| 1 | { |
| 2 | "version": 1, |
| 3 | "kind": "read-only-source-audit", |
| 4 | "home_revision": "7e282e2a363b9cc90cd74dd97809e6613a699af8", |
| 5 | "source_root": "/home/paulca/amadan.net/oficina/home/.claude/worktrees/overnight-provisioner-prepare", |
| 6 | "decision": { |
| 7 | "existing_complete_checker": false, |
| 8 | "existing_mounted_checker": false, |
| 9 | "config_facts_collector_is_complete_checker": false, |
| 10 | "recommendation": "Specify and review one complete checker slice, using a pure shared config parser internally. Do not count an independently shipped unmounted facts helper as checker delivery. Approved text authorizes a separate small implementation/review slice; it does not define the remaining wire, digest or DB compatibility contract.", |
| 11 | "no_live_calls": true, |
| 12 | "no_source_edits": true, |
| 13 | "no_tests_run_for_read_only_audit": true, |
| 14 | "no_fable_invoked": true |
| 15 | }, |
| 16 | "requirements": [ |
| 17 | { |
| 18 | "requirement": "Bounded private result: exact origins, active public operator/assertion/roster fingerprints, consumer-manifest digest; no network, sessions, DB/key/authority changes.", |
| 19 | "source": [ |
| 20 | "S1" |
| 21 | ] |
| 22 | }, |
| 23 | { |
| 24 | "requirement": "Fresh selected-serving-release checker against existing DB under fence/lease, exact artifact/config/key pins; app owns format/key/authorization compatibility. Earlier operator success and HTTP health cannot substitute.", |
| 25 | "source": [ |
| 26 | "P1" |
| 27 | ] |
| 28 | }, |
| 29 | { |
| 30 | "requirement": "Existing regular pinned DB, no creation/migration repair; application identity, expected role/origin, migration ledger and required additive versions verified.", |
| 31 | "source": [ |
| 32 | "S2" |
| 33 | ], |
| 34 | "qualification": "Mutation engine transaction/secure_delete rules are not permission for checker writes." |
| 35 | } |
| 36 | ], |
| 37 | "reusable_primitives": [ |
| 38 | { |
| 39 | "symbols": [ |
| 40 | "home.LoadOrigins", |
| 41 | "home.LoadRuntime", |
| 42 | "home.loadRosterRuntime", |
| 43 | "home.rosterKeyID" |
| 44 | ], |
| 45 | "source": [ |
| 46 | "S3", |
| 47 | "S5", |
| 48 | "S6" |
| 49 | ], |
| 50 | "reuse": "Exact current role, origin, consumer and key validation. Refactor shared pure parsing with explicit protected-snapshot input; preserve runtime behavior and LookupEnv presence semantics.", |
| 51 | "gap": "Private Runtime fields; no complete public facts API. LoadRuntime calls LoadSecrets, which constructs mailer. It does not itself open DB." |
| 52 | }, |
| 53 | { |
| 54 | "symbols": [ |
| 55 | "operator.Pins", |
| 56 | "operator.NewCredential", |
| 57 | "operator.NewDirectory", |
| 58 | "operator.keyID" |
| 59 | ], |
| 60 | "source": [ |
| 61 | "S7", |
| 62 | "S8", |
| 63 | "S9", |
| 64 | "S10" |
| 65 | ], |
| 66 | "reuse": "Explicit configured public pins; SHA256 exact public bytes encoded lower hex; existing key-role separation checks.", |
| 67 | "gap": "No assembled operator runtime config or checker key-role output registry. Owner-seed signer and directory provisioner signer are distinct roles from command-authorizer and assertion/roster keys." |
| 68 | }, |
| 69 | { |
| 70 | "symbols": [ |
| 71 | "operator.Directory.Inspect" |
| 72 | ], |
| 73 | "source": [ |
| 74 | "S11" |
| 75 | ], |
| 76 | "reuse": "Bounded signed challenge and read-transaction observation pattern.", |
| 77 | "gap": "Only generation and proposed next team; does not validate/report compatibility config facts. Do not repurpose its signed purpose/output." |
| 78 | }, |
| 79 | { |
| 80 | "symbols": [ |
| 81 | "operator.newBoundDatabase", |
| 82 | "operator.boundConnector.Connect" |
| 83 | ], |
| 84 | "source": [ |
| 85 | "S12", |
| 86 | "S13" |
| 87 | ], |
| 88 | "reuse": "Existing-file device/inode/path/actual SQLite descriptor proof, one connection, deadline refusal.", |
| 89 | "gap": "Unmounted and private; requires separately verified launch authority. Uses mode=rw and requires O_RDWR actual main descriptor. Readonly DSN substitution would fail its present proof. No evidence this connector promises zero DB/WAL/SHM writes when used as checker." |
| 90 | }, |
| 91 | { |
| 92 | "symbols": [ |
| 93 | "operator.Engine.Execute" |
| 94 | ], |
| 95 | "source": [ |
| 96 | "S14" |
| 97 | ], |
| 98 | "reuse": "Connection checks provide reference for FK/WAL and bounded DB validation.", |
| 99 | "gap": "Not usable as checker execution: BEGIN IMMEDIATE and durable operation/sequence/receipt mutations." |
| 100 | }, |
| 101 | { |
| 102 | "symbols": [ |
| 103 | "home.Runtime.Schema", |
| 104 | "operator.CredentialSchema", |
| 105 | "operator.DirectorySchema" |
| 106 | ], |
| 107 | "reuse": "Role-specific embedded schema requirements available to inspect.", |
| 108 | "gap": "Do not call migrate.Apply. No existing exported checker that compares ledger and rejects incompatible future/partial schemas." |
| 109 | }, |
| 110 | { |
| 111 | "symbols": [ |
| 112 | "operator.ActivationEvidence.ManifestDigest" |
| 113 | ], |
| 114 | "source": [ |
| 115 | "S15", |
| 116 | "S16" |
| 117 | ], |
| 118 | "reuse": "Existing downstream field is canonical 32-byte raw-base64url token.", |
| 119 | "gap": "Validation checks shape only; no manifest digest producer or canonicalization algorithm." |
| 120 | } |
| 121 | ], |
| 122 | "already_authorized_implementation_scope": [ |
| 123 | "Pure shared configuration parsing and facts gathering needed by the approved checker, with deterministic tests and no process/authority side effects.", |
| 124 | "Reuse existing public key byte hashing and exact role validation; preserve private/public separation and never emit secret material.", |
| 125 | "Read-only validation of existing role/DB compatibility is required, but its exact schema acceptance matrix and no-write opening seam must be defined/reviewed before claiming the full checker." |
| 126 | ], |
| 127 | "unresolved_contract_choices": [ |
| 128 | { |
| 129 | "id": "manifest-digest", |
| 130 | "existing": "ActivationEvidence requires CanonicalToken (32-byte raw-base64url); key IDs elsewhere use lowercase hex SHA256.", |
| 131 | "needed": "Choose exact manifest bytes: normalized validated ID->origin map versus literal decoded JSON. Define ordering/encoding/empty or absent directory-role value. No existing approved algorithm found; do not silently use key-ID hex for ManifestDigest." |
| 132 | }, |
| 133 | { |
| 134 | "id": "active-key-roles", |
| 135 | "existing": "Distinct command-authorizer, credential owner-seed signer, directory provisioning signer, browser assertion keys and roster keys; constructors enforce subsets of separation.", |
