release: promote accepted Stage RC d97d7ccf66d9 to main

.github/workflows/build-binaries.yml

@@ -405,6 +405,22 @@ jobs:
             }
           }
 
+      - name: Include managed stage secrets in the stage package
+        if: env.ROLE_MODEL_BUILD_CHANNEL == 'stage'
+        shell: pwsh
+        env:
+          STAGE_ARTIFACT_DIGEST_KEY: ${{ secrets.STAGE_ARTIFACT_DIGEST_KEY }}
+          STAGE_ARTIFACT_ENCRYPTION_KEY: ${{ secrets.STAGE_ARTIFACT_ENCRYPTION_KEY }}
+          STAGE_DESTINATION_MATERIAL: ${{ secrets.STAGE_DESTINATION_MATERIAL }}
+          STAGE_RECOMMENDATION_MATERIAL: ${{ secrets.STAGE_RECOMMENDATION_MATERIAL }}
+        run: |
+          $secretsDir = "role-model-router/dist/release/${{ matrix.target }}/secrets"
+          New-Item -ItemType Directory -Force -Path $secretsDir | Out-Null
+          [IO.File]::WriteAllText("$secretsDir/artifact-digest.key", $env:STAGE_ARTIFACT_DIGEST_KEY)
+          [IO.File]::WriteAllText("$secretsDir/artifact-encryption.key", $env:STAGE_ARTIFACT_ENCRYPTION_KEY)
+          [IO.File]::WriteAllText("$secretsDir/destination-material.json", $env:STAGE_DESTINATION_MATERIAL)
+          [IO.File]::WriteAllText("$secretsDir/recommendation-material.json", $env:STAGE_RECOMMENDATION_MATERIAL)
+
       - name: Archive standalone package (Unix)
         if: matrix.target != 'win32-x64'
         run: |

.github/workflows/ci.yml

@@ -210,6 +210,7 @@ jobs:
           done
           test -s "$recommendation_material"
           node _private/scripts/track-b/launch-packaged-runtime.mjs \
+            --ci-contract \
             --public-root "$GITHUB_WORKSPACE" \
             --manifest "$GITHUB_WORKSPACE/_private/dist/run00-dev/track-b-runtime-manifest.json" \
             --qa-extension-manifest "$GITHUB_WORKSPACE/role-model-router/apps/runtime-host-bridge/test/fixtures/recursive-87-synthetic-extension.manifest.json" \
@@ -228,4 +229,4 @@ jobs:
             --url http://127.0.0.1:3462/healthz \
             --timeout-ms 120000 \
             --poll-interval-ms 1000
-          pnpm --filter @role-model-router/runtime-ui exec playwright test --grep @recursive:87-direct-track-b-semantic-completion
+          pnpm --filter @role-model-router/runtime-ui exec playwright test --grep @recursive:94-direct-track-b-storage-graph-cloud-roundtrip

.gitignore

@@ -16,3 +16,5 @@ tmp-role-model-launch.log
 role-model-router/apps/runtime-ui/build/
 role-model-router/apps/runtime-ui/test-results/
 /.recursive/config/recursive-router-discovered.json
+# CI paired-checkout directory (checkout of try-works/role-model-internal nested by the track-b lane)
+_private/

package.json

@@ -53,6 +53,7 @@
     "test:track-b-router-continuity": "node scripts/track-b/run-command-test.mjs TB03-CMD-02",
     "test:track-b-capacity": "node scripts/track-b/run-command-test.mjs TB03-CMD-03",
     "storage:audit": "node scripts/track-b/run-command-test.mjs TB04-CMD-01",
+    "storage:audit:read-only": "node scripts/track-b/storage-audit.mjs",
     "storage:migrate:dry-run": "node scripts/track-b/run-command-test.mjs TB04-CMD-02",
     "test:track-b-performance-history": "node scripts/track-b/run-command-test.mjs TB04-CMD-03",
     "storage:migrate:verify-parity": "node scripts/track-b/run-command-test.mjs TB04-CMD-04",

packages/extension-host/index.mjs

@@ -472,7 +472,13 @@ export class ExtensionHost {
       return Promise.reject(
         new Error("oversized payload requires a channel-local transfer artifact"),
       );
-    if (envelope.capability && !registered.descriptor.capabilities.includes(envelope.capability))
+    const hostReadCapability =
+      registered.kind === "process" && envelope.capability === "extension-output:read";
+    if (
+      envelope.capability &&
+      !hostReadCapability &&
+      !registered.descriptor.capabilities.includes(envelope.capability)
+    )
       return Promise.reject(new Error("capability denied"));
     if (envelope.signal?.aborted) {
       this.#record(id, "cancelled", envelope);

packages/extension-host/worker-runtime.mjs

@@ -1,4 +1,8 @@
+import { createHash } from "node:crypto";
 import { once } from "node:events";
+import { mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
 import { pathToFileURL } from "node:url";
 import { encodeFrame, extractFrames } from "../extension-sdk/index.mjs";
 
@@ -7,6 +11,116 @@ if (!moduleRef) throw new Error("worker module URL required");
 const extension = await import(moduleRef.includes(":") ? moduleRef : pathToFileURL(moduleRef).href);
 if (typeof extension.run !== "function") throw new Error("worker module must export run(envelope)");
 
