Commit managed activation selections and reconcile forward (WI-05)

src/execution-world/candidate.ts

@@ -0,0 +1,107 @@
+import { open, lstat } from "node:fs/promises";
+import { constants } from "node:fs";
+import { join } from "node:path";
+import type { WorkspaceRevision } from "../capability-model/types.js";
+import { compileExecutionPlan, hexDigest, ExecutionPlanError } from "./plan.js";
+import { loadExecutionInstallation, type PackageInstallationSelection } from "./installation.js";
+import { compileKernelProgram } from "./kernel.js";
+import { compileQueryProgram } from "./queries.js";
+const rootPattern = /^\/nix\/store\/[a-z0-9]{32}-[^/\s]+$/;
+async function readJson(root: string, file: string): Promise<any> {
+  const handle = await open(join(root, file), constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const metadata = await handle.stat();
+    if (!metadata.isFile() || metadata.size > 32 * 1024 * 1024) throw Error(`Invalid checked candidate file: ${file}`);
+    return JSON.parse(await handle.readFile("utf8"));
+  } finally {
+    await handle.close();
+  }
+}
+/** Revalidate the normal checked-candidate output. This is the shared artifact
+ * loader, not a second managed-only executable manifest or an activation grant. */
+export async function loadCheckedInstallationCandidate(
+  root: string,
+  generator: string,
+  selections: Readonly<Record<string, PackageInstallationSelection>> = {},
+) {
+  if (!rootPattern.test(root) || !(await lstat(root)).isDirectory())
+    throw Error("Candidate must be an immutable Nix output directory");
+  const [candidate, recordedPlan, artifacts, source] = await Promise.all([
+    readJson(root, "candidate.json"),
+    readJson(root, "execution-plan.json"),
+    readJson(root, "execution-artifacts.json"),
+    readJson(root, "source.json"),
+  ]);
+  const { executionContracts: _legacyContracts, ...workspace } = candidate;
+  const plan = compileExecutionPlan(workspace as WorkspaceRevision);
+  if (hexDigest(plan) !== hexDigest(recordedPlan))
+    throw new ExecutionPlanError(
+      "CANDIDATE_PLAN_MISMATCH",
+      root,
+      "Recompiled source contract differs from the stored plan",
+    );
+  if (
+    source.kind !== "workspace" ||
+    source.commit !== plan.definition.workspace.sourceRootCommit ||
+    typeof source.repository !== "string"
+  )
+    throw new ExecutionPlanError("CANDIDATE_SOURCE_MISMATCH", root, "Expected exact workspace source provenance");
+  const repository = new URL(source.repository);
+  if (
+    !["https:", "ssh:"].includes(repository.protocol) ||
+    repository.username ||
+    repository.password ||
+    repository.hash ||
+    repository.search
+  )
+    throw new ExecutionPlanError("CANDIDATE_SOURCE_INVALID", root, "Expected a source URL without credentials");
+  if (
+    artifacts.codec !== "camino-checked-execution-v1" ||
+    !artifacts.roots ||
+    typeof artifacts.roots !== "object" ||
+    Array.isArray(artifacts.roots)
+  )
+    throw new ExecutionPlanError("CANDIDATE_ARTIFACTS_INVALID", root, "Expected checked package roots");
+  for (const entry of Object.values(artifacts.roots))
+    if (typeof entry !== "string" || !rootPattern.test(entry))
+      throw new ExecutionPlanError(
+        "CANDIDATE_ARTIFACTS_INVALID",
+        root,
+        "Package artifacts must be immutable Nix roots",
+      );
+  const installation = await loadExecutionInstallation(plan, artifacts.roots, generator, selections);
+  const kernel = compileKernelProgram(plan),
+    queries = compileQueryProgram(plan);
+  // The isolated runner and managed host consume the same compiled programs.
+  for (const [file, expected] of [
+    ["kernel.json", kernel],
+    ["queries.json", queries],
+  ] as const)
+    if (hexDigest(await readJson(root, file)) !== hexDigest(expected))
+      throw new ExecutionPlanError(
+        "CANDIDATE_PROGRAM_MISMATCH",
+        file,
+        "Stored interpreter input differs from checked compilation",
+      );
+  const provenance = {
+    workspaceRevision: workspace.id as string,
+    source: { repository: source.repository as string, commit: source.commit as string },
+    generator,
+    packages: plan.definition.packages.map((pkg) => ({ revision: pkg.revision, source: pkg.source })),
+  };
+  const reference = {
+    root,
+    digest: hexDigest({ plan: plan.digest, world: installation.world, provenance, roots: artifacts.roots }),
+  };
+  return {
+    reference,
+    workspace: plan.definition.workspace.workspaceId,
+    world: installation.world,
+    plan: plan.digest,
+    provenance,
+    kernel,
+    queries,
+    installation,
+    executionPlan: plan,
+  };
+}

src/execution-world/index.ts

@@ -14,3 +14,4 @@ export * from "./kernel.js";
 export * from "./projections.js";
 export * from "./queries.js";
 export { generatePortableClientBindings } from "../bindings/portable-client.js";
+export * from "./candidate.js";