amadan

carlos / platform Public

release: the healthy history a requiring box adopts from without a proof

Builds this box has run well, keyed by sha256 hashed from bytes, newest first, capped at fifty, first record of a sha256 kept (console defences D3, task 3).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claude 15779f7e0fb39ea3cd772067fc4d65664352d858 parent dcafa9d
2 files changed, +180 −0
  • internal/release/healthy.go +118 −0
  • internal/release/healthy_test.go +62 −0
diff --git a/internal/release/healthy.go b/internal/release/healthy.go
new file mode 100644
index 000000000..c6f9fb31f
--- /dev/null
+++ b/internal/release/healthy.go
@@ -0,0 +1,118 @@
+// The healthy history — builds this box has run well (spec
+// 2026-10-06-console-release-defences-design.md §4.5). A sha256 in an app's
+// history is adopted with no proof, which is what lets a requiring box roll
+// back to a build it ran before without waiting on the prover.
+//
+// Root writes it from two places in internal/host: when D1's settle check
+// passes for a restarted named unit (How "settle"), and when a root pass finds
+// a named-unit route's live build bound, active in one invocation for the
+// policy's after, hashed from its running executable and ready (How "live").
+// Every sha256 here was hashed from bytes, never copied from a manifest. It
+// lives in the bake directory, which the sandboxed agent can read.
+package release
+
+import (
+ "encoding/json"
+ "fmt"
+ "log"
+ "os"
+ "path/filepath"
+ "time"
+)
+
+const healthyMax = 50
+
+type HealthyBuild struct {
+ SHA256 string `json:"sha256"`
+ Version string `json:"version,omitempty"`
+ How string `json:"how"`
+ At time.Time `json:"at"`
+}
+
+type healthyFile struct {
+ Schema int `json:"schema"`
+ Builds []HealthyBuild `json:"builds"`
+}
+
+func healthyPath(bakeDir, acct, app string) (string, error) {
+ if bakeDir == "" || !ValidAccount(acct) || !ValidApp(app) {
+ return "", fmt.Errorf("healthy history: invalid %q/%q", acct, app)
+ }
+ return filepath.Join(bakeDir, "healthy", acct, app+".json"), nil
+}
+
+func ReadHealthy(bakeDir, acct, app string) []HealthyBuild {
+ p, err := healthyPath(bakeDir, acct, app)
+ if err != nil {
+ return nil
+ }
+ b, err := os.ReadFile(p)
+ if err != nil {
+ return nil
+ }
+ var f healthyFile
+ if err := json.Unmarshal(b, &f); err != nil || f.Schema != 1 {
+ log.Printf("healthy history: %s does not parse (%v), treating it as empty", p, err)
+ return nil
+ }
+ return f.Builds
+}
+
+func IsHealthy(bakeDir, acct, app, sha string) bool {
+ if sha == "" {
+ return false
+ }
+ for _, b := range ReadHealthy(bakeDir, acct, app) {
+ if b.SHA256 == sha {
+ return true
+ }
+ }
+ return false
+}
+
+// RecordHealthy adds b, newest first, keeping the first record of a sha256
+// and the newest healthyMax builds. Written atomically and world-readable,
+// because the reader is the sandboxed agent.
+func RecordHealthy(bakeDir, acct, app string, b HealthyBuild) error {
+ p, err := healthyPath(bakeDir, acct, app)
+ if err != nil {
+ return err
+ }
+ if !sha256Re.MatchString(b.SHA256) {
+ return fmt.Errorf("healthy history: sha256 %q is not 64 lower-case hex digits", b.SHA256)
