mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-22 19:29:13 +08:00
feat(ql3): establish 3.0 incubation baseline
This commit is contained in:
whyour
@@ -0,0 +1,445 @@
|
||||
'use strict';
|
||||
|
||||
const assert = require('node:assert/strict');
|
||||
const { createHash } = require('node:crypto');
|
||||
const test = require('node:test');
|
||||
|
||||
const {
|
||||
BUILTIN_RUN_READ_TOOL,
|
||||
BUILTIN_RUN_READ_TOOL_DEFINITION,
|
||||
} = require('../dist/tool-execution/builtin-run-read/builtInRunReadTool');
|
||||
const {
|
||||
TRUSTED_TOOL_EXECUTION_RESULT_SCHEMA,
|
||||
} = require('../dist/tool-execution/trustedToolExecution');
|
||||
const {
|
||||
TOOL_EXECUTION_RESULT_KEY_BINDING_SCHEMA,
|
||||
createToolExecutionResultArtifact,
|
||||
normalizeToolExecutionResultKeyBinding,
|
||||
} = require('../dist/tool-execution/toolExecutionCompletion');
|
||||
const {
|
||||
createToolResultKeyCatalogBootstrapCommand,
|
||||
createToolResultKeyRotationCommand,
|
||||
normalizeToolResultKeyCatalogRecord,
|
||||
requireActiveToolResultKey,
|
||||
toolResultKeyCatalogFence,
|
||||
toolResultKeyMaterialProof,
|
||||
} = require('../dist/tool-execution/toolResultKeyCatalog');
|
||||
const {
|
||||
TOOL_EXECUTION_RESULT_REKEY_OVERLAY_SCHEMA,
|
||||
InvalidToolExecutionResultRekeyError,
|
||||
ToolResultKeyRetirementCoverageBuilder,
|
||||
ToolExecutionResultRekeyConflictError,
|
||||
ToolExecutionResultRekeyUnavailableError,
|
||||
createToolExecutionResultRekeyCommand,
|
||||
createToolResultKeyRetirementReceipt,
|
||||
createToolResultKeyRetirementReceiptCommand,
|
||||
normalizeToolExecutionResultRekeyCommand,
|
||||
normalizeToolResultKeyRetirementReceiptCommand,
|
||||
normalizeToolResultKeyRetirementReceipt,
|
||||
openToolExecutionResultRekeyOverlay,
|
||||
} = require('../dist/tool-execution/toolResultRekey');
|
||||
const {
|
||||
ToolDefinitionRegistry,
|
||||
} = require('../dist/tool-execution/tool-registry/toolRegistry');
|
||||
|
||||
const KEY_A = Buffer.alloc(32, 1);
|
||||
const KEY_B = Buffer.alloc(32, 2);
|
||||
const KEY_C = Buffer.alloc(32, 3);
|
||||
const OUTPUT_DIGEST_DOMAIN = Buffer.from(
|
||||
'qinglong/trusted-tool-execution-output-digest@v1\0',
|
||||
'utf8',
|
||||
);
|
||||
const RESULT_DIGEST_DOMAIN = Buffer.from(
|
||||
'qinglong/trusted-tool-execution-result-digest@v1\0',
|
||||
'utf8',
|
||||
);
|
||||
const BINDING_DIGEST_DOMAIN = Buffer.from(
|
||||
'qinglong/tool-execution-result-key-binding-digest@v1\0',
|
||||
'utf8',
|
||||
);
|
||||
|
||||
function hash(domain, value) {
|
||||
return createHash('sha256')
|
||||
.update(domain)
|
||||
.update(JSON.stringify(value))
|
||||
.digest('hex');
|
||||
}
|
||||
|
||||
function registry() {
|
||||
return new ToolDefinitionRegistry([BUILTIN_RUN_READ_TOOL_DEFINITION]);
|
||||
}
|
||||
|
||||
function output() {
|
||||
return {
|
||||
createdAtMs: 1_000,
|
||||
eventSequence: 3,
|
||||
executionOrigin: 'manual',
|
||||
executionOwner: 'runtime',
|
