| 1 | package host |
| 2 | |
| 3 | import ( |
| 4 | "context" |
| 5 | "crypto/ed25519" |
| 6 | "encoding/json" |
| 7 | "errors" |
| 8 | "log" |
| 9 | "os" |
| 10 | "path/filepath" |
| 11 | |
| 12 | "github.com/carlosframework/platform/internal/hostwrite" |
| 13 | "github.com/carlosframework/platform/internal/moves" |
| 14 | "github.com/carlosframework/platform/internal/provision" |
| 15 | "github.com/carlosframework/platform/internal/registry" |
| 16 | "github.com/carlosframework/platform/internal/release" |
| 17 | ) |
| 18 | |
| 19 | // heldMaterialize is release.MaterializeHeld as a variable, so a test can |
| 20 | // make the stage fail the way a read-only version store does on a hardened |
| 21 | // box (the sandboxed agent cannot write /opt/carlos). |
| 22 | var heldMaterialize = release.MaterializeHeld |
| 23 | |
| 24 | // heldStageVerified is release.StageHeldVerified as a variable, so a test can |
| 25 | // make T7's stage under the claim fail the way a read-only version store |
| 26 | // does. |
| 27 | var heldStageVerified = release.StageHeldVerified |
| 28 | |
| 29 | // heldReleaseHooks builds the two release checks a move's held row needs |
| 30 | // (moves design §7.3 and §9.2, amended 2026-10-12 by Paul's T7 ruling): |
| 31 | // ready is T7, asked while the move prepares; live is the configured step's, |
| 32 | // asked by the landing (and a return's install) before it installs the |
| 33 | // database. |
| 34 | // |
| 35 | // With the claim off (writes.Enabled false) both are heldReleaseReady, |
| 36 | // unchanged: T7 stages the pinned release and publishes live/<host>, and |
| 37 | // configured asks the same question. |
| 38 | // |
| 39 | // Under the claim T7 cannot publish: a moving claim grants no held write |
| 40 | // (MovesClaimPolicy), and live/<host> is this host's file. So ready is |
| 41 | // heldReleaseStaged, which stages and verifies without publishing, and live |
| 42 | // is heldReleasePublished, which publishes under the landing's held-release |
| 43 | // selection, where MovesClaimPolicy grants it, and then reads it back. |
| 44 | func heldReleaseHooks(writes hostwrite.Config, reg *registry.Registry, optDir, dataDir, box string, pub ed25519.PublicKey, r *release.DigestRatchet, proof *release.ProofGate, requestStage func(host, ver string, err error)) (ready, live func(context.Context, release.Store, provision.Record, string) moves.Check) { |
| 45 | return heldReleaseHooksVia(heldReleaseVia{}, writes, reg, optDir, dataDir, box, pub, r, proof, requestStage) |
| 46 | } |
| 47 | |
| 48 | // heldReleaseHooksVia is heldReleaseHooks with root's held-release path |
| 49 | // (Task 7b): under the claim, with via.Relay set, a stage this process |
| 50 | // cannot write is asked of root (stage only, then verified here), and the |
| 51 | // publication is root's, inside root's own held-release selection; the |
| 52 | // agent never publishes live/<host> itself. With via.Relay nil it is Task |
| 53 | // 7's behaviour. With the claim off via is not consulted. |
| 54 | func heldReleaseHooksVia(via heldReleaseVia, writes hostwrite.Config, reg *registry.Registry, optDir, dataDir, box string, pub ed25519.PublicKey, r *release.DigestRatchet, proof *release.ProofGate, requestStage func(host, ver string, err error)) (ready, live func(context.Context, release.Store, provision.Record, string) moves.Check) { |
| 55 | if !writes.Enabled { |
| 56 | ready = heldReleaseReady(reg, optDir, dataDir, box, pub, r, proof, requestStage) |
| 57 | return ready, ready |
| 58 | } |
| 59 | return heldReleaseStaged(via, reg, optDir, dataDir, box, pub, r, proof), heldReleasePublished(via, writes, optDir, dataDir, box, pub, r, proof) |
| 60 | } |
| 61 | |
| 62 | // heldReleaseStaged is T7 under the claim (Paul, 2026-10-12): the pinned |
| 63 | // release is staged into the shared version store and verified |
| 64 | // (release.StageHeldVerified: D3's admit, §4.1's authorization, the |
