feat: P2 operator, preprocessing state/service, and runtime config lease
This commit is contained in:
@@ -0,0 +1,239 @@
|
||||
import { execFile } from "node:child_process";
|
||||
import {
|
||||
chmodSync,
|
||||
existsSync,
|
||||
mkdtempSync,
|
||||
mkdirSync,
|
||||
readFileSync,
|
||||
rmSync,
|
||||
statSync,
|
||||
symlinkSync,
|
||||
writeFileSync,
|
||||
} from "node:fs";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join } from "node:path";
|
||||
import { promisify } from "node:util";
|
||||
import { afterEach, expect, test, vi } from "vitest";
|
||||
import { WorkspaceRegistry } from "../src/workspaces/registry.js";
|
||||
import type { WorkspaceRegistryConfig } from "../src/workspaces/types.js";
|
||||
import {
|
||||
publishDeterministicRuntimeConfigLease,
|
||||
renderActiveWorkspaceRuntime,
|
||||
renderWorkspaceRuntimeFromSnapshotPath,
|
||||
} from "../src/workspaces/runtime-config-lease.js";
|
||||
|
||||
const runFile = promisify(execFile);
|
||||
const roots: string[] = [];
|
||||
|
||||
afterEach(() => {
|
||||
vi.unstubAllEnvs();
|
||||
roots.splice(0).forEach((root) => rmSync(root, { recursive: true, force: true }));
|
||||
});
|
||||
|
||||
async function git(cwd: string, args: string[]): Promise<string> {
|
||||
return (await runFile("git", args, { cwd })).stdout.trim();
|
||||
}
|
||||
|
||||
async function fixture() {
|
||||
const root = mkdtempSync(join(tmpdir(), "tht-runtime-lease-"));
|
||||
roots.push(root);
|
||||
const remote = join(root, "remote.git");
|
||||
const source = join(root, "source");
|
||||
const registryRoot = join(root, "registry");
|
||||
const secretRoot = join(root, "secrets");
|
||||
const dataRoot = join(root, "data");
|
||||
const harnessDir = join(root, "harness");
|
||||
mkdirSync(harnessDir, { recursive: true });
|
||||
mkdirSync(join(harnessDir, "config"), { recursive: true });
|
||||
writeFileSync(join(harnessDir, "config", "tht.yaml"), `session_storage:
|
||||
mode: local
|
||||
profile: server
|
||||
`);
|
||||
|
||||
await git(root, ["init", "--bare", "--initial-branch=main", remote]);
|
||||
mkdirSync(source);
|
||||
await git(source, ["init", "--initial-branch=main"]);
|
||||
await git(source, ["config", "user.name", "Runtime Lease Test"]);
|
||||
await git(source, ["config", "user.email", "runtime-lease@example.invalid"]);
|
||||
writeFileSync(join(source, "thoth-workspaces.yaml"), `schema_version: 1
|
||||
workspaces: [{id: psd-clinical, name: Runtime Lease}]
|
||||
`);
|
||||
mkdirSync(join(source, "psd-clinical", "evidence"), { recursive: true });
|
||||
writeFileSync(join(source, "psd-clinical", "workspace.yaml"), `workspace:
|
||||
schema_version: 3
|
||||
id: psd-clinical
|
||||
name: Runtime Lease
|
||||
language: en
|
||||
dwh:
|
||||
engine: postgres
|
||||
database: analytics
|
||||
schema: mart
|
||||
supported_transports: [postgres_direct]
|
||||
semantic_index:
|
||||
vector_store:
|
||||
engine: qdrant
|
||||
collection: psd-clinical
|
||||
dimensions: 1024
|
||||
distance: cosine
|
||||
embedding:
|
||||
