Orginize

2026-08-18 18:11:28 -04:00
parent 0e9a650fa2
commit bbaf47028f
259 changed files with 0 additions and 0 deletions
@@ -0,0 +1,193 @@
+/**
+ * Capability word 6 optional `/proc/bare_os/*.json` payloads (env-injected or derived; bounded, non-secret).
+ * @param {string} id
+ * @param {Record<string, string>} env
+ * @param {{
+ *   ipcStats?: Record<string, unknown> | null,
+ *   delegateInflight?: unknown,
+ *   delegateRateBuckets?: unknown
+ * }} [extras]
+ */
+export function buildBareOsReplicationOperatorSurfaceProcJson(id, env, extras = {}) {
+  const now = Date.now()
+  const esc = (k) => String(env[k] ?? '').trim()
+
+  function parseJsonEnv(key) {
+    const raw = esc(key)
+    if (!raw) return null
+    try {
+      const o = JSON.parse(raw)
+      return o && typeof o === 'object' ? o : null
+    } catch {
+      return { schema: 1, error: 'invalid_json', key, atMs: now }
+    }
+  }
+
+  switch (id) {
+    case 'udx_extended':
+      return {
+        schema: 1,
+        extended: parseJsonEnv('BARE_OS_UDX_EXTENDED_STATS_JSON'),
+        note: 'UDX / transport extended counters from host via env.',
+        atMs: now
+      }
+    case 'dht_status':
+      return {
+        schema: 1,
+        dht: parseJsonEnv('BARE_OS_DHT_STATUS_JSON'),
+        note: 'Bounded DHT reachability sketch; guest does not verify routing.',
+        atMs: now
+      }
+    case 'replication_backpressure':
+      return {
+        schema: 1,
+        backpressure: parseJsonEnv('BARE_OS_REPLICATION_BACKPRESSURE_JSON'),
+        atMs: now
+      }
+    case 'ipc_backpressure': {
+      const st = extras.ipcStats
+      return {
+        schema: 1,
+        ipc: st && typeof st === 'object' ? st : null,
+        note: 'FIFO / channel depth snapshot from bareOsIpc.stats when available.',
+        atMs: now
+      }
+    }
+    case 'delegate_red':
+      return {
+        schema: 1,
+        template: 'rate-errors-duration',
+        delegateInflight: extras.delegateInflight ?? null,
+        delegateRateBuckets: extras.delegateRateBuckets ?? null,
+        overlay: parseJsonEnv('BARE_OS_DELEGATE_RED_JSON'),
+        atMs: now
+      }
+    case 'build_attestation_pointer':
+      return {
+        schema: 1,
+        pointer: parseJsonEnv('BARE_OS_BUILD_ATTESTATION_POINTER_JSON'),
+        note: 'Opaque pointer only; no attestation verification in-guest.',
+        atMs: now
+      }
+    case 'pear_ipc_health':
+      return {
+        schema: 1,
+        health: parseJsonEnv('BARE_OS_PEAR_IPC_HEALTH_JSON'),
+        atMs: now
+      }
+    case 'hypercore_lengths':
+      return {
+        schema: 1,
+        lengths: parseJsonEnv('BARE_OS_HYPERCORE_LENGTHS_JSON'),
+        atMs: now
+      }
+    case 'slo_hints':
+      return {
+        schema: 1,
+        slo: parseJsonEnv('BARE_OS_SLO_HINTS_JSON'),
+        note: 'Documentation-first SLO targets for replication.',
+        atMs: now
+      }
+    case 'locale':
+      return {
+        schema: 1,
+        locale: esc('BARE_OS_LOCALE') || null,
+        charset: esc('BARE_OS_CHARSET') || 'utf-8',
+        atMs: now
+      }
+    case 'worker_budget':
+      return {
+        schema: 2,
+        wallMsMax: esc('BARE_OS_BIN_WORKER_WALL_MS_MAX') || null,
+        cpuMsMax: esc('BARE_OS_BIN_WORKER_CPU_MS_MAX') || null,
+        kernelRunnerClassCpuMsMax: (() => {
+          const r = esc('BARE_OS_KERNEL_RUNNER_CLASS_CPU_MS_MAX_JSON')