| 65 | // digest-bound stage and D3's bind on the staged bytes), under the same |
| 66 | // authority as before (heldStageAuthority: the claim is this move's and |
| 67 | // targets this box, the row is absent or held by the op, the source reports |
| 68 | // this release). live/<host> is never touched and nothing is selected: the |
| 69 | // publication is the configured step's (heldReleasePublished). |
| 70 | // |
| 71 | // A version store this process cannot write is asked of root over its |
| 72 | // control socket (Task 7b, via.Relay): root re-reads the claim, the record |
| 73 | // and the source's report, stages and verifies, and never publishes. Root's |
| 74 | // answer is a hint: T7 passes only on this process's own stage of the same |
| 75 | // version afterwards, which finds the bytes staged and verifies them |
| 76 | // (writing nothing to the version store when they are the release's). With |
| 77 | // no relay, or a root that has no such route, a blocked stage is |
| 78 | // t7NotStaged. Nothing is ever left for the old file relay: it publishes, |
| 79 | // and it refuses held rows while CARLOS_HOST_CLAIM is on. |
| 80 | func heldReleaseStaged(via heldReleaseVia, reg *registry.Registry, optDir, dataDir, box string, pub ed25519.PublicKey, r *release.DigestRatchet, proof *release.ProofGate) func(context.Context, release.Store, provision.Record, string) moves.Check { |
| 81 | return func(ctx context.Context, s release.Store, rec provision.Record, version string) moves.Check { |
| 82 | req := release.HeldStageRequest{Account: rec.Account, App: rec.App, Host: rec.Host, Version: version, Op: rec.Move.ID, Box: box} |
| 83 | if err := heldStageAuthority(reg, s, box, dataDir)(req, nil); err != nil { |
| 84 | logMoveStage(rec.Host, version, err) |
| 85 | return moves.Check{Reason: t7Failed} |
| 86 | } |
| 87 | rt := registry.Route{Host: rec.Host, Kind: "instance", App: rec.App, Account: rec.Account, HoldOp: rec.Move.ID} |
| 88 | _, err := heldStageVerified(ctx, s, pub, r, optDir, rt, version, proof) |
| 89 | if errors.Is(err, release.ErrStageBlocked) && via.Relay != nil { |
| 90 | logMoveStage(rec.Host, version, err) |
| 91 | if err = via.stage(ctx, s, rec, box, version); err == nil { |
| 92 | _, err = heldStageVerified(ctx, s, pub, r, optDir, rt, version, proof) |
| 93 | } |
| 94 | } |
| 95 | switch { |
| 96 | case err == nil: |
| 97 | return moves.Check{OK: true} |
| 98 | case errors.Is(err, release.ErrHeldNotProven): |
| 99 | logMoveStage(rec.Host, version, err) |
| 100 | return moves.Check{Reason: t7NotProven} |
| 101 | case errors.Is(err, release.ErrStageBlocked), errors.Is(err, errHeldReleaseUnavailable): |
| 102 | logMoveStage(rec.Host, version, err) |
| 103 | return moves.Check{Reason: t7NotStaged} |
| 104 | default: |
| 105 | logMoveStage(rec.Host, version, err) |
| 106 | return moves.Check{Reason: t7Failed} |
| 107 | } |
| 108 | } |
| 109 | } |
| 110 | |
| 111 | // heldReleasePublished is the configured step's release under the claim |
| 112 | // (§9.2 as amended 2026-10-12): the release is published for the held row |
| 113 | // under a held-release selection (writes.Select), which MovesClaimPolicy |
| 114 | // grants at the landing's configured, and the dirty return's, for exactly |
| 115 | // the pinned (or recorded) release. release.MaterializeHeldUnder stages it |
| 116 | // outside the selection (T7 has normally staged it already) and swaps |
| 117 | // live/<host> inside it, under the identity naming exactly version, with |
| 118 | // the host's held-stage lock (withHeldStageLock) inside the selection. It |
| 119 | // then passes only on release.VerifyHeldLive under that lock, the reading T7 |
| 120 | // makes with the claim off. A link already live and proven is not published |
| 121 | // again, so a replay selects nothing. |
| 122 | // |
| 123 | // With via.Relay set (Task 7b, production under the claim) the agent never |
