lib/closure/src/baseline/assemble.zig
daab053ee43316e1809a84551d573ddd1e5bf3d2
1 const canonical = @import("../canonical/root.zig");
2 const closure = @import("../root.zig");
3 const discover = @import("../discover/root.zig");
4 const schema = @import("../schema/root.zig");
5 const std = @import("std");
6
7 const limits = closure.limits;
8 const executable_policy_source = "native-workstation-policy-v1";
9 const service_trust_policy_source = "private-pinned-policy-v1";
10 const bootstrap_policy_source = "closure-audited-policy-v1";
11
12 pub const Range = struct {
13 offset: u64,
14 length: u64,
15 digest: schema.Digest,
16 executable: bool,
17 };
18
19 pub const Evidence = struct {
20 kind: EvidenceKind,
21 digest: schema.Digest,
22 };
23
24 pub const EvidenceKind = enum {
25 symbols,
26 relocations,
27 };
28
29 pub const AuditInput = struct {
30 generation: schema.GenerationId,
31 source_reference: schema.Descriptor,
32 source_revision: schema.Digest,
33 zig_version: schema.Descriptor,
34 optimize: schema.Descriptor,
35 artifact_bytes: u64,
36 artifact_digest: schema.Digest,
37 ranges: []const Range,
38 evidence: []const Evidence,
39 };
40
41 const AssemblyError = error{
42 NodeCapacityExceeded,
43 EdgeCapacityExceeded,
44 ArtifactCapacityExceeded,
45 RangeCapacityExceeded,
46 DigestCapacityExceeded,
47 ProvenanceCapacityExceeded,
48 SourceCapacityExceeded,
49 BuildCapacityExceeded,
50 AuthorityCapacityExceeded,
51 LineageCapacityExceeded,
52 ServiceCapacityExceeded,
53 RootCapacityExceeded,
54 ClaimCapacityExceeded,
55 ClaimNodeCapacityExceeded,
56 InvalidExactArtifact,
57 };
58
59 pub const Error = schema.Name.Error || schema.Descriptor.Error ||
60 schema.Digest.ParseError || AssemblyError;
61
62 pub const Storage = struct {
63 nodes: [limits.nodes_max]schema.Node = undefined,
64 edges: [limits.edges_max]schema.Edge = undefined,
65 artifacts: [limits.artifacts_max]schema.Artifact = undefined,
66 ranges: [limits.ranges_max]schema.ByteRange = undefined,
67 digests: [limits.digests_max]schema.DigestRecord = undefined,
68 provenance: [limits.provenance_parents_max]schema.ProvenanceParent = undefined,
69 sources: [limits.source_records_max]schema.SourceRecord = undefined,
70 builds: [limits.build_records_max]schema.BuildRecord = undefined,
71 authorities: [limits.authorities_max]schema.Authority = undefined,
72 lineages: [limits.lineage_references_max]schema.LineageReference = undefined,
73 services: [limits.service_descriptors_max]schema.ServiceDescriptor = undefined,
74 roots: [limits.residual_roots_max]schema.ResidualRoot = undefined,
75 claims: [limits.claims_max]schema.Claim = undefined,
76 claim_nodes: [limits.claim_nodes_max]schema.ClaimNode = undefined,
77 node_count: u16 = 0,
78 edge_count: u16 = 0,
79 artifact_count: u16 = 0,
80 range_count: u16 = 0,
81 digest_count: u16 = 0,
82 provenance_count: u16 = 0,
83 source_count: u16 = 0,
84 build_count: u16 = 0,
85 authority_count: u16 = 0,
86 lineage_count: u16 = 0,
87 service_count: u16 = 0,
88 root_count: u16 = 0,
89 claim_count: u16 = 0,
90 claim_node_count: u16 = 0,
91
92 fn reset(self: *Storage) void {
93 self.node_count = 0;
94 self.edge_count = 0;
95 self.artifact_count = 0;
96 self.range_count = 0;
97 self.digest_count = 0;
98 self.provenance_count = 0;
99 self.source_count = 0;
100 self.build_count = 0;
101 self.authority_count = 0;
102 self.lineage_count = 0;
103 self.service_count = 0;
104 self.root_count = 0;
105 self.claim_count = 0;
106 self.claim_node_count = 0;
107 }
108
109 fn addNode(self: *Storage, value: schema.Node) Error!schema.NodeId {
110 if (self.node_count == self.nodes.len) {
111 return error.NodeCapacityExceeded;
112 }
113 const id: schema.NodeId = @as(u32, self.node_count) + 1;
114 var stored = value;
115 stored.id = id;
116 self.nodes[self.node_count] = stored;
117 self.node_count += 1;
118 return id;
119 }
120
121 fn addEdge(self: *Storage, value: schema.Edge) Error!schema.RecordId {
122 if (self.edge_count == self.edges.len) {
123 return error.EdgeCapacityExceeded;
124 }
125 const id: schema.RecordId = @as(u32, self.edge_count) + 1;
126 var stored = value;
127 stored.id = id;
128 self.edges[self.edge_count] = stored;
129 self.edge_count += 1;
130 return id;
131 }
132
133 fn addArtifact(
134 self: *Storage,
135 value: schema.Artifact,
136 ) Error!schema.RecordId {
