ci: activate Stage A worker measurement

.github/workflows/ci.yml

@@ -31,4 +31,4 @@ jobs:
       contents: read
     # Caller выбирает revision, который чекаутит worker, включая код PR. Сам код
     # считается недоверенным и исполняется только внутри одноразовой ячейки.
-    uses: Labpics-Team/lab-colors/.github/workflows/ci-worker.yml@1461bc2ed60142aed3a8723e618b883be6418156
+    uses: Labpics-Team/lab-colors/.github/workflows/ci-worker.yml@beecd257371a7a6421079b0d8207a109969aa332

packages/colors/bench/private-program-wasm.json

@@ -0,0 +1,33 @@
+{
+  "schemaVersion": 1,
+  "role": "private-program-consumer",
+  "artifact": "packages/colors/private-program/labcolors_private_program.wasm",
+  "toolchain": {
+    "rust": "1.96.0",
+    "rustcCommit": "ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96",
+    "cargo": "1.96.0",
+    "cargoCommit": "30a34c6821b57de0aaec83a901aca39f88f6778c",
+    "target": "wasm32-unknown-unknown",
+    "profile": "release",
+    "feature": "private-fixture",
+    "node": "24.14.0",
+    "binaryenRelease": "version_117",
+    "binaryenNodeArchiveSha256": "2d5a42f2d167a7cc2b4b6664c44c5ace1690d13db4f527324f052afbad461a07",
+    "binaryenComponentSha256": {
+      "wasm-opt.js": "c0b4bc26f1a588dc686ae36b32c4fea3d7b99f4fb8a1778d0ba4129f326f8449",
+      "wasm-opt.wasm": "d823328d8fcad3a59aa605c61d1620d30b9156f086d30ff3246b43c32526856b",
+      "wasm-opt.worker.js": "5b7952731f6ea1d5954db968e45b13f862853e6ef14a03b3f35d036f6136b624"
+    },
+    "wasmOptFlags": "-Oz --enable-bulk-memory --enable-nontrapping-float-to-int"
+  },
+  "measurement": {
+    "source": "github-actions-run-31473003387",
+    "platform": "linux-x64",
+    "rawBytes": 339336
+  },
+  "policy": {
+    "maxRawBytes": 339336,
+    "basis": "exact optimized private Program artifact from GitHub Actions Linux",
+    "gzip": "diagnostic-only"
+  }
+}

packages/colors/test/private-program-ci-contract.test.mjs

@@ -17,7 +17,7 @@ const root = resolve(here, "../../..");
 const read = (...parts) => readFileSync(join(root, ...parts), "utf8");
 const normalizeNewlines = (value) => value.replaceAll("\r\n", "\n");
 
-const CALLER_WORKER_SHA = "1461bc2ed60142aed3a8723e618b883be6418156";
+const CALLER_WORKER_SHA = "beecd257371a7a6421079b0d8207a109969aa332";
 const CALLER_WORKER_REFERENCE =
   `    uses: Labpics-Team/lab-colors/.github/workflows/ci-worker.yml@${CALLER_WORKER_SHA}`;
 const RUNTIME_BUDGET_COMMAND = "        run: node scripts/check-wasm-size-budget.mjs";
@@ -182,12 +182,15 @@ function assertPrivateMutationDeadline(workflow) {
   assert.ok(70 > 40 + 20 + 5, "outer timeout must exceed declared budgets and teardown headroom");
 }
 
-test("Stage A keeps the public caller pinned to the pre-Stage-B immutable worker", () => {
+test("Stage B activates the public caller at the merged Stage A worker commit", () => {
   const caller = read(".github", "workflows", "ci.yml");
   assertImmutableCaller(caller);
 
   for (const mutation of [
     caller.replace(CALLER_WORKER_SHA, "0".repeat(40)),
+    caller.replace(CALLER_WORKER_SHA, "main"),
+    caller.replace(CALLER_WORKER_SHA, CALLER_WORKER_SHA.slice(0, 12)),
+    caller.replace(CALLER_WORKER_REFERENCE, ""),
     caller.replace(CALLER_WORKER_REFERENCE, `${CALLER_WORKER_REFERENCE}\n${CALLER_WORKER_REFERENCE}`),
     caller.replace(
       CALLER_WORKER_REFERENCE,
@@ -261,6 +264,15 @@ test("worker binds the browser proof to the exact verified tarball bytes", () =>
   assert.throws(() => assertWorkerOrderAndRoles(reordered));
 });
 