||||
found: true,
|
||||
id: 'run-rekey-001',
|
||||
priority: 10,
|
||||
queuedAtMs: 1_100,
|
||||
startedAtMs: 1_200,
|
||||
status: 'succeeded',
|
||||
taskId: 'task-rekey-001',
|
||||
taskRevision: 'task-rekey-001@1',
|
||||
version: 2,
|
||||
};
|
||||
}
|
||||
|
||||
function executionResult() {
|
||||
const value = output();
|
||||
const unsigned = Object.freeze({
|
||||
schema: TRUSTED_TOOL_EXECUTION_RESULT_SCHEMA,
|
||||
startId: 'tool-start-rekey-001',
|
||||
barrierDigest: 'a'.repeat(64),
|
||||
adapterDigest: 'b'.repeat(64),
|
||||
output: value,
|
||||
outputDigest: hash(OUTPUT_DIGEST_DOMAIN, value),
|
||||
completedAtMs: 1_500,
|
||||
});
|
||||
return Object.freeze({
|
||||
...unsigned,
|
||||
resultDigest: hash(RESULT_DIGEST_DOMAIN, unsigned),
|
||||
});
|
||||
}
|
||||
|
||||
function artifact() {
|
||||
return createToolExecutionResultArtifact(
|
||||
{
|
||||
artifactId: 'artifact-result-rekey-001',
|
||||
projectId: 'project-rekey-001',
|
||||
runId: 'run-host-rekey-001',
|
||||
stepRunId: 'step-run-rekey-001',
|
||||
tool: BUILTIN_RUN_READ_TOOL,
|
||||
executionResult: executionResult(),
|
||||
keyId: 'result-key-a',
|
||||
key: KEY_A,
|
||||
},
|
||||
registry(),
|
||||
() => Buffer.alloc(12, 4),
|
||||
);
|
||||
}
|
||||
|
||||
function binding(source) {
|
||||
const unsigned = Object.freeze({
|
||||
schema: TOOL_EXECUTION_RESULT_KEY_BINDING_SCHEMA,
|
||||
startId: source.startId,
|
||||
artifactId: source.artifactId,
|
||||
artifactDigest: source.artifactDigest,
|
||||
catalogGeneration: 1,
|
||||
catalogDigest: 'c'.repeat(64),
|
||||
keyId: source.keyId,
|
||||
materialProof: toolResultKeyMaterialProof(source.keyId, KEY_A),
|
||||
});
|
||||
return normalizeToolExecutionResultKeyBinding({
|
||||
...unsigned,
|
||||
bindingDigest: hash(BINDING_DIGEST_DOMAIN, unsigned),
|
||||
});
|
||||
}
|
||||
|
||||
function committed(command, committedAtMs) {
|
||||
return normalizeToolResultKeyCatalogRecord({
|
||||
...command.next,
|
||||
committedAtMs,
|
||||
});
|
||||
}
|
||||
|
||||
function targetCatalogs() {
|
||||
const first = committed(
|
||||
createToolResultKeyCatalogBootstrapCommand({
|
||||
keyId: 'result-key-b',
|
||||
materialProof: toolResultKeyMaterialProof('result-key-b', KEY_B),
|
||||
mutationId: 'result-key-bootstrap-b',
|
||||
}),
|
||||
1_600,
|
||||
);
|
||||
const second = committed(
|
||||
createToolResultKeyRotationCommand(first, {
|
||||
keyId: 'result-key-c',
|
||||
materialProof: toolResultKeyMaterialProof('result-key-c', KEY_C),
|
||||
mutationId: 'result-key-rotate-c',
|
||||
}),
|
||||
1_800,
|
||||
);
|
||||
return { first, second };
|
||||
}
|
||||
|
||||
test('creates an immutable rekey head without rewriting the source Artifact', () => {
|
||||
const source = artifact();
|
||||
const sourceJson = JSON.stringify(source);
|
||||
const sourceBinding = binding(source);
|
||||
const { first } = targetCatalogs();
|
||||
const command = createToolExecutionResultRekeyCommand({
|
||||
