Check execution workspace candidates with pinned artifact builders

2026-09-21 01:09:31 -07:00
parent 7652b4c0b9
commit f69c81f607
4 changed files with 91 additions and 18 deletions
@@ -0,0 +1,28 @@
+// Validate compiler-owned plans and immutable artifact receipts before publishing check outputs.
+import { readFile, writeFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { pathToFileURL } from "node:url";
+import { join } from "node:path";
+const [compilerPath, planPath, checksPath, output] = process.argv.slice(2);
+const compiler = await import(pathToFileURL(compilerPath));
+const plan = JSON.parse(await readFile(planPath, "utf8"));
+const checks = JSON.parse(await readFile(checksPath, "utf8"));
+const roots = Object.create(null);
+for (const check of checks) {
+  if (Object.hasOwn(roots, check.packageRevisionId)) throw Error("Duplicate checked package revision");
+  roots[check.packageRevisionId] = check.artifactPath;
+}
+const checked = await compiler.loadCheckedArtifactWorld(
+  plan,
+  roots,
+  createHash("sha256")
+    .update(await readFile(compilerPath))
+    .digest("hex"),
+);
+for (const [file, value] of [
+  ["execution-world.json", checked.world],
+  ["kernel.json", compiler.compileKernelProgram(plan)],
+  ["queries.json", compiler.compileQueryProgram(plan)],
+  ["execution-artifacts.json", { codec: "camino-checked-execution-v1", roots, manifests: checked.manifests }],
+])
+  await writeFile(join(output, file), JSON.stringify(value) + "\n");