+test("private Program browser proof owns the CI Chrome launch invariant", () => {
+  const browserProof = read("scripts", "test-private-program-browser.mjs");
+  assert.match(
+    browserProof,
+    /"--no-sandbox",/u,
+    "the userspace CfT proof must opt out of an unavailable host sandbox",
+  );
+});
+
 test("private mutation keeps its own deadline reachable inside the wasm job", () => {
   const worker = read(".github", "workflows", "ci-worker.yml");
   assertPrivateMutationDeadline(worker);

packages/colors/test/private-program-mutation-contract.test.mjs

@@ -16,6 +16,7 @@ import {
   parseMutationTimeoutPolicy,
   validateMutationWasm,
 } from "../../../scripts/test-private-program-mutations.mjs";
+import { copyDeclaredCargoRegistryIndex } from "../../../scripts/build-private-program.mjs";
 
 const EXPECTED_MUTATIONS = Object.freeze([
   [
@@ -24,39 +25,39 @@ const EXPECTED_MUTATIONS = Object.freeze([
     "rust-wasm",
     "crates/labcolors-core/src/private_fixture.rs",
     "6d43e030e5d6f4df67b319276d3d9ea1ab33d5b91a2094019ce278476cecd412",
-    "PrivateProgramConsumerError: private Program run failed with status 6",
+    "PrivateProgramConsumerError: private Program consumer: run failed with status 6",
   ],
   [
     "hard-constraint-deletion",
     "semantic",
     "rust-wasm",
     "crates/labcolors-core/src/private_fixture.rs",
     "0e43717331468ae6fb6c65bb6ba441cd5260b49b37ad3c6927a9bbf02494638b",
-    "PrivateProgramConsumerError: private Program run failed with status 6",
+    "PrivateProgramConsumerError: private Program consumer: run failed with status 6",
   ],
   [
     "final-recheck-call-edge-deletion",
     "semantic-source-deletion",
     "rust-wasm",
     "crates/labcolors-core/src/program_session.rs",
     "8e218fddef0b8a13f044b91b7927faeb50e501a54ecb205c05696d6510fe615e",
-    "PrivateProgramConsumerError: private Program run failed with status 8",
+    "PrivateProgramConsumerError: private Program consumer: run failed with status 8",
   ],
   [
     "session-observed-update-bypass",
     "semantic",
     "rust-wasm",
     "crates/labcolors-core/src/private_fixture.rs",
     "8770e1a30407e9cd9ec3ee32feed44cd2b58a0d39be3c636cb428be8b1c472fe",
-    "PrivateProgramConsumerError: shipping trace permits exactly one SetAll callback",
+    "PrivateProgramConsumerError: private Program consumer: shipping trace permits exactly one SetAll callback",
   ],
   [
     "external-attachment-handoff-binding-bypass",
     "semantic-source-bypass",
     "rust-wasm",
     "crates/labcolors-core/src/private_fixture.rs",
     "59f5bc640fbc270db4dbbda5572e339c90aa839d61cab0ac155ef8db5e1e5d59",
-    "PrivateProgramConsumerError: private Program run failed with status 7",
+    "PrivateProgramConsumerError: private Program consumer: run failed with status 7",
   ],
   [
     "javascript-publish-deletion",
@@ -154,6 +155,31 @@ test("exact source mutation rejects missing, repeated, and no-op anchors", () =>
   );
 });
 