| 136 | "needed": "Exact role-labelled fields, active signer versus accepted verification key set, absent/disabled roles, bounds, and binding to actual runtime operator configuration. No new env variable names inferred." |
| 137 | }, |
| 138 | { |
| 139 | "id": "db-compatibility", |
| 140 | "existing": "Required existingDB/schema/role/key checks; embedded role migrations; no complete checker.", |
| 141 | "needed": "Exact supported ledger versions/app identity evidence; checks for stored operator role/origin and post-seed state; correct DEK/pepper/signin compatibility and empty DB handling without synthesizing authority or leaking data. Config fingerprint equality alone does not prove existing ciphertext decryptability or authorization semantics." |
| 142 | }, |
| 143 | { |
| 144 | "id": "no-write-db-open", |
| 145 | "existing": "Pinned connector is mode=rw and demands writable main descriptor.", |
| 146 | "needed": "Specify whether approved no DB changes means no logical writes plus allowed SQLite housekeeping, or byte-level no mutation; prove actual existing DB/WAL/SHM behavior. Do not bypass descriptor proof via unchecked readonly sql.Open or immutable snapshot." |
| 147 | }, |
| 148 | { |
| 149 | "id": "launch-output", |
| 150 | "existing": "Approved immutable protected environment and fixed command under maintenance; no mounted adapter here.", |
| 151 | "needed": "Use reviewed platform launch/receipt binding, private bounded output, failure and freshness handling. No new signed output envelope, env boolean authority or arbitrary command. Facts collector output alone is not launch authority." |
| 152 | } |
| 153 | ], |
| 154 | "proposed_complete_slice_boundaries": { |
| 155 | "configuration": "Internal pure parser shared with serving LoadRuntime; no mailer, DB, process or network construction. Typed configured key roles; exact agreed digest convention.", |
| 156 | "database": "One bounded existing-DB validation path with reviewed identity/no-write semantics and explicit role/schema/key acceptance matrix; no migrations or Engine.Execute.", |
| 157 | "command": "Fixed non-serving dispatch before normal startup, wired only to separately reviewed immutable launch adapter and private bounded result. If launch dependency is unavailable, mark complete command delivery blocked rather than claim a helper is the checker.", |
| 158 | "success": "Only after all configured facts and DB compatibility checks pass; fresh invocation under retained fence/lease. Failure emits no partial/private payload or success evidence." |
| 159 | }, |
| 160 | "existing_tests": { |
| 161 | "internal/operator/inspect_test.go": [ |
| 162 | { |
| 163 | "line": 15, |
| 164 | "symbol": "TestInspectDoesNotInitializeOrReserveAuthority" |
| 165 | }, |
| 166 | { |
| 167 | "line": 59, |
| 168 | "symbol": "TestInspectWrongBindingsAndMutableInputRefuse" |
| 169 | } |
| 170 | ], |
| 171 | "internal/operator/open_linux_test.go": [ |
| 172 | { |
| 173 | "line": 41, |
| 174 | "symbol": "TestBoundDatabaseSubprocess" |
| 175 | }, |
| 176 | { |
| 177 | "line": 344, |
| 178 | "symbol": "TestBoundDatabaseEngineSubprocess" |
| 179 | } |
| 180 | ], |
| 181 | "internal/operator/engine_test.go": [ |
| 182 | { |
| 183 | "line": 82, |
| 184 | "symbol": "TestEngineCommitsOnceAndRecoversExpiredResultPrivately" |
| 185 | }, |
| 186 | { |
| 187 | "line": 117, |
| 188 | "symbol": "TestEngineFailureRollsBackMutationReceiptAndSequence" |
| 189 | }, |
| 190 | { |
| 191 | "line": 156, |
| 192 | "symbol": "TestEngineConcurrentRetryHasOneMutation" |
| 193 | }, |
| 194 | { |
| 195 | "line": 183, |
| 196 | "symbol": "TestEngineForeignKeyEnforcementUsesMutationConnection" |
| 197 | }, |
| 198 | { |
| 199 | "line": 200, |
| 200 | "symbol": "TestEngineRefusesExpiredNewAndCorruptExistingResult" |
| 201 | } |
| 202 | ], |
| 203 | "internal/home/runtime_test.go": [ |
| 204 | { |
| 205 | "line": 38, |
| 206 | "symbol": "TestRuntimeKeepsLegacyAndRequiresExplicitRoles" |
| 207 | }, |
| 208 | { |
| 209 | "line": 49, |
| 210 | "symbol": "TestDirectoryRuntimeNeedsNoCredentialMaterial" |
| 211 | }, |
| 212 | { |
| 213 | "line": 68, |
| 214 | "symbol": "TestCredentialRuntimeValidatesManifestAndSigningKey" |
| 215 | }, |
| 216 | { |
| 217 | "line": 91, |
| 218 | "symbol": "TestDirectoryRuntimeRefusesMalformedKeys" |
| 219 | }, |
| 220 | { |
| 221 | "line": 102, |
| 222 | "symbol": "TestRuntimeEncodedPlatformConfiguration" |
| 223 | } |
| 224 | ], |
| 225 | "internal/home/keys_test.go": [ |
| 226 | { |
| 227 | "line": 47, |
| 228 | "symbol": "TestLoadSealerRefusals" |
| 229 | }, |
| 230 | { |
| 231 | "line": 64, |
| 232 | "symbol": "TestLoadSealerAcceptsA32ByteKey" |
| 233 | }, |
| 234 | { |
| 235 | "line": 75, |
| 236 | "symbol": "TestLoadSecretsAcceptsCompleteConfig" |
| 237 | }, |
| 238 | { |
| 239 | "line": 98, |
| 240 | "symbol": "TestLoadSecretsRefusesEachMissingSecret" |
| 241 | }, |
| 242 | { |
| 243 | "line": 113, |
| 244 | "symbol": "TestLoadSecretsRefusesMalformedSecrets" |
| 245 | }, |
| 246 | { |
| 247 | "line": 130, |
| 248 | "symbol": "TestLoadSecretsRefusesWithoutSMTPHostOrFrom" |
| 249 | }, |
| 250 | { |
| 251 | "line": 150, |
| 252 | "symbol": "TestLoadSecretsRefusesEmptyDBPath" |
| 253 | }, |
| 254 | { |
| 255 | "line": 164, |
| 256 | "symbol": "TestLoadSecretsRefusesAllZeroKeys" |
| 257 | }, |
| 258 | { |
| 259 | "line": 182, |
| 260 | "symbol": "TestNewRefusesIncompleteWiring" |
| 261 | } |
| 262 | ], |
| 263 | "internal/home/roster_runtime_test.go": [ |
| 264 | { |
| 265 | "line": 27, |
| 266 | "symbol": "TestRosterRuntimeModeKeyAndRoleMatrix" |
| 267 | }, |
| 268 | { |
| 269 | "line": 62, |
| 270 | "symbol": "TestRosterRuntimeStrictPrivateEncoding" |
| 271 | }, |
| 272 | { |
| 273 | "line": 80, |
| 274 | "symbol": "TestRosterDirectConstructorsAndEmptySchema" |
| 275 | } |
| 276 | ] |
| 277 | }, |
| 278 | "required_acceptance_tests": [ |
| 279 | "Parser parity with actual serving configuration including credential/directory/legacy, encoded platform values, disabled roster and unset-versus-empty settings.", |
| 280 | "Digest determinism and exact downstream raw-base64url shape; ordering/whitespace changes follow reviewed semantics; changed origin changes digest.", |
| 281 | "All active/accepted public key roles accounted for; collisions, wrong role/pin, absent private config refuse; canaries prove no private bytes in result/errors/logs.", |
| 282 | "No listener, mail send, session mint, authority journal mutation, migration or DB creation; actual subprocess with denied network and controlled inherited descriptors.", |
