty"); + ensure!( + sha256_id(&self.recipe_bytes) == self.facts.recipe_blob_sha256, + "resolved recipe bytes differ from the selected Git object" + ); + Ok(()) + } +} + +#[derive(Clone, Debug, PartialEq, Eq)] +pub struct FrozenSource { + receipt: FrozenSourceReceipt, + facts: SourceSelectionFacts, + recipe_bytes: Vec, + root: PathBuf, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +pub struct FrozenSourceReceipt { + pub transaction_id: String, + pub plan_id: String, + pub snapshot_sha256: String, +} + +impl FrozenSourceReceipt { + pub fn validate_against(&self, plan: &CompiledDeploymentPlan) -> Result<()> { + plan.validate()?; + require_driver_id(&self.transaction_id, "source transaction")?; + ensure!(self.plan_id == plan.plan_id, "frozen source plan differs"); + require_sha256_id(&self.snapshot_sha256, "frozen source snapshot") + } + + fn snapshot_component(&self) -> &str { + self.snapshot_sha256 + .strip_prefix("sha256-") + .expect("validated frozen source digest") + } +} + +pub trait SourcePort { + fn resolve( + &self, + binding: &OperatorBinding, + resolution_id: &str, + selected_at_unix_millis: u64, + ) -> Result; + + fn freeze( + &self, + transaction_id: &str, + plan: &CompiledDeploymentPlan, + ) -> Result; + + fn observe_frozen( + &self, + plan: &CompiledDeploymentPlan, + receipt: &FrozenSourceReceipt, + ) -> Result; + + fn cleanup(&self, transaction_id: &str, receipt: Option<&FrozenSourceReceipt>) -> Result<()>; +} + +pub trait RunnerPort { + fn materialize( + &self, + source: &FrozenSource, + plan: &CompiledDeploymentPlan, + staging_root: &Path, + sealed_at_unix_millis: u64, + ) -> Result; +} + +#[derive(Clone, Debug, PartialEq, Eq)] +pub struct MaterializedRelease { + pub release: SealedRelease, + pub root: PathBuf, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +pub struct InstalledReleaseObservation { + pub sealed_release_id: String, + pub root: PathBuf, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +pub struct ServiceCredentialObservation { + pub environment_name: String, + pub delivered_path: PathBuf, + pub device: u64, + pub inode: u64, + pub uid: u32, + pub gid: u32, + pub mode: u32, + pub size: u64, + pub sha256: String, +} + +/// Root-owned source metadata for one descriptor that PID1 opens and passes +/// only to the service's initial process. The process must consume and close +/// descriptors 3 and 4 before spawning any child; no filesystem path is +/// projected into the workload environment. +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +pub struct ParentOnlyFileDescriptorObservation { + pub fd_number: u32, + pub fd_name: String, + pub source_path: PathBuf, + pub access: String, + pub device: u64, + pub inode: u64, + pub uid: u32, + pub gid: u32, + pub mode: u32, + pub links: u64, + pub size: u64, + pub sha256: String, +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +pub struct WorkloadObservation { + pub unit: String, + pub unit_description: String, + pub invocation_id: String, + pub exec_main_start_timestamp_monotonic: u64, + pub service_type: String, + pub restart_policy: String, + pub kill_mode: String, + pub dynamic_user: bool, + pub systemd_user: String, + pub systemd_group: String, + pub supplementary_groups: String, + pub capability_bounding_set: String, + pub ambient_capabilities: String, + pub private_mounts: bool, + pub private_pids: bool, + pub protect_proc: String, + pub proc_subset: String, + pub no_new_privileges: bool, + pub umask: String, + pub inaccessible_paths: String, + pub load_credential: String, + pub main_pid: u32, + pub process_start_time: u64, + pub process_uids: [u32; 4], + pub process_gids: [u32; 4], + pub process_groups: Vec, + pub process_cap_inheritable: u64, + pub process_cap_permitted: u64, + pub process_cap_effective: u64, + pub process_cap_bounding: u64, + pub process_cap_ambient: u64, + pub process_no_new_privileges: bool, + pub process_namespace_pids: Vec, + pub mount_namespace_id: u64, + pub pid_namespace_id: u64, + pub executable: PathBuf, + pub executable_device: u64, + pub executable_inode: u64, + pub executable_sha256: String, + pub runtime_instance_id: String, + pub working_directory: PathBuf, + pub runtime_bundle: PathBuf, + pub command_line_sha256: String, + pub environment_names: Vec, + pub environment_contract_sha256: String, + pub control_group: String, + pub credentials_directory: Option, + pub parent_only_file_descriptors: Vec, + pub activation_signer_identity_id: String, + pub activation_signer_public_key: Vec, + pub service_credentials: Vec, +} + +#[derive(Clone, Debug, PartialEq, Eq)] +struct LinuxProcessSecurityObservation { + uids: [u32; 4], + gids: [u32; 4], + groups: Vec, + cap_inheritable: u64, + cap_permitted: u64, + cap_effective: u64, + cap_bounding: u64, + cap_ambient: u64, + no_new_privileges: bool, + namespace_pids: Vec, +} + +#[derive(Clone, Debug, PartialEq, Eq)] +struct SystemdUnitObservation { + properties: BTreeMap, + open_files: Vec, +} + +pub trait WorkloadPort { + fn install( + &self, + plan: &CompiledDeploymentPlan, + release: &MaterializedRelease, + ) -> Result; + + fn prepare_activation( + &self, + plan: &CompiledDeploymentPlan, + expected: &IdunnExpectedIncarnationRecord, + launch: IdunnRuntimeActivationLaunch, + ) -> Result; + + fn start_prepared( + &self, + plan: &CompiledDeploymentPlan, + release: &SealedRelease, + installed: &InstalledReleaseObservation, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + ) -> Result; + + fn discard_prepared( + &self, + plan: &CompiledDeploymentPlan, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + ) -> Result<()>; + + fn observe( + &self, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + prior: &WorkloadObservation, + ) -> Result; + + fn stop(&self, observation: &WorkloadObservation) -> Result<()>; +} + +pub trait TopologyPort { + fn publish_expected( + &self, + expected: &IdunnExpectedIncarnationRecord, + provider_anchor: &ServiceIdentityTrustAnchor, + ) -> Result; + fn withdraw_expected( + &self, + expected: &IdunnExpectedIncarnationRecord, + provider_anchor: &ServiceIdentityTrustAnchor, + activation: Option<&IdunnRuntimeActivationRecord>, + lease: Option<&IdunnProcessWriteLeaseRecord>, + ) -> Result<()>; + fn publish_observed_activation( + &self, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + observation: &WorkloadObservation, + ) -> Result; + fn publish_process_write_lease( + &self, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + lease: &IdunnProcessWriteLeaseRecord, + ) -> Result; + fn withdraw_process_write_lease( + &self, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + lease: Option<&IdunnProcessWriteLeaseRecord>, + ) -> Result<()>; + fn receive(&self, target: &str) -> Result>; +} + +#[derive(Clone, Debug, PartialEq, Eq)] +pub struct ReceivedOdinTopologyCorrelation { + pub target: String, + pub canonical_bytes: Vec, +} + +pub trait WriteLeasePort { + fn revoke_exact(&self, incumbent: Option<&IdunnProcessWriteLeaseRecord>) -> Result<()>; + fn observe_empty(&self) -> Result; + fn observe_exact(&self, lease: &IdunnProcessWriteLeaseRecord) -> Result; + fn grant( + &self, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + warming: &SequenceAdmittedWarming, + lease: &IdunnProcessWriteLeaseRecord, + ) -> Result; + fn observe( + &self, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + warming: &SequenceAdmittedWarming, + lease: &IdunnProcessWriteLeaseRecord, + ) -> Result; +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +pub struct RouteObservation { + pub route_id: String, + pub runtime_instance_id: String, + pub membership_sha256: String, + pub signed_presence_sha256: String, + pub observed_at_unix_millis: u64, +} + +impl RouteObservation { + pub fn validate(&self) -> Result<()> { + require_driver_id(&self.route_id, "route observation")?; + require_sha256_id(&self.runtime_instance_id, "route runtime instance")?; + require_sha256_id(&self.membership_sha256, "route membership")?; + require_sha256_id(&self.signed_presence_sha256, "route signed presence")?; + ensure!( + self.observed_at_unix_millis > 0, + "route observation has no trusted receipt time" + ); + Ok(()) + } +} + +#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] +pub struct RoutePreflightReceipt { + pub route_id: String, + pub candidate_runtime_instance_id: String, + pub candidate_membership_sha256: String, + pub incumbent_runtime_instance_id: Option, + pub incumbent_membership_sha256: Option, + pub incumbent_configuration: Option>, +} + +#[derive(Clone, Debug, PartialEq, Eq)] +pub struct RouteSnapshotResponse { + pub message_id: String, + pub canonical_presence: Vec, +} + +const ROUTE_SNAPSHOT_TIMEOUT: Duration = Duration::from_secs(3); +const ROUTE_SNAPSHOT_MAX_BYTES: usize = 1024 * 1024; +const ROUTE_HTTP_MAX_HEADER_BYTES: usize = 32 * 1024; +const ROUTE_HTTP_SNAPSHOT_PATH: &str = "/cultnet/snapshot"; + +impl RoutePreflightReceipt { + pub fn validate(&self) -> Result<()> { + require_driver_id(&self.route_id, "route preflight")?; + require_sha256_id( + &self.candidate_runtime_instance_id, + "candidate route runtime instance", + )?; + require_sha256_id( + &self.candidate_membership_sha256, + "candidate route membership", + )?; + match ( + &self.incumbent_runtime_instance_id, + &self.incumbent_membership_sha256, + &self.incumbent_configuration, + ) { + (None, None, None) => {} + (Some(runtime), Some(membership), Some(configuration)) => { + require_sha256_id(runtime, "incumbent route runtime instance")?; + require_sha256_id(membership, "incumbent route membership")?; + ensure!( + !configuration.is_empty(), + "incumbent route configuration is empty" + ); + ensure!( + sha256_id(configuration) == *membership, + "incumbent route configuration differs from its membership digest" + ); + } + _ => bail!("incumbent route preflight evidence is partial"), + } + Ok(()) + } +} + +/// Fixed-argv Git source driver. It never interprets recipe text as a command +/// and never derives source policy from the target repository. The configured +/// identity performs every Git/network read; root Idunn extracts only exact Git +/// object archives into a separate transaction-owned immutable store. +pub struct GitSourceDriver { + pub source_cache_root: PathBuf, + pub frozen_source_root: PathBuf, + pub identity: Option, + pub git_program: PathBuf, + pub tar_program: PathBuf, +} + +impl GitSourceDriver { + pub fn new( + source_cache_root: impl Into, + frozen_source_root: impl Into, + identity: Option, + ) -> Self { + Self { + source_cache_root: source_cache_root.into(), + frozen_source_root: frozen_source_root.into(), + identity, + git_program: PathBuf::from("/usr/bin/git"), + tar_program: PathBuf::from("/usr/bin/tar"), + } + } + + fn git_command(&self, args: I) -> Result + where + I: IntoIterator, + S: AsRef, + { + ensure!( + self.git_program.is_absolute(), + "Git source driver program is not absolute" + ); + let mut command = Command::new(&self.git_program); + command + .args(args) + .stdin(Stdio::null()) + .env_clear() + .env("HOME", self.source_cache_root.join(".home")) + .env("PATH", "/usr/bin:/bin") + .env("GIT_CONFIG_NOSYSTEM", "1") + .env("GIT_TERMINAL_PROMPT", "0") + .env("LANG", "C.UTF-8"); + apply_identity(&mut command, self.identity)?; + Ok(command) + } + + fn git(&self, args: I) -> Result + where + I: IntoIterator, + S: AsRef, + { + let output = self.git_command(args)?.output().with_context(|| { + format!( + "starting fixed-argv Git driver {}", + self.git_program.display() + ) + })?; + if !output.status.success() { + bail!( + "Git source driver exited with {}: {}", + output.status, + String::from_utf8_lossy(&output.stderr).trim() + ); + } + Ok(output) + } + + fn git_text(&self, args: I) -> Result + where + I: IntoIterator, + S: AsRef, + { + let output = self.git(args)?; + let value = String::from_utf8(output.stdout).context("Git emitted non-UTF-8 text")?; + Ok(value.trim().to_owned()) + } + + fn ensure_checkout(&self, binding: &OperatorBinding) -> Result<()> { + let checkout = &binding.repository.checkout; + if !checkout.exists() { + self.git([ + OsString::from("clone"), + OsString::from("--filter=blob:none"), + OsString::from("--no-checkout"), + OsString::from("--origin"), + OsString::from("origin"), + binding.repository.origin.clone().into(), + checkout.as_os_str().to_owned(), + ])?; + } + let checkout_metadata = fs::symlink_metadata(checkout) + .with_context(|| format!("inspecting source checkout {}", checkout.display()))?; + ensure!( + checkout_metadata.is_dir() && !checkout_metadata.file_type().is_symlink(), + "source checkout is not a native directory" + ); + let canonical_checkout = checkout.canonicalize()?; + ensure!( + canonical_checkout == *checkout, + "source checkout traverses a symlink or noncanonical path" + ); + let git_metadata = fs::symlink_metadata(checkout.join(".git"))?; + ensure!( + git_metadata.is_dir() && !git_metadata.file_type().is_symlink(), + "source checkout has no native Git object directory" + ); + let actual_origin = self.git_text([ + OsString::from("-C"), + checkout.as_os_str().to_owned(), + OsString::from("remote"), + OsString::from("get-url"), + OsString::from("origin"), + ])?; + ensure!( + actual_origin == binding.repository.origin, + "source checkout origin differs from the operator binding" + ); + Ok(()) + } + + fn admitted_ref_name(binding: &OperatorBinding, resolution_id: &str) -> Result { + require_driver_id(resolution_id, "source resolution")?; + Ok(format!( + "refs/idunn/resolutions/{}/{}", + binding.target, resolution_id + )) + } + + fn resolve_selected_revision( + &self, + binding: &OperatorBinding, + admitted_ref_revision: &str, + ) -> Result<(String, SourceSelection)> { + let checkout = &binding.repository.checkout; + let (revision, selection) = match binding.repository.selection { + SourceSelectionPolicy::PinnedObject => ( + binding + .repository + .pinned_revision + .clone() + .context("pinned source binding lost its exact revision")?, + SourceSelection::PinnedObject, + ), + SourceSelectionPolicy::RefHead => { + (admitted_ref_revision.to_owned(), SourceSelection::RefHead) + } + SourceSelectionPolicy::SignedRelease => { + bail!("signed-release selection requires a release-authority source port") + } + }; + require_git_sha(&revision, "selected source revision")?; + self.git([ + OsString::from("-C"), + checkout.as_os_str().to_owned(), + OsString::from("merge-base"), + OsString::from("--is-ancestor"), + binding.repository.minimum_revision.clone().into(), + revision.clone().into(), + ]) + .context("selected source is below the operator minimum revision")?; + self.git([ + OsString::from("-C"), + checkout.as_os_str().to_owned(), + OsString::from("merge-base"), + OsString::from("--is-ancestor"), + revision.clone().into(), + admitted_ref_revision.into(), + ]) + .context("selected source is outside the fetched admitted ref")?; + Ok((revision, selection)) + } + + fn git_tree_entries(&self, repository: &Path, revision: &str) -> Result> { + let output = self + .git([ + OsString::from("-C"), + repository.as_os_str().to_owned(), + OsString::from("ls-tree"), + OsString::from("-r"), + OsString::from("-z"), + revision.into(), + ])? + .stdout; + let mut entries = Vec::new(); + for record in output + .split(|byte| *byte == 0) + .filter(|record| !record.is_empty()) + { + let tab = record + .iter() + .position(|byte| *byte == b'\t') + .context("Git tree record has no path delimiter")?; + let header = std::str::from_utf8(&record[..tab]) + .context("Git tree record header is not UTF-8")?; + let path = + std::str::from_utf8(&record[tab + 1..]).context("Git tree path is not UTF-8")?; + let mut fields = header.split(' '); + let mode = fields.next().context("Git tree record has no mode")?; + let kind = fields.next().context("Git tree record has no kind")?; + let object = fields.next().context("Git tree record has no object")?; + ensure!(fields.next().is_none(), "Git tree record has extra fields"); + require_git_sha(object, "Git tree object")?; + let path = PathBuf::from(path); + let normalized = normalized_relative(&path)?; + ensure!( + normalized == path.to_string_lossy(), + "Git tree path is not normalized" + ); + ensure!( + path.components().all(|component| !matches!( + component, + std::path::Component::Normal(value) if value == ".git" + )), + "Git tree contains forbidden .git metadata" + ); + entries.push(GitTreeEntry { + mode: mode.to_owned(), + kind: kind.to_owned(), + object: object.to_owned(), + path, + }); + } + entries.sort_by(|left, right| left.path.cmp(&right.path)); + ensure!( + entries.windows(2).all(|pair| pair[0].path != pair[1].path), + "Git tree emits a path twice" + ); + Ok(entries) + } + + fn exact_recipe_and_gitlinks( + &self, + binding: &OperatorBinding, + revision: &str, + ) -> Result<(Vec, BTreeMap)> { + let entries = self.git_tree_entries(&binding.repository.checkout, revision)?; + let recipe = entries + .iter() + .find(|entry| entry.path == binding.repository.recipe_path) + .context("selected tree has no deployment recipe")?; + ensure!( + matches!(recipe.mode.as_str(), "100644" | "100755") && recipe.kind == "blob", + "deployment recipe is not a regular Git blob" + ); + let recipe_bytes = self + .git([ + OsString::from("-C"), + binding.repository.checkout.as_os_str().to_owned(), + OsString::from("cat-file"), + OsString::from("blob"), + recipe.object.clone().into(), + ])? + .stdout; + ensure!( + !recipe_bytes.is_empty(), + "selected deployment recipe is empty" + ); + + let observed_gitlinks = entries + .iter() + .filter(|entry| entry.mode == "160000") + .map(|entry| { + ensure!(entry.kind == "commit", "Gitlink has the wrong object kind"); + Ok((entry.path.clone(), entry.object.clone())) + }) + .collect::>>()?; + let expected_paths = binding + .repository + .gitlinks + .keys() + .cloned() + .collect::>(); + let observed_paths = observed_gitlinks + .keys() + .cloned() + .collect::>(); + ensure!( + observed_paths == expected_paths, + "selected tree Gitlinks do not exactly match operator bindings" + ); + let gitlinks = observed_gitlinks + .into_iter() + .map(|(path, revision)| { + let origin = binding.repository.gitlinks[&path].origin.clone(); + (path, GitlinkTreeFact { origin, revision }) + }) + .collect(); + Ok((recipe_bytes, gitlinks)) + } + + fn prepare_source_root(&self, binding: &OperatorBinding) -> Result<()> { + #[cfg(unix)] + ensure!( + unsafe { libc::geteuid() } != 0 || self.identity.is_some(), + "root Idunn must configure an unprivileged source identity" + ); + ensure!( + binding + .repository + .checkout + .starts_with(&self.source_cache_root) + && binding.repository.checkout != self.source_cache_root, + "repository checkout is outside Idunn's source authority root" + ); + ensure_source_directory(&self.source_cache_root, self.identity)?; + ensure!( + self.source_cache_root.canonicalize()? == self.source_cache_root, + "source cache root traverses a symlink or noncanonical path" + ); + ensure_source_directory(&self.source_cache_root.join(".home"), self.identity)?; + ensure_source_directory_tree( + &self.source_cache_root, + binding + .repository + .checkout + .parent() + .context("repository checkout has no parent directory")?, + self.identity, + )?; + self.ensure_checkout(binding) + } + + fn verify_exact_source( + &self, + binding: &OperatorBinding, + resolved: &ResolvedSource, + ) -> Result<()> { + let actual_tree = self.git_text([ + OsString::from("-C"), + binding.repository.checkout.as_os_str().to_owned(), + OsString::from("rev-parse"), + OsString::from(format!("{}^{{tree}}", resolved.facts.revision)), + ])?; + ensure!( + actual_tree == resolved.facts.source_tree, + "selected revision no longer resolves to the frozen source tree" + ); + let (recipe_bytes, gitlinks) = + self.exact_recipe_and_gitlinks(binding, &resolved.facts.revision)?; + ensure!( + recipe_bytes == resolved.recipe_bytes, + "selected recipe object differs from the durable source resolution" + ); + ensure!( + gitlinks == resolved.facts.gitlinks, + "Gitlinks differ from the durable source resolution" + ); + Ok(()) + } + + fn git_archive_into( + &self, + repository: &Path, + revision: &str, + prefix: Option<&Path>, + destination: &Path, + ) -> Result<()> { + ensure!( + self.tar_program.is_absolute(), + "source archive extractor is not absolute" + ); + let mut archive_args = vec![ + OsString::from("-C"), + repository.as_os_str().to_owned(), + OsString::from("archive"), + OsString::from("--format=tar"), + ]; + if let Some(prefix) = prefix { + archive_args.push(OsString::from(format!( + "--prefix={}/", + normalized_relative(prefix)? + ))); + } + archive_args.push(revision.into()); + let mut archive = self.git_command(archive_args)?; + archive.stdout(Stdio::piped()).stderr(Stdio::piped()); + let mut archive = archive.spawn().context("starting exact Git archive")?; + let archive_stdout = archive.stdout.take().context("Git archive has no stdout")?; + let mut extractor = Command::new(&self.tar_program); + extractor + .args([ + OsString::from("--extract"), + OsString::from("--file=-"), + OsString::from("--directory"), + destination.as_os_str().to_owned(), + OsString::from("--no-same-owner"), + ]) + .stdin(Stdio::from(archive_stdout)) + .stdout(Stdio::null()) + .stderr(Stdio::piped()) + .env_clear() + .env("LANG", "C.UTF-8"); + let extractor = extractor + .spawn() + .context("starting fixed-argv source archive extractor")?; + let archive_output = archive + .wait_with_output() + .context("waiting for exact Git archive")?; + let extractor_output = extractor + .wait_with_output() + .context("waiting for source archive extractor")?; + ensure!( + archive_output.status.success(), + "Git archive failed: {}", + String::from_utf8_lossy(&archive_output.stderr).trim() + ); + ensure!( + extractor_output.status.success(), + "source archive extraction failed: {}", + String::from_utf8_lossy(&extractor_output.stderr).trim() + ); + Ok(()) + } + + fn materialize_gitlink_archive( + &self, + binding: &OperatorBinding, + path: &Path, + fact: &GitlinkTreeFact, + destination: &Path, + ) -> Result<()> { + let gitlink_root = self + .source_cache_root + .join(".gitlinks") + .join(&binding.target); + ensure_source_directory_tree(&self.source_cache_root, &gitlink_root, self.identity)?; + let checkout = gitlink_root.join(format!("{}-{}", fact.revision, Uuid::new_v4())); + let result = (|| { + self.git([ + OsString::from("clone"), + OsString::from("--filter=blob:none"), + OsString::from("--no-checkout"), + OsString::from("--origin"), + OsString::from("origin"), + fact.origin.clone().into(), + checkout.as_os_str().to_owned(), + ])?; + self.git([ + OsString::from("-C"), + checkout.as_os_str().to_owned(), + OsString::from("fetch"), + OsString::from("--no-tags"), + OsString::from("origin"), + fact.revision.clone().into(), + ])?; + let actual = self.git_text([ + OsString::from("-C"), + checkout.as_os_str().to_owned(), + OsString::from("rev-parse"), + OsString::from(format!("{}^{{commit}}", fact.revision)), + ])?; + ensure!(actual == fact.revision, "Gitlink exact revision is absent"); + ensure!( + !self + .git_tree_entries(&checkout, &fact.revision)? + .iter() + .any(|entry| entry.mode == "160000"), + "nested Gitlinks are not admitted in Idunn v1" + ); + self.git_archive_into(&checkout, &fact.revision, Some(path), destination) + })(); + let cleanup = if checkout.exists() { + remove_tree_inside(&gitlink_root, &checkout) + } else { + Ok(()) + }; + match (result, cleanup) { + (Ok(()), Ok(())) => Ok(()), + (Err(error), _) => Err(error), + (Ok(()), Err(error)) => Err(error.context("cleaning exact Gitlink checkout")), + } + } +} + +impl SourcePort for GitSourceDriver { + fn resolve( + &self, + binding: &OperatorBinding, + resolution_id: &str, + selected_at_unix_millis: u64, + ) -> Result { + binding.validate()?; + ensure!( + selected_at_unix_millis > 0, + "source selection has no timestamp" + ); + self.prepare_source_root(binding)?; + let fetched_ref = Self::admitted_ref_name(binding, resolution_id)?; + self.git([ + OsString::from("-C"), + binding.repository.checkout.as_os_str().to_owned(), + OsString::from("fetch"), + OsString::from("--force"), + OsString::from("--no-tags"), + OsString::from("origin"), + OsString::from(format!( + "+{}:{fetched_ref}", + binding.repository.admitted_ref + )), + ])?; + let admitted_ref_revision = self.git_text([ + OsString::from("-C"), + binding.repository.checkout.as_os_str().to_owned(), + OsString::from("rev-parse"), + OsString::from(format!("{fetched_ref}^{{commit}}")), + ])?; + require_git_sha(&admitted_ref_revision, "fetched admitted-ref revision")?; + let (revision, selection) = + self.resolve_selected_revision(binding, &admitted_ref_revision)?; + let source_tree = self.git_text([ + OsString::from("-C"), + binding.repository.checkout.as_os_str().to_owned(), + OsString::from("rev-parse"), + OsString::from(format!("{revision}^{{tree}}")), + ])?; + require_git_sha(&source_tree, "selected source tree")?; + let (recipe_bytes, gitlinks) = self.exact_recipe_and_gitlinks(binding, &revision)?; + let facts = SourceSelectionFacts { + schema: SOURCE_SELECTION_FACTS_SCHEMA.into(), + origin: binding.repository.origin.clone(), + admitted_ref: binding.repository.admitted_ref.clone(), + admitted_ref_revision, + revision, + source_tree, + recipe_path: binding.repository.recipe_path.clone(), + recipe_blob_sha256: sha256_id(&recipe_bytes), + gitlinks, + selection, + selected_at_unix_millis, + }; + facts.validate_against(binding)?; + let resolved = ResolvedSource { + facts, + recipe_bytes, + }; + resolved.validate_against(binding)?; + Ok(resolved) + } + + fn freeze( + &self, + transaction_id: &str, + plan: &CompiledDeploymentPlan, + ) -> Result { + plan.validate()?; + require_driver_id(transaction_id, "source transaction")?; + let (_, binding) = plan.parsed_inputs()?; + let resolved = ResolvedSource { + facts: plan.source.clone(), + recipe_bytes: plan.recipe_blob.clone(), + }; + resolved.validate_against(&binding)?; + #[cfg(unix)] + ensure!( + unsafe { libc::geteuid() } == 0 && self.identity.is_some(), + "freezing source requires root Idunn with an unprivileged Git identity" + ); + self.prepare_source_root(&binding)?; + self.git([ + OsString::from("-C"), + binding.repository.checkout.as_os_str().to_owned(), + OsString::from("fetch"), + OsString::from("--no-tags"), + OsString::from("origin"), + resolved.facts.revision.clone().into(), + ]) + .context("fetching the durable exact source revision")?; + self.verify_exact_source(&binding, &resolved)?; + let transaction_root = + prepare_frozen_transaction_root(&self.frozen_source_root, transaction_id)?; + let partial = transaction_root.join(".partial"); + prepare_frozen_source_destination(&partial)?; + let materialization = (|| { + self.git_archive_into( + &binding.repository.checkout, + &resolved.facts.revision, + None, + &partial, + )?; + for (path, fact) in &resolved.facts.gitlinks { + self.materialize_gitlink_archive(&binding, path, fact, &partial)?; + } + let recipe_path = partial.join(&resolved.facts.recipe_path); + let recipe_metadata = fs::symlink_metadata(&recipe_path)?; + ensure!( + recipe_metadata.is_file() && !recipe_metadata.file_type().is_symlink(), + "frozen deployment recipe is not a regular file" + ); + let materialized_recipe = + fs::read(&recipe_path).context("reading frozen deployment recipe")?; + ensure!( + materialized_recipe == resolved.recipe_bytes, + "frozen recipe differs from the durable source resolution" + ); + harden_frozen_source(&partial)?; + validate_frozen_source(&partial)?; + frozen_source_sha256(&partial) + })(); + let snapshot_sha256 = match materialization { + Ok(snapshot_sha256) => snapshot_sha256, + Err(error) => { + let _ = remove_frozen_transaction_root(&self.frozen_source_root, transaction_id); + return Err(error); + } + }; + let snapshot_component = snapshot_sha256 + .strip_prefix("sha256-") + .expect("generated frozen source digest"); + let final_root = transaction_root.join(snapshot_component); + fs::rename(&partial, &final_root).context("publishing immutable frozen source")?; + #[cfg(unix)] + { + use std::os::unix::fs::PermissionsExt; + fs::set_permissions(&transaction_root, fs::Permissions::from_mode(0o500))?; + } + let receipt = FrozenSourceReceipt { + transaction_id: transaction_id.to_owned(), + plan_id: plan.plan_id.clone(), + snapshot_sha256, + }; + receipt.validate_against(plan)?; + Ok(receipt) + } + + fn observe_frozen( + &self, + plan: &CompiledDeploymentPlan, + receipt: &FrozenSourceReceipt, + ) -> Result { + receipt.validate_against(plan)?; + validate_frozen_source_store(&self.frozen_source_root)?; + let root = self + .frozen_source_root + .join(&receipt.transaction_id) + .join(receipt.snapshot_component()); + let canonical_store = self.frozen_source_root.canonicalize()?; + let canonical_root = root.canonicalize()?; + ensure!( + canonical_store == self.frozen_source_root + && canonical_root == root + && canonical_root.starts_with(&canonical_store), + "frozen source receipt resolves outside its authority root" + ); + validate_frozen_source(&root)?; + ensure!( + frozen_source_sha256(&root)? == receipt.snapshot_sha256, + "frozen source snapshot differs from its receipt" + ); + let recipe_path = root.join(&plan.source.recipe_path); + let recipe_metadata = fs::symlink_metadata(&recipe_path)?; + ensure!( + recipe_metadata.is_file() && !recipe_metadata.file_type().is_symlink(), + "observed deployment recipe is not a regular file" + ); + ensure!( + fs::read(&recipe_path)? == plan.recipe_blob, + "observed deployment recipe differs from the persisted plan" + ); + Ok(FrozenSource { + receipt: receipt.clone(), + facts: plan.source.clone(), + recipe_bytes: plan.recipe_blob.clone(), + root, + }) + } + + fn cleanup(&self, transaction_id: &str, receipt: Option<&FrozenSourceReceipt>) -> Result<()> { + require_driver_id(transaction_id, "source transaction")?; + if let Some(receipt) = receipt { + ensure!( + receipt.transaction_id == transaction_id, + "frozen source cleanup receipt belongs to another transaction" + ); + require_sha256_id(&receipt.snapshot_sha256, "frozen source snapshot")?; + } + let transaction_root = self.frozen_source_root.join(transaction_id); + if !transaction_root.exists() { + return Ok(()); + } + remove_frozen_transaction_root(&self.frozen_source_root, transaction_id) + } +} + +/// Docker is only a runner substrate. Recipe argv stays an argv vector, the +/// operator binding selects the exact image/network/mount affordances, and the +/// driver returns complete materialization receipts rather than build truth by +/// convention. +pub struct DockerRunnerDriver { + pub docker_program: PathBuf, +} + +impl Default for DockerRunnerDriver { + fn default() -> Self { + Self { + docker_program: PathBuf::from("/usr/bin/docker"), + } + } +} + +impl DockerRunnerDriver { + fn docker(&self, args: I) -> Result + where + I: IntoIterator, + S: AsRef, + { + ensure!( + self.docker_program.is_absolute(), + "Docker runner program is not absolute" + ); + let output = Command::new(&self.docker_program) + .args(args) + .stdin(Stdio::null()) + .output() + .with_context(|| format!("starting Docker runner {}", self.docker_program.display()))?; + if !output.status.success() { + bail!( + "Docker runner exited with {}: {}", + output.status, + String::from_utf8_lossy(&output.stderr).trim() + ); + } + Ok(output) + } + + fn run_in_workspace( + &self, + runner: &RunnerBinding, + workspace: &Path, + working_directory: &Path, + argv: &[String], + required_environment: &std::collections::BTreeSet, + source_stamp: (&str, &str), + ) -> Result<()> { + ensure!(!argv.is_empty(), "runner command is empty"); + ensure!( + runner.allowed_programs.contains(&argv[0]), + "runner program {} is not operator-bound", + argv[0] + ); + let mut args = self.base_run_args(runner, workspace)?; + args.extend([ + OsString::from("--workdir"), + OsString::from(format!( + "/workspace/{}", + normalized_relative(working_directory)? + )), + OsString::from("--env"), + OsString::from(format!("{}={}", source_stamp.0, source_stamp.1)), + ]); + for name in required_environment { + if let Some(value) = runner.environment.get(name) { + args.push(OsString::from("--env")); + args.push(OsString::from(format!("{name}={value}"))); + } else if let Some(path) = runner.secret_files.get(name) { + validate_runner_secret(path, container_identity(&runner.user)?)?; + args.push(OsString::from("--env")); + args.push(OsString::from(format!("{name}=/run/idunn/secrets/{name}"))); + args.push(OsString::from("--mount")); + args.push(bind_mount( + path, + &format!("/run/idunn/secrets/{name}"), + true, + )?); + } else { + bail!("runner lacks declared step environment {name}") + } + } + args.push(runner.image.clone().into()); + args.extend(argv.iter().map(OsString::from)); + self.docker(args)?; + Ok(()) + } + + fn base_run_args(&self, runner: &RunnerBinding, workspace: &Path) -> Result> { + let identity = container_identity(&runner.user)?; + let mut args = vec![ + OsString::from("run"), + OsString::from("--rm"), + OsString::from("--network"), + OsString::from(runner.network_profile.as_deref().unwrap_or("none")), + OsString::from("--memory"), + OsString::from(format!("{}m", runner.memory_mebibytes)), + OsString::from("--cpus"), + OsString::from(format!( + "{:.2}", + f64::from(runner.cpu_quota_percent) / 100.0 + )), + OsString::from("--mount"), + bind_mount(workspace, "/workspace", false)?, + OsString::from("--user"), + OsString::from(&runner.user), + OsString::from("--cap-drop"), + OsString::from("ALL"), + OsString::from("--security-opt"), + OsString::from("no-new-privileges"), + OsString::from("--read-only"), + OsString::from("--pids-limit"), + OsString::from(runner.pids_limit.to_string()), + OsString::from("--tmpfs"), + OsString::from(format!( + "/tmp:rw,nosuid,nodev,noexec,size={}m", + runner.tmpfs_mebibytes + )), + ]; + if let Some(cache_root) = &runner.cache_root { + ensure_runner_cache_root(cache_root, identity)?; + args.push(OsString::from("--mount")); + args.push(bind_mount(cache_root, "/cache", false)?); + } + Ok(args) + } + + fn materialize_external_input( + &self, + declaration: &TargetDeclaration, + binding: &OperatorBinding, + workspaces: &BTreeMap, + input_id: &str, + ) -> Result { + let input = declaration + .external_inputs + .iter() + .find(|candidate| candidate.id == input_id) + .context("external input declaration disappeared")?; + let runner = &binding.runners[&input.runner]; + let workspace = &workspaces[&input.runner]; + let destination = workspace.join(&input.destination); + ensure!( + destination.starts_with(workspace), + "external input escaped its runner workspace" + ); + if let Some(parent) = destination.parent() { + fs::create_dir_all(parent)?; + } + let mut args = self.base_run_args(runner, workspace)?; + args.extend([ + runner.image.clone().into(), + OsString::from("curl"), + OsString::from("--fail"), + OsString::from("--location"), + OsString::from("--proto"), + OsString::from("=https"), + OsString::from("--output"), + OsString::from(format!( + "/workspace/{}", + normalized_relative(&input.destination)? + )), + input.url.clone().into(), + ]); + self.docker(args)?; + let bytes = fs::read(&destination).with_context(|| { + format!( + "reading materialized external input {}", + destination.display() + ) + })?; + ensure!(!bytes.is_empty(), "materialized external input is empty"); + let digest = raw_sha256(&bytes); + ensure!( + digest == input.sha256, + "materialized external input digest differs from its recipe pin" + ); + Ok(ExternalInputMaterializationReceipt { + input_id: input.id.clone(), + url: input.url.clone(), + sha256: format!("sha256-{digest}"), + runner: input.runner.clone(), + destination: input.destination.clone(), + size_bytes: bytes.len().try_into()?, + }) + } + + fn collect_artifact( + &self, + declaration: &TargetDeclaration, + source: &FrozenSource, + workspaces: &BTreeMap, + staging_root: &Path, + artifact_id: &str, + ) -> Result { + let artifact = declaration + .artifacts + .iter() + .find(|candidate| candidate.id == artifact_id) + .context("artifact declaration disappeared")?; + let source_path = match artifact.source_kind { + ArtifactSource::RunnerOutput => workspaces + .get( + artifact + .runner + .as_deref() + .context("runner artifact lost its runner")?, + ) + .context("runner workspace is absent")? + .join(&artifact.source), + ArtifactSource::WorktreeTree => source.root.join(&artifact.source), + }; + ensure!(source_path.exists(), "declared artifact output is absent"); + let destination = staging_root.join(&artifact.destination); + ensure!( + destination.starts_with(staging_root), + "artifact destination escaped its release staging root" + ); + copy_artifact(&source_path, &destination)?; + let (sha256, size_bytes) = digest_artifact(&destination)?; + if let Some(expected) = &artifact.expected_sha256 { + ensure!( + &sha256 == expected, + "artifact output differs from its recipe-pinned digest" + ); + } + Ok(ArtifactReceipt { + artifact_id: artifact.id.clone(), + destination: artifact.destination.clone(), + sha256: format!("sha256-{sha256}"), + size_bytes, + executable: artifact.executable, + }) + } +} + +impl RunnerPort for DockerRunnerDriver { + fn materialize( + &self, + source: &FrozenSource, + plan: &CompiledDeploymentPlan, + staging_parent: &Path, + sealed_at_unix_millis: u64, + ) -> Result { + plan.validate()?; + source.receipt.validate_against(plan)?; + ensure!( + source.facts == plan.source && source.recipe_bytes == plan.recipe_blob, + "runner source differs from the compiled plan" + ); + let (declaration, binding) = plan.parsed_inputs()?; + fs::create_dir_all(staging_parent)?; + let staging_root = staging_parent.join(&source.receipt.transaction_id); + if staging_root.exists() { + remove_tree_inside(staging_parent, &staging_root)?; + } + fs::create_dir_all(&staging_root)?; + + let mut workspaces = BTreeMap::new(); + for runner_id in binding.runners.keys() { + let workspace = staging_root.join(format!(".runner-{runner_id}")); + copy_tree(&source.root, &workspace)?; + workspaces.insert(runner_id.clone(), workspace); + } + + for input in &declaration.external_inputs { + let workspace = &workspaces[&input.runner]; + let destination = workspace.join(&input.destination); + ensure!