+test("isolated offline mutation builds copy the declared Cargo registry index", async () => {
+  const temporary = await mkdtemp(join(tmpdir(), "labcolors-mutation-cargo-index-"));
+  const declaredCargoHome = join(temporary, "declared-cargo");
+  const isolatedCargoHome = join(temporary, "isolated-cargo");
+  try {
+    await mkdir(join(declaredCargoHome, "registry", "index", "registry.example"), {
+      recursive: true,
+    });
+    await writeFile(
+      join(declaredCargoHome, "registry", "index", "registry.example", "config.json"),
+      "{}\n",
+    );
+    await copyDeclaredCargoRegistryIndex(isolatedCargoHome, { declaredCargoHome });
+    assert.equal(
+      readFileSync(
+        join(isolatedCargoHome, "registry", "index", "registry.example", "config.json"),
+        "utf8",
+      ),
+      "{}\n",
+    );
+  } finally {
+    await rm(temporary, { recursive: true, force: true });
+  }
+});
+
 test("a mutation kill requires its real-browser assertion and semantic marker", () => {
   const definition = PRIVATE_PROGRAM_MUTATION_CASES[0];
   const killed = Object.freeze({
@@ -162,7 +188,7 @@ test("a mutation kill requires its real-browser assertion and semantic marker",
     stdout: "",
     stderr:
       "Error: private Program browser proof: browser assertion failed: " +
-      "PrivateProgramConsumerError: private Program run failed with status 6",
+      "PrivateProgramConsumerError: private Program consumer: run failed with status 6",
   });
   assert.equal(assertMutationSpecificBrowserFailure(definition, killed), true);
   assert.throws(
@@ -189,7 +215,7 @@ test("a mutation kill requires its real-browser assertion and semantic marker",
         ...killed,
         stderr: "private Program browser proof: browser assertion failed: wrong failure",
       }),
-    /mutation-specific failure evidence/u,
+    /mutation-specific failure evidence: expected=.*actual=/u,
   );
   assert.throws(
     () =>

packages/colors/test/release-contract.test.mjs

@@ -2174,6 +2174,11 @@ test("the atomic output sink has one bounded pinned-Chrome browser gate", () =>
     assert.match(source, /const chromeDriverPath = await executableFromEnv\("CHROMEDRIVER_PATH"\);/u);
     assert.match(source, /startChromeDriver\(\s*chromeDriverPath,/u);
     assert.match(source, /binary: chromePath,/u);
+    assert.match(
+      source,
+      /"--no-sandbox",/u,
+      "the userspace CfT proof must opt out of an unavailable host sandbox",
+    );
     assert.match(source, /spawn\(executable, \["--port=0"\]/u);
     assert.match(
       source,

scripts/build-private-program.mjs

@@ -944,6 +944,16 @@ export async function assertCanonicalCargoConfigurationAbsent(options = {}) {
   return true;
 }
 
+export async function copyDeclaredCargoRegistryIndex(
+  cargoHome,
+  { declaredCargoHome = resolve(environmentValue(process.env, "CARGO_HOME")?.trim() || join(homedir(), ".cargo")) } = {},
+) {
+  const sourceIndex = resolve(declaredCargoHome, "registry", "index");
+  const targetIndex = resolve(cargoHome, "registry", "index");
+  await assertRegistryIndexLinksContained(sourceIndex);
+  await cp(sourceIndex, targetIndex, { recursive: true });
+}
+
 async function assertRegistryIndexLinksContained(root) {
   const pending = [root];
   while (pending.length > 0) {
@@ -984,14 +994,8 @@ async function createBuildSandbox({ canonical }) {
   await mkdir(temporaryDirectory, { recursive: true, mode: 0o700 });
   if (canonical) {
     await mkdir(cargoHome, { recursive: true, mode: 0o700 });
-    const declaredCargoHome = resolve(
-      environmentValue(process.env, "CARGO_HOME")?.trim() || join(homedir(), ".cargo"),
-    );
-    const sourceIndex = resolve(declaredCargoHome, "registry", "index");
-    const targetIndex = resolve(cargoHome, "registry", "index");
     try {
-      await assertRegistryIndexLinksContained(sourceIndex);
-      await cp(sourceIndex, targetIndex, { recursive: true });
+      await copyDeclaredCargoRegistryIndex(cargoHome);
     } catch (error) {
       fail(`canonical build requires the declared Cargo registry index: ${error.message}`);
     }

scripts/test-browser-output-sink.mjs

@@ -1335,6 +1335,7 @@ async function main() {
                   "--disable-sync",
                   "--metrics-recording-only",
                   "--no-first-run",
+                  "--no-sandbox",
                   "--window-size=800,600",
                 ],
               },

scripts/test-private-program-browser.mjs

@@ -614,6 +614,7 @@ async function main() {
                   "--disable-sync",
                   "--metrics-recording-only",
                   "--no-first-run",
+                  "--no-sandbox",
                   "--no-proxy-server",
                   "--password-store=basic",
                   "--safebrowsing-disable-auto-update",