| 283 | "Synthetic existing credential/directory DBs: correct role/schema/key passes; wrong role/origin/key, partial/future/corrupt ledger refuses; existing identities/owners/generation/sequence unchanged.", |
| 284 | "Actual DB/WAL/SHM before/after evidence matches reviewed no-write contract, including hot WAL, readonly permissions and failed checks.", |
| 285 | "Replacement-path/open-restore race, hardlinks, expired deadline and actual descriptor mismatch refuse using existing connector proof or explicitly reviewed extension.", |
| 286 | "Selected artifact/environment/attempt mismatch and stale checker output cannot resume; prior action success and HTTP health cannot bypass checker.", |
| 287 | "Mutations removing schema/key verification, role separation or digest comparison must fail meaningful tests." |
| 288 | ], |
| 289 | "source_evidence": [ |
| 290 | { |
| 291 | "id": "S1", |
| 292 | "file": "implementation/home-provisioner.md", |
| 293 | "absolute_path": "/home/paulca/amadan.net/oficina/home/.claude/worktrees/overnight-provisioner-prepare/implementation/home-provisioner.md", |
| 294 | "sha256": "6fc38e7ee071f2c41446d6c254591ac6999e90eb043e02bb418f6f4747e4deb5", |
| 295 | "line": 256, |
| 296 | "end_line": 274, |
| 297 | "excerpt": "Use maintenance's immutable protected environment binding and a fixed non-serving\napplication compatibility checker against that snapshot. The Home checker reports\nonly exact origins, active public operator/assertion/roster key fingerprints and\nconsumer-manifest digest. The Docs checker reports exact TeamMode bindings, verified\nprovisioning record digest, generation and SHA256 of the canonical bearer already\npresent in protected config. These are bounded private results, never public logs.\nCheckers make no network calls, mint no sessions and change no DB/key/authority.\nThey require separate small implementation/review slices; no current API is claimed\nto supply these application-specific facts. Existing secret fingerprints are compared\nprivately to enrolled fingerprints, without copying existing private keys out. Dial only configured\ncanonical HTTPS hosts with normal certificate validation, no redirects unless the\nspecific sign-in probe validates every expected hop. Compare full expected version\nin body/header and current platform route/alias mapping. Store bounded response\ndigests, typed binding facts and timestamps in the encrypted signed journal; token,\nemail, assertion and unrelated response content are never retained in evidence.\n\n## Activation gate and pending roster integration\n\nAn activation authorization signs exact consumer/team/app/audience, generation," |
| 298 | }, |
| 299 | { |
| 300 | "id": "S2", |
| 301 | "file": "implementation/home-operator-seed.md", |
| 302 | "absolute_path": "/home/paulca/amadan.net/oficina/home/.claude/worktrees/overnight-provisioner-prepare/implementation/home-operator-seed.md", |
| 303 | "sha256": "e1d14379b8642e3ada7d355b0e834a3d06acb8f662a6a142e9d738af16ac856b", |
| 304 | "line": 247, |
| 305 | "end_line": 265, |
| 306 | "excerpt": "Open an existing regular database with creation disabled, through the pinned\nplatform path. Check application identity, expected role/origin, migration ledger\nand required additive schema versions before any action. Never call the general\nweb startup migrator to repair an unexpected DB from this command. The deployment\napplies reviewed role-specific additive migrations before operator execution.\n\nAcquire one dedicated database/sql connection. Set foreign_keys ON before beginning\nand read it back as 1 on that exact connection; pooled connections cannot substitute\nfor this check. Also require secure_delete ON, expected journal configuration,\nno foreign_key_check violations, and the verified transport fence/lease. Take an\nimmediate write transaction with a bounded lock timeout; all idempotency, generation,\nsequence, owner receipt and registry preconditions are rechecked inside it. Do not\nperform network work while holding the lock. Refuse wrong clocks, time rollback\nrelative to persisted operator completion time, exhausted counters or corrupt rows.\nWrite all related authority and audit rows together. Close/checkpoint through the\nsupported transport protocol before resume; an uncertain commit remains fenced\nuntil querying the same operation establishes its outcome.\n\nNo success path changes existing sessions, assertion keys, content encryption," |
| 307 | }, |
| 308 | { |
| 309 | "id": "S3", |
| 310 | "file": "internal/home/runtime.go", |
| 311 | "absolute_path": "/home/paulca/amadan.net/oficina/home/.claude/worktrees/overnight-provisioner-prepare/internal/home/runtime.go", |
| 312 | "sha256": "04ad2e232f37b4027ba1900bf0ff75de805f91fd360af464be13ada8d83023ab", |
| 313 | "line": 38, |
| 314 | "end_line": 145, |
| 315 | "excerpt": "func LoadRuntime(dbPath string, logger *slog.Logger) (Runtime, error) {\n\tvar cfg Runtime\n\tvar err error\n\tcfg.origins, err = LoadOrigins()\n\tif err != nil {\n\t\treturn Runtime{}, err\n\t}\n\tcfg.role = os.Getenv(\"HOME_ROLE\")\n\tif cfg.role != \"directory\" {\n\t\tcfg.roster, err = loadRosterRuntime(cfg.role, nil)\n\t\tif err != nil {\n\t\t\treturn Runtime{}, err\n\t\t}\n\t}\n\tswitch cfg.role {\n\tcase \"\":\n\t\tcfg.secrets, err = LoadSecrets(dbPath, logger)\n\t\treturn cfg, err\n\tcase \"credential\":\n\t\tcfg.secrets, err = LoadSecrets(dbPath, logger)\n\t\tif err != nil {\n\t\t\treturn Runtime{}, err\n\t\t}\n\t\tencodedPrivate := os.Getenv(\"HOME_ASSERTION_KEY\")\n\t\tif len(encodedPrivate) > 4096 {\n\t\t\treturn Runtime{}, errExchangeConfig\n\t\t}\n\t\traw, err := base64.StdEncoding.DecodeString(encodedPrivate)\n\t\tif err != nil {\n\t\t\treturn Runtime{}, errExchangeConfig\n\t\t}\n\t\tcfg.signer, err = assertioncrypto.UnmarshalKeypair(raw)\n\t\tif err != nil {\n\t\t\treturn Runtime{}, errExchangeConfig\n\t\t}\n\t\tif cfg.signer.SignPriv.D.Sign() <= 0 || cfg.signer.SignPriv.D.Cmp(elliptic.P256().Params().N) >= 0 {\n\t\t\treturn Runtime{}, errExchangeConfig\n\t\t}\n\t\tpub := cfg.signer.SignPub()\n\t\tsum := sha256.Sum256(pub)\n\t\tcfg.keyID = hex.EncodeToString(sum[:])\n\t\tcfg.keys = map[string][]byte{cfg.keyID: pub}\n\t\trawManifest, err := exchangeJSON(\"HOME_CONSUMERS\", 8192)\n\t\tif err != nil {\n\t\t\treturn Runtime{}, err\n\t\t}\n\t\t// Sixteen pilot origins keep the exact CSP manifest within ordinary header\n\t\t// limits. Production registration needs a separately reviewed scalable path.