( + destination.starts_with(workspace), + "external input escaped its runner workspace" + ); + if let Some(parent) = destination.parent() { + fs::create_dir_all(parent)?; + } + } + for (runner_id, workspace) in &workspaces { + assign_runner_tree( + workspace, + container_identity(&binding.runners[runner_id].user)?, + )?; + } + + let mut external_inputs = Vec::new(); + for input in &declaration.external_inputs { + external_inputs.push(self.materialize_external_input( + &declaration, + &binding, + &workspaces, + &input.id, + )?); + } + for step in &declaration.steps { + let runner = &binding.runners[&step.runner]; + let workspace = &workspaces[&step.runner]; + for required in &step.required_environment { + ensure!( + runner.environment.contains_key(required) + || runner.secret_files.contains_key(required), + "step {} lacks operator-bound environment {required}", + step.id + ); + } + self.run_in_workspace( + runner, + workspace, + &step.working_directory, + &step.argv, + &step.required_environment, + ( + &declaration.source_stamp_environment, + &source.facts.revision, + ), + )?; + } + + let mut artifacts = Vec::new(); + for artifact in &declaration.artifacts { + artifacts.push(self.collect_artifact( + &declaration, + source, + &workspaces, + &staging_root, + &artifact.id, + )?); + } + for workspace in workspaces.values() { + remove_tree_inside(&staging_root, workspace)?; + } + let release = SealedRelease::new( + plan, + artifacts.clone(), + external_inputs.clone(), + sealed_at_unix_millis, + )?; + Ok(MaterializedRelease { + release, + root: staging_root, + }) + } +} + +/// systemd owns process execution. This driver lowers one validated launch +/// contract into a transient unit and then proves the native process and +/// executable that systemd actually started. It does not decide admission, +/// readiness, write authority, or route membership. +pub struct SystemdTransientWorkloadDriver { + pub systemd_run_program: PathBuf, + pub systemctl_program: PathBuf, + pub proc_root: PathBuf, + pub credential_root: PathBuf, +} + +impl Default for SystemdTransientWorkloadDriver { + fn default() -> Self { + Self { + systemd_run_program: PathBuf::from("/usr/bin/systemd-run"), + systemctl_program: PathBuf::from("/usr/bin/systemctl"), + proc_root: PathBuf::from("/proc"), + credential_root: PathBuf::from("/run/idunn/activation-credentials"), + } + } +} + +impl SystemdTransientWorkloadDriver { + fn command(&self, program: &Path, args: I) -> Result + where + I: IntoIterator, + S: AsRef, + { + ensure!( + program.is_absolute(), + "workload actuator program is not absolute" + ); + let output = Command::new(program) + .args(args) + .stdin(Stdio::null()) + .env_clear() + .env("LANG", "C.UTF-8") + .output() + .with_context(|| format!("starting workload actuator {}", program.display()))?; + if !output.status.success() { + bail!( + "workload actuator {} exited with {}: {}", + program.display(), + output.status, + String::from_utf8_lossy(&output.stderr).trim() + ); + } + Ok(output) + } + + fn unit_name(&self, prefix: &str, runtime_instance_id: &str) -> Result { + let suffix = runtime_instance_id + .strip_prefix("sha256-") + .context("runtime instance id has no sha256 prefix")?; + ensure!( + suffix.len() == 64 && suffix.bytes().all(|byte| byte.is_ascii_hexdigit()), + "runtime instance id is not a SHA-256 digest" + ); + Ok(format!("{prefix}-{suffix}.service")) + } + + fn activation_credential_source( + &self, + activation: &IdunnRuntimeActivationRecord, + ) -> Result { + activation.validate()?; + ensure!( + self.credential_root.is_absolute() + && !self + .credential_root + .as_os_str() + .to_string_lossy() + .chars() + .any(char::is_whitespace), + "activation credential root must be an absolute path without whitespace" + ); + Ok(self + .credential_root + .join(format!("{}.credential", activation.runtime_instance_id))) + } + + fn write_activation_credential( + &self, + launch: IdunnRuntimeActivationLaunch, + ) -> Result<(IdunnRuntimeActivationRecord, PathBuf)> { + #[cfg(unix)] + use std::os::unix::fs::{OpenOptionsExt, PermissionsExt}; + + ensure_activation_credential_root(&self.credential_root)?; + let expected_activation = launch.activation().clone(); + let source = self.activation_credential_source(&expected_activation)?; + let mut options = OpenOptions::new(); + options.write(true).create_new(true); + #[cfg(unix)] + options.mode(0o400); + let mut file = options.open(&source).with_context(|| { + format!( + "creating one-shot activation credential {}", + source.display() + ) + })?; + let written = (|| -> Result { + #[cfg(unix)] + file.set_permissions(fs::Permissions::from_mode(0o400))?; + let activation = launch + .write_credential(&mut file) + .context("writing one-shot activation credential")?; + file.flush()?; + file.sync_all()?; + Ok(activation) + })(); + drop(file); + let activation = match written { + Ok(activation) => activation, + Err(error) => { + return match remove_activation_credential_source(&source) { + Ok(()) => Err(error), + Err(cleanup) => Err(error.context(format!( + "deleting incomplete activation credential also failed: {cleanup:#}" + ))), + }; + } + }; + let validation = (|| -> Result<()> { + ensure!( + activation == expected_activation, + "activation launch changed while writing its credential" + ); + validate_activation_credential_source(&source)?; + sync_parent_directory(&source) + })(); + if let Err(error) = validation { + return match remove_activation_credential_source(&source) { + Ok(()) => Err(error), + Err(cleanup) => Err(error.context(format!( + "deleting invalid activation credential also failed: {cleanup:#}" + ))), + }; + } + Ok((activation, source)) + } + + fn validate_prepared_activation_credential( + &self, + activation: &IdunnRuntimeActivationRecord, + source: &Path, + ) -> Result<()> { + validate_activation_credential_source(source)?; + let signer = IdunnRuntimeActivationSigner::from_credential_reader( + open_native_read_only(source).with_context(|| { + format!( + "opening prepared activation credential {}", + source.display() + ) + })?, + )?; + ensure!( + signer.identity_id() == activation.activation_signer_identity_id + && signer.public_key() == activation.activation_signer_public_key, + "prepared activation credential differs from the persisted activation" + ); + Ok(()) + } + + fn parent_only_file_descriptors( + &self, + binding: &OperatorBinding, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + ) -> Result> { + let activation_source = self.activation_credential_source(activation)?; + self.validate_prepared_activation_credential(activation, &activation_source)?; + let presence_source = binding + .workload + .secret_files + .get(RUNTIME_PRESENCE_IDENTITY_BINDING) + .context("workload has no parent-only runtime presence identity source")?; + let presence_signer = + open_service_identity_credential_reader::( + open_native_read_only(presence_source).with_context(|| { + format!( + "opening runtime presence identity source {}", + presence_source.display() + ) + })?, + )?; + ensure!( + presence_signer.entry().identity_id == expected.expected_signer_identity_id, + "runtime presence identity source differs from Expected" + ); + let descriptors = vec![ + observe_parent_only_file_descriptor( + 3, + IDUNN_RUNTIME_ACTIVATION_CREDENTIAL_NAME, + &activation_source, + )?, + observe_parent_only_file_descriptor( + 4, + RUNTIME_PRESENCE_IDENTITY_FD_NAME, + presence_source, + )?, + ]; + parent_only_open_file_properties(&descriptors)?; + Ok(descriptors) + } + + fn stop_submitted_unit(&self, unit: &str, expected_description: &str) -> Result<()> { + let Some(observation) = self.show_unit(unit)? else { + return Ok(()); + }; + let values = &observation.properties; + ensure!( + values.get("Description").map(String::as_str) == Some(expected_description), + "refusing to stop a submitted unit whose description changed" + ); + self.command( + &self.systemctl_program, + [OsString::from("stop"), OsString::from(unit)], + )?; + if let Some(observation) = self.show_unit(unit)? { + let values = &observation.properties; + ensure!( + values + .get("ActiveState") + .is_some_and(|state| { matches!(state.as_str(), "inactive" | "failed") }), + "submitted systemd unit remained active after stop" + ); + } + Ok(()) + } + + fn install_release( + &self, + plan: &CompiledDeploymentPlan, + release: &MaterializedRelease, + ) -> Result { + release.release.validate_against(plan)?; + let (_, binding) = plan.parsed_inputs()?; + let release_root = &binding.workload.release_root; + fs::create_dir_all(release_root) + .with_context(|| format!("creating release root {}", release_root.display()))?; + let installed = release_root.join(&release.release.sealed_release_id); + if !installed.exists() { + let temporary = release_root.join(format!( + ".install-{}-{}", + release.release.sealed_release_id, + Uuid::new_v4() + )); + copy_tree(&release.root, &temporary)?; + if let Err(error) = fs::rename(&temporary, &installed) { + let cleanup = remove_tree_inside(release_root, &temporary); + if installed.exists() && error.kind() == ErrorKind::AlreadyExists { + cleanup?; + } else { + cleanup?; + return Err(error).with_context(|| { + format!("installing sealed release {}", installed.display()) + }); + } + } + } + for artifact in &release.release.artifacts { + let path = installed.join(&artifact.destination); + let (sha256, size_bytes) = digest_artifact(&path)?; + ensure!( + format!("sha256-{sha256}") == artifact.sha256 && size_bytes == artifact.size_bytes, + "installed artifact {} differs from its sealed receipt", + artifact.artifact_id + ); + } + harden_installed_release(&installed, &release.release.artifacts)?; + Ok(InstalledReleaseObservation { + sealed_release_id: release.release.sealed_release_id.clone(), + root: installed, + }) + } + + fn validate_installed_release( + &self, + plan: &CompiledDeploymentPlan, + release: &SealedRelease, + installed: &InstalledReleaseObservation, + ) -> Result<()> { + release.validate_against(plan)?; + let (_, binding) = plan.parsed_inputs()?; + ensure!( + installed.sealed_release_id == release.sealed_release_id + && installed.root + == binding + .workload + .release_root + .join(&release.sealed_release_id), + "installed release observation belongs to another sealed release" + ); + for artifact in &release.artifacts { + let path = installed.root.join(&artifact.destination); + let (sha256, size_bytes) = digest_artifact(&path)?; + ensure!( + format!("sha256-{sha256}") == artifact.sha256 && size_bytes == artifact.size_bytes, + "installed artifact {} differs from its sealed receipt", + artifact.artifact_id + ); + } + harden_installed_release(&installed.root, &release.artifacts) + } + + fn prepare_runtime_bundle( + &self, + binding: &OperatorBinding, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + ) -> Result { + let bundle = binding + .workload + .runtime_root + .join(&activation.runtime_instance_id); + fs::create_dir_all(&bundle) + .with_context(|| format!("creating runtime bundle {}", bundle.display()))?; + write_immutable_record( + &bundle.join("expected.cc"), + CultCacheEnvelope { + key: expected.target.clone(), + r#type: IdunnExpectedIncarnationRecord::TYPE.into(), + payload: expected.canonical_bytes()?, + stored_at: rfc3339_millis(activation.issued_at_unix_millis)?, + schema_id: Some(IDUNN_EXPECTED_INCARNATION_SCHEMA.into()), + }, + )?; + write_immutable_record( + &bundle.join("activation.cc"), + CultCacheEnvelope { + key: expected.target.clone(), + r#type: IdunnRuntimeActivationRecord::TYPE.into(), + payload: activation.canonical_bytes()?, + stored_at: rfc3339_millis(activation.issued_at_unix_millis)?, + schema_id: Some(IDUNN_RUNTIME_ACTIVATION_SCHEMA.into()), + }, + )?; + harden_runtime_bundle(&bundle)?; + Ok(bundle) + } + + fn show_unit(&self, unit: &str) -> Result> { + ensure!( + self.systemctl_program.is_absolute(), + "systemctl program is not absolute" + ); + let output = Command::new(&self.systemctl_program) + .args([ + OsString::from("show"), + OsString::from(unit), + OsString::from("--no-pager"), + OsString::from("--property=LoadState"), + OsString::from("--property=ActiveState"), + OsString::from("--property=SubState"), + OsString::from("--property=Description"), + OsString::from("--property=InvocationID"), + OsString::from("--property=MainPID"), + OsString::from("--property=ExecMainStartTimestampMonotonic"), + OsString::from("--property=Type"), + OsString::from("--property=Restart"), + OsString::from("--property=KillMode"), + OsString::from("--property=DynamicUser"), + OsString::from("--property=User"), + OsString::from("--property=Group"), + OsString::from("--property=SupplementaryGroups"), + OsString::from("--property=CapabilityBoundingSet"), + OsString::from("--property=AmbientCapabilities"), + OsString::from("--property=PrivateMounts"), + OsString::from("--property=PrivatePIDs"), + OsString::from("--property=ProtectProc"), + OsString::from("--property=ProcSubset"), + OsString::from("--property=NoNewPrivileges"), + OsString::from("--property=UMask"), + OsString::from("--property=InaccessiblePaths"), + OsString::from("--property=LoadCredential"), + OsString::from("--property=OpenFile"), + OsString::from("--property=WorkingDirectory"), + OsString::from("--property=ControlGroup"), + ]) + .stdin(Stdio::null()) + .env_clear() + .env("LANG", "C.UTF-8") + .output() + .with_context(|| format!("observing systemd unit {unit}"))?; + let text = + std::str::from_utf8(&output.stdout).context("systemd show output is not UTF-8")?; + let mut values = BTreeMap::new(); + let mut open_files = Vec::new(); + for line in text.lines().filter(|line| !line.is_empty()) { + let (name, value) = line + .split_once('=') + .context("systemd show output is malformed")?; + if name == "OpenFile" { + open_files.push(value.to_owned()); + continue; + } + ensure!( + values.insert(name.to_owned(), value.to_owned()).is_none(), + "systemd show property is duplicated" + ); + } + if values + .get("LoadState") + .is_some_and(|value| value == "not-found") + { + return Ok(None); + } + ensure!( + output.status.success(), + "systemd show failed for {unit}: {}", + String::from_utf8_lossy(&output.stderr).trim() + ); + Ok(Some(SystemdUnitObservation { + properties: values, + open_files, + })) + } + + fn observe_unit( + &self, + unit: &str, + expected_executable: &Path, + runtime_instance_id: &str, + activation_signer_identity_id: &str, + activation_signer_public_key: &[u8], + environment_names: &[String], + service_credential_names: &[String], + parent_only_file_descriptors: &[ParentOnlyFileDescriptorObservation], + ) -> Result { + ensure!( + service_credential_names + .windows(2) + .all(|pair| pair[0] < pair[1]), + "service credential names are not unique and sorted" + ); + let unit_observation = self + .show_unit(unit)? + .with_context(|| format!("systemd unit {unit} is absent"))?; + let values = &unit_observation.properties; + ensure!( + unit_observation.open_files + == parent_only_open_file_properties(parent_only_file_descriptors)?, + "systemd parent-only descriptor contract differs from the Idunn launch" + ); + ensure!( + values + .get("ActiveState") + .is_some_and(|value| value == "active") + && values + .get("SubState") + .is_some_and(|value| value == "running"), + "systemd unit {unit} is not running" + ); + let invocation_id = values + .get("InvocationID") + .filter(|value| value.len() == 32 && value.bytes().all(|byte| byte.is_ascii_hexdigit())) + .context("systemd unit has no canonical invocation id")? + .clone(); + let exec_main_start_timestamp_monotonic = + required_systemd_property(&values, "ExecMainStartTimestampMonotonic")? + .parse::() + .context("systemd unit has no numeric main-process start timestamp")?; + ensure!( + exec_main_start_timestamp_monotonic > 0, + "systemd unit has no main-process start timestamp" + ); + let unit_description = required_systemd_property(&values, "Description")?.to_owned(); + let service_type = required_systemd_property(&values, "Type")?.to_owned(); + let restart_policy = required_systemd_property(&values, "Restart")?.to_owned(); + let kill_mode = required_systemd_property(&values, "KillMode")?.to_owned(); + let dynamic_user = parse_systemd_boolean(&values, "DynamicUser")?; + let systemd_user = systemd_property(&values, "User")?.to_owned(); + let systemd_group = systemd_property(&values, "Group")?.to_owned(); + let supplementary_groups = systemd_property(&values, "SupplementaryGroups")?.to_owned(); + let capability_bounding_set = + systemd_property(&values, "CapabilityBoundingSet")?.to_owned(); + let ambient_capabilities = systemd_property(&values, "AmbientCapabilities")?.to_owned(); + let private_mounts = parse_systemd_boolean(&values, "PrivateMounts")?; + let private_pids = parse_systemd_boolean(&values, "PrivatePIDs")?; + let protect_proc = required_systemd_property(&values, "ProtectProc")?.to_owned(); + let proc_subset = required_systemd_property(&values, "ProcSubset")?.to_owned(); + let no_new_privileges = parse_systemd_boolean(&values, "NoNewPrivileges")?; + let umask = required_systemd_property(&values, "UMask")?.to_owned(); + let inaccessible_paths = + required_systemd_property(&values, "InaccessiblePaths")?.to_owned(); + let load_credential = required_systemd_property(&values, "LoadCredential")?.to_owned(); + ensure!( + service_type == "exec" + && restart_policy == "no" + && kill_mode == "mixed" + && dynamic_user + && systemd_user.is_empty() + && supplementary_groups.is_empty() + && capability_bounding_set.is_empty() + && ambient_capabilities.is_empty() + && private_mounts + && private_pids + && protect_proc == "invisible" + && proc_subset == "all" + && no_new_privileges + && umask == "0007" + && inaccessible_paths == self.credential_root.display().to_string() + && load_credential + == if service_credential_names.is_empty() { + "" + } else { + "[unprintable]" + }, + "systemd workload isolation properties differ from the Idunn contract" + ); + let working_directory = + PathBuf::from(required_systemd_property(&values, "WorkingDirectory")?); + ensure!( + working_directory.is_absolute(), + "systemd unit working directory is not absolute" + ); + let control_group = required_systemd_property(&values, "ControlGroup")?.to_owned(); + ensure!( + control_group.starts_with('/') && !control_group.contains(['\n', '\r', '\0']), + "systemd unit control group is invalid" + ); + let main_pid: u32 = values + .get("MainPID") + .context("systemd unit has no MainPID")? + .parse() + .context("systemd MainPID is not a u32")?; + ensure!(main_pid > 0, "systemd unit has no live main process"); + let process_root = self.proc_root.join(main_pid.to_string()); + let process_executable = process_root.join("exe"); + let executable = fs::read_link(&process_executable) + .with_context(|| format!("observing executable for process {main_pid}"))?; + let mut executable_file = open_proc_magic_link(&process_executable)?; + let executable_metadata = executable_file.metadata()?; + let expected_executable_metadata = fs::metadata(expected_executable)?; + #[cfg(unix)] + let (executable_device, executable_inode) = { + use std::os::unix::fs::MetadataExt; + ensure!( + executable_metadata.is_file() + && executable_metadata.dev() == expected_executable_metadata.dev() + && executable_metadata.ino() == expected_executable_metadata.ino(), + "systemd started an executable inode outside the sealed release" + ); + (executable_metadata.dev(), executable_metadata.ino()) + }; + #[cfg(not(unix))] + let (executable_device, executable_inode) = (0, 0); + ensure!( + fs::canonicalize(&executable)? == fs::canonicalize(expected_executable)?, + "systemd started an executable outside the sealed release" + ); + let executable_sha256 = sha256_reader(&mut executable_file)?; + let process_start_time = linux_process_start_time(&process_root.join("stat"))?; + let process_security = linux_process_security(&process_root.join("status"), main_pid)?; + ensure!( + process_security + .uids + .iter() + .all(|uid| *uid == process_security.uids[0]) + && (61_184..=65_519).contains(&process_security.uids[0]), + "systemd workload does not have one unprivileged process uid" + ); + ensure!( + process_security + .gids + .iter() + .all(|gid| *gid == process_security.gids[0]) + && process_security.gids[0] > 0 + && process_security + .groups + .iter() + .all(|gid| *gid == process_security.gids[0]), + "systemd workload has foreign supplementary groups" + ); + ensure!( + [ + process_security.cap_inheritable, + process_security.cap_permitted, + process_security.cap_effective, + process_security.cap_bounding, + process_security.cap_ambient, + ] + .iter() + .all(|capabilities| *capabilities == 0), + "systemd workload retained Linux capabilities" + ); + ensure!( + process_security.no_new_privileges, + "systemd workload lacks kernel no-new-privileges enforcement" + ); + ensure!( + process_security.namespace_pids.len() >= 2 + && process_security.namespace_pids[0] == main_pid + && process_security.namespace_pids.last() == Some(&1) + && process_security.namespace_pids.iter().all(|pid| *pid > 0), + "systemd workload is not observed in a private pid namespace" + ); + let mount_namespace_id = linux_namespace_id(&process_root.join("ns/mnt"), "mnt")?; + let pid_namespace_id = linux_namespace_id(&process_root.join("ns/pid"), "pid")?; + let observer_mount_namespace_id = + linux_namespace_id(&self.proc_root.join("self/ns/mnt"), "mnt")?; + let observer_pid_namespace_id = + linux_namespace_id(&self.proc_root.join("self/ns/pid"), "pid")?; + ensure!( + mount_namespace_id != observer_mount_namespace_id + && pid_namespace_id != observer_pid_namespace_id, + "systemd workload did not receive private mount and pid namespaces" + ); + let process_control_groups = fs::read_to_string(process_root.join("cgroup"))?; + let process_control_groups = process_control_groups.lines().collect::>(); + ensure!( + process_control_groups.len() == 1 + && process_control_groups[0] == format!("0::{control_group}"), + "systemd MainPID is outside the unit control group" + ); + let command_line = fs::read(process_root.join("cmdline"))?; + ensure!( + !command_line.is_empty(), + "systemd MainPID has no command line" + ); + let process_environment = read_process_environment(&process_root.join("environ"))?; + let selected_environment = + select_process_environment(&process_environment, environment_names)?; + let runtime_bundle = PathBuf::from( + selected_environment + .get(IDUNN_RUNTIME_BUNDLE_ENVIRONMENT) + .context("systemd MainPID lacks the Idunn runtime bundle environment")?, + ); + ensure!( + runtime_bundle.is_absolute(), + "runtime bundle path is not absolute" + ); + let credentials_directory = if service_credential_names.is_empty() { + ensure!( + !process_environment + .iter() + .any(|entry| entry.starts_with(b"CREDENTIALS_DIRECTORY=")), + "systemd MainPID exposed an unowned credential directory" + ); + None + } else { + let path = PathBuf::from(required_process_environment_value( + &process_environment, + "CREDENTIALS_DIRECTORY", + )?); + ensure!( + path == Path::new("/run/credentials").join(unit), + "systemd MainPID exposed an unexpected credential directory" + ); + Some(path) + }; + let activation_descriptor = &parent_only_file_descriptors[0]; + ensure!( + activation_descriptor.fd_name == IDUNN_RUNTIME_ACTIVATION_CREDENTIAL_NAME + && activation_descriptor.size == 32 + && activation_descriptor.uid == 0 + && activation_descriptor.gid == 0 + && activation_descriptor.mode == 0o400 + && activation_descriptor.links == 1, + "activation signing descriptor is not exact root-only source material" + ); + let mut service_credentials = Vec::new(); + for name in service_credential_names { + let delivered_path = credentials_directory + .as_ref() + .context("service credential has no systemd credential directory")? + .join(name); + let delivered_value = delivered_path.display().to_string(); + ensure!( + selected_environment.get(name) == Some(&delivered_value), + "workload secret environment does not name its delivered systemd credential" + ); + let observer_path = + path_inside_process_root(&process_root.join("root"), &delivered_path)?; + let mut file = open_native_read_only(&observer_path).with_context(|| { + format!( + "opening delivered service credential {}", + delivered_path.display() + ) + })?; + let metadata = file.metadata()?; + #[cfg(unix)] + let (device, inode, uid, gid, mode, links) = { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + ( + metadata.dev(), + metadata.ino(), + metadata.uid(), + metadata.gid(), + metadata.permissions().mode() & 0o777, + metadata.nlink(), + ) + }; + #[cfg(not(unix))] + let (device, inode, uid, gid, mode, links) = (0, 0, 0, 0, 0, 0); + ensure!( + metadata.is_file() + && metadata.len() > 0 + && links == 1 + && uid == process_security.uids[0] + && gid == process_security.gids[0] + && mode == 0o400, + "delivered service credential is not readable only by the workload identity" + ); + service_credentials.push(ServiceCredentialObservation { + environment_name: name.clone(), + delivered_path, + device, + inode, + uid, + gid, + mode, + size: metadata.len(), + sha256: sha256_reader(&mut file)?, + }); + } + let final_values = self + .show_unit(unit)? + .with_context(|| format!("systemd unit {unit} vanished during observation"))?; + ensure!( + final_values == unit_observation + && linux_process_start_time(&process_root.join("stat"))? == process_start_time, + "systemd workload identity changed during native observation" + ); + Ok(WorkloadObservation { + unit: unit.to_owned(), + unit_description, + invocation_id, + exec_main_start_timestamp_monotonic, + service_type, + restart_policy, + kill_mode, + dynamic_user, + systemd_user, + systemd_group, + supplementary_groups, + capability_bounding_set, + ambient_capabilities, + private_mounts, + private_pids, + protect_proc, + proc_subset, + no_new_privileges, + umask, + inaccessible_paths, + load_credential, + main_pid, + process_start_time, + process_uids: process_security.uids, + process_gids: process_security.gids, + process_groups: process_security.groups, + process_cap_inheritable: process_security.cap_inheritable, + process_cap_permitted: process_security.cap_permitted, + process_cap_effective: process_security.cap_effective, + process_cap_bounding: process_security.cap_bounding, + process_cap_ambient: process_security.cap_ambient, + process_no_new_privileges: process_security.no_new_privileges, + process_namespace_pids: process_security.namespace_pids, + mount_namespace_id, + pid_namespace_id, + executable, + executable_device, + executable_inode, + executable_sha256, + runtime_instance_id: runtime_instance_id.to_owned(), + working_directory, + runtime_bundle, + command_line_sha256: sha256_id(&command_line), + environment_names: environment_names.to_vec(), + environment_contract_sha256: sha256_id(&rmp_serde::to_vec(&selected_environment)?), + control_group, + credentials_directory, + parent_only_file_descriptors: parent_only_file_descriptors.to_vec(), + activation_signer_identity_id: activation_signer_identity_id.to_owned(), + activation_signer_public_key: activation_signer_public_key.to_vec(), + service_credentials, + }) + } + + fn launch_command( + &self, + declaration: &TargetDeclaration, + binding: &OperatorBinding, + installed: &Path, + ) -> Result> { + let executable_artifact = + release_artifact(declaration, &declaration.service.executable_artifact)?; + let executable = installed.join(&executable_artifact.destination); + ensure!(executable.is_file(), "sealed service executable is absent"); + let mut command = vec![executable.into_os_string()]; + for argument in &declaration.service.arguments { + command.push(match argument { + LaunchArgument::Literal { value } => value.into(), + LaunchArgument::Binding { name } => { + binding.workload.argument_bindings[name].clone().into() + } + }); + } + Ok(command) + } + + fn launch_environment( + &self, + binding: &OperatorBinding, + bundle: &Path, + expected: &IdunnExpectedIncarnationRecord, + unit: &str, + ) -> Result> { + let mut environment = binding.workload.environment.clone(); + let credentials_directory = Path::new("/run/credentials").join(unit); + for name in binding + .workload + .secret_files + .keys() + .filter(|name| name.as_str() != RUNTIME_PRESENCE_IDENTITY_BINDING) + { + ensure!( + environment + .insert( + name.clone(), + credentials_directory.join(name).display().to_string(), + ) + .is_none(), + "workload environment and secret bindings collide" + ); + } + ensure!( + environment + .insert( + IDUNN_RUNTIME_BUNDLE_ENVIRONMENT.into(), + bundle.display().to_string(), + ) + .is_none(), + "operator binding attempts to replace the Idunn runtime bundle" + ); + match &expected.route { + Some(route) => { + let (host, port) = endpoint_host_port( + &route.candidate_endpoint, + &format!("{}://", route.transport), + )?; + ensure!( + environment + .insert( + IDUNN_RUNTIME_CANDIDATE_BIND_ENVIRONMENT.into(), + format!("{host}:{port}"), + ) + .is_none(), + "operator binding attempts to replace the Idunn candidate bind" + ); + } + None => ensure!( + !environment.contains_key(IDUNN_RUNTIME_CANDIDATE_BIND_ENVIRONMENT), + "unrouted workload carries an Idunn candidate bind" + ), + } + match &binding.process_write_lease { + Some(write_lease) => ensure!( + environment + .insert( + IDUNN_PROCESS_WRITE_LEASE_ENVIRONMENT.into(), + write_lease.record_path.display().to_string(), + ) + .is_none(), + "operator binding attempts to replace the Idunn process write lease" + ), + None => ensure!( + !environment.contains_key(IDUNN_PROCESS_WRITE_LEASE_ENVIRONMENT), + "stateless workload carries an Idunn process write lease" + ), + } + Ok(environment) + } + + fn validate_launch_observation( + &self, + observation: &WorkloadObservation, + declaration: &TargetDeclaration, + binding: &OperatorBinding, + installed: &Path, + bundle: &Path, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + ) -> Result<()> { + let command = self.launch_command(declaration, binding, installed)?; + let environment = self.launch_environment(binding, bundle, expected, &observation.unit)?; + let environment_names = environment.keys().cloned().collect::>(); + let expected_description = format!( + "Idunn {} {}", + binding.target, + bundle + .file_name() + .context("runtime bundle has no instance id")? + .to_string_lossy() + ); + ensure!( + observation.unit.ends_with(".service"), + "workload unit has no service suffix" + ); + let expected_group = binding.workload.state_group.as_deref(); + let expected_group_id = expected_group.map(resolve_group_id).transpose()?; + let regular_credential_names = binding + .workload + .secret_files + .keys() + .filter(|name| name.as_str() != RUNTIME_PRESENCE_IDENTITY_BINDING) + .cloned() + .collect::>(); + let expected_credentials_directory = (!regular_credential_names.is_empty()) + .then(|| Path::new("/run/credentials").join(&observation.unit)); + let descriptor_properties = + parent_only_open_file_properties(&observation.parent_only_file_descriptors)?; + let activation_source = self.activation_credential_source(activation)?; + let presence_source = binding + .workload + .secret_files + .get(RUNTIME_PRESENCE_IDENTITY_BINDING) + .context("workload has no parent-only runtime presence identity source")?; + let observed_credential_names = observation + .service_credentials + .iter() + .map(|credential| credential.environment_name.clone()) + .collect::>(); + ensure!( + observation.unit_description == expected_description + && observation.service_type == "exec" + && observation.restart_policy == "no" + && observation.kill_mode == "mixed" + && observation.dynamic_user + && observation.systemd_user.is_empty() + && match expected_group { + Some(group) => observation.systemd_group == group, + None => observation.systemd_group.is_empty(), + } + && observation.supplementary_groups.is_empty() + && observation.capability_bounding_set.is_empty() + && observation.ambient_capabilities.is_empty() + && observation.private_mounts + && observation.private_pids + && observation.protect_proc == "invisible" + && observation.proc_subset == "all" + && observation.no_new_privileges + && observation.umask == "0007" + && observation.inaccessible_paths == self.credential_root.display().to_string() + && observation.load_credential + == if regular_credential_names.is_empty() { + "" + } else { + "[unprintable]" + } + && observation.working_directory == installed + && observation.runtime_bundle == bundle + && observation.credentials_directory == expected_credentials_directory + && observation.command_line_sha256 == sha256_id(&proc_command_line(&command)) + && observation.environment_names == environment_names + && observation.environment_contract_sha256 + == sha256_id(&rmp_serde::to_vec(&environment)?) + && descriptor_properties.len() == 2 + && observation.parent_only_file_descriptors[0].source_path == activation_source + && observation.parent_only_file_descriptors[0].size == 32 + && observation.parent_only_file_descriptors[1].source_path == *presence_source + && observation.activation_signer_identity_id + == activation.activation_signer_identity_id + && observation.activation_signer_public_key + == activation.activation_signer_public_key + && observed_credential_names == regular_credential_names + && match expected_group_id { + Some(group_id) => observation.process_gids[0] == group_id, + None => observation.process_gids[0] == observation.process_uids[0], + }, + "running workload launch contract differs from the admitted launch" + ); + ensure!( + Path::new(&observation.control_group).file_name() + == Some(OsStr::new(&observation.unit)), + "running workload control group belongs to another unit" + ); + Ok(()) + } + + fn validate_writable_bindings(&self, binding: &OperatorBinding) -> Result<()> { + let Some(state_group) = binding.workload.state_group.as_deref() else { + ensure!( + binding.workload.state_root.is_none() + && binding.workload.read_write_paths.is_empty(), + "dynamic workload writable paths have no fixed state group" + ); + return Ok(()); + }; + let state_group_id = resolve_group_id(state_group)?; + if let Some(state_root) = &binding.workload.state_root { + validate_workload_writable_path(state_root, state_group_id, true)?; + } + for path in &binding.workload.read_write_paths { + validate_workload_writable_path(path, state_group_id, false)?; + } + Ok(()) + } + + fn start_transient( + &self, + declaration: &TargetDeclaration, + binding: &OperatorBinding, + installed: &Path, + bundle: &Path, + expected: &IdunnExpectedIncarnationRecord, + parent_only_file_descriptors: &[ParentOnlyFileDescriptorObservation], + unit: &str, + ) -> Result<()> { + ensure!( + declaration + .service + .required_environment + .contains(IDUNN_RUNTIME_BUNDLE_ENVIRONMENT), + "target does not declare the standard Idunn runtime bundle" + ); + ensure!( + !binding + .workload + .environment + .contains_key(IDUNN_RUNTIME_BUNDLE_ENVIRONMENT) + && !binding + .workload + .secret_files + .contains_key(IDUNN_RUNTIME_BUNDLE_ENVIRONMENT), + "operator binding attempts to replace the Idunn runtime bundle" + ); + validate_service_credential_sources(&binding.workload.secret_files)?; + let parent_only_open_files = + parent_only_open_file_properties(parent_only_file_descriptors)?; + let environment = self.launch_environment(binding, bundle, expected, unit)?; + let executable_artifact = + release_artifact(declaration, &declaration.service.executable_artifact)?; + let executable = installed.join(&executable_artifact.destination); + ensure!(executable.is_file(), "sealed service executable is absent"); + let unit_description = format!( + "Idunn {} {}", + binding.target, + bundle + .file_name() + .context("runtime bundle has no instance id")? + .to_string_lossy() + ); + let mut args = vec![ + OsString::from("--no-block"), + OsString::from("--no-ask-password"), + OsString::from("--expand-environment=no"), + OsString::from(format!("--unit={unit}")), + OsString::from("--property=Type=exec"), + OsString::from("--property=Restart=no"), + OsString::from("--property=KillMode=mixed"), + OsString::from("--property=DynamicUser=yes"), + OsString::from("--property=SupplementaryGroups="), + OsString::from("--property=CapabilityBoundingSet="), + OsString::from("--property=AmbientCapabilities="), + OsString::from("--property=NoNewPrivileges=yes"), + OsString::from("--property=PrivateMounts=yes"), + OsString::from("--property=PrivatePIDs=yes"), + OsString::from("--property=ProtectProc=invisible"), + OsString::from("--property=ProcSubset=all"), + OsString::from("--property=PrivateTmp=yes"), + OsString::from("--property=ProtectSystem=strict"), + OsString::from("--property=ProtectHome=yes"), + OsString::from("--property=ProtectControlGroups=yes"), + OsString::from("--property=ProtectKernelModules=yes"), + OsString::from("--property=ProtectKernelTunables=yes"), + OsString::from("--property=RestrictSUIDSGID=yes"), + OsString::from("--property=LockPersonality=yes"), + OsString::from("--property=UMask=0007"), + OsString::from(format!("--property=Description={unit_description}")), + OsString::from(format!( + "--property=InaccessiblePaths={}", + self.credential_root.display() + )), + OsString::from(format!( + "--property=MemoryMax={}M", + binding.workload.memory_mebibytes + )), + OsString::from(format!( + "--property=CPUQuota={}%", + binding.workload.cpu_quota_percent + )), + OsString::from(format!("--working-directory={}", installed.display())), + OsString::from(format!("--property=ReadOnlyPaths={}", installed.display())), + OsString::from(format!("--property=ReadOnlyPaths={}", bundle.display())), + ]; + for open_file in parent_only_open_files { + args.push(OsString::from(format!("--property=OpenFile={open_file}"))); + } + if let Some(state_group) = &binding.workload.state_group { + args.push(OsString::from(format!("--property=Group={state_group}"))); + } + if binding.workload.network == WorkloadNetwork::None { + args.push(OsString::from("--property=PrivateNetwork=yes")); + } + if let Some(state_root) = &binding.workload.state_root { + args.push(OsString::from(format!