Living homepage and game-like world motion, cached Atlas, gated storage routing

.github/workflows/ci.yml

@@ -1,7 +1,7 @@
 name: CI
 on:
   push:
-    branches: [main]
+    branches: [main, feature/atlas-cached-exploration]
   pull_request:
 permissions:
   contents: read
@@ -14,6 +14,7 @@ jobs:
     timeout-minutes: 15
     env:
       MOONSHOT_BUDGET_USD: "0"
+      MOONSHOT_OFFLINE_FIXTURE: "1"
       MOONSHOT_BASE_PATH: /github-factory/
     steps:
       - uses: actions/checkout@v4
@@ -28,7 +29,7 @@ jobs:
       - name: Verify prefixed production app in Chromium
         shell: bash
         run: |
-          HOST=127.0.0.1 PORT=4177 bun run start > /tmp/github-factory.log 2>&1 &
+          HOST=127.0.0.1 PORT=4177 bun --no-env-file --preload ./test/fixtures/offline-runtime.ts .output/server/index.mjs > /tmp/github-factory.log 2>&1 &
           app_pid=$!
           trap 'kill "$app_pid" 2>/dev/null || true' EXIT
           for attempt in {1..30}; do

deploy/d1-storage.ts

@@ -17,7 +17,7 @@ export interface StorageEnvironment {
   WORLDS_DB?: WorldD1Binding; FACTORY_STORAGE_SECRET?: string;
   FACTORY_STORAGE_DATABASE_ID?: string; FACTORY_MIGRATION_EPOCH?: string;
   FACTORY_SOURCE_SHA?: string; FACTORY_WORKER_BUNDLE_SHA256?: string;
-  FACTORY_ADMISSION_FENCE?: string; FACTORY_STORAGE_MODE?: string;
+  FACTORY_ADMISSION_FENCE?: string; FACTORY_STORAGE_MODE?: string; FACTORY_STORAGE_BINDING_NONCE?: string;
 }
 const reply = (value: unknown, status = 200) => Response.json(value, { status, headers: { "cache-control": "no-store", "x-content-type-options": "nosniff" } });
 const record = (x: unknown): x is Record<string, unknown> => Boolean(x) && typeof x === "object" && !Array.isArray(x);
@@ -33,34 +33,41 @@ async function equalSecret(actual: string, expected: string) {
   for (let i = 0; i < a.length; i++) different |= a[i]! ^ b[i]!;
   return different === 0;
 }
-async function boundedBody(request: Request) {
-  if (Number(request.headers.get("content-length")) > 2 * 1024 * 1024) throw new Error("invalid input");
+async function boundedBody(request: Request, proofOnly = false) {
+  const maxBytes = proofOnly ? 4096 : 2 * 1024 * 1024;
+  if (Number(request.headers.get("content-length")) > maxBytes) throw new Error("invalid input");
   const reader = request.body?.getReader(); if (!reader) throw new Error("invalid input");
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const timeout = proofOnly ? new Promise<never>((_, reject) => { timer = setTimeout(() => reject(new Error("invalid input")), 5000); }) : null;
   const chunks: Uint8Array[] = []; let length = 0;
-  try { for (;;) { const { value, done } = await reader.read(); if (done) break; length += value.byteLength; if (length > 2 * 1024 * 1024) throw new Error("invalid input"); chunks.push(value); } }
-  finally { await reader.cancel().catch(() => {}); }
+  try { for (;;) { const { value, done } = await (timeout ? Promise.race([reader.read(), timeout]) : reader.read()); if (done) break; length += value.byteLength; if (length > maxBytes) { clearTimeout(timer); throw new Error("invalid input"); } chunks.push(value); } }
+  finally { clearTimeout(timer); if (proofOnly) void reader.cancel().catch(() => {}); else await reader.cancel().catch(() => {}); }
   const bytes = new Uint8Array(length); let offset = 0; for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength; }
-  const body = JSON.parse(new TextDecoder().decode(bytes)); if (!record(body)) throw new Error("invalid input"); return body;
+  const body = JSON.parse(new TextDecoder("utf-8", { fatal: proofOnly }).decode(bytes)); if (!record(body)) throw new Error("invalid input"); return body;
 }
 
