test(release): authenticate qualification evidence

.github/workflows/ci.yml

@@ -214,21 +214,32 @@ jobs:
 
       - uses: dtolnay/rust-toolchain@stable
 
-      - name: Host lifecycle and closure proofs
+      - name: Host lifecycle and closure proofs (Linux)
+        if: runner.os == 'Linux'
         run: |
           cargo test -p mc-host \
             --test broca_protocol \
             --test broca_subprocess \
             --test harness_closure \
             --test protocol_vectors
 
-      - name: Native module adapter and CLI lifecycle
+      - name: Native module adapter and CLI lifecycle (Linux)
+        if: runner.os == 'Linux'
         run: |
           cargo test -p mc-module --bin ck-mc-host
           cargo test -p mc-module \
             --test host_adapter \
             --test lifecycle_cli
 
+      # The release ships darwin payloads and the GA evidence gate requires
+      # darwin target proofs, so the native lifecycle binary and its CLI
+      # contract need macOS proof alongside the Linux integration set.
+      - name: Native lifecycle binary and CLI contract (macOS)
+        if: runner.os == 'macOS'
+        run: |
+          cargo build -p mc-module --bin ck-mc-host
+          cargo test -p mc-module --test lifecycle_cli
+
   check-plugin:
     name: Check (plugin)
     runs-on: ubuntu-latest

crates/mc-module/src/bin/ck_mc_host/spawn.rs

@@ -94,18 +94,42 @@ pub fn spawn_detached(
     };
 
     let mut pipe_fds = [0 as libc::c_int; 2];
+    // Linux creates the pipe already close-on-exec. Darwin has no `pipe2`, so
+    // there the flag is applied in a second step below.
+    #[cfg(target_os = "linux")]
     // SAFETY: pipe2 writes exactly two descriptors into the array.
     cvt(
         unsafe { libc::pipe2(pipe_fds.as_mut_ptr(), libc::O_CLOEXEC) },
         "envelope pipe creation failed",
     )?;
-    // SAFETY: the descriptors were just returned by pipe2 and are owned here.
+    #[cfg(target_os = "macos")]
+    // SAFETY: pipe writes exactly two descriptors into the array.
+    cvt(
+        unsafe { libc::pipe(pipe_fds.as_mut_ptr()) },
+        "envelope pipe creation failed",
+    )?;
+    // SAFETY: the descriptors were just returned by pipe2/pipe and are owned here.
     let (pipe_r, pipe_w) = unsafe {
         (
             OwnedFd::from_raw_fd(pipe_fds[0]),
             OwnedFd::from_raw_fd(pipe_fds[1]),
         )
     };
+    // Both ends are owned before the flag is set, so a failure here closes them
+    // instead of leaking a descriptor pair. Unlike `pipe2` this is not atomic
+    // with creation: a concurrent exec in another thread could inherit the ends
+    // in that window. The child below is the only exec this binary performs, it
+    // happens after this point, and it keeps the read end deliberately by
+    // dup2-ing it onto stdin (which clears close-on-exec) while closing every
+    // descriptor above 3.
+    #[cfg(target_os = "macos")]
+    for fd in [pipe_r.as_raw_fd(), pipe_w.as_raw_fd()] {
+        // SAFETY: fd is owned by pipe_r/pipe_w and open for this call.
+        cvt(
+            unsafe { libc::fcntl(fd, libc::F_SETFD, libc::FD_CLOEXEC) },
+            "envelope pipe cloexec failed",
+        )?;
+    }
 
     // Everything the child touches is prepared before fork: with tokio
     // worker threads alive, the child may only use async-signal-safe calls

packages/plugin/src/features/magic-context/memory/embedding-synapse.test.ts

@@ -1721,6 +1721,102 @@ describe("embedItemsDetailed", () => {
         }
     });
 
