liveprovider

package
v0.0.0-...-7911669 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 25, 2026 License: MIT Imports: 27 Imported by: 0

Documentation

Overview

Package liveprovider isolates the minimum credential state needed by opt-in live provider tests. It never recursively copies an agent home and never returns source paths or credential contents.

Index

Constants

View Source 
const (
	// SummaryPrefix makes the one machine-readable line easy to extract from verbose go test output.
	SummaryPrefix = "COOP_PROVIDER_LIVE_SUMMARY "
	// LoopSummaryPrefix keeps writable task-completion evidence distinct from a read-only marker probe.
	LoopSummaryPrefix = "COOP_PROVIDER_LOOP_LIVE_SUMMARY "
	// ResumeSummaryPrefix identifies the two-process native-session continuity probe.
	ResumeSummaryPrefix = "COOP_PROVIDER_RESUME_LIVE_SUMMARY "
	// ConsultSummaryPrefix identifies the separate four-provider live consult result contract.
	ConsultSummaryPrefix = "COOP_CONSULT_LIVE_SUMMARY "
	// SupervisorLabelKey is the test-only label used to reap an ACP process even after its outer
	// supervisor is force-killed before normal cleanup.
	SupervisorLabelKey = "coop.live-test"

	StatusPassed  = "passed"
	StatusSkipped = "skipped"
	StatusFailed  = "failed"

	ReasonMissingRuntime        = "missing_runtime"
	ReasonMissingImage          = "missing_image"
	ReasonMissingCredential     = "missing_credential"
	ReasonCredentialRefresh     = "credential_refresh_required"
	ReasonCredentialNotPortable = "credential_not_portable"
	ReasonMissingCLI            = "missing_cli"
	ReasonUnsafeCredential      = "unsafe_credential"
	ReasonVersionProbe          = "version_probe_failed"
	ReasonPromptExit            = "prompt_exit"
	ReasonPromptTimeout         = "prompt_timeout"
	ReasonMarkerMismatch        = "marker_mismatch"
	ReasonRepositoryChanged     = "repository_changed"
	ReasonSourceChanged         = "source_changed"
	ReasonCleanupFailed         = "cleanup_failed"
	ReasonHarnessFailed         = "harness_failed"
	ReasonRingPrerequisite      = "ring_prerequisite"
)

Variables

This section is empty.

Functions

func CLIVersion 

func CLIVersion(provider string, outputs ...string) string

CLIVersion extracts only a semver-like token and composes it with a registry-trusted label. Raw --version lines can contain paths, control sequences, environment echoes, or other secret data; none of that belongs in the stable live summary.

func CaptureRuntimeConnectionEnv 

func CaptureRuntimeConnectionEnv(runtimeName string) (map[string]string, error)

CaptureRuntimeConnectionEnv resolves the selected host runtime's endpoint/TLS/SSH/storage capability before starting a scrubbed child. It never forwards Docker or Podman behavior-bearing config: those files may inject proxy env, mounts, hooks, or other defaults into the live box.

func ChildEnvironment 

func ChildEnvironment(layout procharness.Layout, spec ChildSpec) ([]string, error)

ChildEnvironment builds an allowlist-only environment. It never reads os.Environ; callers must pass PATH and resolved runtime settings explicitly. Provider tokens live only in layout.Config/env.

func CleanupSupervisor 

func CleanupSupervisor(ctx context.Context, spec SupervisorCleanupSpec, ops SupervisorCleanupOps) error

CleanupSupervisor best-effort removes known cidfile containers, then authoritatively sweeps the supervisor label across running and stopped state until it remains quiet for a full grace period.

func ConsultChildEnvironment 

func ConsultChildEnvironment(layout procharness.Layout, spec ConsultChildSpec) ([]string, error)

ConsultChildEnvironment is allowlist-only and fixes every control path to the disposable layout.

func ControlFilePresent 

func ControlFilePresent(root, path string) bool

ControlFilePresent reports only a regular, single-link control file below root as present.

func CopyRegularTree 

func CopyRegularTree(sourceRoot, source, destination string, maxBytes int64) error

CopyRegularTree publishes a bounded private copy of one source subtree. It rejects links and special files, reads every file through the same replacement-resistant boundary as credentials, and leaves no partial destination on failure.

