kami/orchestra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

checkpoint: multi-repo Gitea ingestion, per-project repos, rotation anchor_sha fix

Browse Source 
Pre-existing uncommitted work found at session start: rotation now emits
anchor_sha on TaskReleased (previously silently dropped by store.Append
validation), multi-repo Gitea provider support, per-project git worktree
roots, and associated test coverage. Committing as a checkpoint before
starting remediation work tracked in AUDIT.md.
This commit is contained in:
kami
2026-07-27 18:15:02 +04:00
parent 325c684eb0
commit ce6f02f9e6
31 changed files with 2717 additions and 320 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/store/store.go
+16 -5
View File
@@ -5,6 +5,7 @@ import (
"encoding/json"
"errors"
"fmt"
"orchestra/internal/authz"
"orchestra/internal/domain"
"os"
"path/filepath"
@@ -45,6 +46,10 @@ func Open(dir string) (*Store, error) {
s.external[t.Source+"\x00"+t.ExternalID] = t.ID
}
snapshotSeq = snap.Seq
// Continue event numbering after the snapshot. Without restoring this
// cursor, the first append after a restart reused sequence 1 and made
// the append-only log unreplayable.
s.seq = snapshotSeq
} else if !errors.Is(readErr, os.ErrNotExist) {
return nil, readErr
}
@@ -160,9 +165,6 @@ func (s *Store) apply(e domain.Event) error {
func (s *Store) Append(e domain.Event) error {
s.mu.Lock()
defer s.mu.Unlock()
if err := domain.ValidateEvent(e); err != nil {
return err
}
if e.At.IsZero() {
e.At = time.Now().UTC()
}
@@ -172,6 +174,15 @@ func (s *Store) Append(e domain.Event) error {
if e.SchemaVersion == 0 {
e.SchemaVersion = domain.CurrentEventSchema
}
if err := domain.ValidateEvent(e); err != nil {
return err
}
// Enforced once, at the append boundary, per spec §7.1/invariant 4 — every
// producer (HTTP handler, router, coordinator, provider, federation relay)
// must declare its Surface here; there is no separate in-process bypass.
if err := authz.AuthorizeEvent(authz.Surface(e.Surface), e.Type); err != nil {
return err
}
if e.Type == "TaskCreated" {
var p map[string]any
if err := json.Unmarshal(e.Payload, &p); err != nil {
@@ -327,7 +338,7 @@ func (s *Store) Lease(id, harness string, ttl time.Duration) (domain.Event, erro
return domain.Event{}, domain.ErrConflict
}
p, _ := json.Marshal(map[string]any{"harness_id": harness, "ttl": ttl.Seconds(), "until_ns": time.Now().Add(ttl).UnixNano(), "expected_version": t.Version})
e := domain.Event{ID: id, Type: "TaskLeased", TaskID: id, Version: t.Version + 1, Payload: p}
e := domain.Event{ID: id, Type: "TaskLeased", TaskID: id, Version: t.Version + 1, Payload: p, Surface: string(authz.System)}
return e, s.Append(e)
}
@@ -336,7 +347,7 @@ func (s *Store) ExpireLeases(now time.Time) ([]domain.Event, error) {
for _, t := range s.Tasks() {
if t.State == domain.StateLeased && t.Lease != nil && !t.Lease.Until.After(now) {
p, _ := json.Marshal(map[string]any{"reason": "lease_expired", "harness_id": t.Lease.HarnessID})
e := domain.Event{ID: t.ID, Type: "TaskReleased", TaskID: t.ID, Version: t.Version + 1, Payload: p}
e := domain.Event{ID: t.ID, Type: "TaskReleased", TaskID: t.ID, Version: t.Version + 1, Payload: p, Surface: string(authz.System)}
if err := s.Append(e); err != nil {
return out, err
}
internal/store/store_test.go
+38 -5
View File
@@ -6,12 +6,13 @@ import (
"path/filepath"
"testing"
"orchestra/internal/authz"
"orchestra/internal/domain"
)
func created(id string) domain.Event {
b, _ := json.Marshal(map[string]any{"source": "jsonl", "external_id": "42", "project": "demo", "capability": []string{"mechanical"}})
return domain.Event{ID: id, Type: "TaskCreated", TaskID: "task-1", Version: 1, Payload: b}
return domain.Event{ID: id, Type: "TaskCreated", TaskID: "task-1", Version: 1, Payload: b, Surface: string(authz.System)}
}