| 124 | // publishes: it asks root, with the claim tuple it observes and the render |
| 125 | // hash configured journalled under the row's hold op, and root publishes |
| 126 | // inside its own held-release selection. The agent then passes only on its |
| 127 | // own reading. Root's not-yet, refusal or absence fails this pass, and the |
| 128 | // configured step asks again on the next. |
| 129 | func heldReleasePublished(via heldReleaseVia, writes hostwrite.Config, optDir, dataDir, box string, pub ed25519.PublicKey, r *release.DigestRatchet, proof *release.ProofGate) func(context.Context, release.Store, provision.Record, string) moves.Check { |
| 130 | return func(ctx context.Context, s release.Store, rec provision.Record, version string) moves.Check { |
| 131 | if rec.Move == nil { |
| 132 | return moves.Check{Reason: t7Failed} |
| 133 | } |
| 134 | rt := registry.Route{Host: rec.Host, Kind: "instance", App: rec.App, Account: rec.Account, HoldOp: rec.Move.ID} |
| 135 | lock := func(read func() error) error { return withHeldStageLock(dataDir, rec.Host, read) } |
| 136 | verified := func() (moves.Check, error) { |
| 137 | err := release.VerifyHeldLive(ctx, s, optDir, rt, version, proof, lock) |
| 138 | switch { |
| 139 | case err == nil: |
| 140 | return moves.Check{OK: true}, nil |
| 141 | case errors.Is(err, release.ErrHeldNotProven): |
| 142 | return moves.Check{Reason: t7NotProven}, err |
| 143 | default: |
| 144 | return moves.Check{Reason: t7Failed}, err |
| 145 | } |
| 146 | } |
| 147 | c, err := verified() |
| 148 | if c.OK { |
| 149 | return c |
| 150 | } |
| 151 | if !errors.Is(err, release.ErrHeldNotLive) { |
| 152 | logMoveStage(rec.Host, version, err) |
| 153 | return c |
| 154 | } |
| 155 | if via.Relay != nil { |
| 156 | err := via.publish(ctx, s, rt, rec.Move.ID, heldReleaseHoldOp(rec), box, dataDir, version) |
| 157 | switch { |
| 158 | case errors.Is(err, release.ErrHeldNotProven): |
| 159 | logMoveStage(rec.Host, version, err) |
| 160 | return moves.Check{Reason: t7NotProven} |
| 161 | case err != nil: |
| 162 | logMoveStage(rec.Host, version, err) |
| 163 | return moves.Check{Reason: t7Failed} |
| 164 | } |
| 165 | if c, err = verified(); !c.OK { |
| 166 | logMoveStage(rec.Host, version, err) |
| 167 | } |
| 168 | return c |
| 169 | } |
| 170 | work, err := writes.Select(ctx, rec.Host, movesActionHeldRelease) |
| 171 | if err != nil { |
| 172 | logMoveStage(rec.Host, version, err) |
| 173 | return moves.Check{Reason: t7Failed} |
| 174 | } |
| 175 | _, err = heldMaterializeUnder(ctx, s, pub, r, optDir, rt, version, proof, work, lock) |
| 176 | switch { |
| 177 | case errors.Is(err, release.ErrHeldNotProven): |
| 178 | logMoveStage(rec.Host, version, err) |
| 179 | return moves.Check{Reason: t7NotProven} |
| 180 | case errors.Is(err, release.ErrStageBlocked): |
| 181 | logMoveStage(rec.Host, version, err) |
| 182 | return moves.Check{Reason: t7NotStaged} |
| 183 | case err != nil: |
| 184 | logMoveStage(rec.Host, version, err) |
| 185 | return moves.Check{Reason: t7Failed} |
| 186 | } |
| 187 | if c, err = verified(); !c.OK { |
| 188 | logMoveStage(rec.Host, version, err) |
| 189 | } |
| 190 | return c |
| 191 | } |
| 192 | } |
| 193 | |
| 194 | // heldMaterializeUnder is release.MaterializeHeldUnder as a variable, a test |
| 195 | // seam like heldMaterialize. |
| 196 | var heldMaterializeUnder = release.MaterializeHeldUnder |
| 197 | |
| 198 | // heldReleaseProbeRelease is the probe owners' Release (movesProbeOwners, |
| 199 | // a landing's and a recovery's probe) under the claim on a box whose agent |
| 200 | // cannot write /opt/carlos (Task 7b). A release already live and proven |
| 201 | // for the row is read, not published again, so a probe restart asks root |
| 202 | // nothing. Otherwise the agent's own held-release selection (work) is |
| 203 | // checked once, so a request is never sent for a selection the agent has |