 /** Private fixed-operation RPC. It accepts neither caller SQL nor URLs/prompts,
  * and this Worker has no model key, management token or paid ledger binding. */
-export async function worldStorageRpc(request: Request, env: StorageEnvironment): Promise<Response> {
+export async function worldStorageRpc(request: Request, env: StorageEnvironment, profile: "default" | "rollback-proof" = "default"): Promise<Response> {
   if (!(await equalSecret(request.headers.get("x-factory-storage-key") || "", env.FACTORY_STORAGE_SECRET || "")))
     return reply({ error: "Storage authorization required" }, 403);
+  if (profile !== "default" && profile !== "rollback-proof") return reply({ error: "Storage profile rejected" }, 403);
+  const proofOnly = profile === "rollback-proof";
+  if (proofOnly && (env.FACTORY_STORAGE_MODE !== "probe-only" || env.FACTORY_STORAGE_DATABASE_ID !== "b2210c4a-4ed3-49ba-b044-2f6c24958fac" || env.FACTORY_ADMISSION_FENCE !== "" || !/^[a-f0-9]{32}$/.test(env.FACTORY_STORAGE_BINDING_NONCE || ""))) return reply({ error: "Proof configuration unavailable" }, 503);
   if (request.method !== "POST" || request.headers.get("content-type")?.split(";")[0]?.trim() !== "application/json")
     return reply({ error: "Storage operation rejected" }, 400);
   if (!env.WORLDS_DB) return reply({ error: "Authoritative storage unavailable" }, 503);
   let body: Record<string, unknown>;
-  try { body = await boundedBody(request); } catch { return reply({ error: "Storage operation rejected" }, 400); }
+  try { body = await boundedBody(request, proofOnly); } catch { return reply({ error: "Storage operation rejected" }, 400); }
+  if (proofOnly && !(body.op === "status" && fields(body, ["op"]) || body.op === "probe" && fields(body, ["op", "action", "nonce"]) && body.action === "rollback" && typeof body.nonce === "string" && /^[a-f0-9]{32}$/.test(body.nonce))) return reply({ error: "Only status and rollback proof permitted" }, 403);
   const db = env.WORLDS_DB.withSession?.("first-primary") ?? env.WORLDS_DB;
   let identity: StorageIdentity;
   const ok = (result: unknown) => reply({ ok: true, backend: "d1", op: body.op, identity, result });
   try {
     if (!["probe-only", "worlds"].includes(env.FACTORY_STORAGE_MODE || "")) throw new Error("Storage mode unavailable");
     if (env.FACTORY_STORAGE_MODE === "probe-only" && body.op !== "status" && body.op !== "probe") return reply({ error: "This bridge permits synthetic probes only" }, 403);
     const stored = await db.prepare("SELECT database_uuid,binding_nonce FROM storage_identity WHERE singleton=1").first<{ database_uuid: string; binding_nonce: string }>();
-    if (!stored || stored.database_uuid !== env.FACTORY_STORAGE_DATABASE_ID || !/^[a-f0-9]{32}$/.test(stored.binding_nonce) ||
+    if (!stored || proofOnly && stored.binding_nonce !== env.FACTORY_STORAGE_BINDING_NONCE || stored.database_uuid !== env.FACTORY_STORAGE_DATABASE_ID || !/^[a-f0-9]{32}$/.test(stored.binding_nonce) ||
       !/^[a-f0-9]{32}$/.test(env.FACTORY_MIGRATION_EPOCH || "") || !/^[a-f0-9]{40}$/.test(env.FACTORY_SOURCE_SHA || "") || !/^[a-f0-9]{64}$/.test(env.FACTORY_WORKER_BUNDLE_SHA256 || "")) throw new Error("D1 identity unavailable");
     identity = { databaseId: stored.database_uuid, bindingNonce: stored.binding_nonce, epoch: env.FACTORY_MIGRATION_EPOCH!, sourceSha: env.FACTORY_SOURCE_SHA!, workerBundleSha256: env.FACTORY_WORKER_BUNDLE_SHA256!, admissionFenced: env.FACTORY_ADMISSION_FENCE === env.FACTORY_MIGRATION_EPOCH };
     if (body.op === "migrationSnapshot") {
@@ -145,6 +152,7 @@ export async function worldStorageRpc(request: Request, env: StorageEnvironment)
       return ok({ backend: "d1", authoritative: true, databaseId: identity.databaseId, schemaVersion: version.version, worlds: worlds.count, aliases: aliases.count });
     }
     if (body.op === "probe") {
+      if (proofOnly && (await db.prepare("SELECT MAX(version) version FROM schema_migrations").first<{version:number}>())?.version !== 2) throw new Error("D1 schema unavailable");
       if (!fields(body, ["op", "action", "nonce"]) || typeof body.nonce !== "string" || !/^[a-f0-9]{32}$/.test(body.nonce)) throw new TypeError();
       const id = `storage-rpc-synthetic-${body.nonce}`;
       if (body.action === "rollback") {