( + "--property=ReadWritePaths={}", + state_root.display() + ))); + } + if let Some(write_lease) = &binding.process_write_lease { + for path in [write_lease.record_path.clone(), write_lease.lock_path()] { + args.push(OsString::from(format!( + "--property=ReadOnlyPaths=-{}", + path.display() + ))); + } + } + for path in &binding.workload.read_only_paths { + args.push(OsString::from(format!( + "--property=ReadOnlyPaths={}", + path.display() + ))); + } + for path in &binding.workload.read_write_paths { + args.push(OsString::from(format!( + "--property=ReadWritePaths={}", + path.display() + ))); + } + if binding.workload.devices.is_empty() { + args.push(OsString::from("--property=PrivateDevices=yes")); + } else { + args.push(OsString::from("--property=DevicePolicy=closed")); + for device in &binding.workload.devices { + args.push(OsString::from(format!( + "--property=DeviceAllow={} rw", + device.display() + ))); + } + } + for (name, value) in environment { + args.push(OsString::from(format!("--setenv={name}={value}"))); + } + for (name, path) in binding + .workload + .secret_files + .iter() + .filter(|(name, _)| name.as_str() != RUNTIME_PRESENCE_IDENTITY_BINDING) + { + args.push(OsString::from(format!( + "--property=LoadCredential={name}:{}", + path.display() + ))); + } + args.extend(self.launch_command(declaration, binding, installed)?); + self.command(&self.systemd_run_program, args)?; + Ok(()) + } +} + +impl WorkloadPort for SystemdTransientWorkloadDriver { + fn install( + &self, + plan: &CompiledDeploymentPlan, + release: &MaterializedRelease, + ) -> Result { + self.install_release(plan, release) + } + + fn prepare_activation( + &self, + plan: &CompiledDeploymentPlan, + expected: &IdunnExpectedIncarnationRecord, + launch: IdunnRuntimeActivationLaunch, + ) -> Result { + plan.validate()?; + expected.validate()?; + let proposed_activation = launch.activation(); + proposed_activation.validate()?; + ensure!( + expected.plan_id == plan.plan_id + && proposed_activation.expected_projection_sha256 == expected.canonical_sha256()?, + "prepared activation does not belong to the deployment plan" + ); + let (_, binding) = plan.parsed_inputs()?; + ensure!( + expected.target == binding.target, + "prepared activation target differs from the operator binding" + ); + let unit = self.unit_name( + &binding.workload.unit_prefix, + &proposed_activation.runtime_instance_id, + )?; + ensure!( + self.show_unit(&unit)?.is_none(), + "refusing to replace prepared activation material while its deterministic unit exists" + ); + ensure_activation_credential_root(&self.credential_root)?; + let source = self.activation_credential_source(proposed_activation)?; + match fs::symlink_metadata(&source) { + Ok(_) => remove_activation_credential_source(&source) + .context("retiring an orphaned pre-persistence activation credential")?, + Err(error) if error.kind() == ErrorKind::NotFound => {} + Err(error) => { + return Err(error).with_context(|| { + format!( + "inspecting pre-persistence activation credential {}", + source.display() + ) + }); + } + } + let (activation, written_source) = self.write_activation_credential(launch)?; + if written_source != source { + let error = + anyhow::anyhow!("prepared activation used a nondeterministic credential path"); + return match remove_activation_credential_source(&written_source) { + Ok(()) => Err(error), + Err(cleanup) => Err(error.context(format!( + "deleting nondeterministic activation credential also failed: {cleanup:#}" + ))), + }; + } + Ok(activation) + } + + fn start_prepared( + &self, + plan: &CompiledDeploymentPlan, + release: &SealedRelease, + installed: &InstalledReleaseObservation, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + ) -> Result { + plan.validate()?; + release.validate_against(plan)?; + self.validate_installed_release(plan, release, installed)?; + expected.validate()?; + activation.validate()?; + ensure!( + expected.plan_id == plan.plan_id + && expected.sealed_release_id == release.sealed_release_id + && activation.expected_projection_sha256 == expected.canonical_sha256()?, + "workload inputs do not describe one sealed incarnation" + ); + let (declaration, binding) = plan.parsed_inputs()?; + self.validate_writable_bindings(&binding)?; + let executable_artifact = + release_artifact(&declaration, &declaration.service.executable_artifact)?; + let executable = installed.root.join(&executable_artifact.destination); + let unit = self.unit_name( + &binding.workload.unit_prefix, + &activation.runtime_instance_id, + )?; + let bundle = self.prepare_runtime_bundle(&binding, expected, activation)?; + let service_credential_names = binding + .workload + .secret_files + .keys() + .filter(|name| name.as_str() != RUNTIME_PRESENCE_IDENTITY_BINDING) + .cloned() + .collect::>(); + let environment_names = self + .launch_environment(&binding, &bundle, expected, &unit)? + .into_keys() + .collect::>(); + let parent_only_file_descriptors = + self.parent_only_file_descriptors(&binding, expected, activation)?; + let unit_exists = self.show_unit(&unit)?.is_some(); + if !unit_exists { + self.start_transient( + &declaration, + &binding, + &installed.root, + &bundle, + expected, + &parent_only_file_descriptors, + &unit, + )?; + } + let mut last_error = None; + for _ in 0..100 { + match self.observe_unit( + &unit, + &executable, + &activation.runtime_instance_id, + &activation.activation_signer_identity_id, + &activation.activation_signer_public_key, + &environment_names, + &service_credential_names, + &parent_only_file_descriptors, + ) { + Ok(observation) => { + let validation = self.validate_launch_observation( + &observation, + &declaration, + &binding, + &installed.root, + &bundle, + expected, + &activation, + ); + match validation.and_then(|()| { + ensure!( + observation.executable_sha256 == expected.artifact_sha256, + "started workload executable differs from Expected" + ); + Ok(()) + }) { + Ok(()) => return Ok(observation), + Err(error) => last_error = Some(error), + } + } + Err(error) => last_error = Some(error), + } + thread::sleep(Duration::from_millis(50)); + } + Err(last_error.unwrap_or_else(|| anyhow::anyhow!("systemd did not expose the candidate"))) + } + + fn discard_prepared( + &self, + plan: &CompiledDeploymentPlan, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + ) -> Result<()> { + plan.validate()?; + expected.validate()?; + activation.validate()?; + ensure!( + expected.plan_id == plan.plan_id + && activation.expected_projection_sha256 == expected.canonical_sha256()?, + "discarded activation does not belong to the prepared deployment" + ); + let (_, binding) = plan.parsed_inputs()?; + ensure!( + binding.target == expected.target, + "discarded activation target differs from its binding" + ); + let unit = self.unit_name( + &binding.workload.unit_prefix, + &activation.runtime_instance_id, + )?; + let unit_description = format!( + "Idunn {} {}", + binding.target, activation.runtime_instance_id + ); + self.stop_submitted_unit(&unit, &unit_description) + .context("stopping prepared candidate without a durable workload observation")?; + remove_activation_credential_source(&self.activation_credential_source(activation)?) + .context("deleting discarded activation credential source") + } + + fn observe( + &self, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + prior: &WorkloadObservation, + ) -> Result { + expected.validate()?; + activation.validate()?; + ensure!( + activation.expected_projection_sha256 == expected.canonical_sha256()? + && activation.runtime_instance_id == prior.runtime_instance_id, + "workload observation belongs to another activation" + ); + let observed = self.observe_unit( + &prior.unit, + &prior.executable, + &activation.runtime_instance_id, + &activation.activation_signer_identity_id, + &activation.activation_signer_public_key, + &prior.environment_names, + &prior + .service_credentials + .iter() + .map(|credential| credential.environment_name.clone()) + .collect::>(), + &prior.parent_only_file_descriptors, + )?; + ensure!( + observed == *prior && observed.executable_sha256 == expected.artifact_sha256, + "native workload identity changed after observation" + ); + let credential_source = self.activation_credential_source(activation)?; + remove_activation_credential_source(&credential_source) + .context("retiring a recovered activation credential source")?; + let after_unlink = self.observe_unit( + &prior.unit, + &prior.executable, + &activation.runtime_instance_id, + &activation.activation_signer_identity_id, + &activation.activation_signer_public_key, + &prior.environment_names, + &prior + .service_credentials + .iter() + .map(|credential| credential.environment_name.clone()) + .collect::>(), + &prior.parent_only_file_descriptors, + )?; + ensure!( + after_unlink == observed, + "native workload identity changed after recovered credential cleanup" + ); + Ok(after_unlink) + } + + fn stop(&self, observation: &WorkloadObservation) -> Result<()> { + let Some(unit_observation) = self.show_unit(&observation.unit)? else { + return Ok(()); + }; + let values = &unit_observation.properties; + let active = required_systemd_property(&values, "ActiveState")?; + let sub = required_systemd_property(&values, "SubState")?; + if active == "active" && sub == "running" { + let current = self.observe_unit( + &observation.unit, + &observation.executable, + &observation.runtime_instance_id, + &observation.activation_signer_identity_id, + &observation.activation_signer_public_key, + &observation.environment_names, + &observation + .service_credentials + .iter() + .map(|credential| credential.environment_name.clone()) + .collect::>(), + &observation.parent_only_file_descriptors, + )?; + ensure!( + current == *observation, + "refusing to stop a workload whose native identity changed" + ); + } else { + ensure!( + values.get("InvocationID") == Some(&observation.invocation_id) + && values.get("Description") == Some(&observation.unit_description) + && matches!(active, "inactive" | "failed"), + "refusing to stop a foreign or transitional systemd unit" + ); + } + self.command( + &self.systemctl_program, + [OsString::from("stop"), OsString::from(&observation.unit)], + )?; + if let Some(unit_observation) = self.show_unit(&observation.unit)? { + let values = &unit_observation.properties; + ensure!( + values + .get("ActiveState") + .is_some_and(|state| state == "inactive" || state == "failed"), + "systemd unit remained active after stop" + ); + } + Ok(()) + } +} + +/// One dedicated CultCache file is the write-lease authority for one target. +/// The admitted target holds its sibling lock shared for that process lifetime. +/// Grant and revocation therefore make one nonblocking CAS attempt; revocation +/// follows an exact incumbent stop. A foreign or stuck holder cannot freeze +/// Idunn's control loop. Route membership never enters this store. +pub struct CultCacheWriteLeaseDriver { + pub target: String, + pub record_path: PathBuf, +} + +impl CultCacheWriteLeaseDriver { + pub fn new(target: impl Into, record_path: impl Into) -> Self { + Self { + target: target.into(), + record_path: record_path.into(), + } + } + + fn current(&self) -> Result> { + validate_root_authority_path(&self.record_path)?; + if !self.record_path.exists() { + return Ok(None); + } + let entries = SingleFileMessagePackBackingStore::new(&self.record_path) + .pull_all_read_only_snapshot()?; + match entries.as_slice() { + [] => Ok(None), + [envelope] + if envelope.r#type == IdunnProcessWriteLeaseRecord::TYPE + && envelope.schema_id.as_deref() == Some(IDUNN_PROCESS_WRITE_LEASE_SCHEMA) => + { + let lease = IdunnProcessWriteLeaseRecord::decode_canonical(&envelope.payload)?; + ensure!( + envelope.key == lease.target, + "write-lease key is not its target" + ); + ensure!( + lease.target == self.target, + "write-lease store belongs to another target" + ); + Ok(Some((envelope.clone(), lease))) + } + _ => bail!("process write-lease store is foreign or ambiguous"), + } + } + + fn envelope(&self, lease: &IdunnProcessWriteLeaseRecord) -> Result { + Ok(CultCacheEnvelope { + key: lease.target.clone(), + r#type: IdunnProcessWriteLeaseRecord::TYPE.into(), + payload: lease.canonical_bytes()?, + stored_at: rfc3339_millis(lease.issued_at_unix_millis)?, + schema_id: Some(IDUNN_PROCESS_WRITE_LEASE_SCHEMA.into()), + }) + } + + fn validate_grant( + &self, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + warming: &SequenceAdmittedWarming, + lease: &IdunnProcessWriteLeaseRecord, + ) -> Result<()> { + expected.validate()?; + activation.validate()?; + lease.validate()?; + let expected_sha256 = expected.canonical_sha256()?; + let activation_sha256 = activation.canonical_sha256()?; + ensure!( + self.target == expected.target + && lease.target == expected.target + && lease.expected_projection_sha256 == expected_sha256 + && lease.plan_id == expected.plan_id + && lease.incarnation_id == expected.incarnation_id + && lease.sealed_release_id == expected.sealed_release_id + && lease.activation_witness_sha256 == activation_sha256 + && lease.runtime_id == expected.runtime_id + && lease.runtime_instance_id == activation.runtime_instance_id + && lease.state_schema_generation + == expected + .state_schema_generation + .as_deref() + .context("write-lease Expected has no state generation")? + && lease.state_contract_sha256 + == expected + .state_contract_sha256 + .as_deref() + .context("write-lease Expected has no state contract")? + && lease.warming_presence_sha256 == warming.signed_presence_sha256() + && warming.runtime_instance_id() == activation.runtime_instance_id.as_str(), + "process write lease does not bind the exact warming candidate" + ); + Ok(()) + } +} + +impl WriteLeasePort for CultCacheWriteLeaseDriver { + fn revoke_exact(&self, incumbent: Option<&IdunnProcessWriteLeaseRecord>) -> Result<()> { + if let Some(incumbent) = incumbent { + incumbent.validate()?; + ensure!( + incumbent.target == self.target, + "incumbent write lease belongs to another target" + ); + } + let current = self.current()?; + let Some((envelope, current_lease)) = current else { + return Ok(()); + }; + ensure!( + incumbent == Some(¤t_lease), + "refusing to revoke an unexpected process write lease" + ); + let store = SingleFileMessagePackBackingStore::new(&self.record_path); + match store.try_compare_exchange_snapshot(std::slice::from_ref(&envelope), &[])? { + TryCompareExchangeSnapshotOutcome::Exchanged => Ok(()), + TryCompareExchangeSnapshotOutcome::Mismatch => { + bail!("process write lease changed while fencing the incumbent") + } + TryCompareExchangeSnapshotOutcome::LockContended => { + bail!("process write lease is held by a shared-lock consumer") + } + } + } + + fn observe_empty(&self) -> Result { + Ok(self.current()?.is_none()) + } + + fn observe_exact(&self, lease: &IdunnProcessWriteLeaseRecord) -> Result { + lease.validate()?; + ensure!( + lease.target == self.target, + "observed process write lease belongs to another target" + ); + Ok(self + .current()? + .is_some_and(|(_, current)| current == *lease)) + } + + fn grant( + &self, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + warming: &SequenceAdmittedWarming, + lease: &IdunnProcessWriteLeaseRecord, + ) -> Result { + self.validate_grant(expected, activation, warming, lease)?; + if let Some((_, current)) = self.current()? { + ensure!( + current == *lease, + "another process already owns the write lease" + ); + harden_root_authority_file(&self.record_path)?; + harden_root_authority_file(&authority_lock_path(&self.record_path))?; + return lease.canonical_sha256(); + } + let envelope = self.envelope(lease)?; + let store = SingleFileMessagePackBackingStore::new(&self.record_path); + match store.try_compare_exchange_snapshot(&[], &[envelope])? { + TryCompareExchangeSnapshotOutcome::Exchanged => {} + TryCompareExchangeSnapshotOutcome::Mismatch => { + bail!("process write-lease grant lost its empty-store compare-exchange") + } + TryCompareExchangeSnapshotOutcome::LockContended => { + bail!("process write lease is held by a shared-lock consumer") + } + } + harden_root_authority_file(&self.record_path)?; + harden_root_authority_file(&authority_lock_path(&self.record_path))?; + lease.canonical_sha256() + } + + fn observe( + &self, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + warming: &SequenceAdmittedWarming, + lease: &IdunnProcessWriteLeaseRecord, + ) -> Result { + self.validate_grant(expected, activation, warming, lease)?; + Ok(self + .current()? + .is_some_and(|(_, current)| current == *lease)) + } +} + +/// Idunn projects desired identity plus its own activation and current-lease +/// facts here. Service presence is absent by construction; only Odin may +/// correlate these records with signed runtime observation into Present/Ready. +pub struct CultCacheTopologyDriver { + pub projection_store: PathBuf, + pub correlation_store: PathBuf, +} + +impl CultCacheTopologyDriver { + /// Atomically demotes a failed pre-fence candidate back to the admitted + /// generation's Expected projection. Runtime activation and write-lease + /// records are deliberately absent until admitted-body supervision proves + /// the physical process and lease again. + pub fn restore_admitted_expected_only( + &self, + failed_expected: &IdunnExpectedIncarnationRecord, + failed_provider_anchor: &ServiceIdentityTrustAnchor, + failed_activation: Option<&IdunnRuntimeActivationRecord>, + admitted_expected: &IdunnExpectedIncarnationRecord, + admitted_provider_anchor: &ServiceIdentityTrustAnchor, + admitted_activation: &IdunnRuntimeActivationRecord, + admitted_lease: Option<&IdunnProcessWriteLeaseRecord>, + ) -> Result { + failed_expected.validate()?; + admitted_expected.validate()?; + ensure!( + failed_expected.target == admitted_expected.target, + "projection restoration crosses deployment targets" + ); + let failed_anchor = runtime_presence_trust_anchor(failed_expected, failed_provider_anchor)?; + let admitted_anchor = + runtime_presence_trust_anchor(admitted_expected, admitted_provider_anchor)?; + if let Some(activation) = failed_activation { + activation.validate()?; + ensure!( + activation.expected_projection_sha256 == failed_expected.canonical_sha256()?, + "failed activation does not bind the failed Expected projection" + ); + } + admitted_activation.validate()?; + ensure!( + admitted_activation.expected_projection_sha256 + == admitted_expected.canonical_sha256()?, + "admitted activation does not bind the admitted Expected projection" + ); + if let Some(lease) = admitted_lease { + validate_topology_lease(admitted_expected, admitted_activation, lease)?; + } + if let Some(parent) = self.projection_store.parent() { + fs::create_dir_all(parent)?; + } + let store = SingleFileMessagePackBackingStore::new(&self.projection_store); + let target = admitted_expected.target.as_str(); + let anchor_key = runtime_presence_trust_anchor_id(target); + for _ in 0..8 { + let entries = store.pull_all_read_only_snapshot()?; + let current_expected = + projection_entry(&entries, IdunnExpectedIncarnationRecord::TYPE, target)?; + if let Some(envelope) = current_expected { + ensure!( + envelope.schema_id.as_deref() == Some(IDUNN_EXPECTED_INCARNATION_SCHEMA), + "restored Expected projection schema is foreign" + ); + let current = IdunnExpectedIncarnationRecord::decode_canonical(&envelope.payload)?; + ensure!( + current == *failed_expected || current == *admitted_expected, + "refusing to replace an unknown Expected projection" + ); + } + let current_anchor = projection_entry( + &entries, + GameCultServiceTrustAnchorRecord::TYPE, + &anchor_key, + )?; + if let Some(envelope) = current_anchor { + let current = service_trust_anchor_from_envelope(envelope)?; + ensure!( + current == failed_anchor || current == admitted_anchor, + "refusing to replace an unknown runtime presence trust anchor" + ); + } + let current_activation = + projection_entry(&entries, IdunnRuntimeActivationRecord::TYPE, target)?; + if let Some(envelope) = current_activation { + ensure!( + envelope.schema_id.as_deref() == Some(IDUNN_RUNTIME_ACTIVATION_SCHEMA), + "restored activation projection schema is foreign" + ); + let current = IdunnRuntimeActivationRecord::decode_canonical(&envelope.payload)?; + ensure!( + failed_activation == Some(¤t) || admitted_activation == ¤t, + "refusing to remove an unknown runtime activation projection" + ); + } + let current_lease = + projection_entry(&entries, IdunnProcessWriteLeaseRecord::TYPE, target)?; + if let Some(envelope) = current_lease { + ensure!( + envelope.schema_id.as_deref() == Some(IDUNN_PROCESS_WRITE_LEASE_SCHEMA), + "restored write-lease projection schema is foreign" + ); + let current = IdunnProcessWriteLeaseRecord::decode_canonical(&envelope.payload)?; + ensure!( + admitted_lease == Some(¤t), + "refusing to remove an unknown process write-lease projection" + ); + } + if current_expected.is_some_and(|envelope| { + IdunnExpectedIncarnationRecord::decode_canonical(&envelope.payload) + .is_ok_and(|current| current == *admitted_expected) + }) && current_anchor.is_some_and(|envelope| { + service_trust_anchor_from_envelope(envelope) + .is_ok_and(|current| current == admitted_anchor) + }) && current_activation.is_none() + && current_lease.is_none() + { + return admitted_expected.canonical_sha256(); + } + let mut replacement = entries + .iter() + .filter(|envelope| { + !((envelope.key == target + && matches!( + envelope.r#type.as_str(), + IdunnExpectedIncarnationRecord::TYPE + | IdunnRuntimeActivationRecord::TYPE + | IdunnProcessWriteLeaseRecord::TYPE + )) + || (envelope.key == anchor_key + && envelope.r#type == GameCultServiceTrustAnchorRecord::TYPE)) + }) + .cloned() + .collect::>(); + replacement.extend([ + CultCacheEnvelope { + key: admitted_expected.target.clone(), + r#type: IdunnExpectedIncarnationRecord::TYPE.into(), + payload: admitted_expected.canonical_bytes()?, + stored_at: chrono::Utc::now().to_rfc3339(), + schema_id: Some(IDUNN_EXPECTED_INCARNATION_SCHEMA.into()), + }, + CultCacheEnvelope { + key: admitted_anchor.trust_anchor_id.clone(), + r#type: GameCultServiceTrustAnchorRecord::TYPE.into(), + payload: rmp_serde::to_vec(&admitted_anchor)?, + stored_at: rfc3339_millis(admitted_anchor.bound_at_unix_millis)?, + schema_id: Some(GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA.into()), + }, + ]); + if store.compare_exchange_snapshot(&entries, &replacement)? { + return admitted_expected.canonical_sha256(); + } + } + bail!("topology projection changed repeatedly during admitted restoration") + } + + pub fn admitted_runtime_projection_is_exact( + &self, + expected: &IdunnExpectedIncarnationRecord, + provider_anchor: &ServiceIdentityTrustAnchor, + activation: &IdunnRuntimeActivationRecord, + lease: Option<&IdunnProcessWriteLeaseRecord>, + ) -> Result { + expected.validate()?; + activation.validate()?; + ensure!( + activation.expected_projection_sha256 == expected.canonical_sha256()?, + "admitted activation does not bind its Expected projection" + ); + if let Some(lease) = lease { + validate_topology_lease(expected, activation, lease)?; + } + if !self.projection_store.exists() { + return Ok(false); + } + let entries = SingleFileMessagePackBackingStore::new(&self.projection_store) + .pull_all_read_only_snapshot()?; + let anchor = runtime_presence_trust_anchor(expected, provider_anchor)?; + let expected_is_exact = match projection_entry( + &entries, + IdunnExpectedIncarnationRecord::TYPE, + &expected.target, + )? { + Some(envelope) => { + ensure!( + envelope.schema_id.as_deref() == Some(IDUNN_EXPECTED_INCARNATION_SCHEMA), + "admitted Expected projection schema is foreign" + ); + ensure!( + IdunnExpectedIncarnationRecord::decode_canonical(&envelope.payload)? + == *expected, + "admitted Expected projection was replaced by another incarnation" + ); + true + } + None => false, + }; + let anchor_is_exact = match projection_entry( + &entries, + GameCultServiceTrustAnchorRecord::TYPE, + &anchor.trust_anchor_id, + )? { + Some(envelope) => { + ensure!( + service_trust_anchor_from_envelope(envelope)? == anchor, + "admitted runtime presence trust anchor was replaced" + ); + true + } + None => false, + }; + let activation_is_exact = match projection_entry( + &entries, + IdunnRuntimeActivationRecord::TYPE, + &expected.target, + )? { + Some(envelope) => { + ensure!( + envelope.schema_id.as_deref() == Some(IDUNN_RUNTIME_ACTIVATION_SCHEMA), + "admitted activation projection schema is foreign" + ); + ensure!( + IdunnRuntimeActivationRecord::decode_canonical(&envelope.payload)? + == *activation, + "admitted activation projection was replaced" + ); + true + } + None => false, + }; + let lease_is_exact = match projection_entry( + &entries, + IdunnProcessWriteLeaseRecord::TYPE, + &expected.target, + )? { + Some(envelope) => { + ensure!( + envelope.schema_id.as_deref() == Some(IDUNN_PROCESS_WRITE_LEASE_SCHEMA), + "admitted write-lease projection schema is foreign" + ); + let current = IdunnProcessWriteLeaseRecord::decode_canonical(&envelope.payload)?; + ensure!( + lease == Some(¤t), + "admitted write-lease projection was replaced" + ); + true + } + None => lease.is_none(), + }; + Ok(expected_is_exact && anchor_is_exact && activation_is_exact && lease_is_exact) + } +} + +fn runtime_presence_trust_anchor( + expected: &IdunnExpectedIncarnationRecord, + provider_anchor: &ServiceIdentityTrustAnchor, +) -> Result { + expected.validate()?; + ensure!( + provider_anchor.schema_version + == ::TRUST_ANCHOR_SCHEMA, + "runtime presence trust anchor schema is unsupported" + ); + ensure!( + derive_service_identity_id::(&provider_anchor.public_key)? + == provider_anchor.identity_id + && provider_anchor.identity_id == expected.expected_signer_identity_id, + "runtime presence trust anchor does not bind the Expected signer" + ); + let bound_at_unix_millis: u64 = + chrono::DateTime::parse_from_rfc3339(&provider_anchor.identity_created_at)? + .timestamp_millis() + .try_into() + .context("runtime presence trust anchor creation time predates Unix epoch")?; + let anchor = GameCultServiceTrustAnchorRecord { + schema_version: GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA.into(), + trust_anchor_id: runtime_presence_trust_anchor_id(&expected.target), + service_id: expected.target.clone(), + runtime_id: expected.runtime_id.clone(), + signer_identity_id: provider_anchor.identity_id.clone(), + signer_public_key: provider_anchor.public_key.clone(), + signature_algorithm: "ed25519".into(), + signing_purpose: GAMECULT_RUNTIME_PRESENCE_HEALTH_SIGNING_PURPOSE.into(), + signed_schema: GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA.into(), + binding_authority: "root".into(), + bound_at_unix_millis, + expires_at_unix_millis: None, + private_state_exposed: false, + }; + anchor.validate()?; + Ok(anchor) +} + +fn runtime_presence_trust_anchor_id(target: &str) -> String { + format!("root/{target}/runtime-presence") +} + +fn validate_topology_lease( + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + lease: &IdunnProcessWriteLeaseRecord, +) -> Result<()> { + expected.validate()?; + activation.validate()?; + lease.validate()?; + ensure!( + expected.write_lease_required + && lease.target == expected.target + && lease.expected_projection_sha256 == expected.canonical_sha256()? + && lease.plan_id == expected.plan_id + && lease.incarnation_id == expected.incarnation_id + && lease.sealed_release_id == expected.sealed_release_id + && lease.activation_witness_sha256 == activation.canonical_sha256()? + && lease.state_schema_generation + == expected + .state_schema_generation + .as_deref() + .context("write-lease Expected has no state generation")? + && lease.state_contract_sha256 + == expected + .state_contract_sha256 + .as_deref() + .context("write-lease Expected has no state contract")? + && lease.runtime_id == expected.runtime_id + && lease.runtime_instance_id == activation.runtime_instance_id, + "topology write lease does not bind the exact Expected activation" + ); + Ok(()) +} + +fn service_trust_anchor_from_envelope( + envelope: &CultCacheEnvelope, +) -> Result { + ensure!( + envelope.schema_id.as_deref() == Some(GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA), + "service trust-anchor projection schema is foreign" + ); + let anchor: GameCultServiceTrustAnchorRecord = rmp_serde::from_slice(&envelope.payload)?; + ensure!( + rmp_serde::to_vec(&anchor)? == envelope.payload, + "service trust-anchor projection is noncanonical" + ); + anchor.validate()?; + Ok(anchor) +} + +fn replace_records_atomically(path: &Path, replacements: &[CultCacheEnvelope]) -> Result<()> { + if let Some(parent) = path.parent() { + fs::create_dir_all(parent)?; + } + ensure!( + replacements.iter().enumerate().all(|(index, entry)| { + replacements[index + 1..].iter().all(|other| { + (entry.r#type.as_str(), entry.key.as_str()) + != (other.r#type.as_str(), other.key.as_str()) + }) + }), + "atomic projection set contains a duplicate identity" + ); + let store = SingleFileMessagePackBackingStore::new(path); + for _ in 0..8 { + let entries = store.pull_all_read_only_snapshot()?; + let conditions = replacements + .iter() + .map(|replacement| { + Ok(CultCacheExpectedEnvelope { + r#type: replacement.r#type.clone(), + key: replacement.key.clone(), + current: projection_entry(&entries, &replacement.r#type, &replacement.key)? + .cloned(), + }) + }) + .collect::>>()?; + if conditions + .iter() + .zip(replacements) + .all(|(condition, replacement)| condition.current.as_ref() == Some(replacement)) + { + return Ok(()); + } + if store.compare_exchange(&conditions, replacements)? { + return Ok(()); + } + } + bail!("CultCache projection changed too often to publish atomic set") +} + +fn projection_entry<'a>( + entries: &'a [CultCacheEnvelope], + r#type: &str, + key: &str, +) -> Result> { + let mut matches = entries + .iter() + .filter(|entry| entry.r#type == r#type && entry.key == key); + let current = matches.next(); + ensure!( + matches.next().is_none(), + "CultCache projection identity is ambiguous" + ); + Ok(current) +} + +fn insert_exact_process_lease( + path: &Path, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + replacement: CultCacheEnvelope, +) -> Result<()> { + if let Some(parent) = path.parent() { + fs::create_dir_all(parent)?; + } + let store = SingleFileMessagePackBackingStore::new(path); + for _ in 0..8 { + let entries = store.pull_all_read_only_snapshot()?; + let projected_expected = projection_entry( + &entries, + IdunnExpectedIncarnationRecord::TYPE, + &expected.target, + )? + .context("process write lease has no current Expected projection")?; + ensure!( + projected_expected.schema_id.as_deref() == Some(IDUNN_EXPECTED_INCARNATION_SCHEMA) + && IdunnExpectedIncarnationRecord::decode_canonical(&projected_expected.payload)? + == *expected, + "process write lease current Expected projection is substituted" + ); + let projected_activation = projection_entry( + &entries, + IdunnRuntimeActivationRecord::TYPE, + &expected.target, + )? + .context("process write lease has no observed activation projection")?; + ensure!( + projected_activation.schema_id.as_deref() == Some(IDUNN_RUNTIME_ACTIVATION_SCHEMA) + && IdunnRuntimeActivationRecord::decode_canonical(&projected_activation.payload)? + == *activation, + "process write lease observed activation projection is substituted" + ); + let projected_anchor = service_trust_anchor_from_envelope( + projection_entry( + &entries, + GameCultServiceTrustAnchorRecord::TYPE, + &runtime_presence_trust_anchor_id(&expected.target), + )? + .context("process write lease has no runtime presence trust anchor")?, + )?; + ensure!( + projected_anchor.service_id == expected.target + && projected_anchor.runtime_id == expected.runtime_id + && projected_anchor.signer_identity_id == expected.expected_signer_identity_id + && projected_anchor.signing_purpose + == GAMECULT_RUNTIME_PRESENCE_HEALTH_SIGNING_PURPOSE + && projected_anchor.signed_schema == GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA, + "process write lease runtime presence trust anchor is substituted" + ); + let current = projection_entry(&entries, &replacement.r#type, &replacement.key)?; + if current == Some(&replacement) { + return Ok(()); + } + ensure!( + current.is_none(), + "refusing to replace a different current process write-lease projection" + ); + let conditions = [ + CultCacheExpectedEnvelope { + r#type: IdunnExpectedIncarnationRecord::TYPE.into(), + key: expected.target.clone(), + current: Some(projected_expected.clone()), + }, + CultCacheExpectedEnvelope { + r#type: IdunnRuntimeActivationRecord::TYPE.into(), + key: expected.target.clone(), + current: Some(projected_activation.clone()), + }, + CultCacheExpectedEnvelope { + r#type: GameCultServiceTrustAnchorRecord::TYPE.into(), + key: runtime_presence_trust_anchor_id(&expected.target), + current: projection_entry( + &entries, + GameCultServiceTrustAnchorRecord::TYPE, + &runtime_presence_trust_anchor_id(&expected.target), + )? + .cloned(), + }, + CultCacheExpectedEnvelope { + r#type: replacement.r#type.clone(), + key: replacement.key.clone(), + current: None, + }, + ]; + if store.compare_exchange(&conditions, std::slice::from_ref(&replacement))? { + return Ok(()); + } + } + bail!("CultCache projection changed too often to publish exact record") +} + +impl TopologyPort for CultCacheTopologyDriver { + fn publish_expected( + &self, + expected: &IdunnExpectedIncarnationRecord, + provider_anchor: &ServiceIdentityTrustAnchor, + ) -> Result { + expected.validate()?; + let anchor = runtime_presence_trust_anchor(expected, provider_anchor)?; + replace_records_atomically( + &self.projection_store, + &[ + CultCacheEnvelope { + key: expected.target.clone(), + r#type: IdunnExpectedIncarnationRecord::TYPE.into(), + payload: expected.canonical_bytes()?, + stored_at: chrono::Utc::now().to_rfc3339(), + schema_id: Some(IDUNN_EXPECTED_INCARNATION_SCHEMA.into()), + }, + CultCacheEnvelope { + key: anchor.trust_anchor_id.clone(), + r#type: GameCultServiceTrustAnchorRecord::TYPE.into(), + payload: rmp_serde::to_vec(&anchor)?, + stored_at: rfc3339_millis(anchor.bound_at_unix_millis)?, + schema_id: Some(GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA.into()), + }, + ], + )?; + expected.canonical_sha256() + } + + fn withdraw_expected( + &self, + expected: &IdunnExpectedIncarnationRecord, + provider_anchor: &ServiceIdentityTrustAnchor, + activation: Option<&IdunnRuntimeActivationRecord>, + lease: Option<&IdunnProcessWriteLeaseRecord>, + ) -> Result<()> { + expected.validate()?; + let exact_anchor = runtime_presence_trust_anchor(expected, provider_anchor)?; + if let Some(activation) = activation { + activation.validate()?; + ensure!( + activation.expected_projection_sha256 == expected.canonical_sha256()? + && activation.runtime_id == expected.runtime_id, + "withdrawn activation does not bind the exact Expected projection" + ); + } + if let Some(lease) = lease { + validate_topology_lease( + expected, + activation.context("withdrawn lease has no exact activation")?, + lease, + )?; + } + if !self.projection_store.exists() { + return Ok(()); + } + let store = SingleFileMessagePackBackingStore::new(&self.projection_store); + for _ in 0..8 { + let entries = store.pull_all_read_only_snapshot()?; + let mut found_expected = false; + let mut found_anchor = false; + let mut found_activation = false; + let mut found_lease = false; + let mut retained = Vec::with_capacity(entries.len()); + for envelope in &entries { + if envelope.r#type == GameCultServiceTrustAnchorRecord::TYPE + && envelope.key == exact_anchor.trust_anchor_id + { + ensure!( + !found_anchor + && service_trust_anchor_from_envelope(envelope)? == exact_anchor, + "refusing to withdraw a substituted runtime presence trust anchor" + ); + found_anchor = true; + continue; + } + if envelope.key != expected.target { + retained.push(envelope.clone()); + continue; + } + if envelope.r#type == IdunnExpectedIncarnationRecord::TYPE { + ensure!( + !found_expected + && envelope.schema_id.as_deref() + == Some(IDUNN_EXPECTED_INCARNATION_SCHEMA) + && IdunnExpectedIncarnationRecord::decode_canonical(&envelope.payload)? + == *expected, + "refusing to withdraw a substituted Expected projection" + ); + found_expected = true; + continue; + } + if envelope.r#type == IdunnRuntimeActivationRecord::TYPE { + let current = + IdunnRuntimeActivationRecord::decode_canonical(&envelope.payload)?; + ensure!( + !found_activation + && envelope.schema_id.as_deref() + == Some(IDUNN_RUNTIME_ACTIVATION_SCHEMA) + && activation == Some(¤t), + "refusing to withdraw a substituted runtime activation" + ); + found_activation = true; + continue; + } + if envelope.r#type == IdunnProcessWriteLeaseRecord::TYPE { + let current = + IdunnProcessWriteLeaseRecord::decode_canonical(&envelope.payload)?; + ensure!( + !found_lease + && envelope.schema_id.as_deref() + == Some(IDUNN_PROCESS_WRITE_LEASE_SCHEMA) + && lease == Some(¤t), + "refusing to withdraw a substituted process write lease" + ); + found_lease = true; + continue; + } + retained.push(envelope.clone()); + } + if !found_expected && !found_anchor && !found_activation && !found_lease { + return Ok(()); + } + if store.compare_exchange_snapshot(&entries, &retained)? { + return Ok(()); + } + } + bail!("Expected projection changed repeatedly while withdrawing it") + } + + fn publish_observed_activation( + &self, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + observation: &WorkloadObservation, + ) -> Result { + expected.validate()?; + activation.validate()?; + ensure!