| 204 | // already lost, and root is asked to publish: root selects held-release |
| 205 | // itself and publishes inside that selection, under the render hash |
| 206 | // journalled for rt's hold op. The probe then passes only on the agent's |
| 207 | // own reading. The work's check grants root nothing. |
| 208 | func heldReleaseProbeRelease(via heldReleaseVia, s release.Store, box, optDir, dataDir string, proof *release.ProofGate) func(ctx context.Context, rt registry.Route, version string, work hostwrite.Work) error { |
| 209 | return func(ctx context.Context, rt registry.Route, version string, work hostwrite.Work) error { |
| 210 | if via.Relay == nil || work == nil { |
| 211 | return hostwrite.ErrUnavailable |
| 212 | } |
| 213 | lock := func(read func() error) error { return withHeldStageLock(dataDir, rt.Host, read) } |
| 214 | err := release.VerifyHeldLive(ctx, s, optDir, rt, version, proof, lock) |
| 215 | if err == nil || !errors.Is(err, release.ErrHeldNotLive) { |
| 216 | return err |
| 217 | } |
| 218 | if err := work.With(ctx, hostwrite.Identity{Release: version}, func() error { return nil }); err != nil { |
| 219 | return err |
| 220 | } |
| 221 | if err := via.publish(ctx, s, rt, "", rt.HoldOp, box, dataDir, version); err != nil { |
| 222 | return err |
| 223 | } |
| 224 | return release.VerifyHeldLive(ctx, s, optDir, rt, version, proof, lock) |
| 225 | } |
| 226 | } |
| 227 | |
| 228 | // heldReleaseReady is T7 in production with the claim off (§7.3, §9.2, |
| 229 | // round-4 finding 6; heldReleaseHooks), and the configured step's release |
| 230 | // then too: the pinned release (the source report's Release) is staged for |
| 231 | // the held row and live/<host> points at it, under the same authority the |
| 232 | // root relay uses (heldStageAuthority: the claim is this move's and targets |
| 233 | // this box, the row is absent or held by the op, the source reports this |
| 234 | // release). |
| 235 | // On a hardened box the stage is blocked, so a held-stage request is left |
| 236 | // for the root stage pass (release.ServeHeldStageRequests) and its marker |
| 237 | // touched. |
| 238 | // |
| 239 | // T7 passes only on release.VerifyHeldLive (final review finding 1): at |
| 240 | // check time the authority holds, D3 admits the release under the policy in |
| 241 | // force, and, under the host's held-stage lock (withHeldStageLock, the lock |
| 242 | // every publication holds across its swap, re-hash and rollback), the link |
| 243 | // names the version and D3's bind accepts the bytes it names. A link alone |
| 244 | // is never evidence: the publication may be about to roll it back, and the |
| 245 | // bytes or the policy may have changed since it was written. An existing |
| 246 | // link that fails is t7NotProven and is left alone. |
| 247 | // |
| 248 | // proof is D3's gate (controller ruling D3-held): the held stage admits the |
| 249 | // pinned release as adoption would, before staging and so before any |
| 250 | // relay, and again on the staged bytes before publishing. A refusal is |
| 251 | // t7NotProven and live/<host> is untouched. It is the held path's own gate, |
| 252 | // never agentProofGate: a wait it records for a held host would sit on the |
| 253 | // adoption waiting list, which the fast loop sweeps, for a host adoption |
| 254 | // never visits. |
| 255 | // |
| 256 | // pub and r are §4.1's evidence (settings spec rev 11 §4.3a): the stage |
| 257 | // installs only a build a promotion record or a pointer of the app, |
| 258 | // verified under pub and admitted by r (the agent's pointer digest |
| 259 | // ratchet), authorizes. Anything else is release.ErrHeldNotAuthorized, |
| 260 | // before anything is downloaded or relayed, and T7 fails (t7Failed). A nil |
| 261 | // pub verifies nothing, so every held stage is refused. |