+ }
+ have := ReadHealthy(bakeDir, acct, app)
+ for _, h := range have {
+ if h.SHA256 == b.SHA256 {
+ return nil
+ }
+ }
+ builds := append([]HealthyBuild{b}, have...)
+ if len(builds) > healthyMax {
+ builds = builds[:healthyMax]
+ }
+ body, err := json.MarshalIndent(healthyFile{Schema: 1, Builds: builds}, "", " ")
+ if err != nil {
+ return err
+ }
+ if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
+ return err
+ }
+ tmp, err := os.CreateTemp(filepath.Dir(p), ".healthy-*")
+ if err != nil {
+ return err
+ }
+ defer os.Remove(tmp.Name())
+ if _, err := tmp.Write(append(body, '\n')); err != nil {
+ tmp.Close()
+ return err
+ }
+ if err := tmp.Chmod(0o644); err != nil {
+ tmp.Close()
+ return err
+ }
+ if err := tmp.Close(); err != nil {
+ return err
+ }
+ return os.Rename(tmp.Name(), p)
+}
diff --git a/internal/release/healthy_test.go b/internal/release/healthy_test.go
new file mode 100644
index 000000000..e44f92d88
--- /dev/null
+++ b/internal/release/healthy_test.go
@@ -0,0 +1,62 @@
+package release
+
+import (
+ "fmt"
+ "os"
+ "path/filepath"
+ "testing"
+ "time"
+)
+
+func TestHealthyRecordAndRead(t *testing.T) {
+ bake := t.TempDir()
+ at := time.Date(2026, 10, 6, 9, 0, 0, 0, time.UTC)
+ b := HealthyBuild{SHA256: testSHA, Version: "f4478b15", How: "settle", At: at}
+ if IsHealthy(bake, "bab", "console", testSHA) {
+ t.Fatal("healthy before anything was recorded")
+ }
+ if err := RecordHealthy(bake, "bab", "console", b); err != nil {
+ t.Fatal(err)
+ }
+ b.How, b.At = "live", at.Add(time.Hour)
+ if err := RecordHealthy(bake, "bab", "console", b); err != nil {
+ t.Fatal(err)
+ }
+ got := ReadHealthy(bake, "bab", "console")
+ if len(got) != 1 || got[0].How != "settle" || !got[0].At.Equal(at) {
+ t.Fatalf("history = %+v, want one entry, the first record kept", got)
+ }
+ if !IsHealthy(bake, "bab", "console", testSHA) || IsHealthy(bake, "bab", "other", testSHA) || IsHealthy(bake, "bab", "console", "") {
+ t.Fatal("IsHealthy answers for the wrong app or an empty sha256")
+ }
+}
+
+func TestHealthyKeepsTheNewestFifty(t *testing.T) {
+ bake := t.TempDir()
+ for i := 0; i < 55; i++ {
+ if err := RecordHealthy(bake, "bab", "console", HealthyBuild{SHA256: fmt.Sprintf("%064x", i), How: "live"}); err != nil {
+ t.Fatal(err)
+ }
+ }
+ got := ReadHealthy(bake, "bab", "console")
+ if len(got) != 50 || got[0].SHA256 != fmt.Sprintf("%064x", 54) || IsHealthy(bake, "bab", "console", fmt.Sprintf("%064x", 0)) {
+ t.Fatalf("len = %d, first = %s; want the newest fifty", len(got), got[0].SHA256)
+ }
+}
+
+func TestHealthyCorruptReadsEmpty(t *testing.T) {
+ bake := t.TempDir()
+ p := filepath.Join(bake, "healthy", "bab", "console.json")
+ if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
+ t.Fatal(err)
+ }
+ if err := os.WriteFile(p, []byte(`{"schema":1,"builds":[`), 0o644); err != nil {
+ t.Fatal(err)
+ }
+ if got := ReadHealthy(bake, "bab", "console"); got != nil {
+ t.Fatalf("corrupt history = %+v, want nil", got)
+ }
+ if err := RecordHealthy(bake, "bab", "console", HealthyBuild{SHA256: "nope"}); err == nil {
+ t.Fatal("a non-hex sha256 was recorded")
+ }
+}