( + activation.expected_projection_sha256 == expected.canonical_sha256()? + && activation.runtime_instance_id == observation.runtime_instance_id + && observation.executable_sha256 == expected.artifact_sha256, + "observed activation does not name the Expected native process" + ); + upsert_record( + &self.projection_store, + CultCacheEnvelope { + key: expected.target.clone(), + r#type: IdunnRuntimeActivationRecord::TYPE.into(), + payload: activation.canonical_bytes()?, + stored_at: rfc3339_millis(activation.issued_at_unix_millis)?, + schema_id: Some(IDUNN_RUNTIME_ACTIVATION_SCHEMA.into()), + }, + )?; + activation.canonical_sha256() + } + + fn publish_process_write_lease( + &self, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + lease: &IdunnProcessWriteLeaseRecord, + ) -> Result { + validate_topology_lease(expected, activation, lease)?; + insert_exact_process_lease( + &self.projection_store, + expected, + activation, + CultCacheEnvelope { + key: expected.target.clone(), + r#type: IdunnProcessWriteLeaseRecord::TYPE.into(), + payload: lease.canonical_bytes()?, + stored_at: rfc3339_millis(lease.issued_at_unix_millis)?, + schema_id: Some(IDUNN_PROCESS_WRITE_LEASE_SCHEMA.into()), + }, + )?; + lease.canonical_sha256() + } + + fn withdraw_process_write_lease( + &self, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + lease: Option<&IdunnProcessWriteLeaseRecord>, + ) -> Result<()> { + expected.validate()?; + activation.validate()?; + if let Some(lease) = lease { + validate_topology_lease(expected, activation, lease)?; + } + if !self.projection_store.exists() { + return Ok(()); + } + let store = SingleFileMessagePackBackingStore::new(&self.projection_store); + for _ in 0..8 { + let entries = store.pull_all_read_only_snapshot()?; + let mut found = false; + let mut retained = Vec::with_capacity(entries.len()); + for envelope in &entries { + if envelope.key != expected.target + || envelope.r#type != IdunnProcessWriteLeaseRecord::TYPE + { + retained.push(envelope.clone()); + continue; + } + let current = IdunnProcessWriteLeaseRecord::decode_canonical(&envelope.payload)?; + ensure!( + !found + && envelope.schema_id.as_deref() == Some(IDUNN_PROCESS_WRITE_LEASE_SCHEMA) + && lease == Some(¤t), + "refusing to withdraw an unexpected process write-lease projection" + ); + found = true; + } + if !found { + return Ok(()); + } + if store.compare_exchange_snapshot(&entries, &retained)? { + return Ok(()); + } + } + bail!("process write-lease projection changed repeatedly while withdrawing it") + } + + fn receive(&self, target: &str) -> Result> { + require_driver_id(target, "topology target")?; + if !self.correlation_store.exists() { + return Ok(None); + } + let entries = SingleFileMessagePackBackingStore::new(&self.correlation_store) + .pull_all_read_only_snapshot()?; + let mut matches = entries.iter().filter(|envelope| { + envelope.r#type == OdinRuntimeTopologyCorrelationRecord::TYPE && envelope.key == target + }); + let Some(envelope) = matches.next() else { + return Ok(None); + }; + ensure!( + matches.next().is_none(), + "Odin topology correlation is ambiguous" + ); + ensure!( + envelope.schema_id.as_deref() == Some(ODIN_RUNTIME_TOPOLOGY_CORRELATION_SCHEMA), + "Odin topology correlation schema is foreign" + ); + Ok(Some(ReceivedOdinTopologyCorrelation { + target: target.to_owned(), + canonical_bytes: envelope.payload.clone(), + })) + } +} + +/// nginx owns proxy mechanics. Idunn supplies one exact backend membership, +/// validates the complete nginx configuration, and reloads it. Configuration +/// bytes are actuator state, not proof that the selected runtime answered on +/// the stable route; the control plane admits that proof separately. +pub struct NginxRouteDriver { + pub binding: RouteBinding, + pub nginx_program: PathBuf, + pub systemd_run_program: PathBuf, + pub systemctl_program: PathBuf, + pub preflight_root: PathBuf, +} + +impl NginxRouteDriver { + pub fn new(binding: RouteBinding) -> Self { + Self { + binding, + nginx_program: PathBuf::from("/usr/sbin/nginx"), + systemd_run_program: PathBuf::from("/usr/bin/systemd-run"), + systemctl_program: PathBuf::from("/usr/bin/systemctl"), + preflight_root: PathBuf::from("/run/idunn/route-preflight"), + } + } + + fn command(&self, program: &Path, args: I) -> Result + where + I: IntoIterator, + S: AsRef, + { + ensure!( + program.is_absolute(), + "route actuator program is not absolute" + ); + let output = Command::new(program) + .args(args) + .stdin(Stdio::null()) + .env_clear() + .env("LANG", "C.UTF-8") + .output() + .with_context(|| format!("starting route actuator {}", program.display()))?; + if !output.status.success() { + bail!( + "route actuator {} exited with {}: {}", + program.display(), + output.status, + String::from_utf8_lossy(&output.stderr).trim() + ); + } + Ok(output) + } + + fn render(&self, expected: &IdunnExpectedIncarnationRecord) -> Result> { + expected.validate()?; + let expected_projection_sha256 = expected.canonical_sha256()?; + let route = expected + .route + .as_ref() + .context("expected incarnation has no route")?; + ensure!( + route.route_id == self.binding.route_id + && route.stable_endpoint == self.binding.stable_endpoint, + "route driver binding differs from Expected" + ); + let endpoint_prefix = match (self.binding.driver, route.transport.as_str()) { + (RouteDriver::NginxStreamTcp, "http") => "http://", + (RouteDriver::NginxStreamTcp, "tcp") => "tcp://", + (RouteDriver::NginxStreamUdp, "rudp") => "rudp://", + _ => bail!("route driver cannot carry the Expected transport"), + }; + let (candidate_host, candidate_port) = + endpoint_host_port(&route.candidate_endpoint, endpoint_prefix)?; + ensure!( + candidate_host == self.binding.private_host + && (self.binding.private_port_start..=self.binding.private_port_end) + .contains(&candidate_port), + "Expected candidate endpoint is outside the route binding" + ); + let upstream = nginx_identifier(&self.binding.route_id)?; + let rendered = match self.binding.driver { + RouteDriver::NginxStreamTcp => { + let (stable_host, stable_port) = + endpoint_host_port(&route.stable_endpoint, endpoint_prefix)?; + format!( + "# Idunn Expected {expected_projection_sha256}\nupstream {upstream} {{\n server {candidate_host}:{candidate_port};\n}}\nserver {{\n listen {stable_host}:{stable_port};\n proxy_pass {upstream};\n}}\n" + ) + } + RouteDriver::NginxStreamUdp => { + let (stable_host, stable_port) = + endpoint_host_port(&route.stable_endpoint, "rudp://")?; + format!( + "# Idunn Expected {expected_projection_sha256}\nupstream {upstream} {{\n server {candidate_host}:{candidate_port};\n}}\nserver {{\n listen {stable_host}:{stable_port} udp reuseport;\n proxy_pass {upstream};\n}}\n" + ) + } + }; + Ok(rendered.into_bytes()) + } + + fn current_configuration(&self) -> Result>> { + Ok(match fs::read(&self.binding.config_path) { + Ok(bytes) => Some(bytes), + Err(error) if error.kind() == ErrorKind::NotFound => None, + Err(error) => return Err(error).context("reading route fragment"), + }) + } + + fn write_fragment(&self, content: Option<&[u8]>) -> Result<()> { + match content { + Some(bytes) => atomic_replace(&self.binding.config_path, bytes), + None => match fs::remove_file(&self.binding.config_path) { + Ok(()) => sync_parent_directory(&self.binding.config_path), + Err(error) if error.kind() == ErrorKind::NotFound => Ok(()), + Err(error) => Err(error).context("removing route fragment"), + }, + } + } + + fn reload(&self) -> Result<()> { + self.command(&self.nginx_program, [OsString::from("-t")])?; + self.command( + &self.systemctl_program, + [ + OsString::from("reload"), + OsString::from(&self.binding.reload_unit), + ], + )?; + Ok(()) + } + + fn validate_candidate_in_private_mount(&self, rendered: &[u8]) -> Result<()> { + ensure_route_preflight_root(&self.preflight_root)?; + let route = nginx_identifier(&self.binding.route_id)?; + let nonce = Uuid::new_v4(); + let candidate = self + .preflight_root + .join(format!("{route}-{nonce}.candidate")); + write_root_owned_file(&candidate, rendered, 0o400)?; + let unit = format!("idunn-nginx-preflight-{nonce}"); + let validation = self.command( + &self.systemd_run_program, + [ + OsString::from("--wait"), + OsString::from("--collect"), + OsString::from("--quiet"), + OsString::from(format!("--unit={unit}")), + OsString::from("--property=Type=exec"), + OsString::from("--property=PrivateMounts=yes"), + systemd_read_only_bind_property(&candidate, &self.binding.config_path)?, + OsString::from("--"), + self.nginx_program.clone().into_os_string(), + OsString::from("-t"), + ], + ); + let cleanup = remove_exact_root_owned_file(&candidate, 0o400); + match (validation, cleanup) { + (Ok(_), Ok(())) => Ok(()), + (Err(validation), Ok(())) => { + Err(validation).context("candidate route is invalid in a private mount namespace") + } + (Ok(_), Err(cleanup)) => { + Err(cleanup).context("deleting route preflight material") + } + (Err(validation), Err(cleanup)) => Err(validation).context(format!( + "candidate route is invalid; deleting its private preflight material also failed: {cleanup:#}" + )), + } + } + + fn restore(&self, prior: Option<&[u8]>) -> Result<()> { + self.write_fragment(prior)?; + self.reload() + } + + fn fail_after_rollback( + &self, + prior: Option<&[u8]>, + failure: anyhow::Error, + context: &str, + ) -> Result { + match self.restore(prior) { + Ok(()) => Err(failure).context(context.to_owned()), + Err(rollback) => Err(failure).context(format!( + "{context}; route rollback also failed: {rollback:#}" + )), + } + } + + pub fn preflight( + &self, + expected: &IdunnExpectedIncarnationRecord, + runtime_instance_id: &str, + incumbent: Option<&RouteObservation>, + ) -> Result { + let rendered = self.render(expected)?; + ensure!(!rendered.is_empty(), "candidate route rendered empty"); + let current = self.current_configuration()?; + let incumbent_membership_sha256 = current.as_ref().map(|bytes| sha256_id(bytes)); + match incumbent { + Some(incumbent) => ensure!( + incumbent.route_id == self.binding.route_id + && Some(incumbent.membership_sha256.as_str()) + == incumbent_membership_sha256.as_deref(), + "route preflight baseline differs from the admitted incumbent" + ), + None => ensure!( + incumbent_membership_sha256.is_none(), + "route preflight found an unadmitted incumbent" + ), + } + self.validate_candidate_in_private_mount(&rendered)?; + let after = self.current_configuration()?; + ensure!( + after == current, + "nginx route baseline changed during candidate validation" + ); + let receipt = RoutePreflightReceipt { + route_id: self.binding.route_id.clone(), + candidate_runtime_instance_id: runtime_instance_id.to_owned(), + candidate_membership_sha256: sha256_id(&rendered), + incumbent_runtime_instance_id: incumbent + .map(|observation| observation.runtime_instance_id.clone()), + incumbent_membership_sha256, + incumbent_configuration: current, + }; + receipt.validate()?; + Ok(receipt) + } + + /// Install the candidate route membership and require nginx to accept the + /// complete configuration. Success is not route admission: callers must + /// still obtain a fresh signed runtime observation through the stable + /// listener. + pub fn install( + &self, + expected: &IdunnExpectedIncarnationRecord, + runtime_instance_id: &str, + preflight: &RoutePreflightReceipt, + rollback_allowed: bool, + ) -> Result { + preflight.validate()?; + let rendered = self.render(expected)?; + ensure!( + preflight.route_id == self.binding.route_id + && preflight.candidate_runtime_instance_id == runtime_instance_id + && preflight.candidate_membership_sha256 == sha256_id(&rendered), + "route preflight does not authorize this candidate membership" + ); + let prior = self.current_configuration()?; + let prior_sha256 = prior.as_ref().map(|bytes| sha256_id(bytes)); + let candidate_already_written = prior.as_deref() == Some(rendered.as_slice()); + ensure!( + candidate_already_written + || (prior == preflight.incumbent_configuration + && prior_sha256 == preflight.incumbent_membership_sha256), + "route baseline changed after preflight" + ); + if !candidate_already_written { + atomic_replace(&self.binding.config_path, &rendered)?; + } + if let Err(error) = self.reload() { + if rollback_allowed { + return self.fail_after_rollback( + preflight.incumbent_configuration.as_deref(), + error, + "candidate route validation or reload failed", + ); + } + return Err(error).context( + "candidate route reload failed after incumbent route authority was fenced; candidate fragment retained for retry", + ); + } + ensure!( + self.current_configuration()?.as_deref() == Some(rendered.as_slice()), + "candidate route fragment changed during reload" + ); + Ok(sha256_id(&rendered)) + } + + pub fn observe_membership( + &self, + expected: &IdunnExpectedIncarnationRecord, + membership_sha256: &str, + ) -> Result { + let rendered = self.render(expected)?; + ensure!( + membership_sha256 == sha256_id(&rendered), + "route observation does not describe the expected membership" + ); + Ok(self.current_configuration()?.as_deref() == Some(rendered.as_slice())) + } + + /// Restore the exact membership owned by an admitted generation. Any + /// different fragment is drift, not a rollback baseline, so it is never + /// restored after a failed reload. A failed reload removes the newly + /// written fragment so the next continuity pass cannot mistake disk bytes + /// for an adopted route. The caller must still challenge the stable + /// listener to prove that nginx workers adopted this membership. + pub fn restore_admitted_membership( + &self, + expected: &IdunnExpectedIncarnationRecord, + membership_sha256: &str, + ) -> Result<()> { + let rendered = self.render(expected)?; + ensure!( + membership_sha256 == sha256_id(&rendered), + "admitted route receipt does not describe the expected membership" + ); + self.validate_candidate_in_private_mount(&rendered)?; + if self.current_configuration()?.as_deref() != Some(rendered.as_slice()) { + atomic_replace(&self.binding.config_path, &rendered)?; + } + if let Err(reload) = self.reload() { + return match self.write_fragment(None) { + Ok(()) => Err(reload).context("reloading the exact admitted route membership"), + Err(cleanup) => Err(reload).context(format!( + "reloading the exact admitted route membership; removing its unproved fragment also failed: {cleanup:#}" + )), + }; + } + ensure!( + self.current_configuration()?.as_deref() == Some(rendered.as_slice()), + "admitted route fragment changed during restoration" + ); + Ok(()) + } + + /// Ask the stable listener for one freshly minted provider-owned presence + /// statement. This method validates the CultNet wire exchange and exact + /// document selection only; Idunn's control plane authenticates and + /// correlates the signed payload against current authority. + pub fn request_runtime_presence( + &self, + expected: &IdunnExpectedIncarnationRecord, + message_id: &str, + ) -> Result { + let route = expected + .route + .as_ref() + .context("route challenge has no Expected route")?; + ensure!( + route.route_id == self.binding.route_id + && route.stable_endpoint == self.binding.stable_endpoint, + "route challenge binding differs from Expected" + ); + self.request_runtime_presence_at(expected, message_id, &route.stable_endpoint) + } + + /// The bootstrap exception for the first managed Odin observes Warming on + /// the exact candidate endpoint. It does not install or admit a route. + pub fn request_candidate_runtime_presence( + &self, + expected: &IdunnExpectedIncarnationRecord, + message_id: &str, + ) -> Result { + let route = expected + .route + .as_ref() + .context("candidate challenge has no Expected route")?; + ensure!( + route.route_id == self.binding.route_id, + "candidate challenge binding differs from Expected" + ); + self.render(expected)?; + self.request_runtime_presence_at(expected, message_id, &route.candidate_endpoint) + } + + fn request_runtime_presence_at( + &self, + expected: &IdunnExpectedIncarnationRecord, + message_id: &str, + endpoint: &str, + ) -> Result { + expected.validate()?; + require_driver_id(message_id, "route challenge message")?; + let route = expected + .route + .as_ref() + .context("route challenge has no Expected route")?; + let request = CultNetMessage::SnapshotRequest { + message_id: message_id.to_owned(), + schema_ids: Some(vec![GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA.into()]), + record_keys: Some(vec![expected.target.clone()]), + }; + let endpoint_prefix = match route.transport.as_str() { + "http" => "http://", + "tcp" => "tcp://", + "rudp" => "rudp://", + _ => bail!("route challenge transport is unsupported"), + }; + let (host, port) = endpoint_host_port(endpoint, endpoint_prefix)?; + let target = SocketAddr::new( + host.parse() + .context("route challenge endpoint host is not an IP address")?, + port, + ); + let response = match route.transport.as_str() { + "http" => { + let payload = + encode_cultnet_message_to_vec(&request, CultNetWireContract::CultNetSchemaV0)?; + let response = request_http_snapshot(target, &payload)?; + decode_cultnet_message_from_slice(&response, CultNetWireContract::CultNetSchemaV0)? + } + "tcp" => { + let payload = + encode_cultnet_message_to_vec(&request, CultNetWireContract::CultNetSchemaV0)?; + let response = request_tcp_snapshot(target, &payload)?; + decode_cultnet_message_from_slice(&response, CultNetWireContract::CultNetSchemaV0)? + } + "rudp" => request_raw_snapshot_from_rudp_catalog(CultMeshRudpSnapshotOptions { + target, + runtime_id: "idunn-route-observer".into(), + message_id: message_id.to_owned(), + schema_ids: Some(vec![GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA.into()]), + record_keys: Some(vec![expected.target.clone()]), + ..CultMeshRudpSnapshotOptions::default() + })?, + _ => bail!("route challenge transport is unsupported"), + }; + exact_route_snapshot_response(response, message_id, &expected.target) + } + + /// Restore the exact preflight baseline. This may only replace the exact + /// candidate authorized by the receipt; an unrelated writer is never + /// overwritten as a side effect of rollback. + pub fn rollback( + &self, + expected: &IdunnExpectedIncarnationRecord, + runtime_instance_id: &str, + preflight: &RoutePreflightReceipt, + ) -> Result<()> { + preflight.validate()?; + let rendered = self.render(expected)?; + ensure!( + preflight.route_id == self.binding.route_id + && preflight.candidate_runtime_instance_id == runtime_instance_id + && preflight.candidate_membership_sha256 == sha256_id(&rendered), + "route preflight does not authorize rollback of this candidate membership" + ); + ensure!( + self.current_configuration()?.as_deref() == Some(rendered.as_slice()), + "candidate route changed before rollback" + ); + self.restore(preflight.incumbent_configuration.as_deref()) + } +} + +fn request_tcp_snapshot(target: SocketAddr, payload: &[u8]) -> Result> { + let mut stream = TcpStream::connect_timeout(&target, ROUTE_SNAPSHOT_TIMEOUT) + .with_context(|| format!("connecting stable CultNet TCP route {target}"))?; + stream.set_read_timeout(Some(ROUTE_SNAPSHOT_TIMEOUT))?; + stream.set_write_timeout(Some(ROUTE_SNAPSHOT_TIMEOUT))?; + stream.write_all(&encode_frame(payload)?)?; + stream.flush()?; + + let mut header = [0_u8; 4]; + stream + .read_exact(&mut header) + .context("reading stable CultNet TCP response frame")?; + let length = u32::from_be_bytes(header) as usize; + ensure!( + (1..=ROUTE_SNAPSHOT_MAX_BYTES).contains(&length), + "stable CultNet TCP response exceeds the route observation bound" + ); + let mut response = vec![0_u8; length]; + stream + .read_exact(&mut response) + .context("reading stable CultNet TCP response payload")?; + Ok(response) +} + +fn request_http_snapshot(target: SocketAddr, payload: &[u8]) -> Result> { + let mut stream = TcpStream::connect_timeout(&target, ROUTE_SNAPSHOT_TIMEOUT) + .with_context(|| format!("connecting stable CultNet HTTP route {target}"))?; + stream.set_read_timeout(Some(ROUTE_SNAPSHOT_TIMEOUT))?; + stream.set_write_timeout(Some(ROUTE_SNAPSHOT_TIMEOUT))?; + let head = format!( + "POST {ROUTE_HTTP_SNAPSHOT_PATH} HTTP/1.1\r\nHost: {target}\r\nContent-Type: application/msgpack\r\nAccept: application/msgpack\r\nContent-Length: {}\r\nConnection: close\r\n\r\n", + payload.len() + ); + stream.write_all(head.as_bytes())?; + stream.write_all(payload)?; + stream.flush()?; + + let maximum = ROUTE_HTTP_MAX_HEADER_BYTES + .checked_add(ROUTE_SNAPSHOT_MAX_BYTES) + .context("route HTTP response bound overflow")?; + let mut response = Vec::new(); + (&mut stream) + .take((maximum + 1) as u64) + .read_to_end(&mut response) + .context("reading stable CultNet HTTP response")?; + ensure!( + response.len() <= maximum, + "stable CultNet HTTP response exceeds the route observation bound" + ); + let header_end = response + .windows(4) + .position(|window| window == b"\r\n\r\n") + .map(|index| index + 4) + .context("stable CultNet HTTP response has no header boundary")?; + ensure!( + header_end <= ROUTE_HTTP_MAX_HEADER_BYTES, + "stable CultNet HTTP response headers exceed their bound" + ); + let headers = std::str::from_utf8(&response[..header_end]) + .context("stable CultNet HTTP response headers are not UTF-8")?; + let mut lines = headers.split("\r\n"); + let status = lines + .next() + .context("stable CultNet HTTP response has no status")?; + ensure!( + matches!(status, "HTTP/1.1 200 OK" | "HTTP/1.0 200 OK"), + "stable CultNet HTTP route rejected the snapshot challenge: {status}" + ); + let mut content_length = None; + for line in lines.filter(|line| !line.is_empty()) { + let (name, value) = line + .split_once(':') + .context("stable CultNet HTTP response contains a malformed header")?; + if name.eq_ignore_ascii_case("transfer-encoding") { + bail!("stable CultNet HTTP response uses unsupported transfer encoding"); + } + if name.eq_ignore_ascii_case("content-length") { + ensure!( + content_length.is_none(), + "stable CultNet HTTP response repeats Content-Length" + ); + content_length = Some( + value + .trim() + .parse::() + .context("stable CultNet HTTP Content-Length is invalid")?, + ); + } + } + let content_length = + content_length.context("stable CultNet HTTP response has no Content-Length")?; + ensure!( + content_length <= ROUTE_SNAPSHOT_MAX_BYTES + && response.len().saturating_sub(header_end) == content_length, + "stable CultNet HTTP response body differs from its bounded Content-Length" + ); + Ok(response[header_end..].to_vec()) +} + +fn exact_route_snapshot_response( + response: CultNetMessage, + message_id: &str, + target: &str, +) -> Result { + let CultNetMessage::SnapshotResponseRaw { + message_id: response_id, + documents, + } = response + else { + bail!("stable route returned a non-raw snapshot response") + }; + ensure!( + response_id == message_id, + "stable route snapshot response belongs to another challenge" + ); + ensure!( + documents.len() == 1, + "stable route snapshot response is not the exact singleton presence document" + ); + let document = documents + .into_iter() + .next() + .expect("singleton response length was checked"); + ensure!( + document.schema_id == GAMECULT_RUNTIME_PRESENCE_HEALTH_SCHEMA + && document.record_key == target + && document.payload_encoding == CultNetRawPayloadEncoding::Messagepack, + "stable route substituted the runtime presence document" + ); + ensure!( + !document.payload.is_empty() && document.payload.len() <= ROUTE_SNAPSHOT_MAX_BYTES, + "stable route presence payload is empty or exceeds its bound" + ); + Ok(RouteSnapshotResponse { + message_id: response_id, + canonical_presence: document.payload, + }) +} + +fn release_artifact<'a>( + declaration: &'a TargetDeclaration, + artifact_id: &str, +) -> Result<&'a ArtifactOutput> { + declaration + .artifacts + .iter() + .find(|artifact| artifact.id == artifact_id) + .with_context(|| format!("target declares no artifact {artifact_id}")) +} + +fn write_immutable_record(path: &Path, envelope: CultCacheEnvelope) -> Result<()> { + if let Some(parent) = path.parent() { + fs::create_dir_all(parent)?; + } + let mut store = SingleFileMessagePackBackingStore::new(path); + match store.pull_all_read_only_snapshot()?.as_slice() { + [] => store.push(&envelope), + [current] if current == &envelope => Ok(()), + _ => bail!( + "immutable runtime document {} already differs", + path.display() + ), + } +} + +fn upsert_record(path: &Path, replacement: CultCacheEnvelope) -> Result<()> { + if let Some(parent) = path.parent() { + fs::create_dir_all(parent)?; + } + let store = SingleFileMessagePackBackingStore::new(path); + for _ in 0..8 { + let entries = store.pull_all_read_only_snapshot()?; + let mut matches = entries + .iter() + .filter(|entry| entry.r#type == replacement.r#type && entry.key == replacement.key); + let current = matches.next().cloned(); + ensure!( + matches.next().is_none(), + "CultCache projection identity is ambiguous" + ); + if current.as_ref() == Some(&replacement) { + return Ok(()); + } + if store.compare_exchange( + &[CultCacheExpectedEnvelope { + r#type: replacement.r#type.clone(), + key: replacement.key.clone(), + current, + }], + std::slice::from_ref(&replacement), + )? { + return Ok(()); + } + } + bail!("CultCache projection changed too often to publish") +} + +fn rfc3339_millis(millis: u64) -> Result { + Ok( + chrono::DateTime::from_timestamp_millis(i64::try_from(millis)?) + .context("runtime timestamp is out of range")? + .to_rfc3339(), + ) +} + +#[cfg(unix)] +fn validate_frozen_source_store(store: &Path) -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + ensure!(store.is_absolute(), "frozen source store is not absolute"); + let canonical_store = store + .canonicalize() + .with_context(|| format!("resolving frozen source store {}", store.display()))?; + ensure!( + canonical_store == store, + "frozen source store traverses a symlink or noncanonical path" + ); + let metadata = fs::symlink_metadata(store)?; + ensure!( + metadata.is_dir() + && !metadata.file_type().is_symlink() + && metadata.uid() == 0 + && metadata.permissions().mode() & 0o022 == 0, + "frozen source store is not root-owned and nonwritable" + ); + Ok(()) +} + +#[cfg(not(unix))] +fn validate_frozen_source_store(_store: &Path) -> Result<()> { + bail!("frozen source materialization requires a Unix actuator") +} + +#[cfg(unix)] +fn prepare_frozen_transaction_root(store: &Path, transaction_id: &str) -> Result { + use std::os::unix::fs::PermissionsExt; + + require_driver_id(transaction_id, "source transaction")?; + validate_frozen_source_store(store)?; + let transaction_root = store.join(transaction_id); + if transaction_root.exists() { + remove_frozen_transaction_root(store, transaction_id)?; + } + fs::create_dir(&transaction_root)?; + fs::set_permissions(&transaction_root, fs::Permissions::from_mode(0o700))?; + Ok(transaction_root) +} + +#[cfg(not(unix))] +fn prepare_frozen_transaction_root(_store: &Path, _transaction_id: &str) -> Result { + bail!("frozen source materialization requires a Unix actuator") +} + +#[cfg(unix)] +fn remove_frozen_transaction_root(store: &Path, transaction_id: &str) -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + require_driver_id(transaction_id, "source transaction")?; + validate_frozen_source_store(store)?; + let transaction_root = store.join(transaction_id); + let metadata = fs::symlink_metadata(&transaction_root)?; + ensure!( + metadata.is_dir() + && !metadata.file_type().is_symlink() + && metadata.uid() == 0 + && metadata.permissions().mode() & 0o022 == 0, + "frozen source transaction root is not Idunn-owned" + ); + fs::set_permissions(&transaction_root, fs::Permissions::from_mode(0o700))?; + fs::remove_dir_all(&transaction_root).with_context(|| { + format!( + "removing exact frozen source transaction {}", + transaction_root.display() + ) + }) +} + +#[cfg(not(unix))] +fn remove_frozen_transaction_root(_store: &Path, _transaction_id: &str) -> Result<()> { + bail!("frozen source cleanup requires a Unix actuator") +} + +#[cfg(unix)] +fn prepare_frozen_source_destination(destination: &Path) -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + ensure!( + unsafe { libc::geteuid() } == 0, + "frozen source materialization requires root Idunn" + ); + ensure!( + destination.is_absolute(), + "frozen source destination is not absolute" + ); + let parent = destination + .parent() + .context("frozen source destination has no parent")?; + ensure!(destination != parent, "frozen source destination is broad"); + let canonical_parent = parent + .canonicalize() + .with_context(|| format!("resolving frozen source parent {}", parent.display()))?; + ensure!( + canonical_parent == parent, + "frozen source parent traverses a symlink or noncanonical path" + ); + let parent_metadata = fs::symlink_metadata(parent)?; + ensure!( + parent_metadata.is_dir() + && !parent_metadata.file_type().is_symlink() + && parent_metadata.uid() == 0 + && parent_metadata.permissions().mode() & 0o022 == 0, + "frozen source parent is not root-owned and nonwritable" + ); + if destination.exists() { + remove_frozen_source_destination(destination)?; + } + fs::create_dir(destination) + .with_context(|| format!("creating frozen source {}", destination.display()))?; + fs::set_permissions(destination, fs::Permissions::from_mode(0o700))?; + Ok(()) +} + +#[cfg(not(unix))] +fn prepare_frozen_source_destination(_destination: &Path) -> Result<()> { + bail!("frozen source materialization requires a Unix actuator") +} + +#[cfg(unix)] +fn remove_frozen_source_destination(destination: &Path) -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + ensure!( + destination.is_absolute(), + "frozen source destination is not absolute" + ); + let parent = destination + .parent() + .context("frozen source destination has no parent")?; + ensure!(destination != parent, "frozen source destination is broad"); + let parent_metadata = fs::symlink_metadata(parent)?; + let metadata = fs::symlink_metadata(destination)?; + ensure!( + parent_metadata.is_dir() + && !parent_metadata.file_type().is_symlink() + && parent_metadata.uid() == 0 + && parent_metadata.permissions().mode() & 0o022 == 0, + "frozen source parent is not root-owned and nonwritable" + ); + ensure!( + metadata.is_dir() + && !metadata.file_type().is_symlink() + && metadata.uid() == 0 + && metadata.permissions().mode() & 0o022 == 0, + "existing frozen source is not an Idunn-owned directory" + ); + fs::remove_dir_all(destination) + .with_context(|| format!("removing exact frozen source {}", destination.display())) +} + +#[cfg(not(unix))] +fn remove_frozen_source_destination(_destination: &Path) -> Result<()> { + bail!("frozen source materialization requires a Unix actuator") +} + +#[cfg(unix)] +fn harden_frozen_source(root: &Path) -> Result<()> { + harden_frozen_source_tree(root, root) +} + +#[cfg(unix)] +fn harden_frozen_source_tree(root: &Path, current: &Path) -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + let metadata = fs::symlink_metadata(current)?; + ensure!(metadata.uid() == 0, "frozen source entry is not root-owned"); + ensure!( + current == root || current.file_name() != Some(OsStr::new(".git")), + "frozen source contains forbidden .git metadata" + ); + if metadata.is_dir() { + let mut entries = fs::read_dir(current)?.collect::>>()?; + entries.sort_by_key(|entry| entry.file_name()); + for entry in entries { + harden_frozen_source_tree(root, &entry.path())?; + } + fs::set_permissions(current, fs::Permissions::from_mode(0o555))?; + } else if metadata.is_file() { + let mode = if metadata.permissions().mode() & 0o111 == 0 { + 0o444 + } else { + 0o555 + }; + fs::set_permissions(current, fs::Permissions::from_mode(mode))?; + } else if metadata.file_type().is_symlink() { + validate_frozen_source_symlink(root, current)?; + } else { + bail!("frozen source contains a special filesystem entry") + } + Ok(()) +} + +#[cfg(unix)] +fn validate_frozen_source_symlink(root: &Path, path: &Path) -> Result<()> { + let target = fs::read_link(path)?; + ensure!(target.is_relative(), "frozen source symlink is absolute"); + let parent = path + .parent() + .context("frozen source symlink has no parent")?; + let mut components = parent + .strip_prefix(root)? + .components() + .filter_map(|component| match component { + std::path::Component::Normal(value) => Some(value.to_os_string()), + _ => None, + }) + .collect::>(); + for component in target.components() { + match component { + std::path::Component::CurDir => {} + std::path::Component::Normal(value) => components.push(value.to_os_string()), + std::path::Component::ParentDir => { + ensure!( + components.pop().is_some(), + "frozen source symlink escapes its root" + ); + } + std::path::Component::RootDir | std::path::Component::Prefix(_) => { + bail!("frozen source symlink is absolute") + } + } + } + Ok(()) +} + +#[cfg(not(unix))] +fn harden_frozen_source(_root: &Path) -> Result<()> { + bail!("frozen source materialization requires Unix permissions") +} + +#[cfg(unix)] +fn validate_frozen_source(root: &Path) -> Result<()> { + validate_frozen_source_tree(root, root) +} + +#[cfg(unix)] +fn validate_frozen_source_tree(root: &Path, current: &Path) -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + let metadata = fs::symlink_metadata(current)?; + ensure!(metadata.uid() == 0, "frozen source entry is not root-owned"); + ensure!( + current == root || current.file_name() != Some(OsStr::new(".git")), + "frozen source contains forbidden .git metadata" + ); + if metadata.is_dir() { + ensure!( + metadata.permissions().mode() & 0o777 == 0o555, + "frozen source directory is not 0555" + ); + let mut entries = fs::read_dir(current)?.collect::>>()?; + entries.sort_by_key(|entry| entry.file_name()); + for entry in entries { + validate_frozen_source_tree(root, &entry.path())?; + } + } else if metadata.is_file() { + ensure!( + matches!(metadata.permissions().mode() & 0o777, 0o444 | 0o555), + "frozen source file has a noncanonical mode" + ); + } else if metadata.file_type().is_symlink() { + validate_frozen_source_symlink(root, current)?; + } else { + bail!("frozen source contains a special filesystem entry") + } + Ok(()) +} + +#[cfg(not(unix))] +fn validate_frozen_source(_root: &Path) -> Result<()> { + bail!("frozen source observation requires Unix permissions") +} + +#[cfg(unix)] +fn frozen_source_sha256(root: &Path) -> Result { + let mut hasher = Sha256::new(); + hash_frozen_source_tree(root, root, &mut hasher)?; + Ok(format!("sha256-{:x}", hasher.finalize())) +} + +#[cfg(unix)] +fn hash_frozen_source_tree(root: &Path, current: &Path, hasher: &mut Sha256) -> Result<()> { + use std::os::unix::fs::PermissionsExt; + + let mut entries = fs::read_dir(current)?.collect::>>()?; + entries.sort_by_key(|entry| entry.file_name()); + for entry in entries { + let path = entry.path(); + let relative = normalized_relative(path.strip_prefix(root)?)?; + let metadata = fs::symlink_metadata(&path)?; + if metadata.is_dir() { + hasher.update(b"dir\0"); + hasher.update(relative.as_bytes()); + hasher.update(b"\0"); + hash_frozen_source_tree(root, &path, hasher)?; + } else if metadata.is_file() { + let bytes = fs::read(&path)?; + hasher.update(b"file\0"); + hasher.update(relative.as_bytes()); + hasher.update(b"\0"); + hasher.update( + (metadata.permissions().mode() & 0o111 != 0) + .to_string() + .as_bytes(), + ); + hasher.update(b"\0"); + hasher.update((bytes.len() as u64).to_le_bytes()); + hasher.update(&bytes); + } else if metadata.file_type().is_symlink() { + let target = fs::read_link(&path)?; + hasher.update(b"link\0"); + hasher.update(relative.as_bytes()); + hasher.update(b"\0"); + hasher.update(target.as_os_str().as_encoded_bytes()); + hasher.update(b"\0"); + } else { + bail!("frozen source contains a special filesystem entry") + } + } + Ok(()) +} + +#[cfg(not(unix))] +fn frozen_source_sha256(_root: &Path) -> Result { + bail!("frozen source observation requires Unix permissions") +} + +#[cfg(unix)] +fn harden_installed_release(root: &Path, artifacts: &[ArtifactReceipt]) -> Result<()> { + let executable_paths = artifacts + .iter() + .filter(|artifact| artifact.executable) + .map(|artifact| root.join(&artifact.destination)) + .collect::>(); + harden_root_tree(root, root, &executable_paths) +} + +#[cfg(unix)] +fn harden_root_tree( + root: &Path, + current: &Path, + executable_paths: &std::collections::BTreeSet, +) -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + let metadata = fs::symlink_metadata(current)?; + ensure!( + metadata.uid() == 0, + "sealed release entry is not root-owned" + ); + if metadata.is_dir() { + let mut entries = fs::read_dir(current)?.collect::>>()?; + entries.sort_by_key(|entry| entry.file_name()); + for entry in entries { + harden_root_tree(root, &entry.path(), executable_paths)?; + } + fs::set_permissions(current, fs::Permissions::from_mode(0o555))?; + } else if metadata.is_file() { + fs::set_permissions( + current, + fs::Permissions::from_mode(if executable_paths.contains(current) { + 0o555 + } else { + 0o444 + }), + )?; + } else if metadata.file_type().is_symlink() { + validate_release_symlink(root, current)?; + } else { + bail!("sealed release contains a special filesystem entry") + } + Ok(()) +} + +#[cfg(unix)] +fn validate_release_symlink(root: &Path, path: &Path) -> Result<()> { + let target = fs::read_link(path)?; + ensure!(target.is_relative(), "sealed release symlink is absolute"); + ensure!( + target.components().all(|component| matches!( + component, + std::path::Component::CurDir | std::path::Component::Normal(_) + )), + "sealed release symlink has a parent traversal" + ); + let destination = path + .parent() + .context("sealed release symlink has no parent")? + .join(target); + ensure!( + destination.starts_with(root), + "sealed release symlink escaped its release" + ); + Ok(()) +} + +#[cfg(not(unix))] +fn harden_installed_release(_root: &Path, _artifacts: &[ArtifactReceipt]) -> Result<()> { + bail!("systemd workload installation requires Unix permissions") +} + +#[cfg(unix)] +fn harden_runtime_bundle(bundle: &Path) -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + let metadata = fs::symlink_metadata(bundle)?; + let parent = bundle.parent().context("runtime bundle has no parent")?; + let parent_metadata = fs::symlink_metadata(parent)?; + ensure!( + metadata.is_dir() && !metadata.file_type().is_symlink() && metadata.uid() == 0, + "runtime bundle is not a root-owned directory" + ); + ensure!( + parent_metadata.is_dir() + && !parent_metadata.file_type().is_symlink() + && parent_metadata.uid() == 0 + && parent_metadata.permissions().mode() & 0o022 == 0, + "runtime bundle root is not root-owned and service-nonwritable" + ); + for name in [ + "expected.cc", + "expected.cc.lock", + "activation.cc", + "activation.cc.lock", + ] { + let path = bundle.join(name); + let metadata = fs::symlink_metadata(&path)?; + ensure!