func CredentialDetailCode 

func CredentialDetailCode(err error) string

CredentialDetailCode converts a redacted copier error to a stable operator diagnostic.

func InitRepository 

func InitRepository(layout procharness.Layout) error

InitRepository creates the clean committed repo used by live provider tests. Git config is isolated by the process layout, so ambient aliases/hooks/signing cannot affect the fixture.

func NewProcessControl 

func NewProcessControl(layout procharness.Layout, registry bool) (*os.File, string, error)

NewProcessControl creates the authenticated descriptor shared by tagged live helpers. ACP also requests a private generation registry; direct probes need only the descriptor.

func ParseTargets 

func ParseTargets(raw string) ([]agents.Target, bool, error)

ParseTargets resolves the explicit provider set for an opt-in live run. `all` is deliberately strict and registry-generated; explicit lists preserve their order and may allow prerequisite skips. Account ladders are rejected because one live prompt must consume one credential only.

func ProcessDeadlineExceeded 

func ProcessDeadlineExceeded(result procharness.Result) bool

ProcessDeadlineExceeded derives timeout truth from the managed process result, not from a parent context that may expire after the child has already exited.

func ProcessEnvironment 

func ProcessEnvironment(layout procharness.Layout, path string, runtime RuntimeSettings, spec ProcessSpec) ([]string, error)

ProcessEnvironment is the shared allowlist-only environment for a live test process. It grants runtime connectivity and the isolated Coop layout, but no ambient Coop overrides or provider keys.

func ReadSessionID 

func ReadSessionID(root, path string) (string, error)

ReadSessionID accepts one private, bounded provider session identifier written by the fresh helper. Provider-owned history is never searched by the parent live harness.

func ValidateConsultTargets 

func ValidateConsultTargets(requested []agents.Target) error

ValidateConsultTargets requires one concrete target for every registered provider.

func ValidateStrictTargets 

func ValidateStrictTargets(strict bool, requested []agents.Target) error

ValidateStrictTargets rejects an invalid paid target set before runtime detection or any prompt.

Types

type BoundedBuffer 

type BoundedBuffer struct {
	// contains filtered or unexported fields
}

BoundedBuffer captures subprocess output without applying backpressure after the cap. Write always reports success so a verbose provider cannot turn output truncation into a pipe failure.

func NewBoundedBuffer 

func NewBoundedBuffer(max int) *BoundedBuffer

func (*BoundedBuffer) String 

func (b *BoundedBuffer) String() string

func (*BoundedBuffer) Truncated 

func (b *BoundedBuffer) Truncated() bool

func (*BoundedBuffer) Write 

func (b *BoundedBuffer) Write(data []byte) (int, error)

type ChildProcessObservation 

type ChildProcessObservation struct {
	Result           procharness.Result
	DeadlineExceeded bool
	Attempted        bool
}

type ChildSpec 

type ChildSpec struct {
	Path            string
	Target          string
	Workflow        string
	Stage           string
	SessionID       string
	SessionFile     string
	Marker          string
	ResultFile      string
	AttemptFile     string
	Supervisor      string
	PreflightReason string
	CIDDir          string
	ControlFD       int
	RevokePath      string
	Runtime         RuntimeSettings
}

ChildSpec is the complete authority granted to one clean live helper process.

type ConsultChildSpec 

type ConsultChildSpec struct {
	Path, Marker, ResultFile, AttemptDir, Supervisor, CIDDir string
	Targets                                                  []agents.Target
	PreflightReasons                                         map[string]string
	Strict                                                   bool
	ControlFD                                                int
	RevokePath                                               string
	Runtime                                                  RuntimeSettings
}

ConsultChildSpec is the complete authority granted to the one clean four-provider live helper.

type ConsultEdgeResult 

type ConsultEdgeResult struct {
	Lead string         `json:"lead"`
	Peer ProviderResult `json:"peer"`
}

type ConsultSummary 

type ConsultSummary struct {
	Schema  int                 `json:"schema"`
	Strict  bool                `json:"strict"`
	Results []ConsultEdgeResult `json:"results"`
	Totals  SummaryTotals       `json:"totals"`
}

ConsultSummary is the stable four-provider consult-ring compatibility result schema.