137 if (self.artifact_count == self.artifacts.len) {
138 return error.ArtifactCapacityExceeded;
139 }
140 const id: schema.RecordId = @as(u32, self.artifact_count) + 1;
141 var stored = value;
142 stored.id = id;
143 self.artifacts[self.artifact_count] = stored;
144 self.artifact_count += 1;
145 return id;
146 }
147
148 fn addRange(
149 self: *Storage,
150 value: schema.ByteRange,
151 ) Error!schema.RecordId {
152 if (self.range_count == self.ranges.len) {
153 return error.RangeCapacityExceeded;
154 }
155 const id: schema.RecordId = @as(u32, self.range_count) + 1;
156 var stored = value;
157 stored.id = id;
158 self.ranges[self.range_count] = stored;
159 self.range_count += 1;
160 return id;
161 }
162
163 fn addDigest(
164 self: *Storage,
165 value: schema.DigestRecord,
166 ) Error!schema.RecordId {
167 if (self.digest_count == self.digests.len) {
168 return error.DigestCapacityExceeded;
169 }
170 const id: schema.RecordId = @as(u32, self.digest_count) + 1;
171 var stored = value;
172 stored.id = id;
173 self.digests[self.digest_count] = stored;
174 self.digest_count += 1;
175 return id;
176 }
177
178 fn addProvenance(
179 self: *Storage,
180 value: schema.ProvenanceParent,
181 ) Error!schema.RecordId {
182 if (self.provenance_count == self.provenance.len) {
183 return error.ProvenanceCapacityExceeded;
184 }
185 const id: schema.RecordId = @as(u32, self.provenance_count) + 1;
186 var stored = value;
187 stored.id = id;
188 self.provenance[self.provenance_count] = stored;
189 self.provenance_count += 1;
190 return id;
191 }
192
193 fn addSource(
194 self: *Storage,
195 value: schema.SourceRecord,
196 ) Error!schema.RecordId {
197 if (self.source_count == self.sources.len) {
198 return error.SourceCapacityExceeded;
199 }
200 const id: schema.RecordId = @as(u32, self.source_count) + 1;
201 var stored = value;
202 stored.id = id;
203 self.sources[self.source_count] = stored;
204 self.source_count += 1;
205 return id;
206 }
207
208 fn addBuild(
209 self: *Storage,
210 value: schema.BuildRecord,
211 ) Error!schema.RecordId {
212 if (self.build_count == self.builds.len) {
213 return error.BuildCapacityExceeded;
214 }
215 const id: schema.RecordId = @as(u32, self.build_count) + 1;
216 var stored = value;
217 stored.id = id;
218 self.builds[self.build_count] = stored;
219 self.build_count += 1;
220 return id;
221 }
222
223 fn addLineage(
224 self: *Storage,
225 value: schema.LineageReference,
226 ) Error!schema.RecordId {
227 if (self.lineage_count == self.lineages.len) {
228 return error.LineageCapacityExceeded;
229 }
230 const id: schema.RecordId = @as(u32, self.lineage_count) + 1;
231 var stored = value;
232 stored.id = id;
233 self.lineages[self.lineage_count] = stored;
234 self.lineage_count += 1;
235 return id;
236 }
237
238 fn addService(
239 self: *Storage,
240 value: schema.ServiceDescriptor,
241 ) Error!schema.RecordId {
242 if (self.service_count == self.services.len) {
243 return error.ServiceCapacityExceeded;
244 }
245 const id: schema.RecordId = @as(u32, self.service_count) + 1;
246 var stored = value;
247 stored.id = id;
248 self.services[self.service_count] = stored;
249 self.service_count += 1;
250 return id;
251 }
252
253 fn addRoot(
254 self: *Storage,
255 value: schema.ResidualRoot,
256 ) Error!schema.RecordId {
257 if (self.root_count == self.roots.len) {
258 return error.RootCapacityExceeded;
259 }
260 const id: schema.RecordId = @as(u32, self.root_count) + 1;
261 var stored = value;
262 stored.id = id;
263 self.roots[self.root_count] = stored;
264 self.root_count += 1;
265 return id;
266 }
267
268 fn addClaim(self: *Storage, value: schema.Claim) Error!schema.ClaimId {
269 if (self.claim_count == self.claims.len) {
270 return error.ClaimCapacityExceeded;
271 }
272 const id: schema.ClaimId = @as(u32, self.claim_count) + 1;
273 var stored = value;
274 stored.id = id;
275 self.claims[self.claim_count] = stored;
276 self.claim_count += 1;
277 return id;
278 }
279
280 fn addClaimNode(
281 self: *Storage,
282 value: schema.ClaimNode,
283 ) Error!schema.RecordId {
284 if (self.claim_node_count == self.claim_nodes.len) {
285 return error.ClaimNodeCapacityExceeded;
286 }
287 const id: schema.RecordId = @as(u32, self.claim_node_count) + 1;
288 var stored = value;
289 stored.id = id;
290 self.claim_nodes[self.claim_node_count] = stored;
291 self.claim_node_count += 1;
292 return id;
293 }