( + metadata.is_file() && !metadata.file_type().is_symlink() && metadata.uid() == 0, + "runtime bundle document is not root-owned" + ); + fs::set_permissions(path, fs::Permissions::from_mode(0o444))?; + } + fs::set_permissions(bundle, fs::Permissions::from_mode(0o555))?; + Ok(()) +} + +#[cfg(not(unix))] +fn harden_runtime_bundle(_bundle: &Path) -> Result<()> { + bail!("systemd runtime bundles require Unix permissions") +} + +fn observe_parent_only_file_descriptor( + fd_number: u32, + fd_name: &str, + source_path: &Path, +) -> Result { + validate_open_file_component(fd_name, "parent-only descriptor name")?; + ensure!( + source_path.is_absolute(), + "parent-only descriptor source is not absolute" + ); + validate_open_file_component( + &source_path.as_os_str().to_string_lossy(), + "parent-only descriptor source", + )?; + let mut file = open_native_read_only(source_path).with_context(|| { + format!( + "opening parent-only descriptor source {}", + source_path.display() + ) + })?; + let metadata = file.metadata()?; + ensure!( + metadata.is_file() && metadata.len() > 0, + "parent-only descriptor source is not one nonempty native file" + ); + #[cfg(unix)] + let (device, inode, uid, gid, mode, links) = { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + ( + metadata.dev(), + metadata.ino(), + metadata.uid(), + metadata.gid(), + metadata.permissions().mode() & 0o777, + metadata.nlink(), + ) + }; + #[cfg(not(unix))] + let (device, inode, uid, gid, mode, links) = (0, 0, 0, 0, 0, 0); + ensure!( + uid == 0 && gid == 0 && mode == 0o400 && links == 1, + "parent-only descriptor source is not root-owned, 0400, and singly linked" + ); + Ok(ParentOnlyFileDescriptorObservation { + fd_number, + fd_name: fd_name.to_owned(), + source_path: source_path.to_owned(), + access: "read-only".into(), + device, + inode, + uid, + gid, + mode, + links, + size: metadata.len(), + sha256: sha256_reader(&mut file)?, + }) +} + +fn parent_only_open_file_properties( + descriptors: &[ParentOnlyFileDescriptorObservation], +) -> Result> { + ensure!( + descriptors.len() == 2 + && descriptors[0].fd_number == 3 + && descriptors[0].fd_name == IDUNN_RUNTIME_ACTIVATION_CREDENTIAL_NAME + && descriptors[1].fd_number == 4 + && descriptors[1].fd_name == RUNTIME_PRESENCE_IDENTITY_FD_NAME, + "parent-only descriptor set is not the exact ordered activation/presence pair" + ); + descriptors + .iter() + .map(|descriptor| { + validate_open_file_component(&descriptor.fd_name, "parent-only descriptor name")?; + validate_open_file_component( + &descriptor.source_path.as_os_str().to_string_lossy(), + "parent-only descriptor source", + )?; + ensure!( + descriptor.source_path.is_absolute() + && descriptor.access == "read-only" + && descriptor.uid == 0 + && descriptor.gid == 0 + && descriptor.mode == 0o400 + && descriptor.links == 1 + && descriptor.size > 0, + "parent-only descriptor metadata is outside the Idunn contract" + ); + Ok(format!( + "{}:{}:{}", + descriptor.source_path.display(), + descriptor.fd_name, + descriptor.access + )) + }) + .collect() +} + +fn validate_open_file_component(value: &str, label: &str) -> Result<()> { + ensure!( + !value.is_empty() && !value.contains(':') && !value.chars().any(char::is_control), + "{label} cannot be represented by systemd OpenFile" + ); + Ok(()) +} + +#[cfg(unix)] +fn ensure_activation_credential_root(path: &Path) -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + ensure!( + unsafe { libc::geteuid() } == 0, + "activation credential actuation requires root Idunn" + ); + ensure!( + path.is_absolute(), + "activation credential root is not absolute" + ); + let parent = path + .parent() + .context("activation credential root has no parent")?; + let parent_metadata = fs::symlink_metadata(parent).with_context(|| { + format!( + "inspecting activation credential parent {}", + parent.display() + ) + })?; + ensure!( + parent_metadata.is_dir() + && !parent_metadata.file_type().is_symlink() + && parent_metadata.uid() == 0 + && parent_metadata.permissions().mode() & 0o022 == 0 + && parent.canonicalize()? == parent, + "activation credential parent is not a canonical root-owned directory" + ); + match fs::symlink_metadata(path) { + Ok(metadata) => ensure!( + metadata.is_dir() + && !metadata.file_type().is_symlink() + && metadata.uid() == 0 + && metadata.gid() == 0 + && metadata.permissions().mode() & 0o777 == 0o700 + && path.canonicalize()? == path, + "activation credential root is not an exact root-only native directory" + ), + Err(error) if error.kind() == ErrorKind::NotFound => { + fs::create_dir(path).with_context(|| { + format!("creating activation credential root {}", path.display()) + })?; + fs::set_permissions(path, fs::Permissions::from_mode(0o700))?; + let metadata = fs::symlink_metadata(path)?; + ensure!( + metadata.is_dir() + && !metadata.file_type().is_symlink() + && metadata.uid() == 0 + && metadata.gid() == 0 + && metadata.permissions().mode() & 0o777 == 0o700, + "new activation credential root has the wrong authority" + ); + } + Err(error) => { + return Err(error).with_context(|| { + format!("inspecting activation credential root {}", path.display()) + }); + } + } + Ok(()) +} + +#[cfg(not(unix))] +fn ensure_activation_credential_root(_path: &Path) -> Result<()> { + bail!("systemd activation credentials require a Unix authority path") +} + +#[cfg(unix)] +fn validate_activation_credential_source(path: &Path) -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + let metadata = fs::symlink_metadata(path) + .with_context(|| format!("inspecting activation credential source {}", path.display()))?; + ensure!( + metadata.is_file() + && !metadata.file_type().is_symlink() + && metadata.uid() == 0 + && metadata.gid() == 0 + && metadata.permissions().mode() & 0o777 == 0o400 + && metadata.nlink() == 1 + && metadata.len() == 32, + "activation credential source is not one exact root-owned 0400 32-byte file" + ); + Ok(()) +} + +#[cfg(not(unix))] +fn validate_activation_credential_source(_path: &Path) -> Result<()> { + bail!("systemd activation credentials require Unix file authority") +} + +#[cfg(unix)] +fn validate_service_credential_sources(sources: &BTreeMap) -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + for (name, path) in sources { + ensure!( + path.is_absolute(), + "service credential {name} is not absolute" + ); + let parent = path + .parent() + .context("service credential source has no parent")?; + let parent_metadata = fs::symlink_metadata(parent).with_context(|| { + format!("inspecting service credential parent {}", parent.display()) + })?; + let metadata = fs::symlink_metadata(path) + .with_context(|| format!("inspecting service credential source {}", path.display()))?; + ensure!( + parent.canonicalize()? == parent + && parent_metadata.is_dir() + && !parent_metadata.file_type().is_symlink() + && parent_metadata.uid() == 0 + && parent_metadata.permissions().mode() & 0o022 == 0 + && path.canonicalize()? == path.as_path() + && metadata.is_file() + && !metadata.file_type().is_symlink() + && metadata.uid() == 0 + && metadata.gid() == 0 + && metadata.permissions().mode() & 0o777 == 0o400 + && metadata.nlink() == 1 + && metadata.len() > 0, + "service credential {name} is not one canonical root-owned 0400 file" + ); + } + Ok(()) +} + +#[cfg(not(unix))] +fn validate_service_credential_sources(_sources: &BTreeMap) -> Result<()> { + bail!("systemd service credentials require Unix file authority") +} + +fn remove_activation_credential_source(path: &Path) -> Result<()> { + match fs::symlink_metadata(path) { + Ok(metadata) => { + validate_activation_credential_source_for_removal(path, &metadata)?; + fs::remove_file(path).with_context(|| { + format!("deleting activation credential source {}", path.display()) + })?; + sync_parent_directory(path)?; + ensure!( + matches!(fs::symlink_metadata(path), Err(error) if error.kind() == ErrorKind::NotFound), + "activation credential source remained after deletion" + ); + Ok(()) + } + Err(error) if error.kind() == ErrorKind::NotFound => Ok(()), + Err(error) => Err(error) + .with_context(|| format!("inspecting activation credential source {}", path.display())), + } +} + +#[cfg(unix)] +fn validate_activation_credential_source_for_removal( + path: &Path, + metadata: &fs::Metadata, +) -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + let parent = path + .parent() + .context("activation credential source has no parent")?; + let parent_metadata = fs::symlink_metadata(parent)?; + ensure!( + parent_metadata.is_dir() + && !parent_metadata.file_type().is_symlink() + && parent_metadata.uid() == 0 + && parent_metadata.gid() == 0 + && parent_metadata.permissions().mode() & 0o777 == 0o700 + && metadata.is_file() + && !metadata.file_type().is_symlink() + && metadata.uid() == 0 + && metadata.gid() == 0 + && metadata.nlink() == 1 + && metadata.len() <= 32, + "refusing to delete a surprising activation credential source" + ); + Ok(()) +} + +#[cfg(not(unix))] +fn validate_activation_credential_source_for_removal( + _path: &Path, + _metadata: &fs::Metadata, +) -> Result<()> { + bail!("systemd activation credentials require Unix file authority") +} + +fn sync_parent_directory(path: &Path) -> Result<()> { + let parent = path.parent().context("file has no parent to synchronize")?; + let directory = open_native_read_only(parent)?; + directory + .sync_all() + .with_context(|| format!("synchronizing directory {}", parent.display())) +} + +fn open_native_read_only(path: &Path) -> Result { + let mut options = OpenOptions::new(); + options.read(true); + #[cfg(unix)] + { + use std::os::unix::fs::OpenOptionsExt; + options.custom_flags(libc::O_CLOEXEC | libc::O_NOFOLLOW); + } + Ok(options.open(path)?) +} + +fn open_proc_magic_link(path: &Path) -> Result { + let mut options = OpenOptions::new(); + options.read(true); + #[cfg(unix)] + { + use std::os::unix::fs::OpenOptionsExt; + options.custom_flags(libc::O_CLOEXEC); + } + options + .open(path) + .with_context(|| format!("opening procfs executable {}", path.display())) +} + +fn sha256_reader(reader: &mut impl Read) -> Result { + let mut digest = Sha256::new(); + let mut buffer = [0_u8; 64 * 1024]; + loop { + let read = reader.read(&mut buffer)?; + if read == 0 { + break; + } + digest.update(&buffer[..read]); + } + Ok(format!("sha256-{:x}", digest.finalize())) +} + +fn path_inside_process_root(process_root: &Path, absolute_path: &Path) -> Result { + ensure!( + process_root.is_absolute() && absolute_path.is_absolute(), + "process-root projection requires absolute paths" + ); + ensure!( + absolute_path.components().all(|component| matches!( + component, + std::path::Component::RootDir | std::path::Component::Normal(_) + )), + "process-root projection path is not normalized" + ); + Ok(process_root.join(absolute_path.strip_prefix(Path::new("/"))?)) +} + +fn linux_process_security( + status_path: &Path, + expected_host_pid: u32, +) -> Result { + let status = fs::read_to_string(status_path) + .with_context(|| format!("reading process status {}", status_path.display()))?; + let uids = linux_status_u32_array(&status, "Uid")?; + let gids = linux_status_u32_array(&status, "Gid")?; + let groups = linux_status_u32_values(&status, "Groups")?; + let cap_inheritable = linux_status_hex_u64(&status, "CapInh")?; + let cap_permitted = linux_status_hex_u64(&status, "CapPrm")?; + let cap_effective = linux_status_hex_u64(&status, "CapEff")?; + let cap_bounding = linux_status_hex_u64(&status, "CapBnd")?; + let cap_ambient = linux_status_hex_u64(&status, "CapAmb")?; + let no_new_privileges = match linux_status_value(&status, "NoNewPrivs")? { + "1" => true, + "0" => false, + _ => bail!("process NoNewPrivs value is invalid"), + }; + let namespace_pids = linux_status_u32_values(&status, "NSpid")?; + ensure!( + namespace_pids.first() == Some(&expected_host_pid), + "process status belongs to another host pid" + ); + Ok(LinuxProcessSecurityObservation { + uids, + gids, + groups, + cap_inheritable, + cap_permitted, + cap_effective, + cap_bounding, + cap_ambient, + no_new_privileges, + namespace_pids, + }) +} + +fn linux_status_value<'a>(status: &'a str, name: &str) -> Result<&'a str> { + let prefix = format!("{name}:"); + let matches = status + .lines() + .filter_map(|line| line.strip_prefix(&prefix)) + .collect::>(); + ensure!( + matches.len() == 1, + "process status has zero or duplicate {name} fields" + ); + Ok(matches[0].trim()) +} + +fn linux_status_u32_values(status: &str, name: &str) -> Result> { + linux_status_value(status, name)? + .split_whitespace() + .map(|value| { + value + .parse::() + .with_context(|| format!("process status {name} value is not a u32")) + }) + .collect() +} + +fn linux_status_u32_array(status: &str, name: &str) -> Result<[u32; 4]> { + linux_status_u32_values(status, name)? + .try_into() + .map_err(|_| anyhow::anyhow!("process status {name} does not have four values")) +} + +fn linux_status_hex_u64(status: &str, name: &str) -> Result { + u64::from_str_radix(linux_status_value(status, name)?, 16) + .with_context(|| format!("process status {name} value is not hexadecimal")) +} + +fn linux_namespace_id(path: &Path, kind: &str) -> Result { + let target = fs::read_link(path) + .with_context(|| format!("reading Linux namespace link {}", path.display()))?; + let target = target + .to_str() + .context("Linux namespace link is not UTF-8")?; + let prefix = format!("{kind}:["); + let id = target + .strip_prefix(&prefix) + .and_then(|value| value.strip_suffix(']')) + .context("Linux namespace link has an unexpected shape")?; + let id = id + .parse::() + .context("Linux namespace id is not a u64")?; + ensure!(id > 0, "Linux namespace id is zero"); + Ok(id) +} + +#[cfg(unix)] +fn resolve_group_id(group: &str) -> Result { + use std::ffi::CString; + + if let Ok(group_id) = group.parse::() { + ensure!(group_id > 0, "state group must be unprivileged"); + return Ok(group_id); + } + let group = CString::new(group).context("state group contains a NUL byte")?; + let mut buffer_size = 16_384_usize; + loop { + let mut entry = std::mem::MaybeUninit::::uninit(); + let mut result = std::ptr::null_mut(); + let mut buffer = vec![0_u8; buffer_size]; + let status = unsafe { + libc::getgrnam_r( + group.as_ptr(), + entry.as_mut_ptr(), + buffer.as_mut_ptr().cast(), + buffer.len(), + &mut result, + ) + }; + if status == libc::ERANGE && buffer_size < 1_048_576 { + buffer_size *= 2; + continue; + } + ensure!( + status == 0, + "resolving state group failed with errno {status}" + ); + ensure!(!result.is_null(), "configured state group does not exist"); + let entry = unsafe { entry.assume_init() }; + ensure!(entry.gr_gid > 0, "state group must be unprivileged"); + return Ok(entry.gr_gid); + } +} + +#[cfg(not(unix))] +fn resolve_group_id(_group: &str) -> Result { + bail!("systemd workload groups require a Unix actuator") +} + +#[cfg(unix)] +fn validate_workload_writable_path( + path: &Path, + state_group_id: u32, + require_setgid: bool, +) -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + let metadata = fs::symlink_metadata(path) + .with_context(|| format!("inspecting workload writable path {}", path.display()))?; + let mode = metadata.permissions().mode(); + ensure!( + !metadata.file_type().is_symlink() + && metadata.uid() == 0 + && metadata.gid() == state_group_id + && mode & 0o002 == 0, + "workload writable path {} is not preprovisioned root:state-group without world write", + path.display() + ); + if metadata.is_dir() { + ensure!( + mode & 0o070 == 0o070 && (!require_setgid || mode & 0o2000 != 0), + "workload writable directory {} lacks group access or setgid inheritance", + path.display() + ); + } else { + ensure!( + metadata.is_file() && mode & 0o060 == 0o060, + "workload writable file is special or lacks group access" + ); + } + Ok(()) +} + +#[cfg(not(unix))] +fn validate_workload_writable_path( + _path: &Path, + _state_group_id: u32, + _require_setgid: bool, +) -> Result<()> { + bail!("systemd workload writable paths require Unix permissions") +} + +fn linux_process_start_time(stat_path: &Path) -> Result { + let stat = fs::read_to_string(stat_path) + .with_context(|| format!("reading process stat {}", stat_path.display()))?; + let close = stat + .rfind(')') + .context("process stat has no command terminator")?; + let fields = stat[close + 1..].split_whitespace().collect::>(); + fields + .get(19) + .context("process stat has no start-time field")? + .parse() + .context("process start-time field is not a u64") +} + +fn required_systemd_property<'a>( + values: &'a BTreeMap, + name: &str, +) -> Result<&'a str> { + let value = systemd_property(values, name)?; + ensure!(!value.is_empty(), "systemd unit has no {name}"); + Ok(value) +} + +fn systemd_property<'a>(values: &'a BTreeMap, name: &str) -> Result<&'a str> { + values + .get(name) + .map(String::as_str) + .with_context(|| format!("systemd unit did not expose {name}")) +} + +fn parse_systemd_boolean(values: &BTreeMap, name: &str) -> Result { + match systemd_property(values, name)? { + "yes" => Ok(true), + "no" => Ok(false), + _ => bail!("systemd unit exposed a non-boolean {name}"), + } +} + +fn read_process_environment(path: &Path) -> Result>> { + let bytes = fs::read(path) + .with_context(|| format!("reading process environment {}", path.display()))?; + Ok(bytes + .split(|byte| *byte == 0) + .filter(|entry| !entry.is_empty()) + .map(<[u8]>::to_vec) + .collect()) +} + +fn required_process_environment_value<'a>(entries: &'a [Vec], name: &str) -> Result<&'a str> { + let prefix = format!("{name}=").into_bytes(); + let matches = entries + .iter() + .filter_map(|entry| entry.strip_prefix(prefix.as_slice())) + .collect::>(); + ensure!( + matches.len() == 1, + "process environment has zero or duplicate {name} values" + ); + let value = std::str::from_utf8(matches[0]) + .with_context(|| format!("process environment {name} is not UTF-8"))?; + ensure!(!value.is_empty(), "process environment {name} is empty"); + Ok(value) +} + +fn select_process_environment( + entries: &[Vec], + names: &[String], +) -> Result> { + ensure!( + names.windows(2).all(|pair| pair[0] < pair[1]), + "workload environment witness names are not unique and sorted" + ); + let mut selected = BTreeMap::new(); + for name in names { + let prefix = format!("{name}=").into_bytes(); + let matches = entries + .iter() + .filter(|entry| entry.starts_with(&prefix)) + .collect::>(); + ensure!( + matches.len() == 1, + "workload process environment has missing or duplicate {name}" + ); + let value = std::str::from_utf8(&matches[0][prefix.len()..]) + .with_context(|| format!("workload environment {name} is not UTF-8"))?; + selected.insert(name.clone(), value.to_owned()); + } + Ok(selected) +} + +fn proc_command_line(command: &[OsString]) -> Vec { + let mut encoded = Vec::new(); + for argument in command { + encoded.extend_from_slice(argument.as_encoded_bytes()); + encoded.push(0); + } + encoded +} + +fn endpoint_host_port(endpoint: &str, scheme: &str) -> Result<(String, u16)> { + let authority = endpoint + .strip_prefix(scheme) + .with_context(|| format!("endpoint does not use {scheme}"))?; + ensure!( + !authority + .chars() + .any(|character| matches!(character, '/' | '?' | '#' | '@')) + && !authority.starts_with('['), + "route endpoint is not a plain host and port" + ); + let (host, port) = authority + .rsplit_once(':') + .context("route endpoint has no port")?; + ensure!( + !host.is_empty() + && host + .bytes() + .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'-')), + "route endpoint host is invalid" + ); + let port: u16 = port.parse().context("route endpoint port is not a u16")?; + ensure!(port > 0, "route endpoint port is zero"); + Ok((host.to_owned(), port)) +} + +fn nginx_identifier(route_id: &str) -> Result { + ensure!(!route_id.is_empty(), "nginx route id is empty"); + let mut identifier = String::from("idunn_"); + for byte in route_id.bytes() { + match byte { + b'a'..=b'z' | b'A'..=b'Z' | b'0'..=b'9' | b'_' => { + identifier.push(char::from(byte)); + } + b'-' | b'.' => identifier.push('_'), + _ => bail!("route id cannot lower to an nginx identifier"), + } + } + Ok(identifier) +} + +fn atomic_replace(path: &Path, bytes: &[u8]) -> Result<()> { + #[cfg(unix)] + use std::os::unix::fs::{OpenOptionsExt, PermissionsExt}; + + ensure!(path.is_absolute(), "route path is not absolute"); + let parent = path.parent().context("route path has no parent")?; + ensure_route_authority_parent(parent)?; + match fs::symlink_metadata(path) { + Ok(_) => validate_root_owned_file(path, 0o644)?, + Err(error) if error.kind() == ErrorKind::NotFound => {} + Err(error) => return Err(error).context("inspecting route fragment"), + } + let file_name = path + .file_name() + .context("route path has no file name")? + .to_string_lossy(); + let temporary = parent.join(format!(".{file_name}.idunn-{}", Uuid::new_v4())); + let mut options = fs::OpenOptions::new(); + options.create_new(true).write(true); + #[cfg(unix)] + options.mode(0o644); + let mut file = options + .open(&temporary) + .with_context(|| format!("creating route stage {}", temporary.display()))?; + #[cfg(unix)] + file.set_permissions(fs::Permissions::from_mode(0o644))?; + file.write_all(bytes)?; + file.sync_all()?; + drop(file); + validate_root_owned_file(&temporary, 0o644)?; + if let Err(error) = fs::rename(&temporary, path) { + let _ = fs::remove_file(&temporary); + return Err(error).with_context(|| format!("publishing route {}", path.display())); + } + sync_parent_directory(path)?; + validate_root_owned_file(path, 0o644) +} + +#[cfg(unix)] +fn ensure_route_authority_parent(path: &Path) -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + ensure!( + unsafe { libc::geteuid() } == 0, + "route actuation requires root Idunn" + ); + ensure!(path.is_absolute(), "route authority parent is not absolute"); + if !path.exists() { + let ancestor = path + .parent() + .context("route authority parent has no ancestor")?; + let ancestor_metadata = fs::symlink_metadata(ancestor)?; + ensure!( + ancestor.canonicalize()? == ancestor + && ancestor_metadata.is_dir() + && !ancestor_metadata.file_type().is_symlink() + && ancestor_metadata.uid() == 0 + && ancestor_metadata.permissions().mode() & 0o022 == 0, + "route authority ancestor is not canonical root-owned and nonwritable" + ); + fs::create_dir(path)?; + fs::set_permissions(path, fs::Permissions::from_mode(0o755))?; + } + let metadata = fs::symlink_metadata(path)?; + ensure!( + path.canonicalize()? == path + && metadata.is_dir() + && !metadata.file_type().is_symlink() + && metadata.uid() == 0 + && metadata.gid() == 0 + && metadata.permissions().mode() & 0o022 == 0, + "route authority parent is not canonical root-owned and nonwritable" + ); + Ok(()) +} + +#[cfg(not(unix))] +fn ensure_route_authority_parent(_path: &Path) -> Result<()> { + bail!("nginx route actuation requires Unix file authority") +} + +#[cfg(unix)] +fn ensure_route_preflight_root(path: &Path) -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + ensure!(path.is_absolute(), "route preflight root is not absolute"); + if !path.exists() { + let parent = path + .parent() + .context("route preflight root has no parent")?; + ensure_route_authority_parent(parent)?; + fs::create_dir(path)?; + fs::set_permissions(path, fs::Permissions::from_mode(0o700))?; + } + let metadata = fs::symlink_metadata(path)?; + ensure!( + unsafe { libc::geteuid() } == 0 + && path.canonicalize()? == path + && metadata.is_dir() + && !metadata.file_type().is_symlink() + && metadata.uid() == 0 + && metadata.gid() == 0 + && metadata.permissions().mode() & 0o777 == 0o700, + "route preflight root is not one canonical root-only directory" + ); + Ok(()) +} + +#[cfg(not(unix))] +fn ensure_route_preflight_root(_path: &Path) -> Result<()> { + bail!("nginx route preflight requires Unix file authority") +} + +#[cfg(unix)] +fn write_root_owned_file(path: &Path, bytes: &[u8], mode: u32) -> Result<()> { + use std::os::unix::fs::{OpenOptionsExt, PermissionsExt}; + + let mut options = OpenOptions::new(); + options.create_new(true).write(true).mode(mode); + let mut file = options.open(path)?; + file.set_permissions(fs::Permissions::from_mode(mode))?; + file.write_all(bytes)?; + file.sync_all()?; + drop(file); + sync_parent_directory(path)?; + validate_root_owned_file(path, mode) +} + +#[cfg(not(unix))] +fn write_root_owned_file(_path: &Path, _bytes: &[u8], _mode: u32) -> Result<()> { + bail!("root-owned route material requires Unix file authority") +} + +#[cfg(unix)] +fn validate_root_owned_file(path: &Path, mode: u32) -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + let metadata = fs::symlink_metadata(path)?; + ensure!( + path.canonicalize()? == path + && metadata.is_file() + && !metadata.file_type().is_symlink() + && metadata.uid() == 0 + && metadata.gid() == 0 + && metadata.permissions().mode() & 0o777 == mode + && metadata.nlink() == 1, + "route authority material is not one canonical root-owned file" + ); + Ok(()) +} + +#[cfg(not(unix))] +fn validate_root_owned_file(_path: &Path, _mode: u32) -> Result<()> { + bail!("root-owned route material requires Unix file authority") +} + +fn remove_exact_root_owned_file(path: &Path, mode: u32) -> Result<()> { + validate_root_owned_file(path, mode)?; + fs::remove_file(path)?; + sync_parent_directory(path) +} + +fn bind_mount(source: &Path, destination: &str, read_only: bool) -> Result { + ensure!(source.is_absolute(), "Docker bind source is not absolute"); + let text = source.to_str().context("Docker bind source is not UTF-8")?; + ensure!( + !text + .chars() + .any(|character| matches!(character, ',' | '\n' | '\r')), + "Docker bind source contains a forbidden mount character" + ); + let read_only = if read_only { ",readonly" } else { "" }; + Ok(OsString::from(format!( + "type=bind,src={text},dst={destination}{read_only}" + ))) +} + +fn systemd_read_only_bind_property(source: &Path, destination: &Path) -> Result { + ensure!( + source.is_absolute() && destination.is_absolute(), + "systemd bind paths are not absolute" + ); + let source = source + .to_str() + .context("systemd bind source is not UTF-8")?; + let destination = destination + .to_str() + .context("systemd bind destination is not UTF-8")?; + ensure!( + [source, destination] + .iter() + .all(|path| !path.contains([':', '\n', '\r', '\0'])), + "systemd bind path contains an unescaped property delimiter" + ); + Ok(OsString::from(format!( + "--property=BindReadOnlyPaths={source}:{destination}" + ))) +} + +fn normalized_relative(path: &Path) -> Result { + ensure!(path.is_relative(), "runner path is not relative"); + let mut parts = Vec::new(); + for component in path.components() { + match component { + std::path::Component::CurDir => {} + std::path::Component::Normal(value) => parts.push( + value + .to_str() + .context("runner path contains non-UTF-8")? + .to_owned(), + ), + _ => bail!("runner path escapes its workspace"), + } + } + Ok(parts.join("/")) +} + +fn copy_tree(source: &Path, destination: &Path) -> Result<()> { + ensure!(source.is_dir(), "source tree is not a directory"); + ensure!(!destination.exists(), "destination tree already exists"); + fs::create_dir_all(destination)?; + copy_tree_contents(source, destination) +} + +fn copy_tree_contents(source: &Path, destination: &Path) -> Result<()> { + let mut entries = fs::read_dir(source)?.collect::>>()?; + entries.sort_by_key(|entry| entry.file_name()); + for entry in entries { + let source_path = entry.path(); + let destination_path = destination.join(entry.file_name()); + let metadata = fs::symlink_metadata(&source_path)?; + if metadata.is_dir() { + fs::create_dir(&destination_path)?; + copy_tree_contents(&source_path, &destination_path)?; + } else if metadata.is_file() { + fs::copy(&source_path, &destination_path)?; + } else if metadata.file_type().is_symlink() { + copy_symlink(&source_path, &destination_path)?; + } else { + bail!("source tree contains a special filesystem entry") + } + } + Ok(()) +} + +#[cfg(unix)] +fn copy_symlink(source: &Path, destination: &Path) -> Result<()> { + std::os::unix::fs::symlink(fs::read_link(source)?, destination)?; + Ok(()) +} + +#[cfg(windows)] +fn copy_symlink(source: &Path, destination: &Path) -> Result<()> { + let target = fs::read_link(source)?; + if source.is_dir() { + std::os::windows::fs::symlink_dir(target, destination)?; + } else { + std::os::windows::fs::symlink_file(target, destination)?; + } + Ok(()) +} + +fn copy_artifact(source: &Path, destination: &Path) -> Result<()> { + let metadata = fs::symlink_metadata(source)?; + if metadata.is_dir() { + copy_tree(source, destination) + } else if metadata.is_file() { + if let Some(parent) = destination.parent() { + fs::create_dir_all(parent)?; + } + fs::copy(source, destination)?; + Ok(()) + } else { + bail!("artifact output is not a regular file or directory") + } +} + +fn digest_artifact(path: &Path) -> Result<(String, u64)> { + let metadata = fs::symlink_metadata(path)?; + if metadata.is_file() { + let bytes = fs::read(path)?; + return Ok((raw_sha256(&bytes), bytes.len().try_into()?)); + } + ensure!(metadata.is_dir(), "artifact is not a file or directory"); + let mut hasher = Sha256::new(); + let mut size = 0_u64; + digest_tree(path, path, &mut hasher, &mut size)?; + ensure!(size > 0, "artifact directory has no file content"); + Ok((format!("{:x}", hasher.finalize()), size)) +} + +fn digest_tree(root: &Path, current: &Path, hasher: &mut Sha256, size: &mut u64) -> Result<()> { + let mut entries = fs::read_dir(current)?.collect::>>()?; + entries.sort_by_key(|entry| entry.file_name()); + for entry in entries { + let path = entry.path(); + let relative = path.strip_prefix(root)?; + let relative = normalized_relative(relative)?; + let metadata = fs::symlink_metadata(&path)?; + if metadata.is_dir() { + hasher.update(b"dir\0"); + hasher.update(relative.as_bytes()); + hasher.update(b"\0"); + digest_tree(root, &path, hasher, size)?; + } else if metadata.is_file() { + let bytes = fs::read(&path)?; + hasher.update(b"file\0"); + hasher.update(relative.as_bytes()); + hasher.update(b"\0"); + hasher.update((bytes.len() as u64).to_le_bytes()); + hasher.update(&bytes); + *size = size.saturating_add(bytes.len().try_into()?); + } else if metadata.file_type().is_symlink() { + let target = fs::read_link(&path)?; + hasher.update(b"link\0"); + hasher.update(relative.as_bytes()); + hasher.update(b"\0"); + hasher.update(target.as_os_str().as_encoded_bytes()); + *size = size.saturating_add(target.as_os_str().len().try_into()?); + } else { + bail!("artifact tree contains a special filesystem entry") + } + } + Ok(()) +} + +fn raw_sha256(bytes: &[u8]) -> String { + format!("{:x}", Sha256::digest(bytes)) +} + +fn remove_tree_inside(root: &Path, target: &Path) -> Result<()> { + let root = root.canonicalize()?; + let target = target.canonicalize()?; + ensure!( + target.starts_with(&root) && target != root, + "refusing broad tree removal" + ); + fs::remove_dir_all(&target) + .with_context(|| format!("removing disposable runner workspace {}", target.display())) +} + +fn sha256_id(bytes: &[u8]) -> String { + format!("sha256-{:x}", Sha256::digest(bytes)) +} + +fn require_git_sha(value: &str, label: &str) -> Result<()> { + ensure!( + value.len() == 40 + && value + .bytes() + .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte)), + "{label} is not a lowercase SHA-1 object id" + ); + Ok(()) +} + +fn require_sha256_id(value: &str, label: &str) -> Result<()> { + let digest = value + .strip_prefix("sha256-") + .with_context(|| format!("{label} has no sha256 prefix"))?; + ensure!( + digest.len() == 64 + && digest + .bytes() + .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte)), + "{label} is not a lowercase SHA-256 id" + ); + Ok(()) +} + +fn require_driver_id(value: &str, label: &str) -> Result<()> { + ensure!( + !value.is_empty() + && value.len() <= 128 + && value + .bytes() + .all(|byte| { byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-') }), + "{label} id is invalid" + ); + Ok(()) +} + +fn ensure_source_directory_tree( + root: &Path, + directory: &Path, + identity: Option, +) -> Result<()> { + ensure!( + directory.starts_with(root), + "source directory escaped Idunn's source authority root" + ); + ensure_source_directory(root, identity)?; + let relative = directory.strip_prefix(root)?; + let mut current = root.to_owned(); + for component in relative.components() { + let std::path::Component::Normal(component) = component else { + bail!("source directory is not normalized") + }; + current.push(component); + ensure_source_directory(¤t, identity)?; + } + Ok(()) +} + +fn container_identity(value: &str) -> Result { + let (uid, gid) = value + .split_once(':') + .context("runner user is not numeric UID:GID")?; + let identity = ProcessIdentity { + uid: uid.parse().context("runner UID is not a u32")?, + gid: gid.parse().context("runner GID is not a u32")?, + }; + ensure!( + identity.uid > 0 && identity.gid > 0, + "runner identity must be unprivileged" + ); + Ok(identity) +} + +#[cfg(unix)] +fn ensure_runner_cache_root(path: &Path, identity: ProcessIdentity) -> Result<()> { + use std::os::unix::ffi::OsStrExt; + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + ensure!( + unsafe { libc::geteuid() } == 0, + "runner cache admission requires root Idunn" + ); + let parent = path.parent().context("runner cache root has no parent")?; + let parent_metadata = fs::symlink_metadata(parent) + .with_context(|| format!("inspecting runner cache parent {}", parent.display()))?; + ensure!( + parent_metadata.is_dir() + && !parent_metadata.file_type().is_symlink() + && parent_metadata.uid() == 0 + && parent_metadata.permissions().mode() & 0o022 == 0, + "runner cache parent is not root-owned and nonwritable" + ); + match fs::symlink_metadata(path) { + Ok(metadata) => ensure!( + metadata.is_dir() + && !metadata.file_type().is_symlink() + && metadata.uid() == identity.uid + && metadata.gid() == identity.gid + && metadata.permissions().mode() & 0o777 == 0o700, + "runner cache is not a dedicated exact-identity 0700 directory" + ), + Err(error) if error.kind() == ErrorKind::NotFound => { + fs::create_dir(path) + .with_context(|| format!("creating runner cache {}", path.display()))?; + let path_c = std::ffi::CString::new(path.as_os_str().as_bytes()) + .context("runner cache path contains a NUL byte")?; + if unsafe { libc::lchown(path_c.as_ptr(), identity.uid, identity.gid) } != 0 { + return Err(std::io::Error::last_os_error()) + .context("assigning runner cache owner"); + } + fs::set_permissions(path, fs::Permissions::from_mode(0o700))?; + } + Err(error) => { + return Err(error) + .with_context(|| format!("inspecting runner cache {}", path.display())); + } + } + Ok(()) +} + +#[cfg(not(unix))] +fn ensure_runner_cache_root(_path: &Path, _identity: ProcessIdentity) -> Result<()> { + bail!("runner cache admission requires a Unix actuator") +} + +#[cfg(unix)] +fn validate_runner_secret(path: &Path, identity: ProcessIdentity) -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + ensure!( + unsafe { libc::geteuid() } == 0, + "runner secret admission requires root Idunn" + ); + let parent = path.parent().context("runner secret has no parent")?; + let parent_metadata = fs::symlink_metadata(parent) + .with_context(|| format!("inspecting runner secret parent {}", parent.display()))?; + let metadata = fs::symlink_metadata(path) + .with_context(|| format!("inspecting runner secret {}", path.display()))?; + ensure!( + parent_metadata.is_dir() + && !parent_metadata.file_type().is_symlink() + && parent_metadata.uid() == 0 + && parent_metadata.permissions().mode() & 0o022 == 0, + "runner secret parent is not root-owned and nonwritable" + ); + ensure!( + metadata.is_file() + && !metadata.file_type().is_symlink() + && metadata.uid() == 0 + && metadata.gid() == identity.gid + && metadata.permissions().mode() & 0o777 == 0o440, + "runner secret is not root-owned, exact-group-bound, and 0440" + ); + Ok(()) +} + +#[cfg(not(unix))] +fn validate_runner_secret(_path: &Path, _identity: ProcessIdentity) -> Result<()> { + bail!("runner secret admission requires a Unix actuator") +} + +#[cfg(unix)] +fn assign_runner_tree(path: &Path, identity: ProcessIdentity) -> Result<()> { + use std::os::unix::ffi::OsStrExt; + use std::os::unix::fs::PermissionsExt; + + ensure!( + unsafe { libc::geteuid() } == 0, + "runner workspace ownership requires root Idunn" + ); + let metadata = fs::symlink_metadata(path)?; + if metadata.is_dir() { + let mut entries = fs::read_dir(path)?.collect::>>()?; + entries.sort_by_key(|entry| entry.file_name()); + for entry in entries { + assign_runner_tree(&entry.path(), identity)?; + } + fs::set_permissions(path, fs::Permissions::from_mode(0o750))?; + } else if metadata.is_file() { + let executable = metadata.permissions().mode() & 0o111 != 0; + fs::set_permissions( + path, + fs::Permissions::from_mode(if executable { 0o750 } else { 0o640 }), + )?; + } else if !metadata.file_type().is_symlink() { + bail!("runner workspace contains a special filesystem entry") + } + let path_c = std::ffi::CString::new(path.as_os_str().as_bytes()) + .context("runner workspace path contains a NUL byte")?; + let result = unsafe { libc::lchown(path_c.as_ptr(), identity.uid, identity.gid) }; + if result != 0 { + return Err(std::io::Error::last_os_error()).context("assigning runner workspace owner"); + } + Ok(()) +} + +#[cfg(not(unix))] +fn assign_runner_tree(_path: &Path, _identity: ProcessIdentity) -> Result<()> { + bail!("non-root runner identities require a Unix actuator") +} + +fn ensure_source_directory(path: &Path, identity: Option) -> Result<()> { + match fs::symlink_metadata(path) { + Ok(metadata) => { + ensure!( + metadata.is_dir() && !metadata.file_type().is_symlink(), + "source authority path {} is not a native directory", + path.display() + ); + validate_source_directory_owner(path, &metadata, identity) + } + Err(error) if error.kind() == ErrorKind::NotFound => { + let parent = path + .parent() + .context("source authority directory has no parent")?; + ensure!