\n\t\tif len(rawManifest) > 8192 || json.Unmarshal([]byte(rawManifest), &cfg.consumers) != nil || len(cfg.consumers) == 0 || len(cfg.consumers) > 16 {\n\t\t\treturn Runtime{}, errExchangeConfig\n\t\t}\n\t\tfor id, origin := range cfg.consumers {\n\t\t\tif !consumerName(id) {\n\t\t\t\treturn Runtime{}, errExchangeConfig\n\t\t\t}\n\t\t\tif _, err = assertion.NewVerifier(cfg.origins.Credential, origin, cfg.keys); err != nil {\n\t\t\t\treturn Runtime{}, errExchangeConfig\n\t\t\t}\n\t\t}\n\t\tif cfg.consumers[\"directory\"] != cfg.origins.Directory {\n\t\t\treturn Runtime{}, errExchangeConfig\n\t\t}\n\tcase \"directory\":\n\t\tif dbPath == \"\" || os.Getenv(\"HOME_ASSERTION_KEY\") != \"\" {\n\t\t\treturn Runtime{}, errExchangeConfig\n\t\t}\n\t\tcfg.secrets.Sealer, err = LoadSealer()\n\t\tif err != nil {\n\t\t\treturn Runtime{}, err\n\t\t}\n\t\tvar encoded map[string]string\n\t\traw, err := exchangeJSON(\"HOME_ASSERTION_KEYS\", 4096)\n\t\tif err != nil {\n\t\t\treturn Runtime{}, err\n\t\t}\n\t\tif len(raw) > 4096 || json.Unmarshal([]byte(raw), &encoded) != nil || len(encoded) == 0 || len(encoded) > 8 {\n\t\t\treturn Runtime{}, errExchangeConfig\n\t\t}\n\t\tcfg.keys = make(map[string][]byte, len(encoded))\n\t\tfor kid, value := range encoded {\n\t\t\tkey, err := base64.StdEncoding.DecodeString(value)\n\t\t\tif err != nil {\n\t\t\t\treturn Runtime{}, errExchangeConfig\n\t\t\t}\n\t\t\tcfg.keys[kid] = key\n\t\t}\n\t\tif _, err = assertion.NewVerifier(cfg.origins.Credential, cfg.origins.Directory, cfg.keys); err != nil {\n\t\t\treturn Runtime{}, errExchangeConfig\n\t\t}\n\t\tcfg.roster, err = loadRosterRuntime(cfg.role, cfg.keys)\n\t\tif err != nil {\n\t\t\treturn Runtime{}, err\n\t\t}\n\tdefault:\n\t\treturn Runtime{}, errExchangeConfig\n\t}\n\treturn cfg, nil\n}\nfunc consumerName(s string) bool {\n\tif len(s) == 0 || len(s) > 64 {\n\t\treturn false\n\t}\n\tfor _, b := range []byte(s) {\n\t\tif !(b >= 'a' && b <= 'z' || b >= 'A' && b <= 'Z' || b >= '0' && b <= '9' || b == '_' || b == '-') {\n\t\t\treturn false\n\t\t}\n\t}\n\treturn true" |
| 316 | }, |
| 317 | { |
| 318 | "id": "S4", |
| 319 | "file": "internal/home/keys.go", |
| 320 | "absolute_path": "/home/paulca/amadan.net/oficina/home/.claude/worktrees/overnight-provisioner-prepare/internal/home/keys.go", |
| 321 | "sha256": "4b4cb1c250c6b9827df4871108f4baa2ddde45976457c112bb70a9657fa41b48", |
| 322 | "line": 118, |
| 323 | "end_line": 172, |
| 324 | "excerpt": "func LoadSecrets(dbPath string, logger *slog.Logger) (Secrets, error) {\n\tif logger == nil {\n\t\tlogger = slog.Default()\n\t}\n\n\t// SQLite treats an empty filename as a private temporary database:\n\t// the app comes up, works, and loses every person on restart. There\n\t// is no warning for this anywhere below us, which is why it is\n\t// checked here.\n\tif strings.TrimSpace(dbPath) == \"\" {\n\t\treturn Secrets{}, errors.New(\"no database path: set Options.DBPath or pass -db, or SQLite opens a private temporary database and every person is lost on restart\")\n\t}\n\n\tvar s Secrets\n\tvar err error\n\n\t// Through LoadSealer rather than beside it, so HOME_DEK is read in\n\t// one place. Two readers of the same variable is how one of them\n\t// ends up with a check the other does not have.\n\ts.Sealer, err = LoadSealer()\n\tif err != nil {\n\t\treturn Secrets{}, err\n\t}\n\n\tpepper, err := key32(\"HOME_PEPPER\")\n\tif err != nil {\n\t\treturn Secrets{}, err\n\t}\n\ts.Pepper = pepper[:]\n\n\ts.SigninKey, err = key32(\"HOME_SIGNIN_KEY\")\n\tif err != nil {\n\t\treturn Secrets{}, err\n\t}\n\n\t// mail.FromEnv falls back to mail.Logged with a warning when HOST or\n\t// FROM is absent, and Logged's Send logs \"to\", to \u2014 an address into\n\t// platform-held logs on every single sign-in. A warning is not\n\t// enough: that log is storage we cannot grep or redact, so this is\n\t// the one fallback we refuse instead of accept.\n\t//\n\t// CARLOS_SMTP_PASS is a different failure and is refused for a\n\t// different reason, so the message below distinguishes them. It\n\t// leaks nothing: with HOST and FROM set, FromEnv returns the SMTP\n\t// sender whether or not PASS is present. What a missing PASS costs\n\t// is delivery \u2014 every link fails at send time on an app that\n\t// otherwise looks healthy. (It is inert without CARLOS_SMTP_USER,\n\t// which `carlos email enable` delivers alongside it; refusing on\n\t// PASS is a bet that the platform sets both or neither.)\n\t//\n\t// Deliberately no loopback relaxation. Sheets' LoadAuthEnv allows\n\t// one for local development, keyed on its instance origin being an\n\t// http loopback host. The home has no origin variable at this step,\n\t// so the equivalent carve-out would have to invent one, and a\n\t// carve-out that turns off the leak guard is not a thing to invent" |
| 325 | }, |
| 326 | { |
| 327 | "id": "S5", |
| 328 | "file": "internal/home/origins.go", |
| 329 | "absolute_path": "/home/paulca/amadan.net/oficina/home/.claude/worktrees/overnight-provisioner-prepare/internal/home/origins.go", |
| 330 | "sha256": "dc98e1a428ff5703a08ce24e674a121eb450e9155040e1854319d2449d9be851", |
| 331 | "line": 26, |
| 332 | "end_line": 67, |
| 333 | "excerpt": "func LoadOrigins() (Origins, error) {\n\tcredential, haveCredential := os.LookupEnv(\"HOME_CREDENTIAL_ORIGIN\")\n\tdirectory, haveDirectory := os.LookupEnv(\"HOME_DIRECTORY_ORIGIN\")\n\tif !haveCredential && !haveDirectory {\n\t\treturn Origins{Origin, directoryOrigin}, nil\n\t}\n\torigins := Origins{credential, directory}\n\tif !haveCredential || !haveDirectory {\n\t\treturn Origins{}, errOrigins\n\t}\n\treturn origins, origins.validate()\n}\n\nfunc originHost(origin string) (string, error) {\n\tu, err := url.Parse(origin)\n\tif err != nil || u.Scheme != \"https\" || u.User != nil || u.Host == \"\" || origin != \"https://\"+u.Host || u.Host != strings.ToLower(u.Host) || net.ParseIP(u.Host) != nil {\n\t\treturn \"\", errOrigins\n\t}\n\tif len(u.Host) > 253 {\n\t\treturn \"\", errOrigins\n\t}\n\tlabels := strings.Split(u.Host, \".\")\n\tif len(labels) < 2 {\n\t\treturn \"\", errOrigins\n\t}\n\tfor _, label := range labels {\n\t\tif len(label) == 0 || len(label) > 63 || label[0] == '-' || label[len(label)-1] == '-' {\n\t\t\treturn \"\", errOrigins\n\t\t}\n\t\tfor _, c := range label {\n\t\t\tif !(c >= 'a' && c <= 'z' || c >= '0' && c <= '9' || c == '-') {\n\t\t\t\treturn \"\", errOrigins\n\t\t\t}\n\t\t}\n\t}\n\treturn u.Host, nil\n}\n\nfunc (o Origins) validate() error {\n\tcredential, err := originHost(o.Credential)\n\tif err != nil {\n\t\treturn err" |
| 334 | }, |
| 335 | { |
| 336 | "id": "S6", |
| 337 | "file": "internal/home/roster_runtime.go", |