artifact: source,
|
||||
binding: sourceBinding,
|
||||
previousOverlay: null,
|
||||
overlayId: 'result-rekey-overlay-001',
|
||||
mutationId: 'result-rekey-mutation-001',
|
||||
targetCatalogFence: toolResultKeyCatalogFence(
|
||||
first,
|
||||
requireActiveToolResultKey(first),
|
||||
),
|
||||
targetKey: KEY_B,
|
||||
output: output(),
|
||||
rekeyedAtMs: 1_700,
|
||||
registry: registry(),
|
||||
nonceFactory: () => Buffer.alloc(12, 5),
|
||||
});
|
||||
|
||||
assert.equal(command.expectedRevision, 0);
|
||||
assert.equal(command.expectedOverlayDigest, null);
|
||||
assert.equal(
|
||||
command.overlay.schema,
|
||||
TOOL_EXECUTION_RESULT_REKEY_OVERLAY_SCHEMA,
|
||||
);
|
||||
assert.equal(command.overlay.revision, 1);
|
||||
assert.equal(command.overlay.fromKeyId, 'result-key-a');
|
||||
assert.equal(command.overlay.targetCatalogFence.keyId, 'result-key-b');
|
||||
assert.equal(
|
||||
JSON.stringify(command.overlay).includes('run-rekey-001'),
|
||||
false,
|
||||
);
|
||||
assert.equal(JSON.stringify(source), sourceJson);
|
||||
assert.deepEqual(
|
||||
openToolExecutionResultRekeyOverlay(
|
||||
command.overlay,
|
||||
KEY_B,
|
||||
registry(),
|
||||
source,
|
||||
),
|
||||
output(),
|
||||
);
|
||||
assert.throws(
|
||||
() =>
|
||||
openToolExecutionResultRekeyOverlay(
|
||||
command.overlay,
|
||||
KEY_C,
|
||||
registry(),
|
||||
source,
|
||||
),
|
||||
ToolExecutionResultRekeyUnavailableError,
|
||||
);
|
||||
});
|
||||
|
||||
test('chains rekey revisions with an exact head fence', () => {
|
||||
const source = artifact();
|
||||
const sourceBinding = binding(source);
|
||||
const { first, second } = targetCatalogs();
|
||||
const firstCommand = createToolExecutionResultRekeyCommand({
|
||||
artifact: source,
|
||||
binding: sourceBinding,
|
||||
previousOverlay: null,
|
||||
overlayId: 'result-rekey-overlay-001',
|
||||
mutationId: 'result-rekey-mutation-001',
|
||||
targetCatalogFence: toolResultKeyCatalogFence(
|
||||
first,
|
||||
requireActiveToolResultKey(first),
|
||||
),
|
||||
targetKey: KEY_B,
|
||||
output: output(),
|
||||
rekeyedAtMs: 1_700,
|
||||
registry: registry(),
|
||||
nonceFactory: () => Buffer.alloc(12, 5),
|
||||
});
|
||||
const secondCommand = createToolExecutionResultRekeyCommand({
|
||||
artifact: source,
|
||||
binding: sourceBinding,
|
||||
previousOverlay: firstCommand.overlay,
|
||||
overlayId: 'result-rekey-overlay-002',
|
||||
mutationId: 'result-rekey-mutation-002',
|
||||
targetCatalogFence: toolResultKeyCatalogFence(
|
||||
second,
|
||||
requireActiveToolResultKey(second),
|
||||
),
|
||||
targetKey: KEY_C,
|
||||
output: output(),
|
||||
rekeyedAtMs: 1_900,
|
||||
registry: registry(),
|
||||
nonceFactory: () => Buffer.alloc(12, 6),
|
||||
});
|
||||
|
||||
assert.equal(secondCommand.expectedRevision, 1);
|
||||
assert.equal(
|
||||
secondCommand.expectedOverlayDigest,
|
||||
firstCommand.overlay.overlayDigest,
|
||||
);
|
||||
assert.equal(secondCommand.overlay.revision, 2);
|