294
295 fn input(
296 self: *const Storage,
297 generation: schema.GenerationId,
298 root: schema.Digest,
299 ) schema.GenerationInput {
300 return .{
301 .id = generation,
302 .root = root,
303 .nodes = self.nodes[0..self.node_count],
304 .edges = self.edges[0..self.edge_count],
305 .artifacts = self.artifacts[0..self.artifact_count],
306 .ranges = self.ranges[0..self.range_count],
307 .digests = self.digests[0..self.digest_count],
308 .provenance_parents = self.provenance[0..self.provenance_count],
309 .source_records = self.sources[0..self.source_count],
310 .build_records = self.builds[0..self.build_count],
311 .authorities = self.authorities[0..self.authority_count],
312 .lineage_references = self.lineages[0..self.lineage_count],
313 .service_descriptors = self.services[0..self.service_count],
314 .residual_roots = self.roots[0..self.root_count],
315 .claims = self.claims[0..self.claim_count],
316 .claim_nodes = self.claim_nodes[0..self.claim_node_count],
317 };
318 }
319 };
320
321 const NodeSpec = struct {
322 descriptor: []const u8,
323 identity: schema.Digest,
324 subject_kind: schema.SubjectKind,
325 material_role: schema.MaterialRole,
326 origin: schema.Origin,
327 phases: schema.PhaseSet,
328 locus: schema.ExecutionLocus,
329 owner: []const u8,
330 authority: schema.AuthorityClass,
331 artifact_kind: schema.ArtifactKind,
332 };
333
334 const Profiles = struct {
335 executable: schema.Digest,
336 service_trust: schema.Digest,
337 bootstrap: schema.Digest,
338 };
339
340 const PolicyNodes = struct {
341 executable: schema.NodeId,
342 trust: schema.NodeId,
343 bootstrap: schema.NodeId,
344 };
345
346 const BuildNodes = struct {
347 zig: schema.NodeId,
348 llvm: schema.NodeId,
349 lld: schema.NodeId,
350 zig_std: schema.NodeId,
351 nix: schema.NodeId,
352 tree_sitter: schema.NodeId,
353 };
354
355 const EffectNodes = struct {
356 git: schema.NodeId,
357 linux: schema.NodeId,
358 hardware: schema.NodeId,
359 codex: schema.NodeId,
360 claude: schema.NodeId,
361 };
362
363 const GraphNodes = struct {
364 source: schema.NodeId,
365 policies: PolicyNodes,
366 build: BuildNodes,
367 effects: EffectNodes,
368 auditor: schema.NodeId,
369 };
370
371 const executable_profile =
372 "db78a92d8b6db3071d4b423e333c3cc8c2a799c2f65b290602332f5c2d7a4401";
373 const service_trust_profile =
374 "5a7082ed32ea2c192f33a4a3ae08a68717fce87dc2eafb55a4ece30f199c680e";
375 const bootstrap_profile =
376 "f36d2129538374157a89b3a6108baf2c4442d49d3d5aa4c219769fd56e7fc579";
377
378 pub fn assemble(
379 storage: *Storage,
380 audit: AuditInput,
381 ) Error!schema.GenerationInput {
382 try preflight(audit);
383 storage.reset();
384 const profiles = try loadProfiles();
385 const graph = try addGraph(storage, audit, profiles);
386 const artifact = try addArtifact(storage, audit, graph.auditor);
387 try addEvidence(storage, audit, profiles, graph);
388 try addEdges(storage, graph);
389 const claim = try addClaim(
390 storage,
391 artifact,
392 audit.artifact_digest,
393 profiles,
394 );
395 try addTreatments(storage, graph, claim);
396 var generation = storage.input(
397 audit.generation,
398 schema.Digest.zero(),
399 );
400 generation.root = canonical.generation(generation);
401 return generation;
402 }
403
404 fn preflight(audit: AuditInput) Error!void {
405 if (audit.generation == 0 or
406 !audit.source_revision.isKnown() or
407 audit.artifact_bytes == 0 or
408 !audit.artifact_digest.isKnown() or
409 audit.ranges.len == 0)
410 {
411 return error.InvalidExactArtifact;
412 }
413 if (audit.ranges.len > limits.ranges_max) {
414 return error.RangeCapacityExceeded;
415 }
416 const license_records: usize = 6;
417 if (audit.evidence.len > limits.digests_max - license_records) {
418 return error.DigestCapacityExceeded;
419 }
420 }
421
422 fn loadProfiles() Error!Profiles {
423 return .{
424 .executable = try schema.Digest.fromHex(executable_profile),
425 .service_trust = try schema.Digest.fromHex(service_trust_profile),
426 .bootstrap = try schema.Digest.fromHex(bootstrap_profile),
427 };
428 }
429
430 fn addGraph(
431 storage: *Storage,
432 audit: AuditInput,
433 profiles: Profiles,
434 ) Error!GraphNodes {
435 const source_phase = schema.phaseBit(.source) |
436 schema.phaseBit(.build);
437 const validation_phase = schema.phaseBit(.validation);
438 const build_phase = schema.phaseBit(.build);