func TestAppendReplayAndDeduplicate(t *testing.T) {
@@ -34,10 +35,10 @@ func TestAppendReplayAndDeduplicate(t *testing.T) {
t.Fatal(err)
}
completion, _ := json.Marshal(map[string]any{"report_ref": ref, "receipt": map[string]any{"harness_id": "h", "consumed": 1}})
if err := s.Append(domain.Event{Type: "TaskCompleted", TaskID: "task-1", Version: 2, Payload: completion}); err != nil {
if err := s.Append(domain.Event{Type: "TaskCompleted", TaskID: "task-1", Version: 2, Payload: completion, Surface: string(authz.System)}); err != nil {
t.Fatal(err)
}
if err := s.Append(domain.Event{Type: "TaskReleased", TaskID: "task-1", Version: 2, Payload: json.RawMessage(`{"handoff_ref":"` + ref + `","anchor_sha":"0123456789012345678901234567890123456789"}`)}); err != domain.ErrConflict {
if err := s.Append(domain.Event{Type: "TaskReleased", TaskID: "task-1", Version: 2, Surface: string(authz.System), Payload: json.RawMessage(`{"handoff_ref":"` + ref + `","anchor_sha":"0123456789012345678901234567890123456789"}`)}); err != domain.ErrConflict {
t.Fatalf("expected conflict, got %v", err)
}
s2, err := Open(dir)
@@ -85,7 +86,7 @@ func TestLifecycleEventsRequireEvidence(t *testing.T) {
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
err := domain.ValidateEvent(domain.Event{Type: tc.typ, TaskID: "task-1", Version: 1, Payload: json.RawMessage(tc.body)})
err := domain.ValidateEvent(domain.Event{Type: tc.typ, TaskID: "task-1", Version: 1, Payload: json.RawMessage(tc.body), Surface: string(authz.System)})
if err == nil {
t.Fatal("expected lifecycle evidence validation error")
}
@@ -93,6 +94,38 @@ func TestLifecycleEventsRequireEvidence(t *testing.T) {
}
}
// TestAppendEnforcesAuthorizationAtTheBus proves authorization is checked
// once at the append boundary (spec §7.1/§1.4), not only in HTTP handlers:
// a caller writing to the store directly with a notify-only surface, or with
// no declared surface at all, is rejected exactly like an HTTP request would
// be — there is no in-process bypass for the router, coordinator, or a
// provider adapter that forgets to declare who it's acting as.
func TestAppendEnforcesAuthorizationAtTheBus(t *testing.T) {
s, err := Open(t.TempDir())
if err != nil {
t.Fatal(err)
}
b, _ := json.Marshal(map[string]any{"source": "jsonl", "external_id": "1", "project": "demo"})
// A notify-only surface (e.g. Telegram) must never be able to create a
// task by calling the store directly, even though it bypasses HTTP.
if err := s.Append(domain.Event{ID: "e1", Type: "TaskCreated", TaskID: "task-1", Version: 1, Payload: b, Surface: string(authz.Telegram)}); err == nil {
t.Fatal("notify-only surface created a task via direct store access")
}
// An internal producer that forgets to declare a surface is rejected,
// not silently trusted as the plane.
if err := s.Append(domain.Event{ID: "e2", Type: "TaskCreated", TaskID: "task-1", Version: 1, Payload: b}); err == nil {
t.Fatal("event with no declared surface was accepted")
}
// The plane (router/coordinator/provider) authorizes as System and
// succeeds.
if err := s.Append(domain.Event{ID: "e3", Type: "TaskCreated", TaskID: "task-1", Version: 1, Payload: b, Surface: string(authz.System)}); err != nil {
t.Fatalf("system surface rejected: %v", err)
}
}
func TestExpectedVersionIsCheckedForEveryWriter(t *testing.T) {
s, err := Open(t.TempDir())
if err != nil {
@@ -102,7 +135,7 @@ func TestExpectedVersionIsCheckedForEveryWriter(t *testing.T) {
t.Fatal(err)
}
p := json.RawMessage(`{"reason":"rotate","expected_version":0}`)
err = s.Append(domain.Event{Type: "TaskReleased", TaskID: "task-1", Version: 2, Payload: p})
err = s.Append(domain.Event{Type: "TaskReleased", TaskID: "task-1", Version: 2, Payload: p, Surface: string(authz.System)})
if err != domain.ErrConflict {
t.Fatalf("expected CAS conflict, got %v", err)
}