deploy/d1/0003-history.sql

@@ -0,0 +1,56 @@
+-- UNAPPLIED. Offline history core only; runtime schema/version acceptance and
+-- migration authorization require separate review. Existing schema is untouched.
+CREATE TABLE history_repositories (
+  repo TEXT PRIMARY KEY,
+  revision INTEGER NOT NULL CHECK(revision >= 0),
+  normalized_bytes INTEGER NOT NULL CHECK(normalized_bytes >= 0 AND normalized_bytes <= 12582912)
+);
+CREATE TABLE history_commits (
+  repo TEXT NOT NULL REFERENCES history_repositories(repo),
+  sha TEXT NOT NULL,
+  payload TEXT NOT NULL,
+  PRIMARY KEY(repo,sha)
+);
+CREATE TABLE history_anchors (
+  repo TEXT NOT NULL REFERENCES history_repositories(repo),
+  anchor_key TEXT NOT NULL,
+  generation TEXT NOT NULL,
+  payload TEXT NOT NULL,
+  PRIMARY KEY(repo,anchor_key),
+  UNIQUE(repo,generation)
+);
+CREATE TABLE history_frames (
+  repo TEXT NOT NULL REFERENCES history_repositories(repo),
+  frame_key TEXT NOT NULL,
+  commit_sha TEXT NOT NULL,
+  -- UTF-8-safe boundaries may shorten a chunk by three bytes; a maximum-size
+  -- 512KiB frame can therefore need a ninth chunk.
+  chunk_count INTEGER NOT NULL CHECK(chunk_count BETWEEN 1 AND 9),
+  payload_bytes INTEGER NOT NULL CHECK(payload_bytes BETWEEN 1 AND 524288),
+  payload_hash TEXT NOT NULL,
+  PRIMARY KEY(repo,frame_key)
+);
+CREATE TABLE history_frame_chunks (
+  repo TEXT NOT NULL,
+  frame_key TEXT NOT NULL,
+  ordinal INTEGER NOT NULL CHECK(ordinal BETWEEN 0 AND 8),
+  payload TEXT NOT NULL,
+  PRIMARY KEY(repo,frame_key,ordinal),
+  FOREIGN KEY(repo,frame_key) REFERENCES history_frames(repo,frame_key)
+);
+CREATE TABLE history_batches (
+  repo TEXT NOT NULL REFERENCES history_repositories(repo),
+  batch_id TEXT NOT NULL,
+  action_id TEXT NOT NULL,
+  anchor_key TEXT NOT NULL,
+  fingerprint TEXT NOT NULL,
+  payload TEXT NOT NULL,
+  PRIMARY KEY(repo,batch_id),
+  UNIQUE(repo,anchor_key,action_id)
+);
+-- A failed comparison MUST throw inside D1Database.batch, not report changes=0
+-- after unrelated facts/cursor writes have already committed.
+CREATE TABLE history_append_guards (
+  repo TEXT PRIMARY KEY,
+  accepted INTEGER NOT NULL CHECK(accepted = 1)
+);