439 const source = try addNode(storage, .{
440 .descriptor = "current lib/closure source projection",
441 .identity = audit.source_revision,
442 .subject_kind = .source,
443 .material_role = .validation,
444 .origin = .owned_source,
445 .phases = source_phase,
446 .locus = .nonexecuting,
447 .owner = "closure",
448 .authority = .none,
449 .artifact_kind = .source,
450 });
451 const policies = try addPolicies(storage, profiles);
452 const build = try addBuildNodes(
453 storage,
454 audit.zig_version,
455 source_phase,
456 build_phase,
457 );
458 const effects = try addEffectNodes(
459 storage,
460 validation_phase,
461 );
462 const auditor = try addNode(storage, .{
463 .descriptor = "closure baseline auditor executable",
464 .identity = audit.artifact_digest,
465 .subject_kind = .binary,
466 .material_role = .validation,
467 .origin = .owned_derivation,
468 .phases = build_phase | validation_phase,
469 .locus = .build_host,
470 .owner = "closure",
471 .authority = .validation,
472 .artifact_kind = .executable,
473 });
474 return .{
475 .source = source,
476 .policies = policies,
477 .build = build,
478 .effects = effects,
479 .auditor = auditor,
480 };
481 }
482
483 fn addPolicies(
484 storage: *Storage,
485 profiles: Profiles,
486 ) Error!PolicyNodes {
487 return .{
488 .executable = try policyNode(
489 storage,
490 "native-workstation/v1 executable policy",
491 profiles.executable,
492 ),
493 .trust = try policyNode(
494 storage,
495 "private-pinned service trust policy",
496 profiles.service_trust,
497 ),
498 .bootstrap = try policyNode(
499 storage,
500 "closure-audited bootstrap policy",
501 profiles.bootstrap,
502 ),
503 };
504 }
505
506 fn addBuildNodes(
507 storage: *Storage,
508 zig_version: schema.Descriptor,
509 source_phase: schema.PhaseSet,
510 build_phase: schema.PhaseSet,
511 ) Error!BuildNodes {
512 return .{
513 .zig = try externalNode(
514 storage,
515 zig_version.slice(),
516 .build_tool,
517 .bootstrap_seed,
518 build_phase,
519 .build_host,
520 "zig",
521 .executable,
522 ),
523 .llvm = try buildTool(
524 storage,
525 "LLVM from pinned Zig toolchain",
526 "llvm",
527 build_phase,
528 ),
529 .lld = try buildTool(
530 storage,
531 "LLD from pinned Zig toolchain",
532 "lld",
533 build_phase,
534 ),
535 .zig_std = try externalNode(
536 storage,
537 "Zig standard library source and build runner",
538 .source,
539 .bootstrap_seed,
540 source_phase,
541 .nonexecuting,
542 "zig",
543 .source,
544 ),
545 .nix = try externalNode(
546 storage,
547 "Nix build environment",
548 .build_tool,
549 .bootstrap_seed,
550 build_phase,
551 .build_host,
552 "nix",
553 .executable,
554 ),
555 .tree_sitter = try externalNode(
556 storage,
557 "tree-sitter semantic graph analysis inputs",
558 .build_tool,
559 .validation,
560 source_phase,
561 .build_host,
562 "smg",
563 .data,
564 ),
565 };
566 }
567
568 fn buildTool(
569 storage: *Storage,
570 descriptor: []const u8,
571 owner: []const u8,
572 phase: schema.PhaseSet,
573 ) Error!schema.NodeId {
574 return externalNode(
575 storage,
576 descriptor,
577 .build_tool,
578 .bootstrap_seed,
579 phase,
580 .build_host,
581 owner,
582 .executable,
583 );
584 }
585
586 fn addEffectNodes(
587 storage: *Storage,
588 validation_phase: schema.PhaseSet,
589 ) Error!EffectNodes {
590 return .{
591 .git = try oracleNode(
592 storage,
593 "Git source revision observer",
594 validation_phase,
595 .build_host,
596 "git",
597 ),
598 .linux = try platformNode(
599 storage,
600 "Linux host kernel and filesystem",
601 .firmware,
602 validation_phase,
603 .build_host,
604 "host",
605 .firmware,
606 ),
607 .hardware = try platformNode(
608 storage,
609 "x86_64 host CPU and microcode",
610 .hardware,
611 validation_phase,
612 .normal_world_cpu,
613 "hardware",
614 .hardware,
615 ),
616 .codex = try serviceNode(
617 storage,
618 "OpenAI Codex model service",
619 "OpenAI",
620 ),
621 .claude = try serviceNode(
622 storage,
623 "Claude Opus fallback service",
624 "Anthropic",
625 ),
626 };
627 }
628
629 fn addArtifact(
630 storage: *Storage,
631 audit: AuditInput,
632 auditor: schema.NodeId,
633 ) Error!schema.RecordId {
634 const artifact = try storage.addArtifact(discover.generatedArtifact(.{
635 .id = 0,
636 .node = auditor,
637 .byte_length = audit.artifact_bytes,
638 .digest = audit.artifact_digest,
639 .witness = .owned,
640 }));
641 for (audit.ranges) |range| {