| 338 | "absolute_path": "/home/paulca/amadan.net/oficina/home/.claude/worktrees/overnight-provisioner-prepare/internal/home/roster_runtime.go", |
| 339 | "sha256": "5e2ed41df26b1342834fe6996b5df901a2b05e9f4f41bb6afc98c6e8a7bd3c3c", |
| 340 | "line": 54, |
| 341 | "end_line": 105, |
| 342 | "excerpt": "func loadRosterRuntime(role string, credentialKeys map[string][]byte) (rosterRuntime, error) {\n\tmode, modeSet := os.LookupEnv(\"HOME_ROSTER_MODE\")\n\tencoded, keySet := os.LookupEnv(\"HOME_ROSTER_KEY\")\n\tif role != \"directory\" {\n\t\tif modeSet || keySet {\n\t\t\treturn rosterRuntime{}, errExchangeConfig\n\t\t}\n\t\treturn rosterRuntime{}, nil\n\t}\n\tif !modeSet {\n\t\tmode = \"disabled\"\n\t}\n\tif mode == \"disabled\" {\n\t\tif keySet {\n\t\t\treturn rosterRuntime{}, errExchangeConfig\n\t\t}\n\t\treturn rosterRuntime{mode: mode}, nil\n\t}\n\tif mode != \"serve\" || !keySet || len(encoded) > 4096 {\n\t\treturn rosterRuntime{}, errExchangeConfig\n\t}\n\traw, err := base64.StdEncoding.Strict().DecodeString(encoded)\n\tif err != nil || base64.StdEncoding.EncodeToString(raw) != encoded {\n\t\treturn rosterRuntime{}, errExchangeConfig\n\t}\n\tvar fields struct {\n\t\tSign string `json:\"sign_priv_d\"`\n\t\tBox string `json:\"box_priv_d\"`\n\t}\n\tif json.Unmarshal(raw, &fields, json.RejectUnknownMembers(true)) != nil {\n\t\treturn rosterRuntime{}, errExchangeConfig\n\t}\n\tfor _, s := range []string{fields.Sign, fields.Box} {\n\t\tb, e := hex.DecodeString(s)\n\t\tif e != nil || len(b) != 32 || hex.EncodeToString(b) != s {\n\t\t\treturn rosterRuntime{}, errExchangeConfig\n\t\t}\n\t\td := new(big.Int).SetBytes(b)\n\t\tif d.Sign() <= 0 || d.Cmp(elliptic.P256().Params().N) >= 0 {\n\t\t\treturn rosterRuntime{}, errExchangeConfig\n\t\t}\n\t}\n\tkey, err := family.UnmarshalKeypair(raw)\n\tif err != nil || !validRosterKey(key) {\n\t\treturn rosterRuntime{}, errExchangeConfig\n\t}\n\tcfg := rosterRuntime{mode: mode, signer: key, keyID: rosterKeyID(key)}\n\tif !cfg.valid(role, credentialKeys) {\n\t\treturn rosterRuntime{}, errExchangeConfig\n\t}\n\treturn cfg, nil\n}" |
| 343 | }, |
| 344 | { |
| 345 | "id": "S7", |
| 346 | "file": "internal/operator/protocol.go", |
| 347 | "absolute_path": "/home/paulca/amadan.net/oficina/home/.claude/worktrees/overnight-provisioner-prepare/internal/operator/protocol.go", |
| 348 | "sha256": "332ff9ccbdee79778486a49d54cd2c7c7f36fc0fd28a2770ee4a0f553316dba3", |
| 349 | "line": 54, |
| 350 | "end_line": 58, |
| 351 | "excerpt": "type Pins struct {\n\tRole, Origin, Installation, Registry, Device string\n\tPublicKey string\n\tActions []string\n}" |
| 352 | }, |
| 353 | { |
| 354 | "id": "S8", |
| 355 | "file": "internal/operator/protocol.go", |
| 356 | "absolute_path": "/home/paulca/amadan.net/oficina/home/.claude/worktrees/overnight-provisioner-prepare/internal/operator/protocol.go", |
| 357 | "sha256": "332ff9ccbdee79778486a49d54cd2c7c7f36fc0fd28a2770ee4a0f553316dba3", |
| 358 | "line": 118, |
| 359 | "end_line": 118, |
| 360 | "excerpt": "func keyID(b []byte) string { h := sha256.Sum256(b); return hex.EncodeToString(h[:]) }" |
| 361 | }, |
| 362 | { |
| 363 | "id": "S9", |
| 364 | "file": "internal/operator/directory.go", |
| 365 | "absolute_path": "/home/paulca/amadan.net/oficina/home/.claude/worktrees/overnight-provisioner-prepare/internal/operator/directory.go", |
| 366 | "sha256": "4071f042ee858f0b71aff414b7e0a2cc1ca1bf2598d941e14544db94bf90cf4e", |
| 367 | "line": 82, |
| 368 | "end_line": 121, |
| 369 | "excerpt": "func NewDirectory(engine *Engine, owner *OwnerVerifier, signer *family.Keypair, keys []roster.Key, policy directorydata.Config) (*Directory, error) {\n\tif engine == nil || engine.verifier.pins.Role != \"directory\" || owner == nil || owner.directory != engine.verifier.pins.Origin || !signingKey(signer) || len(keys) == 0 || len(keys) > 8 {\n\t\treturn nil, ErrRefused\n\t}\n\tnames, e := directorydata.New(engine.db, engine.sealer, policy)\n\tif e != nil {\n\t\treturn nil, ErrRefused\n\t}\n\tseen := map[string]bool{}\n\tfor _, k := range [][]byte{engine.verifier.key, owner.key, signer.SignPub()} {\n\t\tif seen[string(k)] {\n\t\t\treturn nil, ErrRefused\n\t\t}\n\t\tseen[string(k)] = true\n\t}\n\tids := map[string]bool{}\n\tfor _, k := range keys {\n\t\tp, e := public(k.Public)\n\t\tif e != nil || !atom(k.ID, 64) || ids[k.ID] || seen[string(p)] {\n\t\t\treturn nil, ErrRefused\n\t\t}\n\t\tids[k.ID] = true\n\t\tseen[string(p)] = true\n\t}\n\td := &Directory{engine, owner, signer, append([]roster.Key(nil), keys...), names, policy, map[string]bool{}}\n\td.policy.Apps = append([]string(nil), policy.Apps...)\n\tfor _, app := range policy.Apps {\n\t\td.apps[app] = true\n\t}\n\treturn d, nil\n}\nfunc atom(s string, max int) bool {\n\tif len(s) == 0 || len(s) > max {\n\t\treturn false\n\t}\n\tfor _, c := range s {\n\t\tif !(c >= 'a' && c <= 'z' || c >= 'A' && c <= 'Z' || c >= '0' && c <= '9' || c == '_' || c == '-') {\n\t\t\treturn false\n\t\t}\n\t}" |
| 370 | }, |
| 371 | { |
| 372 | "id": "S10", |
| 373 | "file": "internal/operator/credential.go", |
| 374 | "absolute_path": "/home/paulca/amadan.net/oficina/home/.claude/worktrees/overnight-provisioner-prepare/internal/operator/credential.go", |
| 375 | "sha256": "327f2e53728f919b1cc63697816dd3898c6393b8bc003436b78a43bd6c5895fb", |
| 376 | "line": 34, |
| 377 | "end_line": 50, |
| 378 | "excerpt": "func NewCredential(engine *Engine, directory string, signer *family.Keypair, browserPublicKeys [][]byte, resolve PersonResolver) (*Credential, error) {\n\tif engine == nil || engine.verifier.pins.Role != \"credential\" || !Origin(directory) || directory == engine.verifier.pins.Origin || !signingKey(signer) || resolve == nil || len(browserPublicKeys) == 0 || len(browserPublicKeys) > 8 || bytes.Equal(signer.SignPub(), engine.verifier.key) {\n\t\treturn nil, ErrRefused\n\t}\n\tfor _, key := range browserPublicKeys {\n\t\tif _, e := public(base64.RawURLEncoding.EncodeToString(key)); e != nil {\n\t\t\treturn nil, ErrRefused\n\t\t}\n\t\tif bytes.Equal(key, signer.SignPub()) || bytes.Equal(key, engine.verifier.key) {\n\t\t\treturn nil, ErrRefused\n\t\t}\n\t}\n\treturn &Credential{engine, directory, signer, resolve}, nil\n}\nfunc (c *Credential) Execute(ctx context.Context, raw []byte) ([]byte, error) {\n\treturn c.engine.Execute(ctx, raw, func(ctx context.Context, conn *sql.Conn, r Request) ([]byte, error) {\n\t\tvar in OwnerInput" |
| 379 | }, |
| 380 | { |
| 381 | "id": "S11", |
| 382 | "file": "internal/operator/inspect.go", |