provider: ollama_internal
|
||||
model: qwen3-embedding:0.6b
|
||||
dimensions: 1024
|
||||
llm_policy:
|
||||
allowed: [zai/glm-5.2]
|
||||
evidence:
|
||||
source:
|
||||
type: filesystem
|
||||
uri: psd-clinical/evidence
|
||||
`);
|
||||
writeFileSync(join(source, "psd-clinical", "evidence", "guide.md"), `# hello
|
||||
`);
|
||||
await git(source, ["add", "."]);
|
||||
await git(source, ["commit", "-m", "Canonical workspace"]);
|
||||
await git(source, ["remote", "add", "origin", remote]);
|
||||
await git(source, ["push", "origin", "main"]);
|
||||
|
||||
mkdirSync(secretRoot);
|
||||
const passwordFile = join(secretRoot, "dwh-password");
|
||||
writeFileSync(passwordFile, "secret", { mode: 0o600 });
|
||||
chmodSync(passwordFile, 0o600);
|
||||
mkdirSync(dataRoot);
|
||||
|
||||
const registryConfig: WorkspaceRegistryConfig = {
|
||||
root: registryRoot,
|
||||
remoteUrl: remote,
|
||||
branch: "main",
|
||||
gitAuthorName: "Runtime Lease Test",
|
||||
gitAuthorEmail: "runtime-lease@example.invalid",
|
||||
installationId: "test",
|
||||
secretRoots: [secretRoot],
|
||||
maxImportBytes: 1024 * 1024,
|
||||
maxImportEntries: 16,
|
||||
};
|
||||
const registry = new WorkspaceRegistry(registryConfig);
|
||||
await registry.bootstrap();
|
||||
const revision = (await registry.list())[0];
|
||||
|
||||
vi.stubEnv("THT_WS_PSD_CLINICAL_DWH_TRANSPORT", "postgres_direct");
|
||||
vi.stubEnv("THT_WS_PSD_CLINICAL_DWH_HOST", "warehouse.internal");
|
||||
vi.stubEnv("THT_WS_PSD_CLINICAL_DWH_PORT", "5432");
|
||||
vi.stubEnv("THT_WS_PSD_CLINICAL_DWH_USER", "reader");
|
||||
vi.stubEnv("THT_WS_PSD_CLINICAL_DWH_PASSWORD_FILE", passwordFile);
|
||||
|
||||
return {
|
||||
dataRoot,
|
||||
harnessDir,
|
||||
registry,
|
||||
registryConfig,
|
||||
revision,
|
||||
};
|
||||
}
|
||||
|
||||
const semanticRuntime = {
|
||||
internalQdrantUrl: "http://qdrant:6333",
|
||||
internalEmbeddingUrl: "http://embedding:11434",
|
||||
internalEmbeddingModel: "qwen3-embedding:0.6b",
|
||||
internalEmbeddingDimensions: 1024,
|
||||
};
|
||||
|
||||
test("active workspace rendering is byte-identical to direct snapshot rendering", async () => {
|
||||
const f = await fixture();
|
||||
const direct = renderWorkspaceRuntimeFromSnapshotPath({
|
||||
snapshotPath: f.revision.snapshotPath,
|
||||
harnessDir: f.harnessDir,
|
||||
configPath: "config/tht.yaml",
|
||||
dataRoot: f.dataRoot,
|
||||
secretRoots: f.registryConfig.secretRoots,
|
||||
semanticRuntime,
|
||||
});
|
||||
const active = await renderActiveWorkspaceRuntime({
|
||||
workspaceId: "psd-clinical",
|
||||
registry: f.registry,
|
||||
registryConfig: f.registryConfig,
|
||||
harnessDir: f.harnessDir,
|
||||
configPath: "config/tht.yaml",
|
||||
dataRoot: f.dataRoot,
|
||||
secretRoots: f.registryConfig.secretRoots,
|
||||
semanticRuntime,
|
||||
});
|
||||
|
||||
expect(active.renderedConfig).toBe(direct.renderedConfig);
|
||||
expect(active.workspaceRevision).toBe(f.revision.commit);
|
||||
expect(active.descriptorBlob).toBe(f.revision.blob);
|
||||