642 if (range.length == 0 or !range.digest.isKnown()) {
643 return error.InvalidExactArtifact;
644 }
645 _ = try storage.addRange(.{
646 .id = 0,
647 .artifact = artifact,
648 .offset = range.offset,
649 .length = range.length,
650 .digest = range.digest,
651 .executable = range.executable,
652 .witness = .owned,
653 });
654 }
655 for (audit.evidence) |evidence| {
656 if (!evidence.digest.isKnown()) {
657 return error.InvalidExactArtifact;
658 }
659 const purpose = switch (evidence.kind) {
660 .symbols => "owned-binary-symbol-table",
661 .relocations => "owned-binary-relocation-table",
662 };
663 const input = discover.EvidenceInput{
664 .id = 0,
665 .node = auditor,
666 .purpose = try schema.Name.init(purpose),
667 .digest = evidence.digest,
668 .witness = .owned,
669 };
670 _ = try storage.addDigest(switch (evidence.kind) {
671 .symbols => discover.symbol(input),
672 .relocations => discover.relocation(input),
673 });
674 }
675 return artifact;
676 }
677
678 fn addEvidence(
679 storage: *Storage,
680 audit: AuditInput,
681 profiles: Profiles,
682 graph: GraphNodes,
683 ) Error!void {
684 try addSourceEvidence(
685 storage,
686 graph.source,
687 "lib/closure",
688 audit.source_revision,
689 );
690 try addSourceEvidence(
691 storage,
692 graph.policies.executable,
693 executable_policy_source,
694 profiles.executable,
695 );
696 try addSourceEvidence(
697 storage,
698 graph.policies.trust,
699 service_trust_policy_source,
700 profiles.service_trust,
701 );
702 try addSourceEvidence(
703 storage,
704 graph.policies.bootstrap,
705 bootstrap_policy_source,
706 profiles.bootstrap,
707 );
708 try addLicenses(storage, graph.build);
709 try addDerivation(storage, audit, graph);
710 try addLineage(storage, audit, graph.source);
711 }
712
713 fn addLicenses(storage: *Storage, build: BuildNodes) Error!void {
714 inline for (.{
715 .{ build.zig, "Zig-license-unreceipted" },
716 .{ build.llvm, "LLVM-license-unreceipted" },
717 .{ build.lld, "LLD-license-unreceipted" },
718 .{ build.zig_std, "Zig-std-license-unreceipted" },
719 .{ build.nix, "Nix-license-unreceipted" },
720 .{ build.tree_sitter, "tree-sitter-license-unreceipted" },
721 }) |entry| {
722 _ = try storage.addDigest(discover.license(.{
723 .id = 0,
724 .node = entry[0],
725 .purpose = try schema.Name.init("license-reference"),
726 .digest = textDigest(entry[1]),
727 .witness = .foreign,
728 }));
729 }
730 }
731
732 fn addDerivation(
733 storage: *Storage,
734 audit: AuditInput,
735 graph: GraphNodes,
736 ) Error!void {
737 _ = try storage.addBuild(discover.buildOption(.{
738 .id = 0,
739 .node = graph.auditor,
740 .tool = graph.build.zig,
741 .option = audit.optimize,
742 .digest = textDigest(audit.optimize.slice()),
743 .witness = .owned,
744 }));
745 _ = try storage.addProvenance(discover.provenance(.{
746 .id = 0,
747 .child = graph.auditor,
748 .parent = graph.source,
749 }));
750 _ = try storage.addProvenance(discover.provenance(.{
751 .id = 0,
752 .child = graph.auditor,
753 .parent = graph.build.zig,
754 }));
755 }
756
757 fn addLineage(
758 storage: *Storage,
759 audit: AuditInput,
760 source: schema.NodeId,
761 ) Error!void {
762 _ = try storage.addLineage(discover.lineage(.{
763 .id = 0,
764 .node = source,
765 .descriptor = audit.source_reference,
766 .digest = audit.source_revision,
767 .witness = .owned,
768 }));
769 _ = try storage.addLineage(discover.lineage(.{
770 .id = 0,
771 .node = source,
772 .descriptor = try schema.Descriptor.init(
773 "codex-goal:019fa38d-f991-71e0-b2fd-692ffd37f215",
774 ),
775 .digest = textDigest(
776 "019fa38d-f991-71e0-b2fd-692ffd37f215",
777 ),
778 .witness = .foreign,
779 }));
780 _ = try storage.addLineage(discover.lineage(.{
781 .id = 0,
782 .node = source,
783 .descriptor = try schema.Descriptor.init(
784 "fable5-quota-blocked:claude-opus-fallback",
785 ),
786 .digest = textDigest(
787 "fable5-quota-blocked:claude-opus-fallback",
788 ),
789 .witness = .foreign,
790 }));
791 }
792
793 fn addEdges(storage: *Storage, graph: GraphNodes) Error!void {
794 inline for (.{
795 .{ graph.policies.executable, graph.source, schema.EdgeKind.data_flow },
796 .{ graph.policies.trust, graph.source, schema.EdgeKind.data_flow },
797 .{ graph.policies.bootstrap, graph.source, schema.EdgeKind.data_flow },
798 .{ graph.effects.codex, graph.source, schema.EdgeKind.data_flow },