||||
assert.equal(secondCommand.overlay.fromKeyId, 'result-key-b');
|
||||
assert.deepEqual(
|
||||
openToolExecutionResultRekeyOverlay(
|
||||
secondCommand.overlay,
|
||||
KEY_C,
|
||||
registry(),
|
||||
source,
|
||||
),
|
||||
output(),
|
||||
);
|
||||
assert.throws(
|
||||
() =>
|
||||
normalizeToolExecutionResultRekeyCommand({
|
||||
...secondCommand,
|
||||
expectedRevision: 0,
|
||||
}),
|
||||
InvalidToolExecutionResultRekeyError,
|
||||
);
|
||||
assert.throws(
|
||||
() =>
|
||||
createToolExecutionResultRekeyCommand({
|
||||
artifact: { ...source, artifactId: 'artifact-result-rekey-other' },
|
||||
binding: sourceBinding,
|
||||
previousOverlay: firstCommand.overlay,
|
||||
overlayId: 'result-rekey-overlay-bad',
|
||||
mutationId: 'result-rekey-mutation-bad',
|
||||
targetCatalogFence: toolResultKeyCatalogFence(
|
||||
second,
|
||||
requireActiveToolResultKey(second),
|
||||
),
|
||||
targetKey: KEY_C,
|
||||
output: output(),
|
||||
rekeyedAtMs: 1_900,
|
||||
registry: registry(),
|
||||
}),
|
||||
TypeError,
|
||||
);
|
||||
assert.throws(
|
||||
() =>
|
||||
createToolExecutionResultRekeyCommand({
|
||||
artifact: source,
|
||||
binding: { ...sourceBinding, artifactId: 'artifact-result-other' },
|
||||
previousOverlay: firstCommand.overlay,
|
||||
overlayId: 'result-rekey-overlay-bad',
|
||||
mutationId: 'result-rekey-mutation-bad',
|
||||
targetCatalogFence: toolResultKeyCatalogFence(
|
||||
second,
|
||||
requireActiveToolResultKey(second),
|
||||
),
|
||||
targetKey: KEY_C,
|
||||
output: output(),
|
||||
rekeyedAtMs: 1_900,
|
||||
registry: registry(),
|
||||
}),
|
||||
TypeError,
|
||||
);
|
||||
});
|
||||
|
||||
test('binds retirement evidence to an exact catalog and zero uncovered heads', () => {
|
||||
const coverage = new ToolResultKeyRetirementCoverageBuilder({
|
||||
catalogGeneration: 2,
|
||||
catalogDigest: 'd'.repeat(64),
|
||||
keyId: 'result-key-a',
|
||||
decryptableKeyIds: ['result-key-b'],
|
||||
});
|
||||
coverage.add({
|
||||
artifactId: 'artifact-result-rekey-001',
|
||||
bindingDigest: 'f'.repeat(64),
|
||||
bindingKeyId: 'result-key-a',
|
||||
headOverlayDigest: '1'.repeat(64),
|
||||
headTargetKeyId: 'result-key-b',
|
||||
headTargetCatalogGeneration: 2,
|
||||
headTargetCatalogDigest: 'd'.repeat(64),
|
||||
});
|
||||
const coverageResult = coverage.finish();
|
||||
assert.deepEqual(
|
||||
{
|
||||
bindingCount: coverageResult.bindingCount,
|
||||
overlayHeadCount: coverageResult.overlayHeadCount,
|
||||
uncoveredBindingCount: coverageResult.uncoveredBindingCount,
|
||||
uncoveredOverlayHeadCount: coverageResult.uncoveredOverlayHeadCount,
|
||||
},
|
||||
{
|
||||
bindingCount: 1,
|
||||
overlayHeadCount: 1,
|
||||
uncoveredBindingCount: 0,
|
||||
uncoveredOverlayHeadCount: 0,
|
||||
},
|
||||
);
|
||||
const receipt = createToolResultKeyRetirementReceipt({
|
||||
catalogGeneration: 2,
|
||||
catalogDigest: 'd'.repeat(64),
|
||||
keyId: 'result-key-a',
|
||||