expect(active.catalogBlob).toMatch(/^[0-9a-f]{40}$/);
|
||||
});
|
||||
|
||||
test("deterministic operator leases publish one revision-bound protected config and refuse changed same-revision bytes", async () => {
|
||||
const f = await fixture();
|
||||
const first = await publishDeterministicRuntimeConfigLease({
|
||||
workspaceId: "psd-clinical",
|
||||
registry: f.registry,
|
||||
registryConfig: f.registryConfig,
|
||||
harnessDir: f.harnessDir,
|
||||
configPath: "config/tht.yaml",
|
||||
dataRoot: f.dataRoot,
|
||||
secretRoots: f.registryConfig.secretRoots,
|
||||
semanticRuntime,
|
||||
});
|
||||
const second = await publishDeterministicRuntimeConfigLease({
|
||||
workspaceId: "psd-clinical",
|
||||
registry: f.registry,
|
||||
registryConfig: f.registryConfig,
|
||||
harnessDir: f.harnessDir,
|
||||
configPath: "config/tht.yaml",
|
||||
dataRoot: f.dataRoot,
|
||||
secretRoots: f.registryConfig.secretRoots,
|
||||
semanticRuntime,
|
||||
});
|
||||
|
||||
expect(second.path).toBe(first.path);
|
||||
expect(first.path).toBe(join(
|
||||
f.dataRoot,
|
||||
"sessions",
|
||||
"psd-clinical",
|
||||
"preprocessing",
|
||||
"runtime-config",
|
||||
`${f.revision.commit}.yaml`,
|
||||
));
|
||||
expect(statSync(first.path).mode & 0o777).toBe(0o400);
|
||||
expect(statSync(first.manifestPath).mode & 0o777).toBe(0o600);
|
||||
expect(readFileSync(first.path, "utf8")).toContain("collection_lifecycle: require_existing");
|
||||
expect(existsSync(first.manifestPath)).toBe(true);
|
||||
|
||||
vi.stubEnv("THT_WS_PSD_CLINICAL_DWH_HOST", "warehouse-two.internal");
|
||||
await expect(publishDeterministicRuntimeConfigLease({
|
||||
workspaceId: "psd-clinical",
|
||||
registry: f.registry,
|
||||
registryConfig: f.registryConfig,
|
||||
harnessDir: f.harnessDir,
|
||||
configPath: "config/tht.yaml",
|
||||
dataRoot: f.dataRoot,
|
||||
secretRoots: f.registryConfig.secretRoots,
|
||||
semanticRuntime,
|
||||
})).rejects.toMatchObject({ code: "effective_config_mismatch" });
|
||||
});
|
||||
|
||||
test("runtime rendering rejects untrusted snapshot paths and symlinks", async () => {
|
||||
const f = await fixture();
|
||||
const outside = join(f.dataRoot, "outside.yaml");
|
||||
writeFileSync(outside, readFileSync(f.revision.snapshotPath, "utf8"));
|
||||
const symlink = join(f.dataRoot, "alias.yaml");
|
||||
symlinkSync(f.revision.snapshotPath, symlink);
|
||||
|
||||
expect(() => renderWorkspaceRuntimeFromSnapshotPath({
|
||||
snapshotPath: outside,
|
||||
harnessDir: f.harnessDir,
|
||||
configPath: "config/tht.yaml",
|
||||
dataRoot: f.dataRoot,
|
||||
secretRoots: f.registryConfig.secretRoots,
|
||||
semanticRuntime,
|
||||
})).toThrow(/trusted runtime snapshot/i);
|
||||
expect(() => renderWorkspaceRuntimeFromSnapshotPath({
|
||||
snapshotPath: symlink,
|
||||
harnessDir: f.harnessDir,
|
||||
configPath: "config/tht.yaml",
|
||||
dataRoot: f.dataRoot,
|
||||
secretRoots: f.registryConfig.secretRoots,
|
||||
semanticRuntime,
|
||||
})).toThrow(/trusted runtime snapshot/i);
|
||||
});
|
||||
Reference in New Issue
Block a user