799 .{ graph.effects.claude, graph.source, schema.EdgeKind.data_flow },
800 .{ graph.build.tree_sitter, graph.source, schema.EdgeKind.build_influence },
801 .{ graph.source, graph.auditor, schema.EdgeKind.derivation },
802 .{ graph.build.llvm, graph.build.zig, schema.EdgeKind.build_influence },
803 .{ graph.build.nix, graph.build.zig, schema.EdgeKind.build_influence },
804 .{ graph.build.zig, graph.auditor, schema.EdgeKind.build_influence },
805 .{ graph.build.lld, graph.auditor, schema.EdgeKind.build_influence },
806 .{ graph.build.zig_std, graph.auditor, schema.EdgeKind.build_influence },
807 .{ graph.effects.git, graph.auditor, schema.EdgeKind.validation },
808 .{ graph.effects.linux, graph.auditor, schema.EdgeKind.validation },
809 .{ graph.effects.hardware, graph.auditor, schema.EdgeKind.validation },
810 }) |edge| {
811 _ = try storage.addEdge(discover.relation(.{
812 .id = 0,
813 .source = edge[0],
814 .target = edge[1],
815 .kind = edge[2],
816 }));
817 }
818 }
819
820 fn addClaim(
821 storage: *Storage,
822 artifact: schema.RecordId,
823 artifact_digest: schema.Digest,
824 profiles: Profiles,
825 ) Error!schema.ClaimId {
826 return storage.addClaim(.{
827 .id = 0,
828 .name = try schema.Name.init("closure-audited/current-tree"),
829 .artifact = artifact,
830 .artifact_digest = artifact_digest,
831 .profiles = .{
832 .executable = try profile(
833 "native-workstation/v1",
834 executable_policy_source,
835 profiles.executable,
836 ),
837 .service_trust = try profile(
838 "private-pinned",
839 service_trust_policy_source,
840 profiles.service_trust,
841 ),
842 .model_origin = schema.ProfileRef.absent(),
843 .bootstrap = try profile(
844 "closure-audited",
845 bootstrap_policy_source,
846 profiles.bootstrap,
847 ),
848 },
849 .traversed_edges = schema.edgeBit(.derivation) |
850 schema.edgeBit(.build_influence) |
851 schema.edgeBit(.data_flow) |
852 schema.edgeBit(.validation),
853 });
854 }
855
856 fn addTreatments(
857 storage: *Storage,
858 graph: GraphNodes,
859 claim: schema.ClaimId,
860 ) Error!void {
861 inline for (.{
862 .{ graph.source, schema.Treatment.owned },
863 .{ graph.policies.executable, schema.Treatment.verified },
864 .{ graph.policies.trust, schema.Treatment.verified },
865 .{ graph.policies.bootstrap, schema.Treatment.verified },
866 .{ graph.build.zig, schema.Treatment.residual_assumption },
867 .{ graph.build.llvm, schema.Treatment.residual_assumption },
868 .{ graph.build.lld, schema.Treatment.residual_assumption },
869 .{ graph.build.zig_std, schema.Treatment.residual_assumption },
870 .{ graph.build.nix, schema.Treatment.residual_assumption },
871 .{ graph.build.tree_sitter, schema.Treatment.residual_assumption },
872 .{ graph.effects.git, schema.Treatment.validation_only },
873 .{ graph.effects.linux, schema.Treatment.validation_only },
874 .{ graph.effects.hardware, schema.Treatment.validation_only },
875 .{ graph.effects.codex, schema.Treatment.residual_assumption },
876 .{ graph.effects.claude, schema.Treatment.residual_assumption },
877 }) |root| {
878 _ = try storage.addRoot(.{
879 .id = 0,
880 .claim = claim,
881 .node = root[0],
882 .treatment = root[1],
883 });
884 }
885 _ = try storage.addClaimNode(.{
886 .id = 0,
887 .claim = claim,
888 .node = graph.auditor,
889 .treatment = .owned,
890 });
891 }
892
893 fn addNode(storage: *Storage, spec: NodeSpec) Error!schema.NodeId {
894 return storage.addNode(discover.node(.{
895 .id = 0,
896 .descriptor = try schema.Descriptor.init(spec.descriptor),
897 .identity = spec.identity,
898 .subject_kind = spec.subject_kind,
899 .material_role = spec.material_role,
900 .origin = spec.origin,
901 .phases = spec.phases,
902 .execution_locus = spec.locus,
903 .owner = try schema.Name.init(spec.owner),
904 .authority = spec.authority,
905 .artifact_kind = spec.artifact_kind,
906 }));
907 }
908
909 fn policyNode(
910 storage: *Storage,
911 description: []const u8,
912 digest: schema.Digest,
913 ) Error!schema.NodeId {
914 return addNode(storage, .{
915 .descriptor = description,
916 .identity = digest,
917 .subject_kind = .specification,
918 .material_role = .validation,
919 .origin = .owned_source,
920 .phases = schema.phaseBit(.source) |
921 schema.phaseBit(.validation),
922 .locus = .nonexecuting,
923 .owner = "policy",
924 .authority = .none,
925 .artifact_kind = .specification,
926 });
927 }
928