scripts/test-private-program-mutations.mjs

@@ -35,6 +35,7 @@ import {
   PRIVATE_PROGRAM_CONSUMER_PATH,
   PRIVATE_PROGRAM_WASM_PATH,
   PRIVATE_PROGRAM_WASM_SURFACE,
+  copyDeclaredCargoRegistryIndex,
   validatePrivateProgramWasmSurface,
 } from "./build-private-program.mjs";
 import { PRIVATE_PROGRAM_BROWSER_PASS_RECEIPT } from "./test-private-program-browser.mjs";
@@ -91,7 +92,7 @@ export const PRIVATE_PROGRAM_MUTATION_CASES = Object.freeze([
     ),
     replacement: "",
     expectedBrowserAssertion:
-      "PrivateProgramConsumerError: private Program run failed with status 6",
+      "PrivateProgramConsumerError: private Program consumer: run failed with status 6",
   }),
   mutation({
     id: "hard-constraint-deletion",
@@ -107,7 +108,7 @@ export const PRIVATE_PROGRAM_MUTATION_CASES = Object.freeze([
     ),
     replacement: "",
     expectedBrowserAssertion:
-      "PrivateProgramConsumerError: private Program run failed with status 6",
+      "PrivateProgramConsumerError: private Program consumer: run failed with status 6",
   }),
   mutation({
     id: "final-recheck-call-edge-deletion",
@@ -141,7 +142,7 @@ export const PRIVATE_PROGRAM_MUTATION_CASES = Object.freeze([
     ),
     replacement: lines("    let has_hard_violation = false;"),
     expectedBrowserAssertion:
-      "PrivateProgramConsumerError: private Program run failed with status 8",
+      "PrivateProgramConsumerError: private Program consumer: run failed with status 8",
   }),
   mutation({
     id: "session-observed-update-bypass",
@@ -161,7 +162,7 @@ export const PRIVATE_PROGRAM_MUTATION_CASES = Object.freeze([
       "    })",
     ).slice(0, -1),
     expectedBrowserAssertion:
-      "PrivateProgramConsumerError: shipping trace permits exactly one SetAll callback",
+      "PrivateProgramConsumerError: private Program consumer: shipping trace permits exactly one SetAll callback",
   }),
   mutation({
     id: "external-attachment-handoff-binding-bypass",
@@ -178,7 +179,7 @@ export const PRIVATE_PROGRAM_MUTATION_CASES = Object.freeze([
       "            ),",
     ),
     expectedBrowserAssertion:
-      "PrivateProgramConsumerError: private Program run failed with status 7",
+      "PrivateProgramConsumerError: private Program consumer: run failed with status 7",
   }),
   mutation({
     id: "javascript-publish-deletion",
@@ -316,7 +317,11 @@ export function assertMutationSpecificBrowserFailure(definition, result) {
     .slice(assertionLine.indexOf(BROWSER_ASSERTION_PREFIX) + BROWSER_ASSERTION_PREFIX.length)
     .trim();
   if (actualAssertion !== definition.expectedBrowserAssertion) {
-    fail(`${definition.id} did not emit its mutation-specific failure evidence`);
+    fail(
+      `${definition.id} did not emit its mutation-specific failure evidence: ` +
+        `expected=${JSON.stringify(definition.expectedBrowserAssertion)} ` +
+        `actual=${JSON.stringify(actualAssertion)}`,
+    );
   }
   return true;
 }
@@ -1090,6 +1095,7 @@ async function executeMutationProof({ tarball, expectedSha256 }, policy) {
       mkdir(resolve(root, "cargo-home"), { recursive: true }),
       mkdir(resolve(root, "cargo-temp"), { recursive: true }),
     ]);
+    await copyDeclaredCargoRegistryIndex(resolve(root, "cargo-home"));
     const executors = await resolveCanonicalRustExecutors(runner);
     const optimizer = await resolveCanonicalOptimizer(root, runner);
     const cargo = cargoEnvironment({ workspace, root, target, executors });

scripts/test_mutation.py

@@ -1849,7 +1849,7 @@ def test_reusable_workers_bound_jobs_and_binaryen_transport(self) -> None:
         ci_caller = (workflows / "ci.yml").read_text(encoding="utf-8")
         admitted_ci_worker = (
             "uses: Labpics-Team/lab-colors/.github/workflows/ci-worker.yml@"
-            "1461bc2ed60142aed3a8723e618b883be6418156"
+            "beecd257371a7a6421079b0d8207a109969aa332"
         )
         self.assertEqual(ci_caller.count("ci-worker.yml@"), 1)
         self.assertIn(admitted_ci_worker, ci_caller)