deploy/d1/0004-world-public-captures.sql

@@ -0,0 +1,14 @@
+-- UNAPPLIED. Standalone D1 public-capture authority core only. NO RPC/runtime
+-- adoption or schema_migrations marker is enabled by this file.
+-- A separate authorized provisioning transaction must insert ONE authority row
+-- with exact existing database UUID/binding nonce, explicit epoch/key_tag, and a
+-- checksum of the original metadata view (including all existing worlds/aliases).
+-- Core constructors/read paths NEVER initialize/reset/repair missing authority.
+-- No company records, paid ledger or upstream/client allowance belongs here.
+CREATE TABLE world_capture_authority (singleton INTEGER PRIMARY KEY CHECK(singleton=1), protocol INTEGER NOT NULL CHECK(protocol=1), database_uuid TEXT NOT NULL CHECK(length(database_uuid)=36), binding_nonce TEXT NOT NULL CHECK(length(binding_nonce)=32 AND binding_nonce NOT GLOB '*[^0-9a-f]*'), authority_epoch TEXT NOT NULL CHECK(length(authority_epoch)=32 AND authority_epoch NOT GLOB '*[^0-9a-f]*'), key_tag TEXT NOT NULL CHECK(length(key_tag)=64 AND key_tag NOT GLOB '*[^0-9a-f]*'), sequence INTEGER NOT NULL CHECK(typeof(sequence)='integer' AND sequence BETWEEN 0 AND 9007199254740991), revision INTEGER NOT NULL CHECK(typeof(revision)='integer' AND revision BETWEEN 0 AND 9007199254740991), checksum TEXT NOT NULL CHECK(length(checksum)=64 AND checksum NOT GLOB '*[^0-9a-f]*'));
+CREATE TABLE world_capture_barriers (repo TEXT PRIMARY KEY CHECK(length(repo) BETWEEN 3 AND 140 AND repo=lower(repo) AND repo NOT GLOB '*[^a-z0-9_./-]*'), sequence INTEGER NOT NULL CHECK(typeof(sequence)='integer' AND sequence BETWEEN 1 AND 9007199254740991), denied INTEGER NOT NULL CHECK(typeof(denied)='integer' AND denied IN (0,1)));
+CREATE TABLE world_capture_generations (handle_hash TEXT PRIMARY KEY CHECK(length(handle_hash)=64 AND handle_hash NOT GLOB '*[^0-9a-f]*'), repo TEXT NOT NULL, start_canonical TEXT NOT NULL, start_sequence INTEGER NOT NULL CHECK(typeof(start_sequence)='integer' AND start_sequence BETWEEN 0 AND 9007199254740991), explicit INTEGER NOT NULL CHECK(typeof(explicit)='integer' AND explicit IN (0,1)), status TEXT NOT NULL CHECK(status IN ('active','committed','deny-pending','denied')), operation_hash TEXT, roots TEXT, targets TEXT, accepted_sequence INTEGER, ordinal INTEGER NOT NULL CHECK(typeof(ordinal)='integer' AND ordinal BETWEEN 1 AND 9007199254740991), CHECK((status='active' AND operation_hash IS NULL AND roots IS NULL AND targets IS NULL AND accepted_sequence IS NULL) OR (status<>'active' AND operation_hash IS NOT NULL AND length(operation_hash)=64 AND operation_hash NOT GLOB '*[^0-9a-f]*' AND roots IS NOT NULL AND json_valid(roots) AND json_type(roots)='array' AND json_array_length(roots) BETWEEN 1 AND 2 AND targets IS NOT NULL AND json_valid(targets) AND json_type(targets)='array' AND json_array_length(targets)<=204 AND typeof(accepted_sequence)='integer' AND accepted_sequence BETWEEN 0 AND 9007199254740991)));
+-- A persistent constant row lets each CAS assertion throw via CHECK INSIDE the
+-- D1 batch without an unsafe changes=0 result or a dangling guard-cleanup step.
+CREATE TABLE world_capture_guard (singleton INTEGER PRIMARY KEY CHECK(singleton=1), accepted INTEGER NOT NULL CHECK(accepted=1));
+INSERT INTO world_capture_guard VALUES(1,1);