929 fn externalNode(
930 storage: *Storage,
931 description: []const u8,
932 subject: schema.SubjectKind,
933 role: schema.MaterialRole,
934 phases: schema.PhaseSet,
935 locus: schema.ExecutionLocus,
936 owner: []const u8,
937 artifact: schema.ArtifactKind,
938 ) Error!schema.NodeId {
939 return addNode(storage, .{
940 .descriptor = description,
941 .identity = textDigest(description),
942 .subject_kind = subject,
943 .material_role = role,
944 .origin = .external_unreceipted,
945 .phases = phases,
946 .locus = locus,
947 .owner = owner,
948 .authority = .none,
949 .artifact_kind = artifact,
950 });
951 }
952
953 fn oracleNode(
954 storage: *Storage,
955 description: []const u8,
956 phases: schema.PhaseSet,
957 locus: schema.ExecutionLocus,
958 owner: []const u8,
959 ) Error!schema.NodeId {
960 return addNode(storage, .{
961 .descriptor = description,
962 .identity = textDigest(description),
963 .subject_kind = .oracle,
964 .material_role = .validation,
965 .origin = .external_unreceipted,
966 .phases = phases,
967 .locus = locus,
968 .owner = owner,
969 .authority = .validation,
970 .artifact_kind = .executable,
971 });
972 }
973
974 fn platformNode(
975 storage: *Storage,
976 description: []const u8,
977 subject: schema.SubjectKind,
978 phases: schema.PhaseSet,
979 locus: schema.ExecutionLocus,
980 owner: []const u8,
981 artifact: schema.ArtifactKind,
982 ) Error!schema.NodeId {
983 return addNode(storage, .{
984 .descriptor = description,
985 .identity = textDigest(description),
986 .subject_kind = subject,
987 .material_role = .residual_root,
988 .origin = .platform_supplied,
989 .phases = phases,
990 .locus = locus,
991 .owner = owner,
992 .authority = .platform_control,
993 .artifact_kind = artifact,
994 });
995 }
996
997 fn serviceNode(
998 storage: *Storage,
999 description: []const u8,
1000 provider: []const u8,
1001 ) Error!schema.NodeId {
1002 const node = try addNode(storage, .{
1003 .descriptor = description,
1004 .identity = textDigest(description),
1005 .subject_kind = .service,
1006 .material_role = .model,
1007 .origin = .external_unreceipted,
1008 .phases = schema.phaseBit(.source),
1009 .locus = .remote_service,
1010 .owner = "model-service",
1011 .authority = .model_behavior,
1012 .artifact_kind = .service,
1013 });
1014 _ = try storage.addService(discover.service(.{
1015 .id = 0,
1016 .node = node,
1017 .provider = try schema.Descriptor.init(provider),
1018 .protocol = try schema.Descriptor.init("remote model API"),
1019 .endpoint_rule = try schema.Descriptor.init("provider managed"),
1020 .trust_anchor = try schema.Descriptor.init(
1021 "host WebPKI unreceipted",
1022 ),
1023 .failure_contract = try schema.Descriptor.init(
1024 "unavailable blocks source assistance",
1025 ),
1026 .requirement = .required,
1027 }));
1028 return node;
1029 }
1030
1031 fn addSourceEvidence(
1032 storage: *Storage,
1033 node: schema.NodeId,
1034 path: []const u8,
1035 digest: schema.Digest,
1036 ) Error!void {
1037 _ = try storage.addSource(discover.sourceFile(.{
1038 .id = 0,
1039 .node = node,
1040 .path = try schema.Descriptor.init(path),
1041 .digest = digest,
1042 .witness = .owned,
1043 }));
1044 }
1045
1046 fn profile(
1047 id: []const u8,
1048 source: []const u8,
1049 digest: schema.Digest,
1050 ) Error!schema.ProfileRef {
1051 return .{
1052 .required = true,
1053 .id = try schema.Name.init(id),
1054 .source = try schema.Name.init(source),
1055 .body_sha256 = digest,
1056 };
1057 }
1058
1059 fn textDigest(value: []const u8) schema.Digest {
1060 var digest: schema.Digest = undefined;
1061 std.crypto.hash.sha2.Sha256.hash(value, &digest.bytes, .{});
1062 return digest;
1063 }
1064
1065 fn testAuditInput(
1066 ranges: []const Range,
1067 evidence: []const Evidence,
1068 ) !AuditInput {
1069 return .{
1070 .generation = 1,
1071 .source_reference = try schema.Descriptor.init(
1072 "git:0123456789abcdef",
1073 ),
1074 .source_revision = textDigest("source"),
1075 .zig_version = try schema.Descriptor.init(
1076 "Zig 0.17.0-dev.test",
1077 ),
1078 .optimize = try schema.Descriptor.init("Debug"),
1079 .artifact_bytes = 4,
1080 .artifact_digest = textDigest("test"),
1081 .ranges = ranges,
1082 .evidence = evidence,
1083 };
1084 }
1085
1086 test "auditor baseline is exact rooted and transparently residual" {
1087 var storage: Storage = .{};
1088 const ranges = [_]Range{
