test: trust runtime storage policy only

Author: vitry

tests/codex-rescue-qualification.test.mjs

@@ -188,20 +188,16 @@ test('qualifies distinct canonical linked worktree execution while hooks remain
   await mkdir(windowsDirectories.at(-1), { recursive: true });
   await mkdir(windowsDirectories[2], { recursive: true });
   await Promise.all(windowsDirectories.map((path) => chmod(path, 0o755)));
-  const windowsInput = workspaceBoundContinuationFixture(originWorkspace, executionWorkspace); windowsInput.installedDataRoot = windowsDataRoot;
-  for (const bytes of JSON.parse(windowsInput.jobRecordBytesJson)) {
+  const installedInput = workspaceBoundContinuationFixture(originWorkspace, executionWorkspace); installedInput.installedDataRoot = windowsDataRoot;
+  for (const bytes of JSON.parse(installedInput.jobRecordBytesJson)) {
     const job = JSON.parse(bytes); await writeFile(join(windowsDirectories.at(-1), `${job.id}.json`), bytes);
   }
   const snapshotStorage = async () => Promise.all(windowsDirectories.map(async (path) => {
     const metadata = await stat(path); return { path, entries: (await readdir(path)).sort(), mode: metadata.mode, mtimeMs: metadata.mtimeMs, ctimeMs: metadata.ctimeMs };
   }));
   const windowsBefore = await snapshotStorage(); const platformBefore = process.platform;
-  windowsInput.installedStoragePermissionModel = 'windows';
-  await qualifyCodexRescuePreparedContinuationEvidence(windowsInput);
-  assert.equal(process.platform, platformBefore);
-  assert.deepEqual(await snapshotStorage(), windowsBefore);
-  windowsInput.installedStoragePermissionModel = 'posix';
-  await assert.rejects(qualifyCodexRescuePreparedContinuationEvidence(windowsInput), CodexRescueEvidenceMismatchError);
+  if (process.platform === 'win32') await qualifyCodexRescuePreparedContinuationEvidence(installedInput);
+  else await assert.rejects(qualifyCodexRescuePreparedContinuationEvidence(installedInput), CodexRescueEvidenceMismatchError);
   assert.equal(process.platform, platformBefore);
   assert.deepEqual(await snapshotStorage(), windowsBefore);
 

tests/helpers/codex-rescue-qualification.mjs

@@ -191,10 +191,8 @@ export async function qualifyCodexRescuePreparedContinuationEvidence(input, opti
     || preBinding.operationId !== binding.operationId || preBinding.anchorJobId !== binding.anchorJobId) mismatch('continuation-binding-identity', 'Raw Rescue binding identity is invalid.');
   if (preBinding.state !== 'active' || preBinding.currentJobId !== preBinding.anchorJobId
     || binding.currentJobId === preBinding.currentJobId) mismatch('continuation-current-job-stale', 'Raw current job binding does not prove the exact pre-reservation CAS transition.');
-  const installedStoragePermissionModel = boundedString(input.installedDataRoot)
-    ? qualificationStoragePermissionModel(input.installedStoragePermissionModel) : undefined;
-  if (workspaceAuthority.checked) await validateContinuationArtifactLocations(input, { ...workspaceAuthority, route: workspaceAuthority.route }, installedStoragePermissionModel);
-  const jobs = await parseRawJobsWithProduction(jobBytes, expected, input.installedDataRoot, installedStoragePermissionModel);
+  if (workspaceAuthority.checked) await validateContinuationArtifactLocations(input, { ...workspaceAuthority, route: workspaceAuthority.route });
+  const jobs = await parseRawJobsWithProduction(jobBytes, expected, input.installedDataRoot);
   if (jobs.length !== 2 || new Set(jobs.map((job) => job?.id)).size !== jobs.length) mismatch('continuation-job-identity', 'Raw job evidence contains extra or duplicate identities.');
   const anchor = jobs.find((job) => job?.id === binding.anchorJobId); const current = jobs.find((job) => job?.id === binding.currentJobId);
   if (!current) mismatch('continuation-current-job-stale', 'Raw current job evidence is absent.');
@@ -1206,13 +1204,13 @@ function assertGlobalCallOwnership(...rollouts) {
   }
 }
 
