test(ql3): accept local cancellation live gate

2026-09-22 19:29:13 +08:00 · 2026-08-12 20:22:41 +08:00
parent d85cd88c2d
commit bd0621c9f2
12 changed files with 1311 additions and 22 deletions
@@ -0,0 +1,164 @@
+#!/usr/bin/env node
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const PROFILES = new Set(['edge', 'standalone']);
+
+function exactKeys(value, expected) {
+  return (
+    value !== null &&
+    typeof value === 'object' &&
+    !Array.isArray(value) &&
+    JSON.stringify(Object.keys(value).sort()) ===
+      JSON.stringify([...expected].sort())
+  );
+}
+
+function validateLocalApiCancellationLiveReport(value) {
+  const findings = [];
+  const record = exactKeys(value, [
+    'artifact',
+    'compatible',
+    'observations',
+    'platform',
+    'profile',
+    'qualification',
+    'resourceEnvelope',
+    'schemaVersion',
+  ]);
+  if (!record || value.schemaVersion !== 1 || !PROFILES.has(value.profile)) {
+    return Object.freeze({
+      compatible: false,
+      findings: ['report identity is invalid'],
+    });
+  }
+  const expectedMemory =
+    value.profile === 'edge' ? 128 * 1024 * 1024 : 256 * 1024 * 1024;
+  const expectedPids = value.profile === 'edge' ? 64 : 256;
+  if (
+    !exactKeys(value.platform, ['architecture', 'os', 'procfs']) ||
+    value.platform?.os !== 'linux' ||
+    !['arm64', 'x64'].includes(value.platform?.architecture) ||
+    value.platform?.procfs !== true
+  )
+    findings.push('Linux /proc platform observation is invalid');
+  if (
+    !exactKeys(value.resourceEnvelope, [
+      'apiRssBytes',
+      'memoryBytes',
+      'pids',
+    ]) ||
+    value.resourceEnvelope?.memoryBytes !== expectedMemory ||
+    value.resourceEnvelope?.pids !== expectedPids ||
+    !Number.isSafeInteger(value.resourceEnvelope?.apiRssBytes) ||
+    value.resourceEnvelope.apiRssBytes < 1 ||
+    value.resourceEnvelope.apiRssBytes > expectedMemory
+  )
+    findings.push('resource envelope is invalid');
+  if (
+    !exactKeys(value.artifact, [
+      'bytes',
+      'compatible',
+      'files',
+      'loadedModules',
+      'profile',
+    ]) ||
+    value.artifact?.profile !== `${value.profile}-application-api` ||
+    !Number.isSafeInteger(value.artifact?.bytes) ||
+    value.artifact.bytes < 1 ||
+    value.artifact.bytes > 6 * 1024 * 1024 ||
+    !Number.isSafeInteger(value.artifact?.files) ||
+    value.artifact.files < 1 ||
+    value.artifact.files > 640 ||
+    !Number.isSafeInteger(value.artifact?.loadedModules) ||
+    value.artifact.loadedModules < 1 ||
+    value.artifact.loadedModules > 256 ||
+    value.artifact.compatible !== true
+  )
+    findings.push('optional API artifact evidence is invalid');
+  const observed = value.observations;
+  if (
+    !exactKeys(observed, [
+      'cancellationAccepted',
+      'durableAllowedAudits',
+      'durableCancellationEvents',
+      'durableIntentEvents',
+      'exactReplay',
+      'processIdentityGone',
+      'processIdentityObserved',
+      'restartObservedCancelled',
+      'sqliteIntegrity',
+      'taskStartAccepted',
+    ]) ||
+    observed?.taskStartAccepted !== true ||
+    observed?.cancellationAccepted !== true ||
+    observed?.exactReplay !== true ||
+    observed?.durableIntentEvents !== 1 ||
+    observed?.durableCancellationEvents !== 1 ||
+    observed?.durableAllowedAudits !== 2 ||
+    observed?.processIdentityObserved !== true ||
+    observed?.processIdentityGone !== true ||
+    observed?.restartObservedCancelled !== true ||
+    observed?.sqliteIntegrity !== 'ok'
+  )
+    findings.push('API to durable process-stop observations are incomplete');
+  if (
+    !exactKeys(value.qualification, [
+      'evidenceClass',
+      'passed',
+      'physicalDevice',
+    ]) ||
+    value.qualification?.evidenceClass !== 'linux_virtualized_live_contract' ||
+    value.qualification?.physicalDevice !== false ||
+    value.qualification?.passed !== true
+  )
+    findings.push('qualification boundary is invalid');
+  if (value.compatible !== true) findings.push('report is not compatible');
+  return Object.freeze({
+    compatible: findings.length === 0,
+    findings: Object.freeze(findings),
+  });
+}
+
+function reportPath(argv) {
+  if (
+    argv.length !== 1 ||
+    !argv[0].startsWith('--report=') ||
+    !path.isAbsolute(argv[0].slice('--report='.length))
+  )
+    throw new Error(
+      'usage: ql3-local-api-cancellation-live-audit --report=/absolute/private-report.json',
+    );
+  return argv[0].slice('--report='.length);
+}
+
+if (require.main === module) {
+  try {
+    const filePath = reportPath(process.argv.slice(2));
+    const stat = fs.lstatSync(filePath);
+    if (
+      !stat.isFile() ||
+      stat.isSymbolicLink() ||
+      (typeof process.getuid === 'function' && stat.uid !== process.getuid()) ||
+      (stat.mode & 0o077) !== 0 ||
+      stat.size > 32 * 1024
+    ) {
+      throw new Error('report must be a private bounded regular file');
+    }
+    const audit = validateLocalApiCancellationLiveReport(
+      JSON.parse(fs.readFileSync(filePath, 'utf8')),
+    );
+    process.stdout.write(`${JSON.stringify(audit)}\n`);
+    if (!audit.compatible) process.exitCode = 1;
+  } catch (error) {
+    process.stderr.write(
+      `${error instanceof Error ? error.message : String(error)}\n`,
+    );
+    process.exitCode = 1;
+  }
+}
+
+module.exports = { validateLocalApiCancellationLiveReport };