1089 .{
1090 .offset = 0,
1091 .length = 2,
1092 .digest = textDigest("te"),
1093 .executable = true,
1094 },
1095 .{
1096 .offset = 2,
1097 .length = 2,
1098 .digest = textDigest("st"),
1099 .executable = false,
1100 },
1101 };
1102 const evidence = [_]Evidence{.{
1103 .kind = .symbols,
1104 .digest = textDigest("symbols"),
1105 }};
1106 const generation = try assemble(
1107 &storage,
1108 try testAuditInput(&ranges, &evidence),
1109 );
1110 try std.testing.expect(generation.root.isKnown());
1111 try std.testing.expectEqual(@as(usize, 16), generation.nodes.len);
1112 try std.testing.expectEqual(@as(usize, 1), generation.claims.len);
1113 try std.testing.expectEqualStrings(
1114 "closure-audited/current-tree",
1115 generation.claims[0].name.slice(),
1116 );
1117 try std.testing.expectEqual(
1118 schema.Origin.external_unreceipted,
1119 generation.nodes[4].origin,
1120 );
1121 try std.testing.expectEqual(
1122 schema.Treatment.residual_assumption,
1123 generation.residual_roots[4].treatment,
1124 );
1125 try std.testing.expectEqual(
1126 @as(u64, 4),
1127 generation.artifacts[0].byte_length,
1128 );
1129 try std.testing.expectEqual(@as(u64, 0), generation.ranges[0].offset);
1130 try std.testing.expectEqual(@as(u64, 2), generation.ranges[0].length);
1131 try std.testing.expectEqual(@as(u64, 2), generation.ranges[1].offset);
1132 try std.testing.expectEqual(@as(u64, 2), generation.ranges[1].length);
1133 try std.testing.expect(
1134 generation.root.eql(&canonical.generation(generation)),
1135 );
1136 var visited: [limits.nodes_max]u8 = undefined;
1137 var queue: [limits.nodes_max]u32 = undefined;
1138 const result = @import("../project/root.zig").check(
1139 generation,
1140 1,
1141 .{ .visited = &visited, .queue = &queue },
1142 10_000_000,
1143 );
1144 try std.testing.expectEqual(
1145 @import("../project/root.zig").Reason.none,
1146 result.reason,
1147 );
1148 try std.testing.expectEqual(schema.Verdict.pass, result.verdict);
1149 }
1150
1151 test "auditor baseline rejects incomplete exact artifact before reuse" {
1152 var storage: Storage = .{};
1153 const evidence = [_]Evidence{.{
1154 .kind = .symbols,
1155 .digest = textDigest("symbols"),
1156 }};
1157 const audit = try testAuditInput(&.{}, &evidence);
1158 try std.testing.expectError(
1159 error.InvalidExactArtifact,
1160 assemble(&storage, audit),
1161 );
1162 }
1163
1164 test "baseline storage retains adjacent range records" {
1165 var storage: Storage = .{};
1166 _ = try storage.addRange(.{
1167 .id = 0,
1168 .artifact = 1,
1169 .offset = 0,
1170 .length = 2,
1171 .digest = textDigest("a"),
1172 .executable = true,
1173 .witness = .owned,
1174 });
1175 _ = try storage.addRange(.{
1176 .id = 0,
1177 .artifact = 1,
1178 .offset = 2,
1179 .length = 2,
1180 .digest = textDigest("b"),
1181 .executable = false,
1182 .witness = .owned,
1183 });
1184 try std.testing.expectEqual(@as(u64, 2), storage.ranges[0].length);
1185 try std.testing.expectEqual(@as(u64, 2), storage.ranges[1].length);
1186 }
1187
1188 test "baseline variable capacity rejects before storage mutation" {
1189 var storage = std.mem.zeroes(Storage);
1190 storage.node_count = 1;
1191 const before = storage;
1192 var ranges: [limits.ranges_max + 1]Range = undefined;
1193 for (&ranges) |*range| {
1194 range.* = .{
1195 .offset = 0,
1196 .length = 1,
1197 .digest = textDigest("range"),
1198 .executable = false,
1199 };
1200 }
1201 const audit = try testAuditInput(&ranges, &.{});
1202 try std.testing.expectError(
1203 error.RangeCapacityExceeded,
1204 assemble(&storage, audit),
1205 );
1206 try std.testing.expectEqualSlices(
1207 u8,
1208 std.mem.asBytes(&before),
1209 std.mem.asBytes(&storage),
1210 );
1211 }
1212
1213 comptime {
1214 std.debug.assert(16 <= limits.nodes_max);
1215 std.debug.assert(15 <= limits.edges_max);
1216 std.debug.assert(1 <= limits.artifacts_max);
1217 std.debug.assert(6 <= limits.digests_max);
1218 std.debug.assert(4 <= limits.source_records_max);
1219 std.debug.assert(2 <= limits.provenance_parents_max);
1220 std.debug.assert(1 <= limits.build_records_max);
1221 std.debug.assert(3 <= limits.lineage_references_max);
1222 std.debug.assert(2 <= limits.service_descriptors_max);
1223 std.debug.assert(15 <= limits.residual_roots_max);
1224 std.debug.assert(1 <= limits.claims_max);
1225 std.debug.assert(1 <= limits.claim_nodes_max);
1226 }