| 383 | "absolute_path": "/home/paulca/amadan.net/oficina/home/.claude/worktrees/overnight-provisioner-prepare/internal/operator/inspect.go", |
| 384 | "sha256": "53f03642dd419e369efbf5decfff291ce5b54c6efe91e5156c2c435b223fa541", |
| 385 | "line": 72, |
| 386 | "end_line": 132, |
| 387 | "excerpt": "func (d *Directory) Inspect(ctx context.Context, raw []byte) ([]byte, error) {\n\tif d == nil || d.engine == nil {\n\t\treturn nil, ErrRefused\n\t}\n\te := d.engine\n\tchallenge, err := e.verifier.verifyInspect(raw, e.now())\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tctx, cancel := context.WithTimeout(ctx, 5*time.Second)\n\tdefer cancel()\n\tc, err := e.db.Conn(ctx)\n\tif err != nil {\n\t\treturn nil, ErrUnavailable\n\t}\n\tdefer c.Close()\n\tif _, err = c.ExecContext(ctx, \"BEGIN\"); err != nil {\n\t\treturn nil, ErrUnavailable\n\t}\n\tdefer c.ExecContext(context.Background(), \"ROLLBACK\")\n\tvar count int\n\tif err = c.QueryRowContext(ctx, \"SELECT count(*) FROM directory_operator_state WHERE singleton=1 AND (origin!=? OR installation!=? OR registry!=? OR device!=? OR key_id!=? OR completed_at>?)\", e.verifier.pins.Origin, e.verifier.pins.Installation, e.verifier.pins.Registry, e.verifier.pins.Device, e.verifier.kid, e.now().Unix()).Scan(&count); err != nil {\n\t\treturn nil, ErrUnavailable\n\t}\n\tif count != 0 {\n\t\treturn nil, ErrRefused\n\t}\n\tvar generation *string\n\trows, err := c.QueryContext(ctx, \"SELECT generation FROM roster_generation WHERE singleton=1\")\n\tif err != nil {\n\t\treturn nil, ErrUnavailable\n\t}\n\tif rows.Next() {\n\t\tvar g string\n\t\tif rows.Scan(&g) != nil || !CanonicalToken(g) {\n\t\t\trows.Close()\n\t\t\treturn nil, ErrUnavailable\n\t\t}\n\t\tgeneration = &g\n\t}\n\terr = rows.Err()\n\tcloseErr := rows.Close()\n\tif err != nil || closeErr != nil {\n\t\treturn nil, ErrUnavailable\n\t}\n\tid, sqid, err := nextTeam(ctx, c)\n\tif err != nil {\n\t\treturn nil, ErrUnavailable\n\t}\n\tif _, err = e.verifier.verifyInspect(raw, e.now()); err != nil {\n\t\treturn nil, ErrRefused\n\t}\n\tout, err := encode(Inspection{1, challenge.Challenge, e.now().Unix(), generation, id, sqid})\n\tif err != nil {\n\t\treturn nil, ErrUnavailable\n\t}\n\tif _, err = c.ExecContext(ctx, \"COMMIT\"); err != nil {\n\t\treturn nil, ErrUnavailable\n\t}\n\treturn out, nil\n}" |
| 388 | }, |
| 389 | { |
| 390 | "id": "S12", |
| 391 | "file": "internal/operator/open_linux.go", |
| 392 | "absolute_path": "/home/paulca/amadan.net/oficina/home/.claude/worktrees/overnight-provisioner-prepare/internal/operator/open_linux.go", |
| 393 | "sha256": "15ba8a2dc975a61d614c39e1cd3f7e7dc24f617140b893610d4954ae87b13c38", |
| 394 | "line": 52, |
| 395 | "end_line": 81, |
| 396 | "excerpt": "func newBoundDatabase(path string, device, inode uint64, deadline time.Time) (*boundDatabase, error) {\n\tif device == 0 || inode == 0 || !deadline.After(time.Now()) {\n\t\treturn nil, ErrRefused\n\t}\n\tpin, id, e := pinExisting(path)\n\tif e != nil {\n\t\treturn nil, e\n\t}\n\tif id != (fileIdentity{device, inode}) {\n\t\tpin.Close()\n\t\treturn nil, ErrRefused\n\t}\n\tc := &boundConnector{path: path, pin: pin, identity: id, deadline: deadline, sqlite: &sqlite.Driver{}}\n\tdb := sql.OpenDB(c)\n\tdb.SetMaxOpenConns(1)\n\tdb.SetMaxIdleConns(1)\n\treturn &boundDatabase{db, c}, nil\n}\nfunc (b *boundDatabase) close() error {\n\te := b.db.Close()\n\tb.connector.mu.Lock()\n\tdefer b.connector.mu.Unlock()\n\tif b.connector.active {\n\t\treturn ErrUnavailable\n\t}\n\tif x := b.connector.pin.Close(); e == nil {\n\t\te = x\n\t}\n\treturn e\n}" |
| 397 | }, |
| 398 | { |
| 399 | "id": "S13", |
| 400 | "file": "internal/operator/open_linux.go", |
| 401 | "absolute_path": "/home/paulca/amadan.net/oficina/home/.claude/worktrees/overnight-provisioner-prepare/internal/operator/open_linux.go", |
| 402 | "sha256": "15ba8a2dc975a61d614c39e1cd3f7e7dc24f617140b893610d4954ae87b13c38", |
| 403 | "line": 202, |
| 404 | "end_line": 283, |
| 405 | "excerpt": "func (c *boundConnector) Connect(ctx context.Context) (driver.Conn, error) {\n\tc.mu.Lock()\n\tdefer c.mu.Unlock()\n\tif c.active || ctx.Err() != nil || c.pathMatches() != nil {\n\t\treturn nil, ErrRefused\n\t}\n\tc.checkpoint(\"before-inventory\")\n\tbaseline, e := descriptors()\n\tif e != nil {\n\t\treturn nil, e\n\t}\n\tfor _, d := range baseline {\n\t\tif writable(d.flags) {\n\t\t\treturn nil, ErrRefused\n\t\t}\n\t}\n\tc.checkpoint(\"before-open\")\n\tif c.pathMatches() != nil {\n\t\treturn nil, ErrRefused\n\t}\n\tc.checkpoint(\"before-driver\")\n\tu := url.URL{Scheme: \"file\", Path: c.path}\n\tq := u.Query()\n\tq.Set(\"mode\", \"rw\")\n\tu.RawQuery = q.Encode()\n\tnative, e := c.sqlite.Open(u.String())\n\tif e != nil {\n\t\treturn nil, ErrUnavailable\n\t}\n\tkeep := false\n\tdefer func() {\n\t\tif !keep {\n\t\t\tnative.Close()\n\t\t}\n\t}()\n\tc.checkpoint(\"after-open\")\n\tcurrent, e := descriptors()\n\tif e != nil {\n\t\treturn nil, e\n\t}\n\tmainFD := -1\n\tfor fd, d := range current {\n\t\tif !writable(d.flags) {\n\t\t\tcontinue\n\t\t}\n\t\tif _, old := baseline[fd]; old {\n\t\t\treturn nil, ErrRefused\n\t\t}\n\t\tif d.identity == c.identity {\n\t\t\tif d.flags&unix.O_ACCMODE != unix.O_RDWR || d.links != 1 || mainFD != -1 {\n\t\t\t\treturn nil, ErrRefused\n\t\t\t}\n\t\t\tmainFD = fd\n\t\t}\n\t}\n\tif mainFD < 0 {\n\t\treturn nil, ErrRefused\n\t}\n\tbound := &boundConnection{Conn: native, owner: c, mainFD: mainFD, siblings: map[string]fileIdentity{}}\n\tif e = bound.check(); e != nil {\n\t\treturn nil, e\n\t}\n\tquery, ok := native.(driver.QueryerContext)\n\tif !ok {\n\t\treturn nil, ErrRefused\n\t}\n\trows, e := query.QueryContext(ctx, \"PRAGMA database_list\", nil)\n\tif e != nil {\n\t\treturn nil, ErrUnavailable\n\t}\n\tvalues := make([]driver.Value, 3)\n\tif rows.Next(values) != nil || values[1] != \"main\" || values[2] != c.path {\n\t\trows.Close()\n\t\treturn nil, ErrRefused\n\t}\n\tif e = rows.Next(values); e != io.EOF {\n\t\trows.Close()\n\t\treturn nil, ErrRefused\n\t}\n\tif rows.Close() != nil {\n\t\treturn nil, ErrUnavailable\n\t}" |
| 406 | }, |
| 407 | { |
| 408 | "id": "S14", |
| 409 | "file": "internal/operator/engine.go", |
| 410 | "absolute_path": "/home/paulca/amadan.net/oficina/home/.claude/worktrees/overnight-provisioner-prepare/internal/operator/engine.go", |
| 411 | "sha256": "76b234222e95df223158aac4fe34b0ab954e75892a0c86f088bcc7c0a9d6d125", |
| 412 | "line": 68, |
| 413 | "end_line": 137, |