func NewConsultSummary 

func NewConsultSummary(strict bool, requested []agents.Target, results []ProviderResult) (ConsultSummary, error)

func ReadConsultChildSummary 

func ReadConsultChildSummary(root, path string, strict bool, targets []agents.Target) (ConsultSummary, error)

ReadConsultChildSummary accepts one bounded, closed-schema provider-ring result and recomputes its totals.

func (ConsultSummary) Line 

func (s ConsultSummary) Line() (string, error)

func (ConsultSummary) PeerResults 

func (s ConsultSummary) PeerResults() []ProviderResult

func (ConsultSummary) Success 

func (s ConsultSummary) Success() bool

type Prepared 

type Prepared struct {
	ConfigDir string
	// contains filtered or unexported fields
}

Prepared is an isolated credential config plus the opaque source-integrity baseline that made it.

func Prepare 

func Prepare(sourceDir, destination string, selections []Selection) (*Prepared, error)

Prepare copies only selected adapter-declared auth material into destination. Destination must not exist. Construction happens in a sibling staging directory and becomes visible by rename only after source stability and destination inode checks pass.

func (*Prepared) Account 

func (p *Prepared) Account(provider string) string

Account returns the account marked default in the isolated config for provider.

func (*Prepared) CredentialPresent 

func (p *Prepared) CredentialPresent(provider, account string) bool

CredentialPresent reports whether the isolated account has a primary file or an explicit env assignment belonging to that account in the source config.

func (*Prepared) PreflightReason 

func (p *Prepared) PreflightReason(provider, account string, deadline time.Time) string

PreflightReason returns the stable prerequisite skip reason for an isolated credential.

func (*Prepared) RevocationPath 

func (p *Prepared) RevocationPath() (string, error)

RevocationPath is the private, parent-known tombstone shared with the tagged timeout path.

func (*Prepared) Revoke 

func (p *Prepared) Revoke() error

Revoke atomically removes the published credential path, then deletes the renamed private tree. Source fingerprints remain usable because they describe the original vault, never ConfigDir. A failed tree removal is retryable by this process even when the tagged child performed the move.

func (*Prepared) SafeThrough 

func (p *Prepared) SafeThrough(provider, account string, deadline time.Time) bool

SafeThrough reports whether using this isolated credential through deadline cannot require a refresh of copied remote state. Explicit env/API-key credentials are safe; file credentials must prove an access token remains valid through the deadline in their adapter.

func (*Prepared) VerifySources 

func (p *Prepared) VerifySources() error

VerifySources fails when any selected source credential changed after Prepare. The error reveals no source location, account, artifact name, token, or digest.

type ProcessSpec 

type ProcessSpec struct {
	Supervisor string
	ProcessDir string
	ControlFD  int
}

ProcessSpec is the authority granted to a live ACP supervisor. ProcessDir is a private, append-only registry activated only when the tagged binary also receives ControlFD.

type ProviderResult 

type ProviderResult struct {
	Provider   string `json:"provider"`
	CLIVersion string `json:"cli_version,omitempty"`
	Attempted  bool   `json:"attempted"`
	Passed     bool   `json:"passed"`
	Status     string `json:"status"`
	ReasonCode string `json:"reason_code,omitempty"`
	Phase      string `json:"phase,omitempty"`
	ExitCode   int    `json:"exit_code,omitempty"`
	TimedOut   bool   `json:"timed_out,omitempty"`
	Truncated  bool   `json:"output_truncated,omitempty"`
	ErrorClass string `json:"error_class,omitempty"`
	DetailCode string `json:"detail_code,omitempty"`
}

ProviderResult is intentionally path/account/token-free so the summary can be retained as CI or task evidence. Attempted becomes true only when the marker command starts.

func ClassifyChildProcess 

func ClassifyChildProcess(
	expectedProvider, root, resultPath string,
	observation ChildProcessObservation,
) ProviderResult

ClassifyChildProcess turns process state plus the separately-owned attempt marker into one stable result. A clean child wins over a racing expired context; otherwise deadlines retain whether the paid prompt had begun.

func FinalizeResult 

func FinalizeResult(child ProviderResult, failures VerificationFailures) ProviderResult

FinalizeResult applies the security precedence: cleanup, source integrity, repository integrity, then the child outcome. Higher-priority verification must not be masked by a provider failure.