| 262 | func heldReleaseReady(reg *registry.Registry, optDir, dataDir, box string, pub ed25519.PublicKey, r *release.DigestRatchet, proof *release.ProofGate, requestStage func(host, ver string, err error)) func(context.Context, release.Store, provision.Record, string) moves.Check { |
| 263 | return func(ctx context.Context, s release.Store, rec provision.Record, version string) moves.Check { |
| 264 | req := release.HeldStageRequest{Account: rec.Account, App: rec.App, Host: rec.Host, Version: version, Op: rec.Move.ID, Box: box} |
| 265 | auth := heldStageAuthority(reg, s, box, dataDir) |
| 266 | if err := auth(req, nil); err != nil { |
| 267 | logMoveStage(rec.Host, version, err) |
| 268 | return moves.Check{Reason: t7Failed} |
| 269 | } |
| 270 | rt := registry.Route{Host: rec.Host, Kind: "instance", App: rec.App, Account: rec.Account, HoldOp: rec.Move.ID} |
| 271 | lock := func(read func() error) error { return withHeldStageLock(dataDir, rec.Host, read) } |
| 272 | verified := func() (moves.Check, bool) { |
| 273 | err := release.VerifyHeldLive(ctx, s, optDir, rt, version, proof, lock) |
| 274 | switch { |
| 275 | case err == nil: |
| 276 | return moves.Check{OK: true}, true |
| 277 | case errors.Is(err, release.ErrHeldNotProven): |
| 278 | logMoveStage(rec.Host, version, err) |
| 279 | return moves.Check{Reason: t7NotProven}, true |
| 280 | case errors.Is(err, release.ErrHeldNotLive): |
| 281 | return moves.Check{Reason: t7Failed}, false |
| 282 | default: |
| 283 | logMoveStage(rec.Host, version, err) |
| 284 | return moves.Check{Reason: t7Failed}, true |
| 285 | } |
| 286 | } |
| 287 | if c, done := verified(); done { |
| 288 | return c |
| 289 | } |
| 290 | _, err := heldMaterialize(ctx, s, pub, r, optDir, rt, version, proof, func(publish func() error) error { return auth(req, publish) }) |
| 291 | switch { |
| 292 | case errors.Is(err, release.ErrHeldNotProven): |
| 293 | logMoveStage(rec.Host, version, err) |
| 294 | return moves.Check{Reason: t7NotProven} |
| 295 | case errors.Is(err, release.ErrStageBlocked): |
| 296 | if werr := writeHeldStageRequest(dataDir, req); werr != nil { |
| 297 | logMoveStage(rec.Host, version, werr) |
| 298 | return moves.Check{Reason: t7Failed} |
| 299 | } |
| 300 | if requestStage != nil { |
| 301 | requestStage(rec.Host, version, err) |
| 302 | } |
| 303 | return moves.Check{Reason: t7Waiting} |
| 304 | case err != nil: |
| 305 | logMoveStage(rec.Host, version, err) |
| 306 | return moves.Check{Reason: t7Failed} |
| 307 | } |
| 308 | // Published by this call: T7 passes on the same reading as ever. |
| 309 | c, _ := verified() |
| 310 | return c |
| 311 | } |
| 312 | } |
| 313 | |
| 314 | func logMoveStage(host, version string, err error) { |
| 315 | log.Printf("moves: %s: T7: stage %s: %v", host, version, err) |
| 316 | } |
| 317 | |
| 318 | // writeHeldStageRequest leaves req for the root stage pass at |
| 319 | // HeldStageDir/<host>.json, atomically: written under a name the pass skips |
| 320 | // (a leading dot) and renamed into place. |
| 321 | func writeHeldStageRequest(dataDir string, req release.HeldStageRequest) error { |
| 322 | dir := release.HeldStageDir(dataDir) |
| 323 | if err := os.MkdirAll(dir, 0o755); err != nil { |
| 324 | return err |
| 325 | } |
| 326 | body, err := json.Marshal(req) |
| 327 | if err != nil { |
| 328 | return err |
| 329 | } |
| 330 | f, err := os.CreateTemp(dir, "."+req.Host+".*") |
| 331 | if err != nil { |
| 332 | return err |
| 333 | } |
| 334 | tmp := f.Name() |
| 335 | if _, err := f.Write(body); err != nil { |
| 336 | f.Close() |
| 337 | os.Remove(tmp) |
| 338 | return err |
| 339 | } |
| 340 | if err := f.Sync(); err != nil { |
| 341 | f.Close() |
| 342 | os.Remove(tmp) |
| 343 | return err |
| 344 | } |
| 345 | if err := f.Close(); err != nil { |
| 346 | os.Remove(tmp) |
| 347 | return err |
| 348 | } |
| 349 | if err := os.Rename(tmp, filepath.Join(dir, req.Host+".json")); err != nil { |
| 350 | os.Remove(tmp) |
| 351 | return err |
| 352 | } |
| 353 | return nil |
| 354 | } |
| 355 | |
amadan