feat(controller): observe the bounded Linux execution substrate

server-tools/bingshuo-tcs-controller/execution-observer.test.mjs

@@ -0,0 +1,89 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import {
+  ExecutionObserver,
+  REQUIRED_PROTOCOL_CHAIN,
+} from "./execution-observer.mjs";
+
+test("observes allowlisted Linux services through typed read-only requests", async () => {
+  const stateRoot = fs.mkdtempSync(
+    path.join(os.tmpdir(), "guanghu-execution-observer-"),
+  );
+  const calls = [];
+  const observer = new ExecutionObserver({
+    binaryPath: "/opt/guanghu/execution-bridge/current/guanghu-execution-bridge",
+    policyPath: "/opt/guanghu/execution-bridge/current/policy.json",
+    stateRoot,
+    services: ["guanghu-ai-discovery.service", "lake-lamp-authz.service"],
+    execute: async (program, argv) => {
+      const request = JSON.parse(
+        fs.readFileSync(argv[1], "utf8"),
+      );
+      calls.push({ program, argv, request });
+      return {
+        stdout: JSON.stringify({
+          schema: "guanghu.execution-receipt/v1",
+          request_id: request.request_id,
+          subject_id: request.subject_id,
+          target_node_id: request.target_node_id,
+          policy_id: "JD-FD-PRIMARY-READONLY-20260807",
+          action: request.action,
+          adapter: "LINUX_SYSTEMD_V1",
+          accepted: true,
+          command_exit_code: 0,
+          target_state_verified: true,
+          final_state: "PASS_100",
+          stdout: "active",
+          stderr: "",
+          rollback_checkpoint_id: null,
+        }),
+        stderr: "",
+      };
+    },
+  });
+
+  const projection = await observer.observe();
+  assert.equal(projection.state, "PASS_100");
+  assert.equal(projection.bridge_bound, 100);
+  assert.equal(projection.target_state_verified, 100);
+  assert.equal(projection.restart_allowed, false);
+  assert.equal(projection.arbitrary_shell, false);
+  assert.equal(calls.length, 2);
+  assert.equal(calls[0].argv[0], "execute");
+  assert.deepEqual(calls[0].request.protocol_chain, REQUIRED_PROTOCOL_CHAIN);
+  assert.equal(calls[0].request.action.kind, "service_status");
+  assert.equal(calls[0].request.authorization, null);
+  assert.equal(calls[0].request.rollback, null);
+});
+
+test("fails closed when the native receipt does not match the requested service", async () => {
+  const stateRoot = fs.mkdtempSync(
+    path.join(os.tmpdir(), "guanghu-execution-observer-"),
+  );
+  const observer = new ExecutionObserver({
+    binaryPath: "/bridge",
+    policyPath: "/policy",
+    stateRoot,
+    services: ["guanghu-ai-discovery.service"],
+    execute: async () => ({
+      stdout: JSON.stringify({
+        schema: "guanghu.execution-receipt/v1",
+        target_node_id: "JD-FD-PRIMARY",
+        action: {
+          kind: "service_status",
+          resource: "different.service",
+        },
+        adapter: "LINUX_SYSTEMD_V1",
+      }),
+      stderr: "",
+    }),
+  });
+
+  await assert.rejects(
+    () => observer.observe(),
+    /execution_receipt_contract_mismatch/,
+  );
+});