| 414 | "excerpt": "func (e *Engine) Execute(ctx context.Context, raw []byte, mutate Mutation) ([]byte, error) {\n\tif e == nil || mutate == nil {\n\t\treturn nil, ErrRefused\n\t}\n\treq, err := e.verifier.Verify(raw)\n\tif err != nil {\n\t\treturn nil, ErrRefused\n\t}\n\ta := req.authorization\n\tctx, cancel := context.WithTimeout(ctx, 5*time.Second)\n\tdefer cancel()\n\tconn, err := e.db.Conn(ctx)\n\tif err != nil {\n\t\treturn nil, ErrUnavailable\n\t}\n\tdefer conn.Close()\n\tfor _, statement := range []string{\"PRAGMA foreign_keys=ON\", \"PRAGMA secure_delete=ON\", \"PRAGMA busy_timeout=1000\"} {\n\t\tif _, err = conn.ExecContext(ctx, statement); err != nil {\n\t\t\treturn nil, ErrUnavailable\n\t\t}\n\t}\n\tvar fk, secure int\n\tvar journal string\n\tif conn.QueryRowContext(ctx, \"PRAGMA foreign_keys\").Scan(&fk) != nil || fk != 1 || conn.QueryRowContext(ctx, \"PRAGMA secure_delete\").Scan(&secure) != nil || secure != 1 || conn.QueryRowContext(ctx, \"PRAGMA journal_mode\").Scan(&journal) != nil || journal != \"wal\" {\n\t\treturn nil, ErrUnavailable\n\t}\n\tviolations, err := conn.QueryContext(ctx, \"PRAGMA foreign_key_check\")\n\tif err != nil {\n\t\treturn nil, ErrUnavailable\n\t}\n\tbad := violations.Next()\n\treadErr := violations.Err()\n\tcloseErr := violations.Close()\n\tif bad || readErr != nil || closeErr != nil {\n\t\treturn nil, ErrUnavailable\n\t}\n\tif _, err = conn.ExecContext(ctx, \"BEGIN IMMEDIATE\"); err != nil {\n\t\treturn nil, ErrUnavailable\n\t}\n\tfinished := false\n\tdefer func() {\n\t\tif !finished {\n\t\t\tcleanup, cancel := context.WithTimeout(context.Background(), time.Second)\n\t\t\tdefer cancel()\n\t\t\tif _, err := conn.ExecContext(cleanup, \"ROLLBACK\"); err != nil {\n\t\t\t\t_ = conn.Raw(func(any) error { return driver.ErrBadConn })\n\t\t\t}\n\t\t}\n\t}()\n\tvar storedOrigin, storedInstallation, storedRegistry, storedDevice, storedHead, storedKey string\n\tvar storedSequence, storedCompleted int64\n\tstateErr := conn.QueryRowContext(ctx, \"SELECT origin,installation,registry,device,sequence,head,completed_at,key_id FROM \"+e.prefix+\"_state WHERE singleton=1\").Scan(&storedOrigin, &storedInstallation, &storedRegistry, &storedDevice, &storedSequence, &storedHead, &storedCompleted, &storedKey)\n\tif stateErr != nil && !errors.Is(stateErr, sql.ErrNoRows) {\n\t\treturn nil, ErrUnavailable\n\t}\n\tif stateErr == nil && (storedOrigin != a.Origin || storedInstallation != a.Installation || storedRegistry != a.Registry || storedDevice != a.Device || storedKey != e.verifier.kid || storedSequence <= 0 || !CanonicalToken(storedHead) || storedCompleted <= 0 || e.now().Unix() < storedCompleted) {\n\t\treturn nil, ErrRefused\n\t}\n\tvar oldAction, oldHead, oldOperator string\n\tvar oldSequence int64\n\tvar oldMAC, sealed []byte\n\terr = conn.QueryRowContext(ctx, \"SELECT action,sequence,authorization_head,request_mac,sealed_result,operator_ref FROM \"+e.prefix+\"_results WHERE operation_id=?\", a.OperationID).Scan(&oldAction, &oldSequence, &oldHead, &oldMAC, &sealed, &oldOperator)\n\tif err == nil {\n\t\tif stateErr != nil || storedSequence < a.Sequence || oldOperator != a.Device || oldAction != a.Action || oldSequence != a.Sequence || oldHead != req.head || !hmac.Equal(oldMAC, e.mac(req)) {\n\t\t\treturn nil, ErrRefused\n\t\t}\n\t\tresult, openErr := e.sealer.Open(e.purpose(a), sealed)\n\t\tif openErr != nil || len(result) == 0 || len(result) > InputLimit {\n\t\t\treturn nil, ErrUnavailable\n\t\t}" |
| 415 | }, |
| 416 | { |
| 417 | "id": "S15", |
| 418 | "file": "internal/operator/verification.go", |
| 419 | "absolute_path": "/home/paulca/amadan.net/oficina/home/.claude/worktrees/overnight-provisioner-prepare/internal/operator/verification.go", |
| 420 | "sha256": "547fef12d2ccdab9a41a172677c0be37d8f1d04b0ada9bd9b15b5a3d7e332c71", |
| 421 | "line": 27, |
| 422 | "end_line": 51, |
| 423 | "excerpt": "type ActivationEvidence struct {\n\tVersion int `json:\"version\"`\n\tPolicy string `json:\"policy\"`\n\tAttempt string `json:\"attempt_id\"`\n\tConsumer string `json:\"consumer\"`\n\tTeamSQID string `json:\"team_sqid\"`\n\tApp string `json:\"app\"`\n\tAudience string `json:\"audience\"`\n\tGeneration string `json:\"generation\"`\n\tRecordSequence int64 `json:\"record_sequence\"`\n\tRecordDigest string `json:\"record_digest\"`\n\tEpoch int64 `json:\"epoch\"`\n\tOwner string `json:\"owner_ref\"`\n\tAppVersion string `json:\"app_version\"`\n\tArtifactDigest string `json:\"artifact_digest\"`\n\tEnvironmentBinding string `json:\"environment_binding\"`\n\tManifestDigest string `json:\"credential_manifest_digest\"`\n\tAliasHost string `json:\"alias_host\"`\n\tStarted int64 `json:\"started_at\"`\n\tCompleted int64 `json:\"completed_at\"`\n}\ntype ActivationInput struct {\n\tInputBase\n\tEvidence ActivationEvidence `json:\"evidence\"`\n}" |
| 424 | }, |
| 425 | { |
| 426 | "id": "S16", |
| 427 | "file": "internal/operator/verification.go", |
| 428 | "absolute_path": "/home/paulca/amadan.net/oficina/home/.claude/worktrees/overnight-provisioner-prepare/internal/operator/verification.go", |
| 429 | "sha256": "547fef12d2ccdab9a41a172677c0be37d8f1d04b0ada9bd9b15b5a3d7e332c71", |
| 430 | "line": 182, |
| 431 | "end_line": 184, |
| 432 | "excerpt": "\tif e != nil || p.Version != 1 || p.Policy != \"oficina/team-activation/v1\" || !CanonicalToken(p.Attempt) || !version(p.AppVersion) || !CanonicalToken(p.ArtifactDigest) || !CanonicalToken(p.EnvironmentBinding) || !CanonicalToken(p.ManifestDigest) || p.AliasHost != u.Host || p.Started <= 0 || p.Completed < p.Started || p.Completed > now || now-p.Completed >= 300 {\n\t\treturn nil, ErrRefused\n\t}" |
| 433 | }, |
| 434 | { |
| 435 | "id": "S17", |
| 436 | "file": "internal/provisioner/prepare_linux.go", |
| 437 | "absolute_path": "/home/paulca/amadan.net/oficina/home/.claude/worktrees/overnight-provisioner-prepare/internal/provisioner/prepare_linux.go", |
| 438 | "sha256": "4b04bb15b1d22bc825207548b0bb8d84266a4c03dc84af125ed91f260320f89e", |
| 439 | "line": 77, |
| 440 | "end_line": 141, |