( + parent.is_dir(), + "source authority parent {} is absent", + parent.display() + ); + fs::create_dir(path).with_context(|| { + format!("creating source authority directory {}", path.display()) + })?; + assign_source_directory_owner(path, identity)?; + let metadata = fs::symlink_metadata(path)?; + validate_source_directory_owner(path, &metadata, identity) + } + Err(error) => Err(error) + .with_context(|| format!("inspecting source authority path {}", path.display())), + } +} + +fn authority_lock_path(path: &Path) -> PathBuf { + let mut lock = path.as_os_str().to_os_string(); + lock.push(".lock"); + PathBuf::from(lock) +} + +#[cfg(unix)] +fn validate_root_authority_path(path: &Path) -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + ensure!( + unsafe { libc::geteuid() } == 0, + "process write-lease actuation requires root Idunn" + ); + let parent = path + .parent() + .context("process write-lease path has no parent")?; + let parent_metadata = fs::symlink_metadata(parent) + .with_context(|| format!("inspecting write-lease parent {}", parent.display()))?; + ensure!( + parent_metadata.is_dir() + && !parent_metadata.file_type().is_symlink() + && parent_metadata.uid() == 0 + && parent_metadata.permissions().mode() & 0o022 == 0, + "write-lease parent is not root-owned and service-nonwritable" + ); + for authority_file in [path.to_owned(), authority_lock_path(path)] { + match fs::symlink_metadata(&authority_file) { + Ok(metadata) => ensure!( + metadata.is_file() + && !metadata.file_type().is_symlink() + && metadata.uid() == 0 + && metadata.gid() == parent_metadata.gid() + && metadata.permissions().mode() & 0o022 == 0, + "write-lease authority file {} is not root-owned and service-nonwritable", + authority_file.display() + ), + Err(error) if error.kind() == ErrorKind::NotFound => {} + Err(error) => { + return Err(error).with_context(|| { + format!( + "inspecting write-lease authority file {}", + authority_file.display() + ) + }); + } + } + } + Ok(()) +} + +#[cfg(not(unix))] +fn validate_root_authority_path(_path: &Path) -> Result<()> { + bail!("process write-lease actuation requires a Unix authority path") +} + +#[cfg(unix)] +fn harden_root_authority_file(path: &Path) -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + let parent = path + .parent() + .context("process write-lease authority file has no parent")?; + let parent_metadata = fs::symlink_metadata(parent)?; + let metadata = fs::symlink_metadata(path)?; + ensure!( + metadata.is_file() + && !metadata.file_type().is_symlink() + && metadata.uid() == 0 + && metadata.gid() == parent_metadata.gid(), + "new write-lease authority file has the wrong owner" + ); + fs::set_permissions(path, fs::Permissions::from_mode(0o640))?; + Ok(()) +} + +#[cfg(not(unix))] +fn harden_root_authority_file(_path: &Path) -> Result<()> { + bail!("process write-lease actuation requires Unix permissions") +} + +#[cfg(unix)] +fn assign_source_directory_owner(path: &Path, identity: Option) -> Result<()> { + use std::os::unix::ffi::OsStrExt; + use std::os::unix::fs::PermissionsExt; + + if let Some(identity) = identity { + let path = std::ffi::CString::new(path.as_os_str().as_bytes()) + .context("source authority path contains a NUL byte")?; + let result = unsafe { libc::chown(path.as_ptr(), identity.uid, identity.gid) }; + if result != 0 { + return Err(std::io::Error::last_os_error()) + .context("assigning source authority directory owner"); + } + } + fs::set_permissions(path, fs::Permissions::from_mode(0o750))?; + Ok(()) +} + +#[cfg(not(unix))] +fn assign_source_directory_owner(_path: &Path, identity: Option) -> Result<()> { + ensure!( + identity.is_none(), + "configured source identities require a Unix actuator" + ); + Ok(()) +} + +#[cfg(unix)] +fn validate_source_directory_owner( + path: &Path, + metadata: &fs::Metadata, + identity: Option, +) -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + let expected = identity.unwrap_or(ProcessIdentity { + uid: unsafe { libc::geteuid() }, + gid: unsafe { libc::getegid() }, + }); + ensure!( + metadata.uid() == expected.uid && metadata.gid() == expected.gid, + "source authority directory {} has the wrong owner", + path.display() + ); + ensure!( + metadata.permissions().mode() & 0o200 != 0, + "source authority directory {} is not owner-writable", + path.display() + ); + Ok(()) +} + +#[cfg(not(unix))] +fn validate_source_directory_owner( + _path: &Path, + _metadata: &fs::Metadata, + identity: Option, +) -> Result<()> { + ensure!( + identity.is_none(), + "configured source identities require a Unix actuator" + ); + Ok(()) +} + +fn apply_identity(command: &mut Command, identity: Option) -> Result<()> { + let Some(identity) = identity else { + return Ok(()); + }; + #[cfg(unix)] + { + use std::os::unix::process::CommandExt; + ensure!( + identity.uid > 0 && identity.gid > 0, + "configured source identity must be unprivileged" + ); + unsafe { + command.pre_exec(move || { + if libc::setgroups(0, std::ptr::null()) != 0 { + return Err(std::io::Error::last_os_error()); + } + if libc::setgid(identity.gid) != 0 { + return Err(std::io::Error::last_os_error()); + } + if libc::setuid(identity.uid) != 0 { + return Err(std::io::Error::last_os_error()); + } + Ok(()) + }); + } + Ok(()) + } + #[cfg(not(unix))] + { + let _ = command; + let _ = identity; + bail!("configured process identities require a Unix actuator") + } +} + +#[cfg(test)] +mod tests { + use super::*; + use cultnet_rs::{ + GameCultProviderHealthIdentity, IDUNN_EXPECTED_INCARNATION_SCHEMA, + IDUNN_PROCESS_WRITE_LEASE_SCHEMA, IdunnServiceIdentity, + OdinRuntimeTopologyCorrelationPurpose, OdinTopologyAuthenticationContext, + OdinTopologyIdentity, authenticate_odin_runtime_topology_correlation, + enroll_service_identity_at, verify_runtime_authority, + }; + + fn digest(byte: char) -> String { + format!("sha256-{}", byte.to_string().repeat(64)) + } + + fn parent_only_descriptor( + fd_number: u32, + fd_name: &str, + source: &str, + ) -> ParentOnlyFileDescriptorObservation { + ParentOnlyFileDescriptorObservation { + fd_number, + fd_name: fd_name.into(), + source_path: PathBuf::from(source), + access: "read-only".into(), + device: 1, + inode: u64::from(fd_number), + uid: 0, + gid: 0, + mode: 0o400, + links: 1, + size: 32, + sha256: digest('a'), + } + } + + #[test] + fn signer_sources_lower_to_exactly_two_ordered_parent_only_open_files() -> Result<()> { + let activation = parent_only_descriptor( + 3, + IDUNN_RUNTIME_ACTIVATION_CREDENTIAL_NAME, + "/run/idunn/activation-credentials/activation.credential", + ); + let presence = parent_only_descriptor( + 4, + RUNTIME_PRESENCE_IDENTITY_FD_NAME, + "/etc/gamecult/service/runtime-presence-identity.cc", + ); + assert_eq!( + parent_only_open_file_properties(&[activation.clone(), presence.clone()])?, + vec![ + "/run/idunn/activation-credentials/activation.credential:gamecult-idunn-runtime-activation-key:read-only", + "/etc/gamecult/service/runtime-presence-identity.cc:gamecult-runtime-presence-identity:read-only", + ] + ); + assert!(parent_only_open_file_properties(&[presence, activation]).is_err()); + Ok(()) + } + + #[cfg(unix)] + fn git_at(repository: &Path, arguments: &[&str]) -> Result { + let output = Command::new("/usr/bin/git") + .arg("-C") + .arg(repository) + .args(arguments) + .env_clear() + .env("HOME", repository) + .env("PATH", "/usr/bin:/bin") + .env("GIT_CONFIG_NOSYSTEM", "1") + .env("LANG", "C.UTF-8") + .output()?; + ensure!( + output.status.success(), + "test Git failed: {}", + String::from_utf8_lossy(&output.stderr).trim() + ); + Ok(String::from_utf8(output.stdout)?.trim().to_owned()) + } + + fn expected() -> IdunnExpectedIncarnationRecord { + IdunnExpectedIncarnationRecord { + schema_version: IDUNN_EXPECTED_INCARNATION_SCHEMA.into(), + target: "service".into(), + plan_id: digest('1'), + incarnation_id: "incarnation-1".into(), + sealed_release_id: digest('2'), + source_repository: "github.com/GameCult/Service".into(), + source_revision: "3".repeat(40), + recipe_sha256: digest('4'), + runtime_id: "service-runtime".into(), + expected_signer_identity_id: "service-signer".into(), + health_contract: "service.health.v1".into(), + artifact_sha256: digest('5'), + state_schema_generation: Some("state-v1".into()), + state_contract_sha256: Some(digest('6')), + write_lease_required: true, + route: None, + capabilities: Vec::new(), + dependencies: Vec::new(), + } + } + + fn authenticated_warming( + root: &Path, + ) -> Result<( + IdunnExpectedIncarnationRecord, + IdunnRuntimeActivationRecord, + SequenceAdmittedWarming, + ServiceIdentityTrustAnchor, + )> { + let provider = enroll_service_identity_at::( + &root.join("provider.cc"), + )?; + let idunn = enroll_service_identity_at::(&root.join("idunn.cc"))?; + let odin = enroll_service_identity_at::(&root.join("odin.cc"))?; + let mut expected = expected(); + expected.expected_signer_identity_id = provider.entry().identity_id.clone(); + let launch = IdunnRuntimeActivationLaunch::issue(&expected, digest('7'), 100, &idunn)?; + let activation = launch.activation().clone(); + launch.write_credential(std::io::sink())?; + let authority = verify_runtime_authority( + &expected, + &activation, + &idunn.trust_anchor()?, + &provider.entry().public_key, + )?; + let mut warming = OdinRuntimeTopologyCorrelationRecord { + schema_version: ODIN_RUNTIME_TOPOLOGY_CORRELATION_SCHEMA.into(), + target: expected.target.clone(), + expected_projection_sha256: expected.canonical_sha256()?, + expected: true, + current_activation_sha256: Some(activation.canonical_sha256()?), + signed_presence_sha256: Some(digest('9')), + observed_presence_state: Some("warming".into()), + observed_presence_publisher_sequence: Some(1), + observed_write_lease_sha256: None, + observed_capabilities: Vec::new(), + runtime_id: expected.runtime_id.clone(), + runtime_instance_id: Some(activation.runtime_instance_id.clone()), + present: true, + ready: false, + dependencies: Vec::new(), + disagreements: Vec::new(), + signer_identity_id: odin.entry().identity_id.clone(), + publisher_sequence: 1, + observed_at_unix_millis: 110, + signature_algorithm: "ed25519".into(), + signature: Vec::new(), + }; + warming.signature = odin + .sign::(&warming.unsigned_signature_payload()?) + .signature; + let warming = authenticate_odin_runtime_topology_correlation( + &warming.canonical_bytes()?, + &authority, + None, + &odin.entry().public_key, + OdinTopologyAuthenticationContext { + trusted_received_at_unix_millis: 120, + maximum_age_millis: 30, + maximum_future_skew_millis: 5, + }, + )?; + let warming = SequenceAdmittedWarming::for_test("test-transaction", warming, 120)?; + Ok((expected, activation, warming, provider.trust_anchor()?)) + } + + fn lease( + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + warming: &SequenceAdmittedWarming, + ) -> IdunnProcessWriteLeaseRecord { + IdunnProcessWriteLeaseRecord { + schema_version: IDUNN_PROCESS_WRITE_LEASE_SCHEMA.into(), + target: expected.target.clone(), + expected_projection_sha256: expected.canonical_sha256().unwrap(), + plan_id: expected.plan_id.clone(), + incarnation_id: expected.incarnation_id.clone(), + sealed_release_id: expected.sealed_release_id.clone(), + activation_witness_sha256: activation.canonical_sha256().unwrap(), + state_schema_generation: expected.state_schema_generation.clone().unwrap(), + state_contract_sha256: expected.state_contract_sha256.clone().unwrap(), + runtime_id: expected.runtime_id.clone(), + runtime_instance_id: activation.runtime_instance_id.clone(), + warming_presence_sha256: warming.signed_presence_sha256().to_owned(), + lease_epoch: 1, + issued_at_unix_millis: 200, + } + } + + fn topology_driver(root: &Path, name: &str) -> CultCacheTopologyDriver { + CultCacheTopologyDriver { + projection_store: root.join(format!("{name}.cc")), + correlation_store: root.join(format!("{name}-correlation.cc")), + } + } + + fn project_activation( + driver: &CultCacheTopologyDriver, + expected: &IdunnExpectedIncarnationRecord, + activation: &IdunnRuntimeActivationRecord, + ) -> Result<()> { + ensure!( + activation.expected_projection_sha256 == expected.canonical_sha256()?, + "test activation belongs to another Expected" + ); + upsert_record( + &driver.projection_store, + CultCacheEnvelope { + key: expected.target.clone(), + r#type: IdunnRuntimeActivationRecord::TYPE.into(), + payload: activation.canonical_bytes()?, + stored_at: rfc3339_millis(activation.issued_at_unix_millis)?, + schema_id: Some(IDUNN_RUNTIME_ACTIVATION_SCHEMA.into()), + }, + ) + } + + #[test] + fn nginx_rudp_route_is_rendered_as_a_udp_stream_proxy() -> Result<()> { + let driver = NginxRouteDriver::new(RouteBinding { + driver: RouteDriver::NginxStreamUdp, + route_id: "odin-rudp".into(), + stable_endpoint: "rudp://127.0.0.1:17872".into(), + private_host: "127.0.0.1".into(), + private_port_start: 27872, + private_port_end: 27879, + config_path: "/etc/nginx/idunn-stream-routes/odin-rudp.conf".into(), + reload_unit: "nginx.service".into(), + }); + let mut candidate = expected(); + candidate.route = Some(cultnet_rs::IdunnExpectedRoute { + route_id: "odin-rudp".into(), + transport: "rudp".into(), + stable_endpoint: "rudp://127.0.0.1:17872".into(), + candidate_endpoint: "rudp://127.0.0.1:27872".into(), + }); + let rendered = String::from_utf8(driver.render(&candidate)?)?; + assert!(rendered.contains("listen 127.0.0.1:17872 udp reuseport;")); + assert!(rendered.contains("server 127.0.0.1:27872;")); + Ok(()) + } + + #[cfg(unix)] + #[test] + fn nginx_preflight_binds_exact_incumbent_configuration_without_claiming_live_route() + -> Result<()> { + use std::os::unix::fs::PermissionsExt; + + let temp = tempfile::tempdir()?; + let config = temp.path().join("route.conf"); + let nginx = temp.path().join("nginx"); + let systemd_run = temp.path().join("systemd-run"); + let systemctl = temp.path().join("systemctl"); + fs::write( + &nginx, + format!( + "#!/bin/sh\nconfig='{}'\nif [ \"$1\" = \"-t\" ]; then\n candidate=${{IDUNN_TEST_SHADOW:-$config}}\n /bin/grep -q 'server 127.0.0.1:4104' \"$candidate\"\n exit $?\nfi\nexit 64\n", + config.display(), + ), + )?; + fs::write( + &systemd_run, + "#!/bin/sh\nshadow=\nwhile [ \"$#\" -gt 0 ]; do\n case \"$1\" in\n --property=BindReadOnlyPaths=*) binding=${1#--property=BindReadOnlyPaths=}; shadow=${binding%%:*} ;; + --) shift; break ;; + esac\n shift\ndone\nIDUNN_TEST_SHADOW=\"$shadow\"; export IDUNN_TEST_SHADOW\nexec \"$@\"\n", + )?; + fs::write( + &systemctl, + "#!/bin/sh\nif [ -e \"$0.fail\" ]; then exit 65; fi\nif [ \"$1\" = \"reload\" ]; then echo reload >> \"$0.calls\"; exit 0; fi\nexit 64\n", + )?; + fs::set_permissions(&nginx, fs::Permissions::from_mode(0o755))?; + fs::set_permissions(&systemd_run, fs::Permissions::from_mode(0o755))?; + fs::set_permissions(&systemctl, fs::Permissions::from_mode(0o755))?; + + let binding = RouteBinding { + driver: RouteDriver::NginxStreamTcp, + route_id: "service-route".into(), + stable_endpoint: "http://127.0.0.1:4103".into(), + private_host: "127.0.0.1".into(), + private_port_start: 4104, + private_port_end: 4109, + config_path: config.clone(), + reload_unit: "nginx.service".into(), + }; + let driver = NginxRouteDriver { + binding, + nginx_program: nginx, + systemd_run_program: systemd_run, + systemctl_program: systemctl.clone(), + preflight_root: temp.path().join("preflight"), + }; + let mut candidate = expected(); + candidate.route = Some(cultnet_rs::IdunnExpectedRoute { + route_id: "service-route".into(), + transport: "http".into(), + stable_endpoint: "http://127.0.0.1:4103".into(), + candidate_endpoint: "http://127.0.0.1:4104".into(), + }); + let preflight = driver.preflight(&candidate, &digest('a'), None)?; + assert!(!config.exists()); + assert_eq!(fs::read_dir(&driver.preflight_root)?.count(), 0); + + let candidate_bytes = driver.render(&candidate)?; + fs::write(&config, &candidate_bytes)?; + let membership_sha256 = driver.install(&candidate, &digest('a'), &preflight, true)?; + assert_eq!( + fs::read_to_string(systemctl.with_extension("calls"))?, + "reload\n" + ); + assert!(driver.observe_membership(&candidate, &membership_sha256)?); + let admitted_bytes = fs::read(&config)?; + assert!(std::str::from_utf8(&admitted_bytes)?.contains("listen 127.0.0.1:4103;")); + let admitted = RouteObservation { + route_id: "service-route".into(), + runtime_instance_id: digest('a'), + membership_sha256, + signed_presence_sha256: digest('c'), + observed_at_unix_millis: 1, + }; + + let next_preflight = driver.preflight(&candidate, &digest('b'), Some(&admitted))?; + assert_eq!(fs::read(&config)?, admitted_bytes); + fs::write(systemctl.with_extension("fail"), b"fail\n")?; + assert!( + driver + .install(&candidate, &digest('b'), &next_preflight, false) + .is_err() + ); + assert_eq!(fs::read(&config)?, admitted_bytes); + fs::remove_file(systemctl.with_extension("fail"))?; + driver.install(&candidate, &digest('b'), &next_preflight, false)?; + fs::write(&config, b"foreign route\n")?; + assert!( + driver + .install(&candidate, &digest('b'), &next_preflight, true) + .is_err() + ); + driver.restore_admitted_membership(&candidate, &admitted.membership_sha256)?; + assert_eq!(fs::read(&config)?, admitted_bytes); + assert!(driver.observe_membership(&candidate, &admitted.membership_sha256)?); + + fs::write(&config, b"foreign route after admission\n")?; + fs::write(systemctl.with_extension("fail"), b"fail\n")?; + assert!( + driver + .restore_admitted_membership(&candidate, &admitted.membership_sha256) + .is_err() + ); + assert!(!config.exists()); + fs::remove_file(systemctl.with_extension("fail"))?; + driver.restore_admitted_membership(&candidate, &admitted.membership_sha256)?; + assert_eq!(fs::read(&config)?, admitted_bytes); + Ok(()) + } + + #[test] + fn process_environment_witness_is_sorted_exact_and_secret_free() -> Result<()> { + let entries = vec![ + b"B=two".to_vec(), + b"A=one".to_vec(), + b"UNRELATED=ignored".to_vec(), + ]; + let selected = select_process_environment(&entries, &["A".into(), "B".into()])?; + assert_eq!(selected.get("A").map(String::as_str), Some("one")); + assert!(!selected.contains_key("UNRELATED")); + assert!(select_process_environment(&entries, &["B".into(), "A".into()]).is_err()); + Ok(()) + } + + #[test] + fn topology_transport_returns_opaque_odin_bytes_without_deciding_ready() -> Result<()> { + let temp = tempfile::tempdir()?; + let correlation_store = temp.path().join("correlation.cc"); + let opaque = b"not a topology receipt".to_vec(); + upsert_record( + &correlation_store, + CultCacheEnvelope { + key: "service".into(), + r#type: OdinRuntimeTopologyCorrelationRecord::TYPE.into(), + payload: opaque.clone(), + stored_at: "2026-09-03T00:00:00Z".into(), + schema_id: Some(ODIN_RUNTIME_TOPOLOGY_CORRELATION_SCHEMA.into()), + }, + )?; + let driver = CultCacheTopologyDriver { + projection_store: temp.path().join("projection.cc"), + correlation_store, + }; + + assert_eq!( + driver.receive("service")?, + Some(ReceivedOdinTopologyCorrelation { + target: "service".into(), + canonical_bytes: opaque, + }) + ); + Ok(()) + } + + #[test] + fn expected_withdrawal_is_exact_atomic_and_idempotent() -> Result<()> { + let temp = tempfile::tempdir()?; + let (expected, activation, warming, provider_anchor) = authenticated_warming(temp.path())?; + let lease = lease(&expected, &activation, &warming); + let driver = topology_driver(temp.path(), "projection"); + driver.publish_expected(&expected, &provider_anchor)?; + let published = SingleFileMessagePackBackingStore::new(&driver.projection_store) + .pull_all_read_only_snapshot()?; + assert_eq!(published.len(), 2); + assert!(published.iter().any(|entry| { + entry.key == expected.target && entry.r#type == IdunnExpectedIncarnationRecord::TYPE + })); + let published_anchor = published + .iter() + .find(|entry| entry.r#type == GameCultServiceTrustAnchorRecord::TYPE) + .context("atomic Expected set has no provider trust anchor")?; + assert_eq!( + service_trust_anchor_from_envelope(published_anchor)?, + runtime_presence_trust_anchor(&expected, &provider_anchor)? + ); + project_activation(&driver, &expected, &activation)?; + driver.publish_process_write_lease(&expected, &activation, &lease)?; + + let mut substituted_expected = expected.clone(); + substituted_expected.incarnation_id = "another-incarnation".into(); + upsert_record( + &driver.projection_store, + CultCacheEnvelope { + key: expected.target.clone(), + r#type: IdunnExpectedIncarnationRecord::TYPE.into(), + payload: substituted_expected.canonical_bytes()?, + stored_at: "2026-09-03T00:00:00Z".into(), + schema_id: Some(IDUNN_EXPECTED_INCARNATION_SCHEMA.into()), + }, + )?; + assert!( + driver + .withdraw_expected(&expected, &provider_anchor, Some(&activation), Some(&lease)) + .is_err() + ); + driver.publish_expected(&expected, &provider_anchor)?; + + let mut substituted_anchor = runtime_presence_trust_anchor(&expected, &provider_anchor)?; + substituted_anchor.runtime_id = "another-runtime".into(); + substituted_anchor.validate()?; + upsert_record( + &driver.projection_store, + CultCacheEnvelope { + key: substituted_anchor.trust_anchor_id.clone(), + r#type: GameCultServiceTrustAnchorRecord::TYPE.into(), + payload: rmp_serde::to_vec(&substituted_anchor)?, + stored_at: "2026-09-03T00:00:00Z".into(), + schema_id: Some(GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA.into()), + }, + )?; + assert!( + driver + .withdraw_expected(&expected, &provider_anchor, Some(&activation), Some(&lease)) + .is_err() + ); + driver.publish_expected(&expected, &provider_anchor)?; + + let mut substituted_activation = activation.clone(); + substituted_activation.expected_projection_sha256 = digest('a'); + upsert_record( + &driver.projection_store, + CultCacheEnvelope { + key: expected.target.clone(), + r#type: IdunnRuntimeActivationRecord::TYPE.into(), + payload: substituted_activation.canonical_bytes()?, + stored_at: "2026-09-03T00:00:00Z".into(), + schema_id: Some(IDUNN_RUNTIME_ACTIVATION_SCHEMA.into()), + }, + )?; + assert!( + driver + .withdraw_expected(&expected, &provider_anchor, Some(&activation), None) + .is_err() + ); + project_activation(&driver, &expected, &activation)?; + + let mut substituted_lease = lease.clone(); + substituted_lease.lease_epoch += 1; + assert!( + driver + .publish_process_write_lease(&expected, &activation, &substituted_lease) + .is_err() + ); + assert!( + driver + .withdraw_expected( + &expected, + &provider_anchor, + Some(&activation), + Some(&substituted_lease), + ) + .is_err() + ); + + upsert_record( + &driver.projection_store, + CultCacheEnvelope { + key: "unrelated".into(), + r#type: "test.unrelated".into(), + payload: vec![0x90], + stored_at: "2026-09-03T00:00:00Z".into(), + schema_id: Some("test.unrelated.v1".into()), + }, + )?; + driver.withdraw_expected(&expected, &provider_anchor, Some(&activation), Some(&lease))?; + let remaining = SingleFileMessagePackBackingStore::new(&driver.projection_store) + .pull_all_read_only_snapshot()?; + assert_eq!(remaining.len(), 1); + assert_eq!(remaining[0].key, "unrelated"); + driver.withdraw_expected(&expected, &provider_anchor, Some(&activation), Some(&lease))?; + Ok(()) + } + + #[test] + fn incumbent_projection_restoration_demotes_to_expected_only_and_rejects_unknown_authority() + -> Result<()> { + let temp = tempfile::tempdir()?; + let (incumbent, activation, warming, provider_anchor) = authenticated_warming(temp.path())?; + let lease = lease(&incumbent, &activation, &warming); + let driver = topology_driver(temp.path(), "restoration"); + driver.publish_expected(&incumbent, &provider_anchor)?; + project_activation(&driver, &incumbent, &activation)?; + driver.publish_process_write_lease(&incumbent, &activation, &lease)?; + + let mut candidate = incumbent.clone(); + candidate.plan_id = digest('a'); + candidate.incarnation_id = "candidate-incarnation".into(); + candidate.sealed_release_id = digest('b'); + candidate.artifact_sha256 = digest('c'); + let mut candidate_activation = activation.clone(); + candidate_activation.expected_projection_sha256 = candidate.canonical_sha256()?; + candidate_activation.runtime_instance_id = digest('d'); + driver.publish_expected(&candidate, &provider_anchor)?; + project_activation(&driver, &candidate, &candidate_activation)?; + + upsert_record( + &driver.projection_store, + CultCacheEnvelope { + key: "unrelated".into(), + r#type: "test.unrelated".into(), + payload: vec![0x90], + stored_at: "2026-09-03T00:00:00Z".into(), + schema_id: Some("test.unrelated.v1".into()), + }, + )?; + + assert_eq!( + driver.restore_admitted_expected_only( + &candidate, + &provider_anchor, + Some(&candidate_activation), + &incumbent, + &provider_anchor, + &activation, + Some(&lease), + )?, + incumbent.canonical_sha256()? + ); + + let restored = SingleFileMessagePackBackingStore::new(&driver.projection_store) + .pull_all_read_only_snapshot()?; + assert_eq!(restored.len(), 3); + assert_eq!( + IdunnExpectedIncarnationRecord::decode_canonical( + &restored + .iter() + .find(|entry| entry.r#type == IdunnExpectedIncarnationRecord::TYPE) + .unwrap() + .payload, + )?, + incumbent + ); + assert_eq!( + service_trust_anchor_from_envelope( + restored + .iter() + .find(|entry| entry.r#type == GameCultServiceTrustAnchorRecord::TYPE) + .unwrap(), + )?, + runtime_presence_trust_anchor(&incumbent, &provider_anchor)? + ); + assert!( + restored + .iter() + .all(|entry| entry.r#type != IdunnRuntimeActivationRecord::TYPE + && entry.r#type != IdunnProcessWriteLeaseRecord::TYPE) + ); + assert!( + restored + .iter() + .any(|entry| entry.key == "unrelated" && entry.r#type == "test.unrelated") + ); + let idempotent_bytes = fs::read(&driver.projection_store)?; + driver.restore_admitted_expected_only( + &candidate, + &provider_anchor, + Some(&candidate_activation), + &incumbent, + &provider_anchor, + &activation, + Some(&lease), + )?; + assert_eq!(fs::read(&driver.projection_store)?, idempotent_bytes); + + let admitted_anchor = runtime_presence_trust_anchor(&incumbent, &provider_anchor)?; + let mut unknown_expected = incumbent.clone(); + unknown_expected.incarnation_id = "unknown-incarnation".into(); + let mut unknown_anchor = admitted_anchor.clone(); + unknown_anchor.runtime_id = "unknown-runtime".into(); + unknown_anchor.validate()?; + let mut unknown_activation = activation.clone(); + unknown_activation.runtime_instance_id = digest('e'); + let mut unknown_lease = lease.clone(); + unknown_lease.lease_epoch += 1; + let substitutions = [ + CultCacheEnvelope { + key: incumbent.target.clone(), + r#type: IdunnExpectedIncarnationRecord::TYPE.into(), + payload: unknown_expected.canonical_bytes()?, + stored_at: "2026-09-03T00:00:00Z".into(), + schema_id: Some(IDUNN_EXPECTED_INCARNATION_SCHEMA.into()), + }, + CultCacheEnvelope { + key: admitted_anchor.trust_anchor_id.clone(), + r#type: GameCultServiceTrustAnchorRecord::TYPE.into(), + payload: rmp_serde::to_vec(&unknown_anchor)?, + stored_at: "2026-09-03T00:00:00Z".into(), + schema_id: Some(GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA.into()), + }, + CultCacheEnvelope { + key: incumbent.target.clone(), + r#type: IdunnRuntimeActivationRecord::TYPE.into(), + payload: unknown_activation.canonical_bytes()?, + stored_at: "2026-09-03T00:00:00Z".into(), + schema_id: Some(IDUNN_RUNTIME_ACTIVATION_SCHEMA.into()), + }, + CultCacheEnvelope { + key: incumbent.target.clone(), + r#type: IdunnProcessWriteLeaseRecord::TYPE.into(), + payload: unknown_lease.canonical_bytes()?, + stored_at: "2026-09-03T00:00:00Z".into(), + schema_id: Some(IDUNN_PROCESS_WRITE_LEASE_SCHEMA.into()), + }, + ]; + for substitution in substitutions { + fs::write(&driver.projection_store, &idempotent_bytes)?; + upsert_record(&driver.projection_store, substitution)?; + let before = fs::read(&driver.projection_store)?; + assert!( + driver + .restore_admitted_expected_only( + &candidate, + &provider_anchor, + Some(&candidate_activation), + &incumbent, + &provider_anchor, + &activation, + Some(&lease), + ) + .is_err() + ); + assert_eq!(fs::read(&driver.projection_store)?, before); + } + Ok(()) + } + + #[cfg(unix)] + #[test] + fn service_credential_sources_require_one_root_owned_0400_inode() -> Result<()> { + use std::os::unix::fs::{PermissionsExt, symlink}; + + let temp = tempfile::tempdir()?; + let root = temp.path().join("credentials"); + fs::create_dir(&root)?; + fs::set_permissions(&root, fs::Permissions::from_mode(0o700))?; + let source = root.join("token"); + fs::write(&source, b"secret")?; + fs::set_permissions(&source, fs::Permissions::from_mode(0o400))?; + let mut sources = BTreeMap::from([("SERVICE_TOKEN".into(), source.clone())]); + + validate_service_credential_sources(&sources)?; + + fs::set_permissions(&source, fs::Permissions::from_mode(0o600))?; + assert!(validate_service_credential_sources(&sources).is_err()); + fs::set_permissions(&source, fs::Permissions::from_mode(0o400))?; + + let hardlink = root.join("token-hardlink"); + fs::hard_link(&source, &hardlink)?; + assert!(validate_service_credential_sources(&sources).is_err()); + fs::remove_file(&hardlink)?; + + let symlink_path = root.join("token-symlink"); + symlink(&source, &symlink_path)?; + sources.insert("SERVICE_TOKEN".into(), symlink_path); + assert!(validate_service_credential_sources(&sources).is_err()); + Ok(()) + } + + #[cfg(unix)] + #[test] + fn write_lease_revoke_is_exact_and_never_deletes_a_surprise() -> Result<()> { + let temp = tempfile::tempdir()?; + let path = temp.path().join("lease.cc"); + let driver = CultCacheWriteLeaseDriver::new("service", &path); + let (expected, activation, warming, provider_anchor) = authenticated_warming(temp.path())?; + let lease = lease(&expected, &activation, &warming); + let topology = topology_driver(temp.path(), "lease-projection"); + topology.publish_expected(&expected, &provider_anchor)?; + project_activation(&topology, &expected, &activation)?; + + let lease_sha256 = driver.grant(&expected, &activation, &warming, &lease)?; + assert_eq!(lease_sha256, lease.canonical_sha256()?); + assert!(driver.observe(&expected, &activation, &warming, &lease)?); + assert!( + !SingleFileMessagePackBackingStore::new(&topology.projection_store) + .pull_all_read_only_snapshot()? + .iter() + .any(|entry| entry.r#type == IdunnProcessWriteLeaseRecord::TYPE) + ); + assert_eq!( + topology.publish_process_write_lease(&expected, &activation, &lease)?, + lease_sha256 + ); + + let mut surprise = lease.clone(); + surprise.lease_epoch = 2; + assert!(driver.revoke_exact(Some(&surprise)).is_err()); + assert!(driver.observe(&expected, &activation, &warming, &lease)?); + + SingleFileMessagePackBackingStore::new(&path).with_read_only_shared_snapshot(|_| { + let denial = driver + .revoke_exact(Some(&lease)) + .expect_err("shared lifetime holder must deny without blocking"); + assert!( + denial + .to_string() + .contains("held by a shared-lock consumer") + ); + Ok(()) + })?; + assert!(driver.observe(&expected, &activation, &warming, &lease)?); + + driver.revoke_exact(Some(&lease))?; + assert!(driver.observe_empty()?); + topology.withdraw_process_write_lease(&expected, &activation, Some(&lease))?; + assert!( + !SingleFileMessagePackBackingStore::new(&topology.projection_store) + .pull_all_read_only_snapshot()? + .iter() + .any(|entry| entry.r#type == IdunnProcessWriteLeaseRecord::TYPE) + ); + topology.withdraw_process_write_lease(&expected, &activation, Some(&lease))?; + driver.revoke_exact(Some(&lease))?; + + SingleFileMessagePackBackingStore::new(&path).with_read_only_shared_snapshot( + |snapshot| { + assert!(snapshot.is_empty()); + let denial = driver + .grant(&expected, &activation, &warming, &lease) + .expect_err("shared lifetime holder must deny grant without blocking"); + assert!( + denial + .to_string() + .contains("held by a shared-lock consumer") + ); + Ok(()) + }, + )?; + assert!(driver.observe_empty()?); + assert_eq!( + driver.grant(&expected, &activation, &warming, &lease)?, + lease.canonical_sha256()? + ); + driver.revoke_exact(Some(&lease))?; + Ok(()) + } + + #[cfg(unix)] + #[test] + fn installed_release_is_root_owned_and_nonwritable() -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + let temp = tempfile::tempdir()?; + let root = temp.path().join("release"); + fs::create_dir(&root)?; + let artifact = root.join("service"); + fs::write(&artifact, b"sealed")?; + fs::set_permissions(&artifact, fs::Permissions::from_mode(0o777))?; + harden_installed_release( + &root, + &[ArtifactReceipt { + artifact_id: "service".into(), + destination: PathBuf::from("service"), + sha256: sha256_id(b"sealed"), + size_bytes: 6, + executable: true, + }], + )?; + let root_metadata = fs::symlink_metadata(&root)?; + let artifact_metadata = fs::symlink_metadata(&artifact)?; + assert_eq!(root_metadata.uid(), 0); + assert_eq!(root_metadata.permissions().mode() & 0o777, 0o555); + assert_eq!(artifact_metadata.uid(), 0); + assert_eq!(artifact_metadata.permissions().mode() & 0o777, 0o555); + Ok(()) + } + + #[cfg(unix)] + #[test] + fn runner_cache_is_created_once_for_one_exact_identity() -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt}; + + let temp = tempfile::tempdir()?; + fs::set_permissions(temp.path(), fs::Permissions::from_mode(0o700))?; + let cache = temp.path().join("cache"); + let identity = ProcessIdentity { + uid: 1000, + gid: 1000, + }; + ensure_runner_cache_root(&cache, identity)?; + let metadata = fs::symlink_metadata(&cache)?; + assert_eq!((metadata.uid(), metadata.gid()), (1000, 1000)); + assert_eq!(metadata.permissions().mode() & 0o777, 0o700); + assert!(ensure_runner_cache_root(&cache, identity).is_ok()); + assert!( + ensure_runner_cache_root( + &cache, + ProcessIdentity { + uid: 1001, + gid: 1001 + } + ) + .is_err() + ); + Ok(()) + } + + #[cfg(unix)] + #[test] + fn runner_secret_is_root_owned_and_bound_to_the_runner_group() -> Result<()> { + use std::os::unix::ffi::OsStrExt; + use std::os::unix::fs::PermissionsExt; + + let temp = tempfile::tempdir()?; + fs::set_permissions(temp.path(), fs::Permissions::from_mode(0o700))?; + let secret = temp.path().join("token"); + fs::write(&secret, b"secret")?; + let secret_c = std::ffi::CString::new(secret.as_os_str().as_bytes())?; + ensure!(unsafe { libc::lchown(secret_c.as_ptr(), 0, 1000) } == 0); + fs::set_permissions(&secret, fs::Permissions::from_mode(0o440))?; + let identity = ProcessIdentity { + uid: 1000, + gid: 1000, + }; + validate_runner_secret(&secret, identity)?; + fs::set_permissions(&secret, fs::Permissions::from_mode(0o444))?; + assert!(validate_runner_secret(&secret, identity).is_err()); + Ok(()) + } + + #[cfg(unix)] + #[test] + fn exact_git_archive_becomes_root_owned_immutable_source_without_git_metadata() -> Result<()> { + use std::os::unix::fs::{MetadataExt, PermissionsExt, symlink}; + + let temp = tempfile::tempdir()?; + let repository = temp.path().join("repository"); + fs::create_dir(&repository)?; + git_at(&repository, &["init", "--initial-branch=main"])?; + git_at(&repository, &["config", "user.name", "Idunn Test"])?; + git_at( + &repository, + &["config", "user.email", "idunn-test@example.invalid"], + )?; + fs::write(repository.join("deployment.toml"), b"target = 'test'\n")?; + let script = repository.join("build.sh"); + fs::write(&script, b"#!/bin/sh\nexit 0\n")?; + fs::set_permissions(&script, fs::Permissions::from_mode(0o755))?; + fs::create_dir(repository.join("links"))?; + symlink("../deployment.toml", repository.join("links/deployment"))?; + git_at(&repository, &["add", "--all"])?; + git_at(&repository, &["commit", "-m", "fixture"])?; + let revision = git_at(&repository, &["rev-parse", "HEAD"])?; + + let parent = temp.path().join("transaction"); + fs::create_dir(&parent)?; + fs::set_permissions(&parent, fs::Permissions::from_mode(0o700))?; + let destination = parent.join("source"); + prepare_frozen_source_destination(&destination)?; + let driver = GitSourceDriver::new( + temp.path().join("source-cache"), + temp.path().join("frozen-source"), + None, + ); + driver.git_archive_into(&repository, &revision, None, &destination)?; + driver.git_archive_into( + &repository, + &revision, + Some(Path::new("vendor/fixture")), + &destination, + )?; + harden_frozen_source(&destination)?; + + assert!(!destination.join(".git").exists()); + assert_eq!( + fs::symlink_metadata(destination.join("deployment.toml"))? + .permissions() + .mode() + & 0o777, + 0o444 + ); + let script_metadata = fs::symlink_metadata(destination.join("build.sh"))?; + assert_eq!(script_metadata.uid(), 0); + assert_eq!(script_metadata.permissions().mode() & 0o777, 0o555); + assert!(destination.join("vendor/fixture/deployment.toml").is_file()); + validate_frozen_source_symlink(&destination, &destination.join("links/deployment"))?; + validate_frozen_source(&destination)?; + let digest = frozen_source_sha256(&destination)?; + let recipe = destination.join("deployment.toml"); + fs::set_permissions(&recipe, fs::Permissions::from_mode(0o644))?; + assert!(validate_frozen_source(&destination).is_err()); + fs::set_permissions(&recipe, fs::Permissions::from_mode(0o444))?; + fs::write(&recipe, b"target = 'changed'\n")?; + assert_ne!(frozen_source_sha256(&destination)?, digest); + Ok(()) + } + + #[cfg(unix)] + #[test] + fn frozen_source_rejects_a_symlink_that_escapes_the_transaction_tree() -> Result<()> { + use std::os::unix::fs::{PermissionsExt, symlink}; + + let temp = tempfile::tempdir()?; + let parent = temp.path().join("transaction"); + fs::create_dir(&parent)?; + fs::set_permissions(&parent, fs::Permissions::from_mode(0o700))?; + let destination = parent.join("source"); + prepare_frozen_source_destination(&destination)?; + symlink("../../outside", destination.join("escape"))?; + assert!(harden_frozen_source(&destination).is_err()); + Ok(()) + } +} diff --git a/src/lib.rs b/src/lib.rs new file mode 100644 index 0000000..7899c59 --- /dev/null +++ b/src/lib.rs @@ -0,0 +1,5 @@ +pub mod control_plane; +pub mod deployment; +pub mod deployment_plan; +pub mod drivers; +pub mod provisioning; diff --git a/src/main.rs b/src/main.rs new file mode 100644 index 0000000..e7bd0a5 --- /dev/null +++ b/src/main.rs @@ -0,0 +1,3 @@ +fn main() -> anyhow::Result<()> { + idunn_daemon::control_plane::run(std::env::args().skip(1)) +} diff --git a/src/provisioning.rs b/src/provisioning.rs new file mode 100644 index 0000000..8ae58a9 --- /dev/null +++ b/src/provisioning.rs @@ -0,0 +1,2455 @@ +use anyhow::{Context, Result, anyhow, bail}; +use cultcache_rs::{ + CultCacheEnvelope, CultCacheExpectedEnvelope, DatabaseEntry, SingleFileMessagePackBackingStore, +}; +use cultnet_rs::{ + GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA, GameCultProviderHealthIdentity, + GameCultServiceTrustAnchorRecord, IDUNN_AUTHENTICATED_PROVIDER_HEALTH_PROJECTION_SCHEMA, + IDUNN_AUTHENTICATED_PROVIDER_HEALTH_PROJECTION_SIGNING_PURPOSE, + IDUNN_DAEMON_HEALTH_TRUST_BINDING_SCHEMA, IDUNN_DEPLOYMENT_BRAKE_AUTHORITY, + IDUNN_DEPLOYMENT_BRAKE_ID, IDUNN_DEPLOYMENT_BRAKE_SCHEMA, IDUNN_DEPLOYMENT_BRAKE_SCOPE, + IDUNN_DEPLOYMENT_RELEASE_PURPOSE, IDUNN_LIFECYCLE_BRAKE_AUTHORITY, IDUNN_LIFECYCLE_BRAKE_SCHEMA, + IDUNN_LIFECYCLE_BRAKE_SCOPE, IdunnDaemonHealthTrustBindingRecord, + IdunnDeploymentBrakeObservation, IdunnDeploymentBrakeOperatorIdentity, + IdunnDeploymentBrakeRecord, IdunnDeploymentBrakeReleasePurpose, IdunnLifecycleBrakeObservation, + IdunnLifecycleBrakeRecord, IdunnServiceIdentity, OdinTopologyIdentity, ServiceIdentityProfile, + ServiceIdentityTrustAnchor, derive_service_identity_id, enroll_service_identity_at, + evaluate_idunn_continuity_restart, evaluate_idunn_deployment_brake, + export_service_identity_trust_anchor, open_service_identity_at, +}; +use std::collections::{BTreeMap, BTreeSet}; +use std::path::{Path, PathBuf}; + +trait RootDistributionDocument: DatabaseEntry { + fn root_key(&self) -> &str; +} + +impl RootDistributionDocument for IdunnDaemonHealthTrustBindingRecord { + fn root_key(&self) -> &str { + &self.binding_id + } +} + +impl RootDistributionDocument for GameCultServiceTrustAnchorRecord { + fn root_key(&self) -> &str { + &self.trust_anchor_id + } +} + +pub fn run(args: impl IntoIterator) -> Result<()> { + let mut args = args.into_iter(); + let command = args.next().ok_or_else(|| anyhow!(usage()))?; + let options = parse_options(args)?; + match command.as_str() { + "enroll-provider-health-identity" => { + let public_key = enroll_provider_health_identity(&options)?; + println!("{public_key}"); + } + "provider-health-public-key" => { + let public_key = provider_health_public_key(&options)?; + println!("{public_key}"); + } + "export-provider-health-public-anchor" => export_identity_anchor::< + GameCultProviderHealthIdentity, + >( + &options, "provider health public anchor" + )?, + "enroll-idunn-identity" => enroll_identity::(&options)?, + "export-idunn-public-anchor" => { + export_identity_anchor::(&options, "Idunn public anchor")? + } + "enroll-odin-topology-identity" => enroll_identity::(&options)?, + "export-odin-topology-public-anchor" => { + export_identity_anchor::(&options, "Odin topology public anchor")? + } + "enroll-deployment-brake-operator" => { + enroll_identity::(&options)? + } + "export-deployment-brake-operator-anchor" => { + export_identity_anchor::( + &options, + "deployment brake operator anchor", + )? + } + "deployment-brake-engage" => deployment_brake_engage(&options)?, + "deployment-brake-release" => deployment_brake_release(&options)?, + "deployment-brake-status" => deployment_brake_status(&options)?, + "lifecycle-brake-engage" => lifecycle_brake_engage(&options)?, + "lifecycle-brake-release" => lifecycle_brake_release(&options)?, + "lifecycle-brake-status" => lifecycle_brake_status(&options)?, + "create-daemon-health-trust-binding" => create_health_binding(&options)?, + "add-daemon-health-trust-binding" => add_health_binding(&options)?, + "require-daemon-health-release-binding" => require_health_binding_release(&options)?, + "rotate-daemon-health-trust-signer" => rotate_health_binding_signer(&options)?, + "validate-daemon-health-trust-binding" => { + require_only(&options, &["input"])?; + validate_health_binding_store(&path(&options, "input")?)?; + } + "create-provider-projection-trust-anchor" => create_projection_anchor(&options)?, + "validate-provider-projection-trust-anchor" => validate_projection_anchor(&options)?, + _ => bail!("unknown command {command:?}\n{}", usage()), + } + Ok(()) +} + +fn enroll_identity(options: &BTreeMap) -> Result<()> { + require_only(options, &["private-store"])?; + enroll_service_identity_at::