+    it("reports a page cancelled when the abort lands inside its re-validation", async () => {
+        const db = ledgerDb();
+        try {
+            const host = new DetailedHost();
+            const controller = new AbortController();
+            let demands = 0;
+            const provider = new SynapseEmbeddingProvider({
+                connectionFile: "fixture",
+                projectRoot: "/repo",
+                session: "ses-1",
+                model: MODEL,
+                fingerprint: FP,
+                tableEpoch: 0,
+                dims: 3,
+                recommendedBatch: 2,
+                batchTimeoutMs: 5_000,
+                clientFactory: async () => host,
+                demandStart: async () => {
+                    demands += 1;
+                    // The abort lands while the managed demand is in flight, so
+                    // `initialize` observes it on its own await and reports the
+                    // plain `false` a rejected `raceSignal` is folded into.
+                    controller.abort();
+                    await new Promise((resolve) => setTimeout(resolve, 0));
+                    return {
+                        ok: true,
+                        reason: "started",
+                        storage: "ready",
+                        authenticatedDaemonId: new Uint8Array([7, 7]),
+                    };
+                },
+            });
+            // Certify the lane before installing the managed origin: `initialize`
+            // is the only writer of the identity, and the pre-loop initialize
+            // must return from the already-certified state so the first page
+            // dispatches instead of demanding.
+            expect(await provider.initialize()).toBe(true);
+            const internals = provider as unknown as {
+                connectionOrigin: string;
+                compatibleDaemonId: Uint8Array | null;
+                initialized: boolean;
+            };
+            internals.connectionOrigin = "managed-default";
+            internals.compatibleDaemonId = new Uint8Array([7, 7]);
+
+            // Reproduce the state a rotation on an earlier page installs: the
+            // lane is managed and no longer certified, which is precisely the
+            // precondition the per-page re-validation exists to answer. Doing it
+            // from the first page's own response keeps the second page's
+            // `signal.aborted` check ahead of the abort, so the abort can only
+            // be observed inside the re-validation itself.
+            host.resultPages = (_jobId, items) => {
+                if (items.some((item) => item.id === "memory:1")) internals.initialized = false;
+                return {
+                    result: {
+                        ...ENVELOPE,
+                        done: true,
+                        vectors: items.map((item) => ({
+                            id: item.id,
+                            content_sha256: item.content_sha256,
+                            vector: [1, 2, 3],
+                        })),
+                    },
+                };
+            };
+
+            const result = await provider.embedItemsDetailed(
+                detailedItems([
+                    { id: "memory:1", group: "g1" },
+                    { id: "memory:2", group: "g2" },
+                ]),
+                detailedContext(db),
+                controller.signal,
+            );
+
+            // The first page completed before the identity was invalidated.
+            expect(result.receipts).toHaveLength(1);
+            expect(result.receipts[0].applicationGroup).toBe("g1");
+            // Exactly one demand: the second page's re-validation.
+            expect(demands).toBe(1);
+            expect(result.failures).toHaveLength(1);
+            const g2 = result.failures[0];
+            expect(g2.applicationGroup).toBe("g2");
+            // This read `transport`/`retryable` before the signal was re-checked
+            // after initialization, which invites a retry of a request the caller
+            // withdrew and disagrees with the `cancelled` every later page reports.
+            expect(g2.code).toBe("cancelled");
+            expect(g2.message).toBe("Synapse request aborted");
+            expect(g2.disposition).toBe("retryable");
+            // The cancelled page must never have reached the wire.
+            expect(host.batchCalls()).toHaveLength(1);
+        } finally {
+            closeQuietly(db);
+        }
+    });
+
     it("scopes an exhausted restart budget to its page and leaves sibling pages runnable", async () => {
         const db = ledgerDb();
         try {

packages/plugin/src/features/magic-context/memory/embedding-synapse.ts

@@ -895,6 +895,11 @@ export class SynapseEmbeddingProvider implements EmbeddingProvider {
         }
         for (let start = 0; start < items.length; ) {
             if (signal?.aborted || this.permanentFailure) break;
+            // A `module_restarted` failure on an earlier page invalidated the
+            // compatible daemon identity. Re-run the full initialization so
+            // the remaining pages only proceed against an incarnation that
+            // re-passed lifecycle compatibility validation.
+            if (!this.initialized && !(await this.initialize(signal))) break;
             const page = this.nextPage(items, start);
             start += page.length;
             try {
@@ -1024,6 +1029,35 @@ export class SynapseEmbeddingProvider implements EmbeddingProvider {
                     });
                     continue;
                 }
+                // A `module_restarted` failure on an earlier page invalidated
+                // the compatible daemon identity; re-validate before this page
+                // so it never rides an unverified incarnation.
+                if (!this.initialized && !(await this.initialize(signal))) {
+                    // `initialize` reports an abort raised during its own await
+                    // as a plain `false`, so the signal is re-read here. Without
+                    // it a caller-cancelled request records this one page as a
+                    // retryable `transport` failure — inviting a retry of work
+                    // the caller withdrew — while every later page correctly
+                    // reports `cancelled` from the check above.
+                    const aborted = signal?.aborted === true;
+                    result.failures.push({
+                        applicationGroup,
+                        items: manifest,
+                        rowId: null,
+                        code: this.permanentFailure
+                            ? "artifact_invalid"
+                            : aborted
+                              ? "cancelled"
+                              : "transport",
+                        message: this.permanentFailure
+                            ? "Synapse lane disabled after a permanent failure"
+                            : aborted
+                              ? "Synapse request aborted"
+                              : "Synapse lane is unavailable",
+                        disposition: this.permanentFailure ? "permanent" : "retryable",
+                    });
+                    continue;
+                }
                 try {
                     result.receipts.push(
                         await this.runDetailedPage(page, applicationGroup, context, signal),