| 441 | "excerpt": "func decodeOperationPlan(raw []byte) (OperationPlan, any, error) {\n\tvar p OperationPlan\n\tif len(raw) == 0 || len(raw) > operator.BodyLimit || json.Unmarshal(raw, &p, json.RejectUnknownMembers(true)) != nil || p.Version != 1 || !operator.CanonicalToken(p.Installation) || !operator.CanonicalToken(p.Operation) || len(p.Input) == 0 || len(p.Input) > operator.InputLimit {\n\t\treturn p, nil, ErrRefused\n\t}\n\tvar input any\n\tvar base *operator.InputBase\n\tswitch p.Action {\n\tcase \"directory.initialize\":\n\t\tin := new(operator.InitializeInput)\n\t\tinput = in\n\t\tbase = &in.InputBase\n\tcase \"credential.owner-seed\":\n\t\tin := new(operator.OwnerInput)\n\t\tinput = in\n\t\tbase = &in.InputBase\n\tcase \"directory.seed-team\":\n\t\tin := new(operator.SeedInput)\n\t\tinput = in\n\t\tbase = &in.InputBase\n\tcase \"directory.provision-consumer\":\n\t\tin := new(operator.ProvisionInput)\n\t\tinput = in\n\t\tbase = &in.InputBase\n\tdefault:\n\t\t// Verification and activation await checked record/evidence collectors.\n\t\treturn p, nil, ErrRefused\n\t}\n\trole := \"directory\"\n\tif p.Action == \"credential.owner-seed\" {\n\t\trole = \"credential\"\n\t}\n\tif p.Role != role || json.Unmarshal(p.Input, input, json.RejectUnknownMembers(true)) != nil || base.Version != 1 || base.Operation != p.Action || base.OperationID != p.Operation {\n\t\treturn p, nil, ErrRefused\n\t}\n\treturn p, input, nil\n}\nfunc preparationScope(s *installationState, input any) bool {\n\tif s == nil {\n\t\treturn false\n\t}\n\tswitch in := input.(type) {\n\tcase *operator.InitializeInput:\n\t\treturn in.ExpectedGeneration == nil && operator.CanonicalToken(in.Generation) && in.Baseline == \"operator-attests-never-provisioned\"\n\tcase *operator.OwnerInput:\n\t\tsqid, e := operator.TeamSQID(in.TeamID)\n\t\taddress, parseErr := mail.ParseAddress(in.Address)\n\t\treturn e == nil && parseErr == nil && address.Address == in.Address && address.Name == \"\" && in.ExistingOnly && in.TeamSQID == sqid && in.Directory == s.Plan.Directory.Origin && len(in.Address) > 0 && len(in.Address) <= 320\n\tcase *operator.SeedInput:\n\t\treturn in.Generation == s.Generation && s.Generation != \"\"\n\tcase *operator.ProvisionInput:\n\t\treturn in.Generation == s.Generation && s.Generation != \"\"\n\t}\n\treturn false\n}\nfunc prepareRequest(ctx context.Context, statePath, floorPath string, password, plan []byte, output *requestOutput) (PreparationInfo, error) {\n\tp, input, e := decodeOperationPlan(plan)\n\tif e != nil || output == nil {\n\t\treturn PreparationInfo{}, ErrRefused\n\t}\n\tj, e := existingJournal(statePath, floorPath, password)\n\tif e != nil {\n\t\treturn PreparationInfo{}, e\n\t}\n\tdefer closeExisting(j)" |
| 442 | }, |
| 443 | { |
| 444 | "id": "S18", |
| 445 | "file": "cmd/home/main.go", |
| 446 | "absolute_path": "/home/paulca/amadan.net/oficina/home/.claude/worktrees/overnight-provisioner-prepare/cmd/home/main.go", |
| 447 | "sha256": "a414edf4e33e2be0293aeec50e5973bff7ad8978f0188b1c589547ab56522701", |
| 448 | "line": 52, |
| 449 | "end_line": 119, |
| 450 | "excerpt": "func main() {\n\tlogger := slog.Default()\n\n\t// DBPath is set here, not required as a flag \u2014 see the package\n\t// comment. Relative, so Resolve joins it to $STATE_DIRECTORY.\n\topts, err := rastrillo.Resolve(rastrillo.Options{Logger: logger, DBPath: \"home.db\"})\n\tif err != nil {\n\t\tlogger.Error(\"resolve\", \"err\", err)\n\t\tos.Exit(1)\n\t}\n\n\t// Every secret and setting whose absence is silent is validated\n\t// before anything serves. Each refusal here is a case where\n\t// continuing would produce an app that answers /healthz perfectly\n\t// well and is broken or leaking: no DEK and addresses persist in the\n\t// clear, no pepper and every person row is orphaned, no SMTP host\n\t// and magic links are written to platform-held logs instead of\n\t// emailed. The database path cannot be empty on this path \u2014 it is\n\t// set below \u2014 but LoadSecrets checks it anyway, for the caller that\n\t// builds its own Options.\n\truntime, err := home.LoadRuntime(opts.DBPath, logger)\n\tif err != nil {\n\t\tlogger.Error(\"config\", \"err\", err)\n\t\tos.Exit(1)\n\t}\n\n\t// Before db.Open, never after: Open calls Ping, which opens the\n\t// writer pool's single long-lived connection there and then, and a\n\t// hook registered afterwards misses it forever. That connection is\n\t// the only one that performs DELETEs.\n\thome.RegisterSecureDelete()\n\n\td, err := rdb.Open(opts.DBPath, logger)\n\tif err != nil {\n\t\tlogger.Error(\"open db\", \"err\", err)\n\t\tos.Exit(1)\n\t}\n\tdefer d.Close()\n\n\t// Ledgered, once at boot, forward-only. A boot that cannot reconcile\n\t// its schema refuses rather than guessing, same as a failed open.\n\tif _, err := migrate.Apply(context.Background(), d, runtime.Schema()); err != nil {\n\t\tlogger.Error(\"migrate\", \"err\", err)\n\t\tos.Exit(1)\n\t}\n\n\tapp, err := home.NewRuntime(runtime, d, logger)\n\tif err != nil {\n\t\tlogger.Error(\"wire app\", \"err\", err)\n\t\tos.Exit(1)\n\t}\n\n\t// rastrillo.Options.Mux wants a *http.ServeMux; the app's own\n\t// router is a chi.Router (an http.Handler), so it mounts under one.\n\tmux := http.NewServeMux()\n\tmux.Handle(\"/\", app.Router())\n\topts.Mux = mux\n\topts.CSP = app.SecurityPolicy()\n\n\t// Blanked because this file opened the handle itself: Serve would\n\t// otherwise open a second one against the same file.\n\topts.DBPath = \"\"\n\n\tif err := rastrillo.Serve(opts); err != nil {\n\t\tlogger.Error(\"serve\", \"err\", err)\n\t\tos.Exit(1)\n\t}\n}" |
| 451 | }, |
| 452 | { |
| 453 | "id": "P1", |
| 454 | "absolute_path": "/home/paulca/amadan.net/carlos/platform/.claude/worktrees/overnight-always-awake-design/implementation/maintenance-exec.md", |
| 455 | "line": 55, |
| 456 | "end_line": 57, |
| 457 | "excerpt": "Resume is a separately approved operation, not `clear maintenance`. It names an expected serving release/artifact, configuration/key binding and successful app-specific compatibility-check command from that release. Platform verifies all pins under the fence/lease, runs the non-serving checker against the existing DB, verifies integrity/checkpoint and records its result. The app checker owns format/key/authorization compatibility; platform cannot infer it from exit of an earlier migration or a byte-compatible old binary. Docs TeamMode's minimum authorization-aware release floor is one such consumer requirement.\n\nOnly after the checker succeeds may the worker publish resume-ready evidence, install the pinned serving release/config and arrange the lease-to-serving replication handoff. Clear the fence through one guarded transition bound to this evidence; old/new worker races cannot resurrect a superseded resume. Admit HTTP only after the exact new process and replication are healthy and report the approved version; retain a durable resumed receipt. If process startup/replication/version verification fails, return to fenced/failed, not ready. The implementation must decide and test the precise lease handoff before code approval; simply releasing and hoping the next wake uses the approved pins is insufficient.", |
| 458 | "sha256": "82912e12d845b42179507362951a7b17ccf04632b9c59537e0f6b78246152335" |
| 459 | } |
| 460 | ] |
| 461 | } |
| 462 | |
amadan