jason.woltje
4ac6f13bcf
Commits the 5 product paths and 7 gate helpers of the row 227 R4 source overlay on top of HEAD 5a0c801cb. scripts/case2/console.mjs is already committed at HEAD and is not part of this commit. The R4 independent review is sha256 6667baaa6af9d6d78a3ec7c64d9f3163ecbc350b94050f62899d9c01deabe002, verdict APPROVE source-only. Packet hashes: PACKET.sha256 4eb60915b2144137df9b5a42afd0c5b266718d71de051fb8be53a27430a2cad4, CURRENT-SOURCE.sha256 0cfd47c2073bc18a3ba7bff1ce6fdf39fe33a64b7fca209be71517b9feb89020. The 12 committed files match the review hash table, the applied overlay JSON (size, mode, hash) and the saved overlay tar. No scripts/test-case2.sh run exists on these bytes.
44 lines
2.9 KiB
JavaScript
44 lines
2.9 KiB
JavaScript
// Private invocation/fixture barrier. Labels alone never authorize the controller's release.
|
|
import { setPriority, getPriority } from 'node:os';
|
|
import { readFileSync, writeFileSync, existsSync, renameSync } from 'node:fs';
|
|
import { dirname, join, resolve } from 'node:path';
|
|
import { createHash } from 'node:crypto';
|
|
const stat = readFileSync('/proc/self/stat', 'utf8');
|
|
const start = stat.slice(stat.lastIndexOf(')') + 2).split(/\s+/)[19];
|
|
const boot = readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim();
|
|
const host = process.env.ROW227_CONTROL_ROOT;
|
|
const runDir = process.env.MOSAIC_TURN_MARKER ? dirname(process.env.MOSAIC_TURN_MARKER)
|
|
: process.argv[1]?.endsWith('/packages/harness/src/runner.mjs') ? resolve(process.argv[2]) : null;
|
|
const control = host ? JSON.parse(readFileSync(join(host, 'control.json'), 'utf8'))
|
|
: runDir ? JSON.parse(readFileSync(join(runDir, '.row227-native-control.json'), 'utf8')) : null;
|
|
if (!control || control.version !== 1 || !/^[a-f0-9]{32}$/.test(control.nonce)) throw Error('native-control-missing');
|
|
const kind = host ? 'host' : process.env.MOSAIC_TURN_MARKER ? 'adapter' : 'runner';
|
|
const role = host ? process.execArgv.includes('--check') ? 'host-syntax' : 'host-main' : kind;
|
|
const directory = host ? join(host, 'host') : join(runDir, '.row227-native');
|
|
setPriority(0, 19);
|
|
const nice = getPriority(0);
|
|
if (nice !== 19) throw Error('native-priority-refused');
|
|
const row = { version: 1, nonce: control.nonce, kind, pid: process.pid, start, boot, nice,
|
|
argv: process.argv, module: process.argv[1] ?? null, execArgv: process.execArgv, run: host ? null : resolve(runDir) };
|
|
const name = `${kind}-${process.pid}-${start}`;
|
|
const bytes = JSON.stringify(row) + '\n';
|
|
const digest = createHash('sha256').update(bytes).digest('hex');
|
|
const pending = join(directory, name + '.pending');
|
|
writeFileSync(pending, bytes, { flag: 'wx', mode: 0o600 });
|
|
renameSync(pending, join(directory, name + '.json'));
|
|
const stop = () => process.exit(143);
|
|
process.once('SIGTERM', stop); process.once('SIGINT', stop);
|
|
const end = Date.now() + 5000;
|
|
while (!existsSync(join(directory, name + '.release'))) {
|
|
if (Date.now() >= end) throw Error('native-release-timeout');
|
|
await new Promise(r => setTimeout(r, 10));
|
|
}
|
|
const release = JSON.parse(readFileSync(join(directory, name + '.release'), 'utf8'));
|
|
const binding = release.binding;
|
|
if (release.receiptSha256 !== digest || JSON.stringify(release.receipt) !== JSON.stringify(row)
|
|
|| binding?.receiptSha256 !== digest || binding.kind !== kind || binding.role !== role
|
|
|| binding.namespacePid !== process.pid || binding.hostStart !== start || binding.boot !== boot
|
|
|| binding.run !== row.run || binding.module !== row.module || JSON.stringify(binding.argv) !== JSON.stringify(row.argv)
|
|
|| JSON.stringify(binding.execArgv) !== JSON.stringify(row.execArgv) || getPriority(0) !== 19) throw Error('native-release-association-refused');
|
|
process.removeListener('SIGTERM', stop); process.removeListener('SIGINT', stop);
|