deploy/gateway.ts

@@ -1,8 +1,54 @@
 import { worldStorageRpc, type StorageEnvironment } from "./d1-storage";
+import { historyStorageRpc } from "./history-rpc";
+import { worldCaptureRpc } from "./world-capture-rpc";
+import type { HistoryD1Binding } from "./history-storage";
+
+export interface GatewayEnvironment extends Omit<StorageEnvironment, "WORLDS_DB"> {
+  WORLDS_DB?: StorageEnvironment["WORLDS_DB"] & HistoryD1Binding;
+  FACTORY_ORIGIN: string; FACTORY_GATEWAY_SECRET?: string;
+  COMPANY_SITE?: { fetch(request: Request): Promise<Response> };
+  /** Unset/"" keeps the legacy storage RPC. "4" mounts ONLY the schema4 world
+   * capture RPC at the same path; any other value or invalid key fails closed. */
+  FACTORY_WORLD_CAPTURE_SCHEMA_VERSION?: string; FACTORY_WORLD_CAPTURE_KEY_HEX?: string;
+  /** Exactly "true" mounts the history RPC; otherwise its path is an edge 404. */
+  FACTORY_HISTORY_RPC_ENABLED?: string;
+}
+
+const STORAGE_PATH = "/github-factory/_storage";
+const noStore = { "content-type": "application/json; charset=utf-8", "cache-control": "no-store", "x-content-type-options": "nosniff" };
+const unavailable = () => new Response(JSON.stringify({ ok: false, code: "WORLD_STORAGE_UNAVAILABLE", error: "The fixed world storage operation is unavailable or rejected.", writeOutcome: "not-started" }), { status: 503, headers: noStore });
+// One non-extractable HMAC key per isolate, re-imported only if the hex changes.
+let captureKey: { hex: string; key: Promise<CryptoKey> } | undefined;
+function importCaptureKey(hex: string) {
+  if (captureKey?.hex !== hex) {
+    const raw = Uint8Array.from(hex.match(/../g)!, v => parseInt(v, 16));
+    const key = crypto.subtle.importKey("raw", raw, { name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]);
+    key.catch(() => { if (captureKey?.key === key) captureKey = undefined; });
+    captureKey = { hex, key };
+  }
+  return captureKey.key;
+}
+
+/** Private storage paths never reach the Bun origin. Profile selection is by
+ * explicit Worker configuration only, never by request content. */
+async function storageRoute(request: Request, pathname: string, env: GatewayEnvironment): Promise<Response> {
+  if (pathname === `${STORAGE_PATH}/history`)
+    return env.FACTORY_HISTORY_RPC_ENABLED === "true" ? historyStorageRpc(request, env) : new Response("Not found", { status: 404 });
+  if (pathname !== STORAGE_PATH) return new Response("Not found", { status: 404 });
+  const version = env.FACTORY_WORLD_CAPTURE_SCHEMA_VERSION;
+  if (version === undefined || version === "") return worldStorageRpc(request, env);
+  const hex = env.FACTORY_WORLD_CAPTURE_KEY_HEX ?? "";
+  if (version !== "4" || !/^[a-f0-9]{64}$/.test(hex)) return unavailable();
+  let key: CryptoKey;
+  try { key = await importCaptureKey(hex); } catch { return unavailable(); }
+  const identity = { databaseId: env.FACTORY_STORAGE_DATABASE_ID ?? "", bindingNonce: env.FACTORY_STORAGE_BINDING_NONCE ?? "", epoch: env.FACTORY_MIGRATION_EPOCH ?? "" };
+  return worldCaptureRpc(request, env, { identity, key });
+}
+
 /** Independent path Worker. A prefix route also catches bare-path query strings.
  * No company-site bundle, credentials, SQLite or model code is included. */
 export default {
-  async fetch(request: Request, env: StorageEnvironment & { FACTORY_ORIGIN: string; FACTORY_GATEWAY_SECRET?: string; COMPANY_SITE?: { fetch(request: Request): Promise<Response> } }): Promise<Response> {
+  async fetch(request: Request, env: GatewayEnvironment): Promise<Response> {
     const publicUrl = new URL(request.url);
     if (publicUrl.hostname !== "chaorders.com")
       return new Response("Not found", { status: 404 });
@@ -11,7 +57,7 @@ export default {
     // transparent service binding for adjacent company paths, never recursion.
     if (!(publicUrl.pathname === "/github-factory" || publicUrl.pathname.startsWith("/github-factory/")))
       return env.COMPANY_SITE?.fetch(request) ?? new Response("Not found", { status: 404 });
-    if (publicUrl.pathname === "/github-factory/_storage") return worldStorageRpc(request, env);
+    if (publicUrl.pathname === STORAGE_PATH || publicUrl.pathname.startsWith(`${STORAGE_PATH}/`)) return storageRoute(request, publicUrl.pathname, env);
     // Before retiring a legacy Bun process, close every admission path that can
     // collect or generate. Cached gallery/preview reads remain available until
     // the dedicated connector is stopped to close already accepted slow bodies.