feat(controller): observe the bounded Linux execution substrate

server-tools/bingshuo-tcs-controller/execution-observer.mjs

@@ -0,0 +1,127 @@
+import { execFile as execFileCallback } from "node:child_process";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+
+const execFile = promisify(execFileCallback);
+
+export const REQUIRED_PROTOCOL_CHAIN = Object.freeze([
+  "GLS-0301",
+  "GLS-0302",
+  "GLS-0303",
+  "GLS-0306",
+  "GLS-0309",
+  "GLS-0311",
+  "GLS-0130",
+  "GLS-0131",
+  "GLS-0709",
+  "GLS-0710",
+]);
+
+const DEFAULT_SERVICES = Object.freeze([
+  "guanghu-ai-discovery.service",
+  "bingshuo-tcs-living-controller.service",
+  "lake-lamp-authz.service",
+]);
+
+function safeId(value) {
+  return value.replace(/[^A-Za-z0-9_-]/g, "_");
+}
+
+function validateReceipt(receipt, service, targetNodeId) {
+  if (
+    receipt?.schema !== "guanghu.execution-receipt/v1" ||
+    receipt?.target_node_id !== targetNodeId ||
+    receipt?.action?.kind !== "service_status" ||
+    receipt?.action?.resource !== service ||
+    receipt?.adapter !== "LINUX_SYSTEMD_V1"
+  ) {
+    throw new Error(`execution_receipt_contract_mismatch:${service}`);
+  }
+  return receipt;
+}
+
+export class ExecutionObserver {
+  constructor({
+    binaryPath,
+    policyPath,
+    stateRoot,
+    execute = execFile,
+    targetNodeId = "JD-FD-PRIMARY",
+    subjectId = "ICE-P-ZY001",
+    services = DEFAULT_SERVICES,
+  }) {
+    this.binaryPath = binaryPath;
+    this.policyPath = policyPath;
+    this.stateRoot = stateRoot;
+    this.execute = execute;
+    this.targetNodeId = targetNodeId;
+    this.subjectId = subjectId;
+    this.services = [...services];
+  }
+
+  async observe() {
+    const observedAt = new Date().toISOString();
+    const requestRoot = path.join(this.stateRoot, "execution-observer");
+    await fs.mkdir(requestRoot, { recursive: true, mode: 0o700 });
+
+    const serviceReceipts = [];
+    for (const service of this.services) {
+      const requestId = `JD-COGNITIVE-OBSERVE-${safeId(service)}`;
+      const requestPath = path.join(requestRoot, `${requestId}.json`);
+      const request = {
+        schema: "guanghu.execution-request/v1",
+        request_id: requestId,
+        subject_id: this.subjectId,
+        target_node_id: this.targetNodeId,
+        protocol_chain: REQUIRED_PROTOCOL_CHAIN,
+        action: {
+          kind: "service_status",
+          resource: service,
+        },
+        authorization: null,
+        rollback: null,
+      };
+      await fs.writeFile(
+        requestPath,
+        `${JSON.stringify(request, null, 2)}\n`,
+        { mode: 0o600 },
+      );
+      const { stdout } = await this.execute(
+        this.binaryPath,
+        ["execute", requestPath, this.policyPath],
+        {
+          timeout: 5_000,
+          maxBuffer: 64 * 1024,
+          windowsHide: true,
+        },
+      );
+      serviceReceipts.push(
+        validateReceipt(JSON.parse(stdout), service, this.targetNodeId),
+      );
+    }
+
+    const ready = serviceReceipts.every(
+      (receipt) =>
+        receipt.accepted === true &&
+        receipt.target_state_verified === true &&
+        receipt.final_state === "PASS_100",
+    );
+    return {
+      schema: "guanghu.cognitive-execution-observation/v1",
+      target_node_id: this.targetNodeId,
+      subject_id: this.subjectId,
+      observed_at: observedAt,
+      mode: "READ_ONLY_STATUS",
+      language_authority: "REPO-012",
+      execution_implementation: "REPO-014",
+      linux_role: "COOPERATIVE_EXECUTION_SUBSTRATE",
+      arbitrary_shell: false,
+      restart_allowed: false,
+      bridge_bound: 100,
+      target_state_verified: ready ? 100 : 0,
+      state: ready ? "PASS_100" : "FAIL_0",
+      service_receipts: serviceReceipts,
+    };
+  }
+}