(&path(options, "private-store")?)?; + Ok(()) +} + +fn export_identity_anchor( + options: &BTreeMap, + label: &str, +) -> Result<()> { + require_only(options, &["private-store", "public-anchor"])?; + let private = path(options, "private-store")?; + let public = path(options, "public-anchor")?; + reject_alias(&private, &public)?; + refuse_existing(&public, label)?; + let signer = open_service_identity_at::

(&private)?; + export_service_identity_trust_anchor(&signer, &public)?; + Ok(()) +} + +fn enroll_provider_health_identity(options: &BTreeMap) -> Result { + require_only(options, &["private-store"])?; + let signer = enroll_service_identity_at::(&path( + options, + "private-store", + )?)?; + encode_public_key(&signer.entry().public_key) +} + +fn provider_health_public_key(options: &BTreeMap) -> Result { + require_only(options, &["private-store"])?; + let signer = open_service_identity_at::(&path( + options, + "private-store", + )?)?; + encode_public_key(&signer.entry().public_key) +} + +fn deployment_brake_engage(options: &BTreeMap) -> Result<()> { + require_only( + options, + &[ + "store", + "runtime-id", + "owner", + "reason", + "observed-at-unix-millis", + ], + )?; + let observed = parse_u64(options, "observed-at-unix-millis")?; + let record = IdunnDeploymentBrakeRecord { + schema_version: IDUNN_DEPLOYMENT_BRAKE_SCHEMA.into(), + brake_id: IDUNN_DEPLOYMENT_BRAKE_ID.into(), + authority: IDUNN_DEPLOYMENT_BRAKE_AUTHORITY.into(), + runtime_id: required(options, "runtime-id")?.into(), + status: "engaged".into(), + scope: IDUNN_DEPLOYMENT_BRAKE_SCOPE.into(), + reason: required(options, "reason")?.into(), + observed_at_unix_millis: observed, + expires_at_unix_millis: None, + authorization_id: None, + authorization_purpose: None, + authorized_release_id: None, + authorized_deployment_id: None, + authorized_by: None, + authorization_issued_at_unix_millis: None, + authorization_expires_at_unix_millis: None, + signature_algorithm: None, + signature: None, + private_state_exposed: false, + updated_by: required(options, "owner")?.into(), + }; + record.validate()?; + replace_brake(&path(options, "store")?, record, observed) +} + +fn deployment_brake_release(options: &BTreeMap) -> Result<()> { + require_only( + options, + &[ + "store", + "private-store", + "runtime-id", + "owner", + "reason", + "authorization-id", + "release-id", + "deployment-id", + "issued-at-unix-millis", + "expires-at-unix-millis", + ], + )?; + let issued = parse_u64(options, "issued-at-unix-millis")?; + let expires = parse_u64(options, "expires-at-unix-millis")?; + let signer = open_service_identity_at::(&path( + options, + "private-store", + )?)?; + let mut record = IdunnDeploymentBrakeRecord { + schema_version: IDUNN_DEPLOYMENT_BRAKE_SCHEMA.into(), + brake_id: IDUNN_DEPLOYMENT_BRAKE_ID.into(), + authority: IDUNN_DEPLOYMENT_BRAKE_AUTHORITY.into(), + runtime_id: required(options, "runtime-id")?.into(), + status: "released".into(), + scope: IDUNN_DEPLOYMENT_BRAKE_SCOPE.into(), + reason: required(options, "reason")?.into(), + observed_at_unix_millis: issued, + expires_at_unix_millis: Some(expires), + authorization_id: Some(required(options, "authorization-id")?.into()), + authorization_purpose: Some(IDUNN_DEPLOYMENT_RELEASE_PURPOSE.into()), + authorized_release_id: Some(required(options, "release-id")?.into()), + authorized_deployment_id: Some(required(options, "deployment-id")?.into()), + authorized_by: Some(signer.trust_anchor()?.identity_id), + authorization_issued_at_unix_millis: Some(issued), + authorization_expires_at_unix_millis: Some(expires), + signature_algorithm: Some("ed25519".into()), + signature: None, + private_state_exposed: false, + updated_by: required(options, "owner")?.into(), + }; + record.signature = Some( + signer + .sign::(&rmp_serde::to_vec(&record)?) + .signature, + ); + record.validate()?; + replace_brake(&path(options, "store")?, record, issued) +} + +fn deployment_brake_status(options: &BTreeMap) -> Result<()> { + allow_only( + options, + &[ + "store", + "operator-anchor", + "runtime-id", + "release-id", + "deployment-id", + "now-unix-millis", + ], + )?; + let exact_actuation_fields = ["release-id", "deployment-id", "now-unix-millis"]; + let exact_actuation_field_count = exact_actuation_fields + .into_iter() + .filter(|field| options.contains_key(*field)) + .count(); + if exact_actuation_field_count != 0 + && exact_actuation_field_count != exact_actuation_fields.len() + { + bail!("exact deployment-brake actuation validation requires release, deployment, and time"); + } + let record = read_brake(&path(options, "store")?)?; + if record.runtime_id != required(options, "runtime-id")? { + bail!("deployment brake belongs to another runtime") + } + if record.status == "engaged" { + if exact_actuation_field_count != 0 { + bail!("engaged deployment brake denies exact actuation validation"); + } + println!( + "engaged runtime={} scope={} owner={} reason={}", + record.runtime_id, record.scope, record.updated_by, record.reason + ); + return Ok(()); + } + let anchor = read_operator_anchor(&path(options, "operator-anchor")?)?; + evaluate_idunn_deployment_brake( + IdunnDeploymentBrakeObservation::Present(&record), + &anchor, + required(options, "runtime-id")?, + required(options, "release-id")?, + required(options, "deployment-id")?, + parse_u64(options, "now-unix-millis")?, + ) + .map_err(|d| anyhow!("deployment brake denied actuation: {d:?}"))?; + println!( + "released runtime={} release={} deployment={} owner={}", + record.runtime_id, + record.authorized_release_id.unwrap(), + record.authorized_deployment_id.unwrap(), + record.updated_by + ); + Ok(()) +} + +fn lifecycle_brake_engage(options: &BTreeMap) -> Result<()> { + require_only( + options, + &[ + "store", + "runtime-id", + "target", + "reason", + "updated-at-unix-millis", + ], + )?; + let updated = parse_u64(options, "updated-at-unix-millis")?; + let record = IdunnLifecycleBrakeRecord { + schema_version: IDUNN_LIFECYCLE_BRAKE_SCHEMA.into(), + authority: IDUNN_LIFECYCLE_BRAKE_AUTHORITY.into(), + runtime_id: required(options, "runtime-id")?.into(), + target: required(options, "target")?.into(), + scope: IDUNN_LIFECYCLE_BRAKE_SCOPE.into(), + status: "engaged".into(), + reason: required(options, "reason")?.into(), + updated_at_unix_millis: updated, + released_until_unix_millis: None, + }; + replace_lifecycle_brake(&path(options, "store")?, record) +} + +fn lifecycle_brake_release(options: &BTreeMap) -> Result<()> { + allow_only( + options, + &[ + "store", + "runtime-id", + "target", + "reason", + "updated-at-unix-millis", + "released-until-unix-millis", + ], + )?; + let updated = parse_u64(options, "updated-at-unix-millis")?; + let record = IdunnLifecycleBrakeRecord { + schema_version: IDUNN_LIFECYCLE_BRAKE_SCHEMA.into(), + authority: IDUNN_LIFECYCLE_BRAKE_AUTHORITY.into(), + runtime_id: required(options, "runtime-id")?.into(), + target: required(options, "target")?.into(), + scope: IDUNN_LIFECYCLE_BRAKE_SCOPE.into(), + status: "released".into(), + reason: required(options, "reason")?.into(), + updated_at_unix_millis: updated, + released_until_unix_millis: options + .get("released-until-unix-millis") + .map(|value| { + value + .parse() + .context("--released-until-unix-millis must be u64") + }) + .transpose()?, + }; + replace_lifecycle_brake(&path(options, "store")?, record) +} + +fn lifecycle_brake_status(options: &BTreeMap) -> Result<()> { + require_only( + options, + &["store", "runtime-id", "target", "now-unix-millis"], + )?; + let runtime_id = lifecycle_identifier(options, "runtime-id")?; + let target = lifecycle_identifier(options, "target")?; + let now = parse_u64(options, "now-unix-millis")?; + match read_lifecycle_brake(&path(options, "store")?)? { + None => { + evaluate_idunn_continuity_restart( + IdunnLifecycleBrakeObservation::Missing, + runtime_id, + target, + now, + ) + .map_err(|denial| anyhow!("lifecycle brake denied continuity restart: {denial:?}"))?; + println!("allowed runtime={runtime_id} target={target} brake=absent"); + } + Some(record) => { + evaluate_idunn_continuity_restart( + IdunnLifecycleBrakeObservation::Present(&record), + runtime_id, + target, + now, + ) + .map_err(|denial| anyhow!("lifecycle brake denied continuity restart: {denial:?}"))?; + if let Some(expires) = record.released_until_unix_millis { + println!( + "allowed runtime={} target={} brake=released expires={expires}", + record.runtime_id, record.target + ); + } else { + println!( + "allowed runtime={} target={} brake=released expires=never", + record.runtime_id, record.target + ); + } + } + } + Ok(()) +} + +fn replace_lifecycle_brake(path: &Path, record: IdunnLifecycleBrakeRecord) -> Result<()> { + record.validate()?; + let store = SingleFileMessagePackBackingStore::new(path); + let entries = store.pull_all_read_only_snapshot()?; + let current = match entries.as_slice() { + [] => None, + [entry] + if entry.r#type == IdunnLifecycleBrakeRecord::TYPE + && entry.schema_id.as_deref() == Some(IDUNN_LIFECYCLE_BRAKE_SCHEMA) => + { + let current_record = IdunnLifecycleBrakeRecord::decode_canonical(&entry.payload)?; + if entry.key != current_record.target { + bail!("lifecycle brake envelope key does not match its target"); + } + if current_record.runtime_id != record.runtime_id + || current_record.target != record.target + { + bail!("lifecycle brake store is bound to another runtime or target"); + } + if record.updated_at_unix_millis <= current_record.updated_at_unix_millis { + bail!("lifecycle brake update time must advance"); + } + Some(entry.clone()) + } + _ => bail!("lifecycle brake store is corrupt or ambiguous"), + }; + let next = typed_envelope( + &record.target, + &record, + IDUNN_LIFECYCLE_BRAKE_SCHEMA, + record.updated_at_unix_millis, + )?; + if !store.compare_exchange( + &[CultCacheExpectedEnvelope { + r#type: IdunnLifecycleBrakeRecord::TYPE.into(), + key: record.target.clone(), + current, + }], + &[next], + )? { + bail!("lifecycle brake changed during transition"); + } + Ok(()) +} + +fn read_lifecycle_brake(path: &Path) -> Result> { + if !path.exists() { + return Ok(None); + } + let entries = SingleFileMessagePackBackingStore::new(path).pull_all_read_only_snapshot()?; + let entry = match entries.as_slice() { + [] => return Ok(None), + [entry] => entry, + _ => bail!("lifecycle brake store is ambiguous"), + }; + if entry.r#type != IdunnLifecycleBrakeRecord::TYPE + || entry.schema_id.as_deref() != Some(IDUNN_LIFECYCLE_BRAKE_SCHEMA) + { + bail!("lifecycle brake store contains a foreign record"); + } + let record = IdunnLifecycleBrakeRecord::decode_canonical(&entry.payload)?; + if entry.key != record.target { + bail!("lifecycle brake envelope key does not match its target"); + } + Ok(Some(record)) +} + +fn lifecycle_identifier<'a>(options: &'a BTreeMap, name: &str) -> Result<&'a str> { + let value = required(options, name)?; + if value.trim().is_empty() || value.len() > 256 || value.chars().any(char::is_control) { + bail!("--{name} is empty, oversized, or contains control characters"); + } + Ok(value) +} + +fn replace_brake(path: &Path, record: IdunnDeploymentBrakeRecord, millis: u64) -> Result<()> { + let store = SingleFileMessagePackBackingStore::new(path); + let entries = store.pull_all_read_only_snapshot()?; + let current = match entries.as_slice() { + [] => None, + [entry] + if entry.r#type == IdunnDeploymentBrakeRecord::TYPE + && entry.key == IDUNN_DEPLOYMENT_BRAKE_ID => + { + Some(entry.clone()) + } + _ => bail!("deployment brake store is corrupt or ambiguous"), + }; + let next = typed_envelope( + IDUNN_DEPLOYMENT_BRAKE_ID, + &record, + IDUNN_DEPLOYMENT_BRAKE_SCHEMA, + millis, + )?; + if !store.compare_exchange( + &[CultCacheExpectedEnvelope { + r#type: IdunnDeploymentBrakeRecord::TYPE.into(), + key: IDUNN_DEPLOYMENT_BRAKE_ID.into(), + current, + }], + &[next], + )? { + bail!("deployment brake changed during transition"); + } + Ok(()) +} + +fn read_brake(path: &Path) -> Result { + let entries = SingleFileMessagePackBackingStore::new(path).pull_all_read_only_snapshot()?; + let [entry] = entries.as_slice() else { + bail!("deployment brake is missing or ambiguous") + }; + if entry.r#type != IdunnDeploymentBrakeRecord::TYPE + || entry.key != IDUNN_DEPLOYMENT_BRAKE_ID + || entry.schema_id.as_deref() != Some(IDUNN_DEPLOYMENT_BRAKE_SCHEMA) + { + bail!("deployment brake is foreign") + } + let record: IdunnDeploymentBrakeRecord = rmp_serde::from_slice(&entry.payload)?; + if rmp_serde::to_vec(&record)? != entry.payload { + bail!("deployment brake is noncanonical") + } + record.validate()?; + Ok(record) +} + +fn read_operator_anchor(path: &Path) -> Result { + let entries = SingleFileMessagePackBackingStore::new(path).pull_all_read_only_snapshot()?; + let [entry] = entries.as_slice() else { + bail!("operator anchor is missing or ambiguous") + }; + if entry.r#type != IdunnDeploymentBrakeOperatorIdentity::TRUST_ANCHOR_TYPE + || entry.key != IdunnDeploymentBrakeOperatorIdentity::TRUST_ANCHOR_KEY + { + bail!("operator anchor is foreign") + } + Ok(rmp_serde::from_slice(&entry.payload)?) +} + +fn validate_health_binding_store(path: &Path) -> Result<()> { + let entries = SingleFileMessagePackBackingStore::new(path).pull_all_read_only_snapshot()?; + validated_health_bindings(&entries)?; + Ok(()) +} + +fn validated_health_bindings( + entries: &[CultCacheEnvelope], +) -> Result> { + if entries.is_empty() { + bail!("daemon health trust store is empty"); + } + let mut keys = BTreeSet::new(); + let mut tuples = BTreeSet::new(); + let mut bindings = Vec::with_capacity(entries.len()); + for envelope in entries { + if envelope.r#type != IdunnDaemonHealthTrustBindingRecord::TYPE + || envelope.schema_id.as_deref() != Some(IDUNN_DAEMON_HEALTH_TRUST_BINDING_SCHEMA) + { + bail!("trust store contains an alien type or schema"); + } + let binding: IdunnDaemonHealthTrustBindingRecord = + rmp_serde::from_slice(&envelope.payload)?; + if rmp_serde::to_vec(&binding)? != envelope.payload || envelope.key != binding.binding_id { + bail!("trust store contains a noncanonical or mismatched binding"); + } + binding.validate()?; + if !keys.insert(binding.binding_id.clone()) + || !tuples.insert(( + binding.daemon_id.clone(), + binding.health_contract.clone(), + binding.source_runtime_id.clone(), + )) + { + bail!("trust store contains a duplicate binding id or tuple"); + } + bindings.push(binding); + } + Ok(bindings) +} + +fn create_health_binding(options: &BTreeMap) -> Result<()> { + let record = health_binding(options)?; + write_new_typed( + &path(options, "output")?, + &record.binding_id, + &record, + IDUNN_DAEMON_HEALTH_TRUST_BINDING_SCHEMA, + record.bound_at_unix_millis, + ) +} + +fn health_binding( + options: &BTreeMap, +) -> Result { + require_only( + options, + &[ + "output", + "binding-id", + "daemon", + "health-contract", + "source-runtime", + "signer-public-key-hex", + "bound-at-unix-millis", + "release-binding-required", + ], + )?; + let public_key = decode_public_key(required(options, "signer-public-key-hex")?)?; + let record = IdunnDaemonHealthTrustBindingRecord { + schema_version: IDUNN_DAEMON_HEALTH_TRUST_BINDING_SCHEMA.into(), + binding_id: required(options, "binding-id")?.into(), + daemon_id: required(options, "daemon")?.into(), + health_contract: required(options, "health-contract")?.into(), + source_runtime_id: required(options, "source-runtime")?.into(), + signer_identity_id: derive_service_identity_id::( + &public_key, + )?, + signer_public_key: public_key, + binding_authority: "root".into(), + bound_at_unix_millis: parse_u64(options, "bound-at-unix-millis")?, + release_binding_required: parse_bool(options, "release-binding-required")?, + private_state_exposed: false, + }; + record.validate()?; + Ok(record) +} + +fn add_health_binding(options: &BTreeMap) -> Result<()> { + let record = health_binding(options)?; + let output = path(options, "output")?; + let store = SingleFileMessagePackBackingStore::new(&output); + let existing = store.pull_all_read_only_snapshot()?; + if existing.is_empty() { + bail!("trust store must already exist; create the first binding explicitly"); + } + let mut keys = BTreeSet::new(); + let mut tuples = BTreeSet::new(); + let mut expected = Vec::with_capacity(existing.len() + 1); + for envelope in existing { + if envelope.r#type != IdunnDaemonHealthTrustBindingRecord::TYPE + || envelope.schema_id.as_deref() != Some(IDUNN_DAEMON_HEALTH_TRUST_BINDING_SCHEMA) + { + bail!("trust store contains an alien type or schema"); + } + let binding: IdunnDaemonHealthTrustBindingRecord = + rmp_serde::from_slice(&envelope.payload)?; + if rmp_serde::to_vec(&binding)? != envelope.payload || envelope.key != binding.binding_id { + bail!("trust store contains a noncanonical or mismatched binding"); + } + binding.validate()?; + if !keys.insert(binding.binding_id.clone()) { + bail!("trust store contains duplicate binding ids"); + } + if !tuples.insert(( + binding.daemon_id, + binding.health_contract, + binding.source_runtime_id, + )) { + bail!("trust store contains duplicate daemon/contract/runtime tuples"); + } + expected.push(CultCacheExpectedEnvelope { + r#type: envelope.r#type.clone(), + key: envelope.key.clone(), + current: Some(envelope), + }); + } + if keys.contains(&record.binding_id) { + bail!("binding id already exists"); + } + if tuples.contains(&( + record.daemon_id.clone(), + record.health_contract.clone(), + record.source_runtime_id.clone(), + )) { + bail!("daemon/contract/runtime tuple already exists"); + } + expected.push(CultCacheExpectedEnvelope { + r#type: IdunnDaemonHealthTrustBindingRecord::TYPE.into(), + key: record.binding_id.clone(), + current: None, + }); + let envelope = typed_envelope( + &record.binding_id, + &record, + IDUNN_DAEMON_HEALTH_TRUST_BINDING_SCHEMA, + record.bound_at_unix_millis, + )?; + if !store.compare_exchange(&expected, &[envelope])? { + bail!("trust store changed during validated append"); + } + Ok(()) +} + +fn require_health_binding_release(options: &BTreeMap) -> Result<()> { + require_only( + options, + &[ + "store", + "binding-id", + "daemon", + "health-contract", + "source-runtime", + "signer-public-key-hex", + ], + )?; + let store_path = path(options, "store")?; + let store = SingleFileMessagePackBackingStore::new(&store_path); + let entries = store.pull_all_read_only_snapshot()?; + let signer_public_key = decode_public_key(required(options, "signer-public-key-hex")?)?; + require_health_binding_release_from_snapshot( + &store, + entries, + required(options, "binding-id")?, + required(options, "daemon")?, + required(options, "health-contract")?, + required(options, "source-runtime")?, + &signer_public_key, + ) +} + +fn require_health_binding_release_from_snapshot( + store: &SingleFileMessagePackBackingStore, + entries: Vec, + binding_id: &str, + daemon_id: &str, + health_contract: &str, + source_runtime_id: &str, + signer_public_key: &[u8], +) -> Result<()> { + let bindings = validated_health_bindings(&entries)?; + let target_index = bindings + .iter() + .position(|binding| binding.binding_id == binding_id) + .ok_or_else(|| anyhow!("named daemon health trust binding does not exist"))?; + let current = &bindings[target_index]; + if current.daemon_id != daemon_id + || current.health_contract != health_contract + || current.source_runtime_id != source_runtime_id + || current.signer_public_key != signer_public_key + { + bail!("named daemon health trust binding does not match the expected immutable fields"); + } + if current.release_binding_required { + return Ok(()); + } + + let mut next = current.clone(); + next.release_binding_required = true; + next.validate()?; + let mut replacement = entries[target_index].clone(); + replacement.payload = rmp_serde::to_vec(&next)?; + let expected = entries + .into_iter() + .map(|envelope| CultCacheExpectedEnvelope { + r#type: envelope.r#type.clone(), + key: envelope.key.clone(), + current: Some(envelope), + }) + .collect::>(); + if !store.compare_exchange(&expected, &[replacement])? { + let latest_entries = store.pull_all_read_only_snapshot()?; + let latest_bindings = validated_health_bindings(&latest_entries)?; + if let Some(latest) = latest_bindings + .iter() + .find(|binding| binding.binding_id == binding_id) + && latest.daemon_id == daemon_id + && latest.health_contract == health_contract + && latest.source_runtime_id == source_runtime_id + && latest.signer_public_key == signer_public_key + && latest.release_binding_required + { + return Ok(()); + } + bail!("daemon health trust store changed during release-binding transition"); + } + Ok(()) +} + +fn rotate_health_binding_signer(options: &BTreeMap) -> Result<()> { + require_only( + options, + &[ + "output", + "binding-id", + "signer-public-key-hex", + "bound-at-unix-millis", + ], + )?; + let output = path(options, "output")?; + validate_health_binding_store(&output)?; + let store = SingleFileMessagePackBackingStore::new(&output); + let existing = store.pull_all_read_only_snapshot()?; + let binding_id = required(options, "binding-id")?; + let public_key = decode_public_key(required(options, "signer-public-key-hex")?)?; + let bound_at = parse_u64(options, "bound-at-unix-millis")?; + let mut expected = Vec::with_capacity(existing.len()); + let mut replacement = None; + for envelope in existing { + let binding: IdunnDaemonHealthTrustBindingRecord = + rmp_serde::from_slice(&envelope.payload)?; + if binding.binding_id == binding_id { + if bound_at <= binding.bound_at_unix_millis { + bail!("rotated signer binding time must advance"); + } + if binding.signer_public_key == public_key { + bail!("rotated signer must differ from the current signer"); + } + let mut rotated = binding.clone(); + rotated.signer_identity_id = + derive_service_identity_id::(&public_key)?; + rotated.signer_public_key = public_key.clone(); + rotated.bound_at_unix_millis = bound_at; + rotated.validate()?; + replacement = Some(rotated); + } + expected.push(CultCacheExpectedEnvelope { + r#type: envelope.r#type.clone(), + key: envelope.key.clone(), + current: Some(envelope), + }); + } + let replacement = replacement.ok_or_else(|| anyhow!("binding id does not exist"))?; + let envelope = typed_envelope( + &replacement.binding_id, + &replacement, + IDUNN_DAEMON_HEALTH_TRUST_BINDING_SCHEMA, + bound_at, + )?; + if !store.compare_exchange(&expected, &[envelope])? { + bail!("trust store changed during validated signer rotation"); + } + validate_health_binding_store(&output) +} + +fn typed_envelope( + key: &str, + value: &T, + schema: &str, + millis: u64, +) -> Result { + let stored_at = chrono::DateTime::from_timestamp_millis(i64::try_from(millis)?) + .ok_or_else(|| anyhow!("document timestamp is out of range"))? + .to_rfc3339(); + Ok(CultCacheEnvelope { + key: key.into(), + r#type: T::TYPE.into(), + payload: rmp_serde::to_vec(value)?, + stored_at, + schema_id: Some(schema.into()), + }) +} + +fn create_projection_anchor(options: &BTreeMap) -> Result<()> { + require_only( + options, + &[ + "output", + "trust-anchor-id", + "runtime-id", + "idunn-public-anchor", + "bound-at-unix-millis", + "expires-at-unix-millis", + ], + )?; + let output = path(options, "output")?; + let low_path = path(options, "idunn-public-anchor")?; + reject_alias(&output, &low_path)?; + let low = read_low_level_idunn_anchor(&low_path)?; + let bound = parse_u64(options, "bound-at-unix-millis")?; + let record = GameCultServiceTrustAnchorRecord { + schema_version: GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA.into(), + trust_anchor_id: required(options, "trust-anchor-id")?.into(), + service_id: "idunn".into(), + runtime_id: required(options, "runtime-id")?.into(), + signer_identity_id: derive_service_identity_id::(&low.public_key)?, + signer_public_key: low.public_key, + signature_algorithm: "ed25519".into(), + signing_purpose: IDUNN_AUTHENTICATED_PROVIDER_HEALTH_PROJECTION_SIGNING_PURPOSE.into(), + signed_schema: IDUNN_AUTHENTICATED_PROVIDER_HEALTH_PROJECTION_SCHEMA.into(), + binding_authority: "root".into(), + bound_at_unix_millis: bound, + expires_at_unix_millis: options + .get("expires-at-unix-millis") + .map(|value| value.parse().context("expires-at-unix-millis must be u64")) + .transpose()?, + private_state_exposed: false, + }; + record.validate()?; + write_new_typed( + &output, + &record.trust_anchor_id, + &record, + GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA, + bound, + ) +} + +fn validate_projection_anchor(options: &BTreeMap) -> Result<()> { + require_only(options, &["input", "idunn-public-anchor"])?; + let input = path(options, "input")?; + let low_path = path(options, "idunn-public-anchor")?; + reject_alias(&input, &low_path)?; + let record = read_typed::( + &input, + GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA, + )?; + record.validate()?; + let low = read_low_level_idunn_anchor(&low_path)?; + if record.signer_public_key != low.public_key || record.signer_identity_id != low.identity_id { + bail!("projection trust anchor does not match the supplied Idunn public anchor"); + } + Ok(()) +} + +fn write_new_typed( + path: &Path, + key: &str, + value: &T, + schema: &str, + millis: u64, +) -> Result<()> { + refuse_existing(path, "root distribution document")?; + if let Some(parent) = path.parent() { + std::fs::create_dir_all(parent)?; + } + let stored_at = chrono::DateTime::from_timestamp_millis( + i64::try_from(millis).context("document timestamp is out of range")?, + ) + .ok_or_else(|| anyhow!("document timestamp is out of range"))? + .to_rfc3339(); + let envelope = CultCacheEnvelope { + key: key.into(), + r#type: T::TYPE.into(), + payload: rmp_serde::to_vec(value)?, + stored_at, + schema_id: Some(schema.into()), + }; + let created = SingleFileMessagePackBackingStore::new(path).compare_exchange( + &[CultCacheExpectedEnvelope { + r#type: T::TYPE.into(), + key: key.into(), + current: None, + }], + &[envelope], + )?; + if !created { + bail!("root distribution document lost atomic create race; refusing replacement"); + } + Ok(()) +} + +fn read_typed(path: &Path, schema: &str) -> Result { + let entries = SingleFileMessagePackBackingStore::new(path).pull_all_read_only_snapshot()?; + let [entry] = entries.as_slice() else { + bail!("root distribution file must contain exactly one document"); + }; + if entry.r#type != T::TYPE || entry.schema_id.as_deref() != Some(schema) { + bail!("root distribution document has the wrong type or schema"); + } + let value: T = rmp_serde::from_slice(&entry.payload).context("decoding typed root document")?; + if rmp_serde::to_vec(&value)? != entry.payload { + bail!("root distribution document is not canonical positional MessagePack"); + } + if entry.key != value.root_key() { + bail!("root distribution envelope key does not match its typed document"); + } + Ok(value) +} + +fn read_low_level_idunn_anchor(path: &Path) -> Result { + let entries = SingleFileMessagePackBackingStore::new(path).pull_all_read_only_snapshot()?; + let [entry] = entries.as_slice() else { + bail!("Idunn public anchor store must contain exactly one document"); + }; + if entry.r#type != IdunnServiceIdentity::TRUST_ANCHOR_TYPE + || entry.key != IdunnServiceIdentity::TRUST_ANCHOR_KEY + || entry.schema_id.as_deref() != Some(IdunnServiceIdentity::TRUST_ANCHOR_SCHEMA) + { + bail!("public anchor does not belong to the Idunn service identity profile"); + } + let anchor: ServiceIdentityTrustAnchor = rmp_serde::from_slice(&entry.payload)?; + if rmp_serde::to_vec(&anchor)? != entry.payload + || anchor.schema_version != IdunnServiceIdentity::TRUST_ANCHOR_SCHEMA + || anchor.identity_id + != derive_service_identity_id::(&anchor.public_key)? + { + bail!("Idunn public anchor is malformed or names the wrong key"); + } + Ok(anchor) +} + +fn parse_options(args: impl Iterator) -> Result> { + let mut args = args.peekable(); + let mut out = BTreeMap::new(); + while let Some(name) = args.next() { + let name = name + .strip_prefix("--") + .ok_or_else(|| anyhow!("expected --option, got {name:?}"))?; + if name.contains("seed") || name.contains("private-key") { + bail!("private seed/key input is forbidden; enroll a protected identity instead"); + } + let value = args + .next() + .ok_or_else(|| anyhow!("missing value for --{name}"))?; + if out.insert(name.into(), value).is_some() { + bail!("duplicate option --{name}"); + } + } + Ok(out) +} + +fn require_only(options: &BTreeMap, names: &[&str]) -> Result<()> { + for name in names { + required(options, name)?; + } + if let Some(name) = options.keys().find(|name| !names.contains(&name.as_str())) { + bail!("unsupported option --{name}"); + } + Ok(()) +} + +fn allow_only(options: &BTreeMap, names: &[&str]) -> Result<()> { + if let Some(name) = options.keys().find(|name| !names.contains(&name.as_str())) { + bail!("unsupported option --{name}"); + } + Ok(()) +} + +fn required<'a>(options: &'a BTreeMap, name: &str) -> Result<&'a str> { + options + .get(name) + .map(String::as_str) + .ok_or_else(|| anyhow!("missing --{name}")) +} + +fn path(options: &BTreeMap, name: &str) -> Result { + let value = required(options, name)?; + if value.trim().is_empty() { + bail!("--{name} must not be empty"); + } + Ok(PathBuf::from(value)) +} + +fn parse_u64(options: &BTreeMap, name: &str) -> Result { + required(options, name)? + .parse() + .with_context(|| format!("--{name} must be u64")) +} + +fn parse_bool(options: &BTreeMap, name: &str) -> Result { + match required(options, name)? { + "true" => Ok(true), + "false" => Ok(false), + _ => bail!("--{name} must be true or false"), + } +} + +fn decode_public_key(value: &str) -> Result> { + if value.len() != 64 + || !value + .bytes() + .all(|byte| byte.is_ascii_hexdigit() && !byte.is_ascii_uppercase()) + { + bail!("signer public key must be exactly 64 lowercase hexadecimal characters"); + } + (0..32) + .map(|index| u8::from_str_radix(&value[index * 2..index * 2 + 2], 16).map_err(Into::into)) + .collect() +} + +fn encode_public_key(value: &[u8]) -> Result { + if value.len() != 32 { + bail!("provider health public key must be exactly 32 bytes"); + } + const HEX: &[u8; 16] = b"0123456789abcdef"; + let mut encoded = String::with_capacity(64); + for byte in value { + encoded.push(HEX[(byte >> 4) as usize] as char); + encoded.push(HEX[(byte & 0x0f) as usize] as char); + } + Ok(encoded) +} + +fn refuse_existing(path: &Path, label: &str) -> Result<()> { + if path.exists() { + bail!( + "{label} {} already exists; replacement is forbidden", + path.display() + ); + } + Ok(()) +} + +fn reject_alias(first: &Path, second: &Path) -> Result<()> { + if normalized(first)? == normalized(second)? { + bail!("private/public or input/output paths must not alias"); + } + Ok(()) +} + +fn normalized(path: &Path) -> Result { + let absolute = if path.is_absolute() { + path.to_path_buf() + } else { + std::env::current_dir()?.join(path) + }; + let parent = absolute + .parent() + .ok_or_else(|| anyhow!("path has no parent"))?; + let parent = parent + .canonicalize() + .unwrap_or_else(|_| parent.to_path_buf()); + Ok(parent.join( + absolute + .file_name() + .ok_or_else(|| anyhow!