+const extensionId = process.env.ROLE_MODEL_EXTENSION_ID ?? "unknown-extension";
+const stateRoot = process.env.ROLE_MODEL_EXTENSION_STATE_ROOT;
+if (stateRoot) mkdirSync(stateRoot, { recursive: true });
+const outputDatabase = new DatabaseSync(
+  stateRoot ? join(stateRoot, "durable-output.sqlite") : ":memory:",
+);
+outputDatabase.exec(`
+  PRAGMA journal_mode=WAL;
+  PRAGMA synchronous=FULL;
+  CREATE TABLE IF NOT EXISTS durable_extension_outputs (
+    output_key TEXT PRIMARY KEY,
+    request_id TEXT NOT NULL,
+    capability TEXT NOT NULL,
+    channel TEXT NOT NULL,
+    scope_id TEXT NOT NULL,
+    result_hash TEXT NOT NULL,
+    byte_length INTEGER NOT NULL,
+    result_json TEXT,
+    created_at TEXT NOT NULL
+  );
+  CREATE INDEX IF NOT EXISTS durable_extension_outputs_created
+    ON durable_extension_outputs(created_at, output_key);
+`);
+const MAX_INLINE_OUTPUT_BYTES = 16 * 1024;
+const MAX_DURABLE_OUTPUT_ROWS = 512;
+
+function persistBusinessOutput(envelope, result) {
+  const capability = envelope.capability ?? "health:probe";
+  const resultJson = JSON.stringify(result ?? null);
+  const byteLength = Buffer.byteLength(resultJson, "utf8");
+  const resultHash = `sha256:${createHash("sha256").update(resultJson).digest("hex")}`;
+  const outputKey = `sha256:${createHash("sha256")
+    .update(`${extensionId}\0${envelope.requestId}\0${capability}\0${resultHash}`)
+    .digest("hex")}`;
+  outputDatabase
+    .prepare("INSERT OR IGNORE INTO durable_extension_outputs VALUES (?,?,?,?,?,?,?,?,?)")
+    .run(
+      outputKey,
+      envelope.requestId,
+      capability,
+      envelope.channel,
+      envelope.scope,
+      resultHash,
+      byteLength,
+      byteLength <= MAX_INLINE_OUTPUT_BYTES ? resultJson : null,
+      new Date().toISOString(),
+    );
+  outputDatabase
+    .prepare(`DELETE FROM durable_extension_outputs WHERE output_key IN (
+      SELECT output_key FROM durable_extension_outputs
+      ORDER BY created_at DESC, output_key DESC LIMIT -1 OFFSET ?
+    )`)
+    .run(MAX_DURABLE_OUTPUT_ROWS);
+  const durableLocator = Object.freeze({
+    extensionId,
+    requestId: envelope.requestId,
+    capability,
+    channel: envelope.channel,
+    scope: envelope.scope,
+    outputKey,
+    resultHash,
+    byteLength,
+  });
+  const businessOutput =
+    result && typeof result === "object" && !Array.isArray(result) ? result : { value: result };
+  return {
+    ...businessOutput,
+    businessOutput,
+    durableLocator,
+    evidenceRef: `extension-output:${outputKey}`,
+    readCapability: "extension-output:read",
+  };
+}
+
+function readBusinessOutput(envelope) {
+  const locator = envelope.payload?.durableLocator;
+  const durableOutputId = envelope.payload?.durableOutputId;
+  if (
+    !locator ||
+    locator.extensionId !== extensionId ||
+    locator.channel !== envelope.channel ||
+    locator.scope !== envelope.scope ||
+    !locator.outputKey ||
+    !durableOutputId
+  ) {
+    throw new Error("durable extension output read identity is incomplete");
+  }
+  const row = outputDatabase
+    .prepare("SELECT * FROM durable_extension_outputs WHERE output_key=?")
+    .get(locator.outputKey);
+  if (
+    !row ||
+    row.request_id !== locator.requestId ||
+    row.capability !== locator.capability ||
+    row.channel !== locator.channel ||
+    row.scope_id !== locator.scope ||
+    row.result_hash !== locator.resultHash ||
+    row.byte_length !== locator.byteLength
+  ) {
+    throw new Error("durable extension output locator does not match stored evidence");
+  }
+  return {
+    durableLocator: locator,
+    evidenceRef: `extension-output:${locator.outputKey}`,
+    readbackOutputId: durableOutputId,
+    resultHash: row.result_hash,
+    byteLength: row.byte_length,
+  };
+}
+
 const retained = new Map();
 let input = Buffer.alloc(0);
 const send = async (value) => {
@@ -24,12 +138,22 @@ process.stdin.on("data", async (chunk) => {
       continue;
     }
     if (message.type === "shutdown") {
+      outputDatabase.close();
       await send({ type: "shutdown-ack" });
       process.exit(0);
     }
     if (message.type !== "invoke") continue;
     try {
-      const result = await extension.run(message.envelope);
+      let result;
+      if (message.envelope.capability === "extension-output:read") {
+        result = readBusinessOutput(message.envelope);
+      } else {
+        const value = await extension.run(message.envelope);
+        result =
+          message.envelope.capability === "health:probe"
+            ? value
+            : persistBusinessOutput(message.envelope, value);
+      }
       const response = { type: "result", requestId: message.requestId, result };
       retained.set(message.requestId, response);
       await send(response);