quixos-toolchain/quixos-protocol
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Load checked installations independently of the running compiler (WI-16)

Browse Source 
Keep compiler-dependent checks in Nix builds; load stored plans and programs with original provenance and runtime artifact validation. Allow an identical executable world to receive a new activation epoch after a toolchain rebuild.

Compiler-update/altered-program regression, coordinator and full sandboxed integration checks pass; lint and formatting pass. Default platform/source wiring remains the next task.
This commit is contained in:
Timothy J. Aveni
2026-09-21 22:01:47 -07:00
parent e5544dde21
commit 60b44a6637
5 changed files with 87 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/execution-world/candidate.ts
+38 -26
View File
@@ -1,11 +1,8 @@
import { open, lstat } from "node:fs/promises";
import { constants } from "node:fs";
import { join } from "node:path";
import type { WorkspaceRevision } from "../capability-model/types.js";
import { compileExecutionPlan, hexDigest, ExecutionPlanError, type ExecutionPlan } from "./plan.js";
import { hexDigest, ExecutionPlanError, type ExecutionPlan } from "./plan.js";
import { loadExecutionInstallation, type PackageInstallationSelection } from "./installation.js";
import { compileKernelProgram } from "./kernel.js";
import { compileQueryProgram } from "./queries.js";
const rootPattern = /^\/nix\/store\/[a-z0-9]{32}-[^/\s]+$/;
async function readJson(root: string, file: string): Promise<any> {
const handle = await open(join(root, file), constants.O_RDONLY | constants.O_NOFOLLOW);
@@ -17,29 +14,35 @@ async function readJson(root: string, file: string): Promise<any> {
await handle.close();
}
}
/** Revalidate the normal checked-candidate output. This is the shared artifact
* loader, not a second managed-only executable manifest or an activation grant. */
/** Load the checked Nix output, preserving its original compilation and provenance.
* The selected toolchain validates generated code during the build. This loader
* checks stored identities and artifact/runtime contracts, never recompiles the
* historical candidate with whichever compiler happens to run the host. */
export async function loadCheckedInstallationCandidate(
root: string,
generator: string,
selections: Readonly<Record<string, PackageInstallationSelection>> = {},
) {
if (!rootPattern.test(root) || !(await lstat(root)).isDirectory())
throw Error("Candidate must be an immutable Nix output directory");
const [candidate, recordedPlan, artifacts, source, entryRequest] = await Promise.all([
const [candidate, plan, artifacts, source, entryRequest, kernel, queries] = await Promise.all([
readJson(root, "candidate.json"),
readJson(root, "execution-plan.json"),
readJson(root, "execution-artifacts.json"),
readJson(root, "source.json"),
readJson(root, "entry.json"),
readJson(root, "kernel.json"),
readJson(root, "queries.json"),
]);
const { executionContracts: _legacyContracts, ...workspace } = candidate;
const plan = compileExecutionPlan(workspace as WorkspaceRevision);
if (hexDigest(plan) !== hexDigest(recordedPlan))
if (
plan?.definition?.codec !== "camino-execution-plan-v1" ||
hexDigest(plan.definition) !== plan.digest ||
hexDigest(workspace) !== hexDigest(plan.definition.workspace)
)
throw new ExecutionPlanError(
"CANDIDATE_PLAN_MISMATCH",
root,
"Recompiled source contract differs from the stored plan",
"Stored plan must match its digest and exact workspace source contract",
);
if (
source.kind !== "workspace" ||
@@ -57,7 +60,9 @@ export async function loadCheckedInstallationCandidate(
)
throw new ExecutionPlanError("CANDIDATE_SOURCE_INVALID", root, "Expected a source URL without credentials");
if (
artifacts.codec !== "camino-checked-execution-v1" ||
artifacts.codec !== "camino-checked-execution-v2" ||
typeof artifacts.generator !== "string" ||
!/^[0-9a-f]{64}$/.test(artifacts.generator) ||
!artifacts.roots ||
typeof artifacts.roots !== "object" ||
Array.isArray(artifacts.roots)
@@ -70,30 +75,37 @@ export async function loadCheckedInstallationCandidate(
root,
"Package artifacts must be immutable Nix roots",
);
const installation = await loadExecutionInstallation(plan, artifacts.roots, generator, selections);
const installation = await loadExecutionInstallation(plan, artifacts.roots, selections);
const entry = compileWorkspaceEntry(plan, entryRequest);
const kernel = compileKernelProgram(plan),
queries = compileQueryProgram(plan);
// The isolated runner and managed host consume the same compiled programs.
for (const [file, expected] of [
["kernel.json", kernel],
["queries.json", queries],
for (const [name, program, codec] of [
["kernel", kernel, "camino-kernel-program-v1"],
["queries", queries, "camino-query-program-v1"],
] as const)
if (hexDigest(await readJson(root, file)) !== hexDigest(expected))
if (program?.codec !== codec || program.plan !== plan.digest || hexDigest(program) !== artifacts.programs?.[name])
throw new ExecutionPlanError(
"CANDIDATE_PROGRAM_MISMATCH",
file,
"Stored interpreter input differs from checked compilation",
name,
"Stored interpreter input must match the checked build and plan",
);
const provenance = {
workspaceRevision: workspace.id as string,
source: { repository: source.repository as string, commit: source.commit as string },
generator,
packages: plan.definition.packages.map((pkg) => ({ revision: pkg.revision, source: pkg.source })),
generator: artifacts.generator as string,
packages: (plan as ExecutionPlan).definition.packages.map((pkg) => ({
revision: pkg.revision,
source: pkg.source,
})),
};
const reference = {
root,
digest: hexDigest({ plan: plan.digest, world: installation.world, provenance, roots: artifacts.roots, entry }),
digest: hexDigest({
plan: plan.digest,
world: installation.world,
provenance,
roots: artifacts.roots,
entry,
programs: artifacts.programs,
}),
};
return {
reference,
@@ -105,7 +117,7 @@ export async function loadCheckedInstallationCandidate(
kernel,
queries,
installation,
executionPlan: plan,
executionPlan: plan as ExecutionPlan,
};
}