("path has no filename"))?, + )) +} + +fn usage() -> &'static str { + "Usage: idunn-provision enroll-provider-health-identity --private-store \n idunn-provision provider-health-public-key --private-store \n idunn-provision export-provider-health-public-anchor --private-store --public-anchor \n idunn-provision enroll-idunn-identity --private-store \n idunn-provision export-idunn-public-anchor --private-store --public-anchor \n idunn-provision enroll-odin-topology-identity --private-store \n idunn-provision export-odin-topology-public-anchor --private-store --public-anchor \n idunn-provision enroll-deployment-brake-operator --private-store \n idunn-provision export-deployment-brake-operator-anchor --private-store --public-anchor \n idunn-provision deployment-brake-engage --store --runtime-id --owner --reason --observed-at-unix-millis \n idunn-provision deployment-brake-release --store --private-store --runtime-id --owner --reason --authorization-id --release-id --deployment-id --issued-at-unix-millis --expires-at-unix-millis \n idunn-provision deployment-brake-status --store --operator-anchor --runtime-id [--release-id --deployment-id --now-unix-millis ]\n idunn-provision lifecycle-brake-engage --store --runtime-id --target --reason --updated-at-unix-millis \n idunn-provision lifecycle-brake-release --store --runtime-id --target --reason --updated-at-unix-millis [--released-until-unix-millis ]\n idunn-provision lifecycle-brake-status --store --runtime-id --target --now-unix-millis \n idunn-provision create-daemon-health-trust-binding --output --binding-id --daemon --health-contract --source-runtime --signer-public-key-hex --bound-at-unix-millis --release-binding-required \n idunn-provision add-daemon-health-trust-binding --output --binding-id --daemon --health-contract --source-runtime --signer-public-key-hex --bound-at-unix-millis --release-binding-required \n idunn-provision require-daemon-health-release-binding --store --binding-id --daemon --health-contract --source-runtime --signer-public-key-hex \n idunn-provision rotate-daemon-health-trust-signer --output --binding-id --signer-public-key-hex --bound-at-unix-millis \n idunn-provision validate-daemon-health-trust-binding --input \n idunn-provision create-provider-projection-trust-anchor --output --trust-anchor-id --runtime-id --idunn-public-anchor --bound-at-unix-millis --expires-at-unix-millis \n idunn-provision validate-provider-projection-trust-anchor --input --idunn-public-anchor " +} + +#[cfg(test)] +mod tests { + use super::*; + use cultcache_rs::CacheBackingStore; + use tempfile::TempDir; + + fn invoke(args: &[&str]) -> Result<()> { + run(args.iter().map(|value| value.to_string())) + } + + fn replace_typed( + path: &Path, + key: &str, + schema: &str, + value: &T, + ) -> Result<()> { + std::fs::remove_file(path)?; + SingleFileMessagePackBackingStore::new(path).push(&CultCacheEnvelope { + key: key.into(), + r#type: T::TYPE.into(), + payload: rmp_serde::to_vec(value)?, + stored_at: "2026-07-19T20:00:00Z".into(), + schema_id: Some(schema.into()), + }) + } + + fn binding_args<'a>( + command: &'a str, + output: &'a str, + id: &'a str, + daemon: &'a str, + runtime: &'a str, + ) -> Vec<&'a str> { + vec![ + command, + "--output", + output, + "--binding-id", + id, + "--daemon", + daemon, + "--health-contract", + "provider.health", + "--source-runtime", + runtime, + "--signer-public-key-hex", + "1111111111111111111111111111111111111111111111111111111111111111", + "--bound-at-unix-millis", + "1784483100000", + "--release-binding-required", + "false", + ] + } + + const TEST_SIGNER_HEX: &str = + "1111111111111111111111111111111111111111111111111111111111111111"; + const WRONG_SIGNER_HEX: &str = + "2222222222222222222222222222222222222222222222222222222222222222"; + + fn write_test_binding( + command: &str, + store: &str, + id: &str, + daemon: &str, + runtime: &str, + ) -> Result<()> { + invoke(&binding_args(command, store, id, daemon, runtime)) + } + + fn require_test_binding( + store: &str, + id: &str, + daemon: &str, + contract: &str, + runtime: &str, + signer: &str, + ) -> Result<()> { + invoke(&[ + "require-daemon-health-release-binding", + "--store", + store, + "--binding-id", + id, + "--daemon", + daemon, + "--health-contract", + contract, + "--source-runtime", + runtime, + "--signer-public-key-hex", + signer, + ]) + } + + fn store_snapshot(path: &Path) -> Result> { + SingleFileMessagePackBackingStore::new(path).pull_all_read_only_snapshot() + } + + #[test] + fn append_health_binding_preserves_existing_and_rejects_collisions_and_aliens() -> Result<()> { + let temp = TempDir::new()?; + let store = temp.path().join("trust.cc"); + let path = store.to_str().unwrap(); + invoke(&binding_args( + "create-daemon-health-trust-binding", + path, + "one", + "daemon-one", + "runtime-one", + ))?; + let before = SingleFileMessagePackBackingStore::new(&store) + .pull_all_read_only_snapshot()? + .remove(0) + .payload; + invoke(&binding_args( + "add-daemon-health-trust-binding", + path, + "two", + "daemon-two", + "runtime-two", + ))?; + let entries = + SingleFileMessagePackBackingStore::new(&store).pull_all_read_only_snapshot()?; + assert_eq!(entries.len(), 2); + assert_eq!( + entries + .iter() + .find(|entry| entry.key == "one") + .unwrap() + .payload, + before + ); + assert!( + invoke(&binding_args( + "add-daemon-health-trust-binding", + path, + "two", + "daemon-three", + "runtime-three" + )) + .is_err() + ); + assert!( + invoke(&binding_args( + "add-daemon-health-trust-binding", + path, + "three", + "daemon-one", + "runtime-one" + )) + .is_err() + ); + SingleFileMessagePackBackingStore::new(&store).push(&CultCacheEnvelope { + key: "alien".into(), + r#type: "alien".into(), + payload: vec![], + stored_at: "2026-07-19T20:00:00Z".into(), + schema_id: Some("alien.v0".into()), + })?; + assert!( + invoke(&binding_args( + "add-daemon-health-trust-binding", + path, + "four", + "daemon-four", + "runtime-four" + )) + .is_err() + ); + Ok(()) + } + + #[test] + fn require_release_binding_changes_only_the_named_flag_and_is_idempotent() -> Result<()> { + let temp = TempDir::new()?; + let store = temp.path().join("trust.cc"); + let path = store.to_str().unwrap(); + write_test_binding( + "create-daemon-health-trust-binding", + path, + "one", + "daemon-one", + "runtime-one", + )?; + write_test_binding( + "add-daemon-health-trust-binding", + path, + "two", + "daemon-two", + "runtime-two", + )?; + let before = store_snapshot(&store)?; + + require_test_binding( + path, + "one", + "daemon-one", + "provider.health", + "runtime-one", + TEST_SIGNER_HEX, + )?; + let after = store_snapshot(&store)?; + let before_target = before.iter().find(|entry| entry.key == "one").unwrap(); + let after_target = after.iter().find(|entry| entry.key == "one").unwrap(); + let mut expected: IdunnDaemonHealthTrustBindingRecord = + rmp_serde::from_slice(&before_target.payload)?; + expected.release_binding_required = true; + assert_eq!( + rmp_serde::from_slice::(&after_target.payload)?, + expected + ); + let mut expected_envelope = before_target.clone(); + expected_envelope.payload = after_target.payload.clone(); + assert_eq!(after_target, &expected_envelope); + assert_eq!( + after.iter().find(|entry| entry.key == "two"), + before.iter().find(|entry| entry.key == "two") + ); + + require_test_binding( + path, + "one", + "daemon-one", + "provider.health", + "runtime-one", + TEST_SIGNER_HEX, + )?; + assert_eq!(store_snapshot(&store)?, after); + require_health_binding_release_from_snapshot( + &SingleFileMessagePackBackingStore::new(&store), + before, + "one", + "daemon-one", + "provider.health", + "runtime-one", + &decode_public_key(TEST_SIGNER_HEX)?, + )?; + Ok(()) + } + + #[test] + fn require_release_binding_refuses_wrong_identity_and_invalid_store_without_writing() + -> Result<()> { + let temp = TempDir::new()?; + let store = temp.path().join("trust.cc"); + let path = store.to_str().unwrap(); + write_test_binding( + "create-daemon-health-trust-binding", + path, + "one", + "daemon-one", + "runtime-one", + )?; + let before = store_snapshot(&store)?; + for (id, daemon, contract, runtime, signer) in [ + ( + "one", + "wrong", + "provider.health", + "runtime-one", + TEST_SIGNER_HEX, + ), + ("one", "daemon-one", "wrong", "runtime-one", TEST_SIGNER_HEX), + ( + "one", + "daemon-one", + "provider.health", + "wrong", + TEST_SIGNER_HEX, + ), + ( + "one", + "daemon-one", + "provider.health", + "runtime-one", + WRONG_SIGNER_HEX, + ), + ( + "missing", + "daemon-one", + "provider.health", + "runtime-one", + TEST_SIGNER_HEX, + ), + ] { + assert!(require_test_binding(path, id, daemon, contract, runtime, signer).is_err()); + } + assert!( + invoke(&[ + "require-daemon-health-release-binding", + "--store", + path, + "--binding-id", + "one", + "--daemon", + "daemon-one", + "--health-contract", + "provider.health", + "--signer-public-key-hex", + TEST_SIGNER_HEX, + ]) + .is_err() + ); + assert_eq!(store_snapshot(&store)?, before); + + SingleFileMessagePackBackingStore::new(&store).push(&CultCacheEnvelope { + key: "alien".into(), + r#type: "alien".into(), + payload: vec![], + stored_at: "2026-07-19T20:00:00Z".into(), + schema_id: Some("alien.v0".into()), + })?; + let foreign = store_snapshot(&store)?; + assert!( + require_test_binding( + path, + "one", + "daemon-one", + "provider.health", + "runtime-one", + TEST_SIGNER_HEX, + ) + .is_err() + ); + assert_eq!(store_snapshot(&store)?, foreign); + + let ambiguous = temp.path().join("ambiguous.cc"); + let ambiguous_path = ambiguous.to_str().unwrap(); + write_test_binding( + "create-daemon-health-trust-binding", + ambiguous_path, + "one", + "daemon-one", + "runtime-one", + )?; + let mut duplicate: IdunnDaemonHealthTrustBindingRecord = + rmp_serde::from_slice(&store_snapshot(&ambiguous)?.remove(0).payload)?; + duplicate.binding_id = "duplicate".into(); + SingleFileMessagePackBackingStore::new(&ambiguous).push(&typed_envelope( + &duplicate.binding_id, + &duplicate, + IDUNN_DAEMON_HEALTH_TRUST_BINDING_SCHEMA, + duplicate.bound_at_unix_millis, + )?)?; + let ambiguous_before = store_snapshot(&ambiguous)?; + assert!( + require_test_binding( + ambiguous_path, + "one", + "daemon-one", + "provider.health", + "runtime-one", + TEST_SIGNER_HEX, + ) + .is_err() + ); + assert_eq!(store_snapshot(&ambiguous)?, ambiguous_before); + Ok(()) + } + + #[test] + fn require_release_binding_cas_covers_the_whole_validated_store() -> Result<()> { + let temp = TempDir::new()?; + let store_path = temp.path().join("trust.cc"); + let path = store_path.to_str().unwrap(); + write_test_binding( + "create-daemon-health-trust-binding", + path, + "one", + "daemon-one", + "runtime-one", + )?; + write_test_binding( + "add-daemon-health-trust-binding", + path, + "two", + "daemon-two", + "runtime-two", + )?; + let stale = store_snapshot(&store_path)?; + require_test_binding( + path, + "two", + "daemon-two", + "provider.health", + "runtime-two", + TEST_SIGNER_HEX, + )?; + + let store = SingleFileMessagePackBackingStore::new(&store_path); + let error = require_health_binding_release_from_snapshot( + &store, + stale, + "one", + "daemon-one", + "provider.health", + "runtime-one", + &decode_public_key(TEST_SIGNER_HEX)?, + ) + .unwrap_err(); + assert!(error.to_string().contains("changed during release-binding")); + let records = validated_health_bindings(&store_snapshot(&store_path)?)?; + assert!( + !records + .iter() + .find(|binding| binding.binding_id == "one") + .unwrap() + .release_binding_required + ); + assert!( + records + .iter() + .find(|binding| binding.binding_id == "two") + .unwrap() + .release_binding_required + ); + Ok(()) + } + + #[test] + fn concurrent_health_binding_appends_have_one_cas_winner() -> Result<()> { + let temp = TempDir::new()?; + let store = temp.path().join("trust.cc"); + let path = store.to_str().unwrap().to_string(); + invoke(&binding_args( + "create-daemon-health-trust-binding", + &path, + "one", + "daemon-one", + "runtime-one", + ))?; + let barrier = std::sync::Arc::new(std::sync::Barrier::new(3)); + let workers = [ + ("two", "daemon-two", "runtime-two"), + ("three", "daemon-three", "runtime-three"), + ] + .map(|(id, daemon, runtime)| { + let path = path.clone(); + let barrier = barrier.clone(); + std::thread::spawn(move || { + barrier.wait(); + invoke(&binding_args( + "add-daemon-health-trust-binding", + &path, + id, + daemon, + runtime, + )) + }) + }); + barrier.wait(); + let wins = workers + .into_iter() + .map(|worker| worker.join().unwrap()) + .filter(Result::is_ok) + .count(); + assert!((1..=2).contains(&wins)); + assert_eq!( + SingleFileMessagePackBackingStore::new(&store) + .pull_all_read_only_snapshot()? + .len(), + 1 + wins + ); + Ok(()) + } + + #[test] + fn provider_health_identity_enrollment_is_profile_exact_and_immutable() -> Result<()> { + let temp = TempDir::new()?; + let private = temp.path().join("provider-health-identity.cc"); + let options = BTreeMap::from([( + "private-store".to_string(), + private.to_string_lossy().into_owned(), + )]); + + let public_key_hex = enroll_provider_health_identity(&options)?; + let signer = open_service_identity_at::(&private)?; + assert_eq!( + public_key_hex, + encode_public_key(&signer.entry().public_key)? + ); + assert_eq!( + decode_public_key(&public_key_hex)?, + signer.entry().public_key + ); + + let entries = + SingleFileMessagePackBackingStore::new(&private).pull_all_read_only_snapshot()?; + let [entry] = entries.as_slice() else { + panic!("provider health identity store must contain exactly one entry"); + }; + assert_eq!(entry.r#type, GameCultProviderHealthIdentity::PRIVATE_TYPE); + assert_eq!(entry.key, GameCultProviderHealthIdentity::PRIVATE_KEY); + assert_eq!( + entry.schema_id.as_deref(), + Some(GameCultProviderHealthIdentity::PRIVATE_SCHEMA) + ); + assert!(open_service_identity_at::(&private).is_err()); + + let before = std::fs::read(&private)?; + assert!( + invoke(&[ + "enroll-provider-health-identity", + "--private-store", + private.to_str().unwrap(), + ]) + .is_err() + ); + assert_eq!(std::fs::read(&private)?, before); + + let unauthorized = temp.path().join("unauthorized.cc"); + assert!( + invoke(&[ + "enroll-provider-health-identity", + "--private-store", + unauthorized.to_str().unwrap(), + "--release-binding-required", + "true", + ]) + .is_err() + ); + assert!(!unauthorized.exists()); + Ok(()) + } + + #[test] + fn provider_health_public_key_is_read_only_and_rejects_wrong_profile_or_options() -> Result<()> + { + let temp = TempDir::new()?; + let provider = temp.path().join("provider-health.cc"); + let provider_options = BTreeMap::from([( + "private-store".to_string(), + provider.to_string_lossy().into_owned(), + )]); + let expected = enroll_provider_health_identity(&provider_options)?; + let provider_before = std::fs::read(&provider)?; + assert_eq!(provider_health_public_key(&provider_options)?, expected); + assert_eq!(std::fs::read(&provider)?, provider_before); + + let wrong_profile = temp.path().join("idunn.cc"); + enroll_service_identity_at::(&wrong_profile)?; + let wrong_before = std::fs::read(&wrong_profile)?; + assert!( + invoke(&[ + "provider-health-public-key", + "--private-store", + wrong_profile.to_str().unwrap(), + ]) + .is_err() + ); + assert_eq!(std::fs::read(&wrong_profile)?, wrong_before); + + assert!( + invoke(&[ + "provider-health-public-key", + "--private-store", + provider.to_str().unwrap(), + "--release-binding-required", + "true", + ]) + .is_err() + ); + assert_eq!(std::fs::read(&provider)?, provider_before); + Ok(()) + } + + #[test] + fn provider_and_odin_anchor_exports_are_profile_exact_immutable_and_non_aliasing() -> Result<()> + { + let temp = TempDir::new()?; + let provider_private = temp.path().join("provider-private.cc"); + let provider_anchor = temp.path().join("provider-anchor.cc"); + invoke(&[ + "enroll-provider-health-identity", + "--private-store", + provider_private.to_str().unwrap(), + ])?; + assert!( + invoke(&[ + "export-provider-health-public-anchor", + "--private-store", + provider_private.to_str().unwrap(), + "--public-anchor", + provider_private.to_str().unwrap(), + ]) + .is_err() + ); + invoke(&[ + "export-provider-health-public-anchor", + "--private-store", + provider_private.to_str().unwrap(), + "--public-anchor", + provider_anchor.to_str().unwrap(), + ])?; + let provider_entries = store_snapshot(&provider_anchor)?; + let [provider_envelope] = provider_entries.as_slice() else { + panic!("provider anchor store must contain exactly one envelope"); + }; + assert_eq!( + provider_envelope.r#type, + GameCultProviderHealthIdentity::TRUST_ANCHOR_TYPE + ); + assert_eq!( + provider_envelope.key, + GameCultProviderHealthIdentity::TRUST_ANCHOR_KEY + ); + assert_eq!( + provider_envelope.schema_id.as_deref(), + Some(GameCultProviderHealthIdentity::TRUST_ANCHOR_SCHEMA) + ); + let provider: ServiceIdentityTrustAnchor = + rmp_serde::from_slice(&provider_envelope.payload)?; + assert_eq!(rmp_serde::to_vec(&provider)?, provider_envelope.payload); + assert_eq!( + provider.identity_id, + derive_service_identity_id::(&provider.public_key)? + ); + assert!(open_service_identity_at::(&provider_private).is_err()); + let provider_before = std::fs::read(&provider_anchor)?; + assert!( + invoke(&[ + "export-provider-health-public-anchor", + "--private-store", + provider_private.to_str().unwrap(), + "--public-anchor", + provider_anchor.to_str().unwrap(), + ]) + .is_err() + ); + assert_eq!(std::fs::read(&provider_anchor)?, provider_before); + + let odin_private = temp.path().join("odin-private.cc"); + let odin_anchor = temp.path().join("odin-anchor.cc"); + invoke(&[ + "enroll-odin-topology-identity", + "--private-store", + odin_private.to_str().unwrap(), + ])?; + assert!(open_service_identity_at::(&odin_private).is_err()); + assert!( + invoke(&[ + "export-odin-topology-public-anchor", + "--private-store", + odin_private.to_str().unwrap(), + "--public-anchor", + odin_private.to_str().unwrap(), + ]) + .is_err() + ); + invoke(&[ + "export-odin-topology-public-anchor", + "--private-store", + odin_private.to_str().unwrap(), + "--public-anchor", + odin_anchor.to_str().unwrap(), + ])?; + let odin_entries = store_snapshot(&odin_anchor)?; + let [odin_envelope] = odin_entries.as_slice() else { + panic!("Odin anchor store must contain exactly one envelope"); + }; + assert_eq!( + odin_envelope.r#type, + OdinTopologyIdentity::TRUST_ANCHOR_TYPE + ); + assert_eq!(odin_envelope.key, OdinTopologyIdentity::TRUST_ANCHOR_KEY); + assert_eq!( + odin_envelope.schema_id.as_deref(), + Some(OdinTopologyIdentity::TRUST_ANCHOR_SCHEMA) + ); + let odin: ServiceIdentityTrustAnchor = rmp_serde::from_slice(&odin_envelope.payload)?; + assert_eq!(rmp_serde::to_vec(&odin)?, odin_envelope.payload); + assert_eq!( + odin.identity_id, + derive_service_identity_id::(&odin.public_key)? + ); + assert_ne!(provider.identity_id, odin.identity_id); + let odin_before = std::fs::read(&odin_anchor)?; + assert!( + invoke(&[ + "export-odin-topology-public-anchor", + "--private-store", + odin_private.to_str().unwrap(), + "--public-anchor", + odin_anchor.to_str().unwrap(), + ]) + .is_err() + ); + assert_eq!(std::fs::read(&odin_anchor)?, odin_before); + + let wrong_profile_output = temp.path().join("wrong-profile.cc"); + assert!( + invoke(&[ + "export-provider-health-public-anchor", + "--private-store", + odin_private.to_str().unwrap(), + "--public-anchor", + wrong_profile_output.to_str().unwrap(), + ]) + .is_err() + ); + assert!(!wrong_profile_output.exists()); + Ok(()) + } + + #[test] + fn identity_enrollment_and_export_are_immutable_and_paths_cannot_alias() -> Result<()> { + let temp = TempDir::new()?; + let private = temp.path().join("identity.cc"); + let public = temp.path().join("identity-public.cc"); + invoke(&[ + "enroll-idunn-identity", + "--private-store", + private.to_str().unwrap(), + ])?; + assert!( + invoke(&[ + "enroll-idunn-identity", + "--private-store", + private.to_str().unwrap() + ]) + .is_err() + ); + assert!( + invoke(&[ + "export-idunn-public-anchor", + "--private-store", + private.to_str().unwrap(), + "--public-anchor", + private.to_str().unwrap(), + ]) + .is_err() + ); + invoke(&[ + "export-idunn-public-anchor", + "--private-store", + private.to_str().unwrap(), + "--public-anchor", + public.to_str().unwrap(), + ])?; + assert!( + invoke(&[ + "export-idunn-public-anchor", + "--private-store", + private.to_str().unwrap(), + "--public-anchor", + public.to_str().unwrap(), + ]) + .is_err() + ); + assert!( + invoke(&[ + "enroll-idunn-identity", + "--private-store", + temp.path().join("new.cc").to_str().unwrap(), + "--private-seed", + "00", + ]) + .is_err() + ); + Ok(()) + } + + #[test] + fn health_binding_derives_identity_and_rejects_overwrite_and_corruption() -> Result<()> { + let temp = TempDir::new()?; + let output = temp.path().join("provider-binding.cc"); + let key = "07".repeat(32); + let args = [ + "create-daemon-health-trust-binding", + "--output", + output.to_str().unwrap(), + "--binding-id", + "root/epiphany/health", + "--daemon", + "yggdrasil-epiphany", + "--health-contract", + "epiphany.cultnet-rudp-runtime-health", + "--source-runtime", + "epiphany-daemon-supervisor", + "--signer-public-key-hex", + &key, + "--bound-at-unix-millis", + "1784483100000", + "--release-binding-required", + "true", + ]; + invoke(&args)?; + assert!(invoke(&args).is_err()); + let mut record = read_typed::( + &output, + IDUNN_DAEMON_HEALTH_TRUST_BINDING_SCHEMA, + )?; + assert_eq!( + record.signer_identity_id, + derive_service_identity_id::( + &record.signer_public_key + )? + ); + record.signer_identity_id = "caller-chosen".into(); + replace_typed( + &output, + &record.binding_id, + IDUNN_DAEMON_HEALTH_TRUST_BINDING_SCHEMA, + &record, + )?; + assert!( + invoke(&[ + "validate-daemon-health-trust-binding", + "--input", + output.to_str().unwrap() + ]) + .is_err() + ); + + record.signer_identity_id = derive_service_identity_id::( + &record.signer_public_key, + )?; + record.schema_version = "wrong.schema.v9".into(); + replace_typed( + &output, + &record.binding_id, + IDUNN_DAEMON_HEALTH_TRUST_BINDING_SCHEMA, + &record, + )?; + assert!( + invoke(&[ + "validate-daemon-health-trust-binding", + "--input", + output.to_str().unwrap() + ]) + .is_err() + ); + Ok(()) + } + + #[test] + fn projection_anchor_is_exact_profile_and_matches_low_level_anchor() -> Result<()> { + let temp = TempDir::new()?; + let private = temp.path().join("identity.cc"); + let public = temp.path().join("public.cc"); + let root = temp.path().join("root-anchor.cc"); + invoke(&[ + "enroll-idunn-identity", + "--private-store", + private.to_str().unwrap(), + ])?; + invoke(&[ + "export-idunn-public-anchor", + "--private-store", + private.to_str().unwrap(), + "--public-anchor", + public.to_str().unwrap(), + ])?; + let create = [ + "create-provider-projection-trust-anchor", + "--output", + root.to_str().unwrap(), + "--trust-anchor-id", + "root/idunn/provider-health", + "--runtime-id", + "idunn-yggdrasil", + "--idunn-public-anchor", + public.to_str().unwrap(), + "--bound-at-unix-millis", + "1784483100000", + "--expires-at-unix-millis", + "1815000000000", + ]; + invoke(&create)?; + invoke(&[ + "validate-provider-projection-trust-anchor", + "--input", + root.to_str().unwrap(), + "--idunn-public-anchor", + public.to_str().unwrap(), + ])?; + assert!(invoke(&create).is_err()); + assert!( + invoke(&[ + "validate-provider-projection-trust-anchor", + "--input", + public.to_str().unwrap(), + "--idunn-public-anchor", + public.to_str().unwrap(), + ]) + .is_err() + ); + + let mut record = read_typed::( + &root, + GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA, + )?; + record.signing_purpose = "wrong-purpose".into(); + replace_typed( + &root, + &record.trust_anchor_id, + GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA, + &record, + )?; + assert!( + invoke(&[ + "validate-provider-projection-trust-anchor", + "--input", + root.to_str().unwrap(), + "--idunn-public-anchor", + public.to_str().unwrap(), + ]) + .is_err() + ); + + record.signing_purpose = + IDUNN_AUTHENTICATED_PROVIDER_HEALTH_PROJECTION_SIGNING_PURPOSE.into(); + record.signer_public_key = vec![9; 32]; + replace_typed( + &root, + &record.trust_anchor_id, + GAMECULT_SERVICE_TRUST_ANCHOR_SCHEMA, + &record, + )?; + assert!( + invoke(&[ + "validate-provider-projection-trust-anchor", + "--input", + root.to_str().unwrap(), + "--idunn-public-anchor", + public.to_str().unwrap(), + ]) + .is_err() + ); + Ok(()) + } + + #[test] + fn release_binding_policy_is_explicit_and_boolean() { + let temp = TempDir::new().unwrap(); + let output = temp.path().join("binding.cc"); + let base = [ + "create-daemon-health-trust-binding", + "--output", + output.to_str().unwrap(), + "--binding-id", + "root/provider/health", + "--daemon", + "provider", + "--health-contract", + "provider.health", + "--source-runtime", + "provider-runtime", + "--signer-public-key-hex", + "0707070707070707070707070707070707070707070707070707070707070707", + "--bound-at-unix-millis", + "1784483100000", + ]; + assert!(invoke(&base).is_err()); + let mut partial = base.to_vec(); + partial.extend(["--release-binding-required", "sometimes"]); + assert!(invoke(&partial).is_err()); + } + + #[test] + fn signer_rotation_changes_only_the_named_trust_binding_signer() -> Result<()> { + let temp = TempDir::new()?; + let output = temp.path().join("binding.cc"); + invoke(&[ + "create-daemon-health-trust-binding", + "--output", + output.to_str().unwrap(), + "--binding-id", + "heimdall-yggdrasil-provider-health", + "--daemon", + "yggdrasil-heimdall", + "--health-contract", + "heimdall.cultnet-rudp-provider-health", + "--source-runtime", + "heimdall-service", + "--signer-public-key-hex", + "0707070707070707070707070707070707070707070707070707070707070707", + "--bound-at-unix-millis", + "100", + "--release-binding-required", + "false", + ])?; + assert!( + invoke(&[ + "rotate-daemon-health-trust-signer", + "--output", + output.to_str().unwrap(), + "--binding-id", + "heimdall-yggdrasil-provider-health", + "--signer-public-key-hex", + "0808080808080808080808080808080808080808080808080808080808080808", + "--bound-at-unix-millis", + "100", + ]) + .is_err() + ); + invoke(&[ + "rotate-daemon-health-trust-signer", + "--output", + output.to_str().unwrap(), + "--binding-id", + "heimdall-yggdrasil-provider-health", + "--signer-public-key-hex", + "0808080808080808080808080808080808080808080808080808080808080808", + "--bound-at-unix-millis", + "101", + ])?; + let [envelope] = SingleFileMessagePackBackingStore::new(&output) + .pull_all_read_only_snapshot()? + .try_into() + .map_err(|_| anyhow!("expected one trust binding"))?; + let binding: IdunnDaemonHealthTrustBindingRecord = + rmp_serde::from_slice(&envelope.payload)?; + assert_eq!(binding.binding_id, "heimdall-yggdrasil-provider-health"); + assert_eq!(binding.daemon_id, "yggdrasil-heimdall"); + assert_eq!( + binding.health_contract, + "heimdall.cultnet-rudp-provider-health" + ); + assert_eq!(binding.source_runtime_id, "heimdall-service"); + assert_eq!(binding.signer_public_key, vec![8; 32]); + assert_eq!(binding.bound_at_unix_millis, 101); + assert!(!binding.release_binding_required); + validate_health_binding_store(&output) + } + + #[test] + fn brake_operator_can_issue_one_exact_bounded_rollout_grant() -> Result<()> { + let temp = TempDir::new()?; + let private = temp.path().join("operator-private.cc"); + let anchor = temp.path().join("operator-public.cc"); + let store = temp.path().join("brake.cc"); + invoke(&[ + "enroll-deployment-brake-operator", + "--private-store", + private.to_str().unwrap(), + ])?; + invoke(&[ + "export-deployment-brake-operator-anchor", + "--private-store", + private.to_str().unwrap(), + "--public-anchor", + anchor.to_str().unwrap(), + ])?; + invoke(&[ + "deployment-brake-engage", + "--store", + store.to_str().unwrap(), + "--runtime-id", + "yggdrasil", + "--owner", + "operator/metacrat", + "--reason", + "sleep mode", + "--observed-at-unix-millis", + "100", + ])?; + assert_eq!(read_brake(&store)?.status, "engaged"); + invoke(&[ + "deployment-brake-status", + "--store", + store.to_str().unwrap(), + "--operator-anchor", + anchor.to_str().unwrap(), + "--runtime-id", + "yggdrasil", + ])?; + assert!( + invoke(&[ + "deployment-brake-status", + "--store", + store.to_str().unwrap(), + "--operator-anchor", + anchor.to_str().unwrap(), + "--runtime-id", + "yggdrasil", + "--release-id", + "commit-4", + "--deployment-id", + "request-4", + "--now-unix-millis", + "150", + ]) + .is_err() + ); + invoke(&[ + "deployment-brake-release", + "--store", + store.to_str().unwrap(), + "--private-store", + private.to_str().unwrap(), + "--runtime-id", + "yggdrasil", + "--owner", + "operator/metacrat", + "--reason", + "one rollout", + "--authorization-id", + "auth/r4", + "--release-id", + "commit-4", + "--deployment-id", + "request-4", + "--issued-at-unix-millis", + "200", + "--expires-at-unix-millis", + "800", + ])?; + invoke(&[ + "deployment-brake-status", + "--store", + store.to_str().unwrap(), + "--operator-anchor", + anchor.to_str().unwrap(), + "--runtime-id", + "yggdrasil", + "--release-id", + "commit-4", + "--deployment-id", + "request-4", + "--now-unix-millis", + "500", + ])?; + assert!( + invoke(&[ + "deployment-brake-status", + "--store", + store.to_str().unwrap(), + "--operator-anchor", + anchor.to_str().unwrap(), + "--runtime-id", + "yggdrasil", + "--release-id", + "substituted", + "--deployment-id", + "request-4", + "--now-unix-millis", + "500" + ]) + .is_err() + ); + Ok(()) + } + + #[test] + fn lifecycle_brake_is_absence_allow_and_exact_to_runtime_target_and_expiry() -> Result<()> { + let temp = TempDir::new()?; + let missing = temp.path().join("missing-lifecycle.cc"); + invoke(&[ + "lifecycle-brake-status", + "--store", + missing.to_str().unwrap(), + "--runtime-id", + "idunn-yggdrasil", + "--target", + "ghostlight", + "--now-unix-millis", + "100", + ])?; + assert!(!missing.exists()); + + let store = temp.path().join("ghostlight-lifecycle.cc"); + invoke(&[ + "lifecycle-brake-engage", + "--store", + store.to_str().unwrap(), + "--runtime-id", + "idunn-yggdrasil", + "--target", + "ghostlight", + "--reason", + "operator maintenance", + "--updated-at-unix-millis", + "200", + ])?; + let engaged = read_lifecycle_brake(&store)?.context("lifecycle brake must exist")?; + assert_eq!(engaged.status, "engaged"); + assert_eq!(engaged.runtime_id, "idunn-yggdrasil"); + assert_eq!(engaged.target, "ghostlight"); + assert!(read_brake(&store).is_err()); + assert!( + invoke(&[ + "lifecycle-brake-status", + "--store", + store.to_str().unwrap(), + "--runtime-id", + "idunn-yggdrasil", + "--target", + "ghostlight", + "--now-unix-millis", + "201", + ]) + .is_err() + ); + + let engaged_bytes = std::fs::read(&store)?; + assert!( + invoke(&[ + "lifecycle-brake-release", + "--store", + store.to_str().unwrap(), + "--runtime-id", + "idunn-nightwing", + "--target", + "ghostlight", + "--reason", + "wrong runtime", + "--updated-at-unix-millis", + "300", + ]) + .is_err() + ); + assert!( + invoke(&[ + "lifecycle-brake-release", + "--store", + store.to_str().unwrap(), + "--runtime-id", + "idunn-yggdrasil", + "--target", + "odin", + "--reason", + "wrong target", + "--updated-at-unix-millis", + "300", + ]) + .is_err() + ); + assert_eq!(std::fs::read(&store)?, engaged_bytes); + + invoke(&[ + "lifecycle-brake-release", + "--store", + store.to_str().unwrap(), + "--runtime-id", + "idunn-yggdrasil", + "--target", + "ghostlight", + "--reason", + "bounded continuity window", + "--updated-at-unix-millis", + "300", + "--released-until-unix-millis", + "500", + ])?; + invoke(&[ + "lifecycle-brake-status", + "--store", + store.to_str().unwrap(), + "--runtime-id", + "idunn-yggdrasil", + "--target", + "ghostlight", + "--now-unix-millis", + "499", + ])?; + for (runtime, target, now) in [ + ("idunn-nightwing", "ghostlight", "499"), + ("idunn-yggdrasil", "odin", "499"), + ("idunn-yggdrasil", "ghostlight", "500"), + ] { + assert!( + invoke(&[ + "lifecycle-brake-status", + "--store", + store.to_str().unwrap(), + "--runtime-id", + runtime, + "--target", + target, + "--now-unix-millis", + now, + ]) + .is_err() + ); + } + let released_bytes = std::fs::read(&store)?; + assert!( + invoke(&[ + "lifecycle-brake-engage", + "--store", + store.to_str().unwrap(), + "--runtime-id", + "idunn-yggdrasil", + "--target", + "ghostlight", + "--reason", + "stale replay", + "--updated-at-unix-millis", + "300", + ]) + .is_err() + ); + assert_eq!(std::fs::read(&store)?, released_bytes); + Ok(()) + } + + #[test] + fn brake_compare_exchange_rejects_stale_transition_snapshot() -> Result<()> { + let temp = TempDir::new()?; + let store_path = temp.path().join("brake.cc"); + let base = IdunnDeploymentBrakeRecord { + schema_version: IDUNN_DEPLOYMENT_BRAKE_SCHEMA.into(), + brake_id: IDUNN_DEPLOYMENT_BRAKE_ID.into(), + authority: IDUNN_DEPLOYMENT_BRAKE_AUTHORITY.into(), + runtime_id: "yggdrasil".into(), + status: "engaged".into(), + scope: IDUNN_DEPLOYMENT_BRAKE_SCOPE.into(), + reason: "first".into(), + observed_at_unix_millis: 100, + expires_at_unix_millis: None, + authorization_id: None, + authorization_purpose: None, + authorized_release_id: None, + authorized_deployment_id: None, + authorized_by: None, + authorization_issued_at_unix_millis: None, + authorization_expires_at_unix_millis: None, + signature_algorithm: None, + signature: None, + private_state_exposed: false, + updated_by: "operator/a".into(), + }; + replace_brake(&store_path, base.clone(), 100)?; + let stale = SingleFileMessagePackBackingStore::new(&store_path) + .pull_all_read_only_snapshot()? + .remove(0); + let mut changed = base.clone(); + changed.reason = "racing writer".into(); + changed.observed_at_unix_millis = 101; + replace_brake(&store_path, changed, 101)?; + let candidate = typed_envelope( + IDUNN_DEPLOYMENT_BRAKE_ID, + &base, + IDUNN_DEPLOYMENT_BRAKE_SCHEMA, + 102, + )?; + assert!( + !SingleFileMessagePackBackingStore::new(&store_path).compare_exchange( + &[CultCacheExpectedEnvelope { + r#type: IdunnDeploymentBrakeRecord::TYPE.into(), + key: IDUNN_DEPLOYMENT_BRAKE_ID.into(), + current: Some(stale) + }], + &[candidate] + )? + ); + Ok(()) + } +} diff --git a/state/map.yaml b/state/map.yaml deleted file mode 100644 index 00421d0..0000000 --- a/state/map.yaml +++ /dev/null @@ -1,64 +0,0 @@ -# Odin deployment and admission map. -# -# This file describes a live system and is the fastest-rotting thing in the -# repository. Verify every line against the host before acting on it; the -# commands that do so are in AGENTS.md. Where this disagrees with yggdrasil, -# yggdrasil is right and this file is a bug. - -verified_at: 2026-09-10T22:45Z -verified_against: yggdrasil (systemctl, idunn status) - -deployment_authority: - managed_by: idunn-yggdrasil.service - binding: /etc/gamecult/idunn/bindings/odin.toml # on the host, not in this repo - recipe: deployment/idunn/recipe.toml - source_selection: ref-head on refs/heads/main - minimum_revision: 08965a44e135b393a130d62b075dc5036d2df901 - idunn_minimum: 1a54db1 # incarnation-keyed projection (903e1c8) plus the queue and give-up fixes - idunn_live: 692ba1f # route driver owns the stable endpoint allow (f16fb46); warming fixes (e81c73e, 692ba1f) - -runtime: - admitted: true - admitted_by: up-e728909f-abee-49e4-9cf3-0f88b24cdea5 # tx-0e8fa81e, 2026-09-10 22:44:21Z - release: sha256-4d6e959a655f0e7158d8a520587be10f10dbf7782abdc6092edd4c32fc18e701 # Odin main b8ef6c6 - incarnation: odin@sha256-903af5f8691a… # full digest in the projection - # The live unit is idunn-odin-.service and that hash changes - # on every restart. It is not this release hash. 318 failed unit residues - # were loaded on 2026-09-10T19:23Z, all with distinct hashes. - state_root: /var/lib/gamecult/odin - projection: /var/lib/gamecult/idunn-projection/topology.cc - route: /etc/nginx/idunn-stream-routes/odin.conf # rudp://10.77.0.1:17871 -> 127.0.0.1:17972; the Node coordinator that held 17871 is retired - - # Before Odin 27ca3b3 and Idunn 1899df2, Odin exited 1 after 2.5-16 min per - # unit because the queued deployment overwrote the target-keyed Expected slot. - # That path no longer exists; see notes/odin-incarnation-keyed-projection-2026-09-10.md. - healthy: true # admitted 22:44:21Z, zero rejections, mesh reachable on 17871 - condition: admitted - -# A unit named odin.service exists in /etc/systemd/system and is `active` with -# MainPID 0. It owns no process and is not the running Odin. It has misled two -# separate readings; check -p MainPID before believing it. -decoys: - - unit: odin.service - state: active - main_pid: 0 - owns_process: false - -in_flight: [] - -brakes: - deployment_store: /var/lib/gamecult/idunn-authority/odin-deployment-brake.cc - lifecycle_store: /var/lib/gamecult/idunn-authority/odin-lifecycle-brake.cc - lifecycle_state: released # verified 2026-09-10T19:03:12Z from the brake file: released by idunn.root, reason continuity-restart - # A deployment brake release is release-specific and expires after 15 minutes; - # each attempt needs its own signature naming that exact transaction. - -known_defects: - - an admitted Odin cannot observe a candidate Odin; Odin deployments succeed only - by bootstrap after the incumbent stops (see notes/odin-cycle-mechanism-2026-09-10.md, - "Not owned by this cut") - - incarnation_key is duplicated in odin-daemon lib.rs and Idunn drivers.rs; lifting it - into CultLib cultnet-rs is the open follow-up - - CultLib pins are behind main (Odin a8aedda, Idunn c13b6ba; CultLib 47b9fc4 changed RUDP - reader semantics on 2026-09-10: receive_once returns None only on an empty socket). Odin's - poll_once-per-iteration loop is unaffected. Bump both with the incarnation_key lift. diff --git a/tests/fixtures/README.md b/tests/fixtures/README.md new file mode 100644 index 0000000..70060bf --- /dev/null +++ b/tests/fixtures/README.md @@ -0,0 +1,12 @@ +# Bifrost release-authority wire fixture + +`bifrost-release-authority-v1.payload.hex` is the exact MessagePack payload +emitted on 2026-07-16 by Bifrost's TypeScript CultCache writer +`tools/bifrost-repository-release-authority.mjs` for `GameCult/Epiphany`, +`refs/heads/main`, commit +`0123456789abcdef0123456789abcdef01234567`. + +It is checked in because the TypeScript runtime emits a camelCase MessagePack +map while Rust `DatabaseEntry` derives tuple payloads. Idunn must prove it can +decode the producer's real wire shape rather than round-tripping a fixture it +serialized itself. diff --git a/tests/fixtures/bifrost-release-authority-v1.payload.hex b/tests/fixtures/bifrost-release-authority-v1.payload.hex new file mode 100644 index 0000000..e67843a --- /dev/null +++ b/tests/fixtures/bifrost-release-authority-v1.payload.hex @@ -0,0 +1 @@ +de0018aa736368656d614e616d65d924626966726f73742e7265706f7369746f72795f72656c656173655f617574686f72697479ad736368656d6156657273696f6ed927626966726f73742e7265706f7369746f72795f72656c656173655f617574686f726974792e7631ab617574686f726974794964d95272656c656173653a47616d6543756c742f4570697068616e793a726566732f68656164732f6d61696e3a30313233343536373839616263646566303132333435363738396162636465663031323334353637a9636f6d6d616e644964d92163756c746d6573682d636f6d6d616e642d6570697068616e792d72656c65617365b163726f7373696e67526563656970744964b963726f7373696e675f6570697068616e795f72656c65617365b27265706f7369746f727946756c6c4e616d65b147616d6543756c742f4570697068616e79ab757073747265616d526566af726566732f68656164732f6d61696ea9636f6d6d6974536861d92830313233343536373839616263646566303132333435363738396162636465663031323334353637a86465636973696f6ea9617574686f72697a65a6737461747573aa617574686f72697a6564b0706f6c6963794465636973696f6e4964b7706f6c6963792d6570697068616e792d72656c65617365b2617574686f726974795265666572656e6365b8626966726f73743a72656c656173653a6570697068616e79ad6163746f724964656e74697479a86d65746163726174aa736f757263654b696e64b8626966726f73742e676f7665726e616e63652e746f706963a8736f757263654964b6746f7069632d6570697068616e792d72656c65617365ad6570697068616e7952756e4964b472756e2d6570697068616e792d72656c65617365ae6570697068616e794c616e654964b168616e64732d7075626c69636174696f6eb56570697068616e794167656e744964656e74697479a86570697068616e79b265787465726e616c5265636569707455726cd95468747470733a2f2f6769746875622e636f6d2f47616d6543756c742f4570697068616e792f636f6d6d69742f30313233343536373839616263646566303132333435363738396162636465663031323334353637b165787465726e616c526563656970744964d92830313233343536373839616263646566303132333435363738396162636465663031323334353637ac617574686f72697a65644174b4323032362d30372d31365430303a30303a30305aa9657870697265734174a0a97265766f6b65644174a0b07265766f636174696f6e526561736f6ea0