func ReadChildResult 

func ReadChildResult(root, path, expectedProvider string) (ProviderResult, error)

ReadChildResult accepts exactly one bounded, root-owned result and validates it through the same summary contract used for persisted evidence.

type RepositorySnapshot 

type RepositorySnapshot struct {
	Head, Status, Refs, Reflog string
	Tree                       [32]byte
}

RepositorySnapshot covers the Git and working-tree state a read-only live command must preserve.

func SnapshotRepository 

func SnapshotRepository(layout procharness.Layout) (RepositorySnapshot, error)

func VerifyRepository 

func VerifyRepository(layout procharness.Layout, baseline RepositorySnapshot) (RepositorySnapshot, error)

VerifyRepository hashes the complete repository before invoking Git. A provider-controlled local config or hook therefore cannot execute in the host-side semantic checks.

func (RepositorySnapshot) Equal 

func (s RepositorySnapshot) Equal(other RepositorySnapshot) bool

type RuntimeSettings 

type RuntimeSettings struct {
	Name          string
	Image         string
	BaseImage     string
	HomeInBox     string
	AgentPackages string
	ConnectionEnv map[string]string
}

RuntimeSettings is the narrow host-runtime capability copied from the user's resolved Coop config. ConnectionEnv may point at runtime-owned configuration, so it must reach only the runtime process; it is never forwarded as container environment or persisted in live evidence.

type Selection 

type Selection struct {
	Provider      string
	Account       string
	SourceDefault bool
}

Selection is one source credential account to isolate. SourceDefault says the source env file belongs to this account; the destination always marks one selected account per provider default.

func DefaultSelections 

func DefaultSelections(cfg *config.Config) ([]Selection, error)

DefaultSelections returns exactly one selected credential account per registered provider. ACP live conformance switches providers, but it does not need authority from unrelated named accounts.

func SelectionForTarget 

func SelectionForTarget(cfg *config.Config, target agents.Target) (Selection, error)

SelectionForTarget resolves one concrete account without changing the source config. A live compatibility prompt deliberately supports one account only; account ladders belong to the deterministic rotation suites.

func SelectionsForTargets 

func SelectionsForTargets(cfg *config.Config, targets []agents.Target) ([]Selection, error)

SelectionsForTargets expands account ladders into the exact unique credential accounts a live process may reach. A bare target selects only that provider's marked default.

type Summary 

type Summary struct {
	Schema  int              `json:"schema"`
	Strict  bool             `json:"strict"`
	Results []ProviderResult `json:"results"`
	Totals  SummaryTotals    `json:"totals"`
}

Summary is the stable provider-live result schema.

func NewSummary 

func NewSummary(strict bool, requested []agents.Target, results []ProviderResult) (Summary, error)

func (Summary) Line 

func (s Summary) Line() (string, error)

func (Summary) LoopLine 

func (s Summary) LoopLine() (string, error)

func (Summary) ResumeLine 

func (s Summary) ResumeLine() (string, error)

func (Summary) Success 

func (s Summary) Success() bool

Success applies the operator contract: standard mode tolerates prerequisite skips only; strict mode requires every registered provider attempted and passed with no skip or failure.

type SummaryTotals 

type SummaryTotals struct {
	Requested int `json:"requested"`
	Attempted int `json:"attempted"`
	Passed    int `json:"passed"`
	Skipped   int `json:"skipped"`
	Failed    int `json:"failed"`
}

type SupervisorCleanupOps 

type SupervisorCleanupOps struct {
	RemoveContainer func(context.Context, string) error
	RemoveByLabel   func(context.Context, string, string) (int, error)
	Now             func() time.Time
	Sleep           func(context.Context, time.Duration) error
}

type SupervisorCleanupSpec 

type SupervisorCleanupSpec struct {
	Root, CIDDir, ProcessDir, Supervisor, LabelKey string
	Phases                                         []string
	OperationTimeout, ProcessGrace, QuietPeriod    time.Duration
	PollInterval                                   time.Duration
}

type VerificationFailures 

type VerificationFailures struct {
	CleanupFailed     bool
	SourceChanged     bool
	RepositoryChanged bool
	AttemptedObserved bool
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.