materialProof: toolResultKeyMaterialProof('result-key-a', KEY_A),
|
||||
mutationId: 'result-key-retirement-receipt-001',
|
||||
bindingCount: coverageResult.bindingCount,
|
||||
overlayHeadCount: coverageResult.overlayHeadCount,
|
||||
coverageDigest: coverageResult.coverageDigest,
|
||||
createdAtMs: 2_000,
|
||||
});
|
||||
|
||||
assert.equal(receipt.uncoveredBindingCount, 0);
|
||||
assert.equal(receipt.uncoveredOverlayHeadCount, 0);
|
||||
assert.throws(
|
||||
() =>
|
||||
normalizeToolResultKeyRetirementReceipt({
|
||||
...receipt,
|
||||
uncoveredBindingCount: 1,
|
||||
}),
|
||||
InvalidToolExecutionResultRekeyError,
|
||||
);
|
||||
|
||||
const command = createToolResultKeyRetirementReceiptCommand({
|
||||
expectedCatalogGeneration: 2,
|
||||
expectedCatalogDigest: 'd'.repeat(64),
|
||||
keyId: 'result-key-a',
|
||||
mutationId: 'result-key-retirement-receipt-001',
|
||||
});
|
||||
assert.throws(
|
||||
() =>
|
||||
normalizeToolResultKeyRetirementReceiptCommand({
|
||||
...command,
|
||||
expectedCatalogGeneration: 3,
|
||||
}),
|
||||
InvalidToolExecutionResultRekeyError,
|
||||
);
|
||||
});
|
||||
|
||||
test('retirement coverage rejects missing and self-key heads', () => {
|
||||
const missing = new ToolResultKeyRetirementCoverageBuilder({
|
||||
catalogGeneration: 2,
|
||||
catalogDigest: 'd'.repeat(64),
|
||||
keyId: 'result-key-a',
|
||||
decryptableKeyIds: ['result-key-b'],
|
||||
});
|
||||
missing.add({
|
||||
artifactId: 'artifact-result-rekey-001',
|
||||
bindingDigest: 'f'.repeat(64),
|
||||
bindingKeyId: 'result-key-a',
|
||||
headOverlayDigest: null,
|
||||
headTargetKeyId: null,
|
||||
headTargetCatalogGeneration: null,
|
||||
headTargetCatalogDigest: null,
|
||||
});
|
||||
assert.equal(missing.finish().uncoveredBindingCount, 1);
|
||||
|
||||
const self = new ToolResultKeyRetirementCoverageBuilder({
|
||||
catalogGeneration: 2,
|
||||
catalogDigest: 'd'.repeat(64),
|
||||
keyId: 'result-key-a',
|
||||
decryptableKeyIds: ['result-key-b'],
|
||||
});
|
||||
self.add({
|
||||
artifactId: 'artifact-result-rekey-002',
|
||||
bindingDigest: '2'.repeat(64),
|
||||
bindingKeyId: 'result-key-b',
|
||||
headOverlayDigest: '3'.repeat(64),
|
||||
headTargetKeyId: 'result-key-a',
|
||||
headTargetCatalogGeneration: 1,
|
||||
headTargetCatalogDigest: 'c'.repeat(64),
|
||||
});
|
||||
assert.equal(self.finish().uncoveredOverlayHeadCount, 1);
|
||||
});
|
||||
|
||||
test('exposes rekey only from its explicit subpath', () => {
|
||||
const root = require('../dist');
|
||||
const authority = require('@qinglong/runtime-core/tool-result-rekey');
|
||||
|
||||
assert.equal(root.createToolExecutionResultRekeyCommand, undefined);
|
||||
assert.equal(
|
||||
authority.createToolExecutionResultRekeyCommand,
|
||||
createToolExecutionResultRekeyCommand,
|
||||
);
|
||||
assert.equal(
|
||||
authority.ToolExecutionResultRekeyConflictError,
|
||||
ToolExecutionResultRekeyConflictError,
|
||||
);
|
||||
});
|
||||
Reference in New Issue
Block a user