+          if (!r) return null
+          try {
+            const o = JSON.parse(r)
+            return o && typeof o === 'object' ? o : null
+          } catch {
+            return { error: 'invalid_json' }
+          }
+        })(),
+        offloadAllowHint:
+          'BARE_OS_BIN_WORKER_ALLOW may include metaproc:* for getfacl,setfacl,xattr.',
+        note: 'Optional wall/CPU caps for bin-worker offload; class map is host-supplied JSON.',
+        atMs: now
+      }
+    case 'sandbox_profile':
+      return {
+        schema: 1,
+        profile: esc('BARE_OS_SANDBOX_PROFILE_NAME') || null,
+        capabilities: parseJsonEnv('BARE_OS_SANDBOX_CAPABILITIES_JSON'),
+        extensionUntrustedPathPrefix:
+          esc('BARE_OS_EXTENSION_PATH_PREFIX') || null,
+        seccompLikeProfileName: esc('BARE_OS_SECCOMP_LIKE_PROFILE') || null,
+        note: 'Host-interpreted capability JSON; guest makes no seccomp claims. Path prefix constrains untrusted extension VFS roots when set.',
+        atMs: now
+      }
+    case 'dns_map_active':
+      return {
+        schema: 1,
+        summary: summarizeDnsMap(esc('BARE_OS_DNS_MAP_JSON')),
+        atMs: now
+      }
+    case 'git_delegate_stats':
+      return {
+        schema: 1,
+        stats: parseJsonEnv('BARE_OS_GIT_DELEGATE_STATS_JSON'),
+        atMs: now
+      }
+    case 'corestore_snapshot':
+      return {
+        schema: 2,
+        snapshotTag: esc('BARE_OS_SEED_CORESTORE_SNAPSHOT_TAG') || null,
+        snapshotHintsJson: parseJsonEnv('BARE_OS_SEED_SNAPSHOT_HINTS_JSON'),
+        operatorSnapshotState: parseJsonEnv(
+          'BARE_OS_CORESTORE_SNAPSHOT_STATE_JSON'
+        ),
+        paused:
+          esc('BARE_OS_CORESTORE_SNAPSHOT_PAUSED') === '1' ||
+          esc('BARE_OS_CORESTORE_SNAPSHOT_PAUSED') === 'true',
+        replicationPausedEnv: Boolean(esc('BARE_OS_REPLICATION_PAUSED')),
+        note:
+          'Operator surface for Corestore snapshot tags, seeder snapshot_hints JSON, and optional host **`BARE_OS_CORESTORE_SNAPSHOT_STATE_JSON`** (non-secret lengths / paused flags from corestore-snapshot-style tooling). Replication runs on the host/seeder.',
+        atMs: now
+      }
+    case 'replication_operator_panel':
+      return {
+        schema: 1,
+        panel: parseJsonEnv('BARE_OS_REPLICATION_OPERATOR_PANEL_JSON'),
+        hypercoreLengths: parseJsonEnv('BARE_OS_HYPERCORE_LENGTHS_JSON'),
+        replicationBackpressure: parseJsonEnv(
+          'BARE_OS_REPLICATION_BACKPRESSURE_JSON'
+        ),
+        peerAllowlistHexConfigured: Boolean(esc('BARE_OS_PEER_ALLOWLIST_HEX')),
+        dhtStatus: parseJsonEnv('BARE_OS_DHT_STATUS_JSON'),
+        note:
+          'Merged P2P replication operator view; host sets BARE_OS_REPLICATION_OPERATOR_PANEL_JSON for authoritative tree length / fork / backlog fields.',
+        atMs: now
+      }
+    default:
+      return { schema: 1, error: 'unknown_wave6_proc', id, atMs: now }
+  }
+}
+
+/**
+ * @param {string} raw
+ */
+function summarizeDnsMap(raw) {
+  if (!raw) return { active: false, entryCount: 0 }
+  try {
+    const o = JSON.parse(raw)
+    if (!o || typeof o !== 'object') return { active: false, entryCount: 0 }
+    const keys = Object.keys(o)
+    return {
+      active: true,
+      entryCount: Math.min(keys.length, 256),
+      sampleKeys: keys.slice(0, 8)
+    }
+  } catch {
+    return { active: false, error: 'invalid_BARE_OS_DNS_MAP_JSON' }
+  }
+}