-async function parseRawJobsWithProduction(jobBytes, expected, installedDataRoot, permissionModel) {
+async function parseRawJobsWithProduction(jobBytes, expected, installedDataRoot) {
   if (!Array.isArray(jobBytes) || jobBytes.length !== 2) mismatch('continuation-job-identity', 'Exactly two raw persisted job files are required.');
   if (jobBytes.some((bytes) => typeof bytes !== 'string' || !bytes.endsWith('\n'))) mismatch('continuation-job-record', 'Raw persisted job file bytes are invalid.');
   const routed = jobBytes.map((bytes) => { let value; try { value = JSON.parse(bytes); } catch { mismatch('continuation-job-record', 'Raw persisted job bytes are malformed.'); } if (!/^[a-f0-9]{64}$/u.test(value?.id)) mismatch('continuation-job-record', 'Raw persisted job identity is invalid.'); return { bytes, id: value.id, value }; });
   const suppliedRoot = typeof installedDataRoot === 'string' && installedDataRoot.length > 0 ? installedDataRoot : undefined;
   if (suppliedRoot !== undefined) {
-    const installedStorage = await resolveReadonlyQualificationStorage(suppliedRoot, expected.workspace, permissionModel).catch(() => mismatch('continuation-job-record', 'Observed installed job storage is unsafe or absent.'));
+    const installedStorage = await resolveReadonlyQualificationStorage(suppliedRoot, expected.workspace).catch(() => mismatch('continuation-job-record', 'Observed installed job storage is unsafe or absent.'));
     const installedJobs = join(installedStorage.directory, 'jobs');
     for (const { bytes, id, value } of routed) {
       if (await readFile(join(installedJobs, `${id}.json`), 'utf8').catch(() => null) !== bytes) mismatch('continuation-job-record', 'Observed installed job bytes do not match their persisted source files.');
@@ -1341,7 +1339,7 @@ async function validateContinuationWorkspaceBinding(input, expected, active) {
   return { originWorkspace, executionWorkspace, generationId: active.generationId, route, checked: true };
 }
 
-async function validateContinuationArtifactLocations(input, evidence, permissionModel) {
+async function validateContinuationArtifactLocations(input, evidence) {
   if (typeof input.artifactLocationsJson !== 'string' || Buffer.byteLength(input.artifactLocationsJson) > MAX_ROLLOUT_BYTES) {
     mismatch('continuation-artifact-location', 'Workspace-bound artifact locations are absent or oversized.');
   }
@@ -1357,8 +1355,8 @@ async function validateContinuationArtifactLocations(input, evidence, permission
   if (boundedString(input.installedDataRoot)) {
     let originStorage; let executionStorage;
     try { [originStorage, executionStorage] = await Promise.all([
-      resolveReadonlyQualificationStorage(input.installedDataRoot, evidence.originWorkspace, permissionModel),
-      resolveReadonlyQualificationStorage(input.installedDataRoot, evidence.executionWorkspace, permissionModel),
+      resolveReadonlyQualificationStorage(input.installedDataRoot, evidence.originWorkspace),
+      resolveReadonlyQualificationStorage(input.installedDataRoot, evidence.executionWorkspace),
     ]); } catch { mismatch('continuation-artifact-location', 'Workspace-bound artifact storage could not be resolved canonically.'); }
     if (originStorage.workspacePath !== evidence.originWorkspace || executionStorage.workspacePath !== evidence.executionWorkspace) {
       mismatch('continuation-artifact-location', 'Workspace-bound artifact storage resolved to another workspace.');
@@ -1404,19 +1402,13 @@ async function validateContinuationArtifactLocations(input, evidence, permission
   if (remaining.length !== 0) mismatch('continuation-artifact-location', 'Workspace-bound artifact evidence contains an unaccounted duplicate or substitute.');
 }
 
-function qualificationStoragePermissionModel(value) {
-  if (value === undefined) return process.platform === 'win32' ? 'windows' : 'posix';
-  if (value === 'windows' || value === 'posix') return value;
-  mismatch('continuation-artifact-location', 'Installed storage permission model is invalid.');
-}
-
-async function resolveReadonlyQualificationStorage(dataRoot, workspace, permissionModel) {
+async function resolveReadonlyQualificationStorage(dataRoot, workspace) {
   const workspacePath = await realpath(resolve(workspace)); const dataRootPath = await realpath(resolve(dataRoot));
   const workspaceKey = createHash('sha256').update(workspacePath).digest('hex');
   const workspacesDirectory = join(dataRootPath, 'workspaces'); const directory = join(workspacesDirectory, workspaceKey);
   for (const path of [dataRootPath, workspacesDirectory, directory]) {
     const stats = await lstat(path);
-    if (!stats.isDirectory() || stats.isSymbolicLink() || (permissionModel === 'posix' && (stats.mode & 0o077) !== 0) || await realpath(path) !== path) {
+    if (!stats.isDirectory() || stats.isSymbolicLink() || (process.platform !== 'win32' && (stats.mode & 0o077) !== 0) || await realpath(path) !== path) {
       throw new Error('unsafe qualification storage');
     }
   }