packages/plugin/src/shared/mc-host-lifecycle/compatibility.test.ts

@@ -137,4 +137,24 @@ describe("semver parsing", () => {
             expect(parseSemverTriple(bad)).toBeNull();
         }
     });
+
+    test("leading zeroes are rejected rather than normalized", () => {
+        expect(parseSemverTriple("0.1.0")).toEqual([0, 1, 0]);
+        // Each of these would parse to an in-range triple under `\d+`, so the
+        // range gate would accept a non-canonical version.
+        for (const bad of ["00.1.0", "0.01.0", "0.1.00", "00.01.000", "01.2.3"]) {
+            expect(parseSemverTriple(bad)).toBeNull();
+        }
+    });
+
+    test("a non-canonical daemon version fails the compatibility gate", () => {
+        // `00.01.000` normalizes to `[0, 1, 0]`, which is inside the supported
+        // half-open range, so only canonical-form rejection keeps this closed.
+        const verdict = evaluateDaemonCompatibility("mc-host/00.01.000");
+        expect(verdict.ok).toBe(false);
+        if (!verdict.ok) {
+            expect(verdict.reason).toBe("incompatible_daemon");
+            expect(verdict.detail).toBe("daemon version is not a canonical mc-host/X.Y.Z value");
+        }
+    });
 });

packages/plugin/src/shared/mc-host-lifecycle/compatibility.ts

@@ -24,8 +24,17 @@ export type CompatibilityVerdict =
 
 type SemverTriple = [number, number, number];
 
+/**
+ * Each part is a semver numeric identifier: a single `0`, or a non-zero digit
+ * followed by any digits. `\d+` would also admit leading zeroes, which
+ * `Number.parseInt` then silently normalizes — `00.01.000` would parse to
+ * `[0, 1, 0]` and pass the range gate, so a non-canonical peer version would
+ * satisfy a check whose verdict promises a canonical `X.Y.Z` value.
+ */
+const CANONICAL_SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+
 export function parseSemverTriple(value: string): SemverTriple | null {
-    const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(value);
+    const match = CANONICAL_SEMVER.exec(value);
     if (!match) return null;
     const triple: SemverTriple = [
         Number.parseInt(match[1] as string, 10),
@@ -182,19 +191,57 @@ export function evaluateEpochCompatibility(observed: ObservedEpochs): Compatibil
     return { ok: true };
 }
 
+export interface CompatibilityInput {
+    authenticatedDaemonVer: string;
+    catalog: CatalogEntry[];
+    epochs: ObservedEpochs;
+}
+
+/**
+ * The single ordered source of truth for the compatibility gate: stage id,
+ * the CLI check id it reports under, and its evaluator. `evaluateCompatibility`,
+ * the managed probe's `evaluatedThrough` labels, and the policy's emitted
+ * `compatibility.*` checks all derive from this list, so a stage added or
+ * reordered in one place cannot leave the probe sequence and the reported
+ * checks disagreeing.
+ */
+export const COMPATIBILITY_STAGES = [
+    {
+        stage: "daemon",
+        checkId: "compatibility.daemon",
+        evaluate: (input: CompatibilityInput): CompatibilityVerdict =>
+            evaluateDaemonCompatibility(input.authenticatedDaemonVer),
+    },
+    {
+        stage: "modules",
+        checkId: "compatibility.modules",
+        evaluate: (input: CompatibilityInput): CompatibilityVerdict =>
+            evaluateModuleCompatibility(input.catalog),
+    },
+    {
+        stage: "epochs",
+        checkId: "compatibility.epochs",
+        evaluate: (input: CompatibilityInput): CompatibilityVerdict =>
+            evaluateEpochCompatibility(input.epochs),
+    },
+] as const;
+
+export type CompatibilityStage = (typeof COMPATIBILITY_STAGES)[number]["stage"];
+
+/** Position of `stage` in the ordered gate; the order is the array order. */
+export function compatibilityStageIndex(stage: CompatibilityStage): number {
+    return COMPATIBILITY_STAGES.findIndex((entry) => entry.stage === stage);
+}
+
 /**
  * The composed demand/status/doctor gate order: daemon range, then modules,
  * then epochs. First failure wins and is reported without any stop, replace,
  * or restart side effect (R17).
  */
-export function evaluateCompatibility(input: {
-    authenticatedDaemonVer: string;
-    catalog: CatalogEntry[];
-    epochs: ObservedEpochs;
-}): CompatibilityVerdict {
-    const daemon = evaluateDaemonCompatibility(input.authenticatedDaemonVer);
-    if (!daemon.ok) return daemon;
-    const modules = evaluateModuleCompatibility(input.catalog);
-    if (!modules.ok) return modules;
-    return evaluateEpochCompatibility(input.epochs);
+export function evaluateCompatibility(input: CompatibilityInput): CompatibilityVerdict {
+    for (const stage of COMPATIBILITY_STAGES) {
+        const verdict = stage.evaluate(input);
+        if (!verdict.ok) return verdict;
+    }
+    return { ok: true };
 }