Version portable snapshot content identity (#8195)

Author: chubes4

src/core/agent_task_scheduler/mod.rs

@@ -1510,11 +1510,17 @@ mod committed_harvest_tests {
         let content_hash =
             crate::core::runner::workspace_content_hash(workspace.path(), &snapshot.sync_excludes)
                 .expect("content hash");
+        let content_hash_algorithm = crate::core::runner::workspace_content_hash_algorithm(
+            crate::core::runner::WORKSPACE_CONTENT_DEFAULT_PERMISSION_POLICY,
+        )
+        .expect("default content hash algorithm");
         let lab = serde_json::json!({
             "runner_id": "lab", "remote_workspace": path, "sync_mode": "snapshot", "status": "offloaded",
             "source_snapshot": snapshot,
             "workspace_verification": {
-                "schema": "homeboy/lab-workspace-verification/v1", "identity": "snapshot:provider-ready",
+                "schema": "homeboy/lab-workspace-verification/v2", "identity": "snapshot:provider-ready",
+                "content_hash_algorithm": content_hash_algorithm,
+                "permission_policy": crate::core::runner::WORKSPACE_CONTENT_DEFAULT_PERMISSION_POLICY,
                 "content_hash": content_hash, "sync_excludes": snapshot.sync_excludes,
                 "source_snapshot": snapshot,
                 "primary_workspace": { "identity": "snapshot:provider-ready", "remote_path": workspace.path().display().to_string() }

src/core/extension/trace/canonicality.rs

@@ -1265,6 +1265,10 @@ mod tests {
         let workspace_content_hash =
             crate::core::runner::workspace_content_hash(source.path(), &snapshot.sync_excludes)
                 .unwrap();
+        let content_hash_algorithm = crate::core::runner::workspace_content_hash_algorithm(
+            crate::core::runner::WORKSPACE_CONTENT_DEFAULT_PERMISSION_POLICY,
+        )
+        .unwrap();
         let lab = serde_json::json!({
             "runner_id": "homeboy-lab",
             "remote_workspace": remote.path().display().to_string(),
@@ -1274,8 +1278,10 @@ mod tests {
             "workspace_content_hash": workspace_content_hash,
             "workspace_materialization_plan": { "identity": "workspace:verified" },
             "workspace_verification": {
-                "schema": "homeboy/lab-workspace-verification/v1",
+                "schema": "homeboy/lab-workspace-verification/v2",
                 "identity": "workspace:verified",
+                "content_hash_algorithm": content_hash_algorithm,
+                "permission_policy": crate::core::runner::WORKSPACE_CONTENT_DEFAULT_PERMISSION_POLICY,
                 "content_hash": workspace_content_hash,
                 "sync_excludes": [".git", ".git/**"],
                 "source_snapshot": snapshot,

src/core/runner/lab/offload/metadata.rs

@@ -588,19 +588,25 @@ pub(crate) fn attach_lab_workspace_metadata(
 ) -> Result<()> {
     let source_snapshot = inputs.source_snapshot;
     let primary_workspace_plan = &inputs.primary_synced_workspace.materialization_plan;
+    let permission_policy = crate::core::runner::WORKSPACE_CONTENT_DEFAULT_PERMISSION_POLICY;
     let content_hash = crate::core::runner::workspace_content_hash(
         Path::new(&source_snapshot.local_path.clone().unwrap_or_default()),
         &source_snapshot.sync_excludes,
     )?;
+    let content_hash_algorithm =
+        crate::core::runner::workspace_content_hash_algorithm(permission_policy)
+            .expect("default workspace content permission policy is supported");
     lab_metadata["source_snapshot"] =
         serde_json::to_value(source_snapshot).unwrap_or(serde_json::json!(null));
     lab_metadata["workspace_content_hash"] = serde_json::json!(content_hash);
     lab_metadata["workspace_materialization_plan"] =
         serde_json::to_value(inputs.legacy_path_materialization_plan)
             .unwrap_or(serde_json::json!(null));
     lab_metadata["workspace_verification"] = serde_json::json!({
-        "schema": "homeboy/lab-workspace-verification/v1",
+        "schema": "homeboy/lab-workspace-verification/v2",
         "identity": primary_workspace_plan.identity,
+        "content_hash_algorithm": content_hash_algorithm,
+        "permission_policy": permission_policy,
         "content_hash": content_hash,
         "sync_excludes": source_snapshot.sync_excludes,
         "source_snapshot": source_snapshot,

src/core/runner/lab/offload/tests/capability_metadata.rs

@@ -288,6 +288,37 @@ fn lab_offload_workspace_verification_metadata_survives_process_env_hydration()
         serde_json::to_value(&synced_workspace.materialization_plan)
             .expect("primary sync plan JSON")
     );
+    assert_eq!(
+        metadata["workspace_verification"]["schema"],
+        "homeboy/lab-workspace-verification/v2"
+    );
+    assert_eq!(
+        metadata["workspace_verification"]["content_hash_algorithm"],
+        crate::core::runner::workspace_content_hash_algorithm(
+            crate::core::runner::WORKSPACE_CONTENT_DEFAULT_PERMISSION_POLICY,
+        )
+        .expect("default content hash algorithm")
+    );
+    assert_eq!(
+        metadata["workspace_verification"]["permission_policy"],
+        crate::core::runner::WORKSPACE_CONTENT_DEFAULT_PERMISSION_POLICY
+    );
+    assert!(metadata["workspace_verification"]
+        .get("content_manifest")
+        .is_none());
+    assert!(metadata["workspace_verification"].get("entries").is_none());
+    let serialized_metadata = serde_json::to_string(&metadata).expect("metadata JSON");
+    assert!(!serialized_metadata.contains("README.md"));
+    assert!(!serialized_metadata.contains("verified contents"));
+
+    std::fs::write(remote.path().join("README.md"), "changed contents\n")
+        .expect("change remote file");
+    let error = verify_lab_workspace_from_env(&remote_path.display().to_string(), remote.path())
+        .expect_err("changed remote content must fail verification");
+    assert!(error.contains("homeboy-workspace-content-v2+"));
+    assert!(error.contains("expected sha256:"));
+    assert!(error.contains("got sha256:"));
+    assert!(error.contains("homeboy runner workspace sync --mode snapshot"));
 
     match prior_lab {
         Some(value) => std::env::set_var(LAB_OFFLOAD_METADATA_ENV, value),

src/core/runner/mod.rs

@@ -171,7 +171,8 @@ pub use workspace::{
 };
 pub(crate) use workspace::{
     verify_lab_workspace_from_env, verify_lab_workspace_git_root, workspace_content_hash,
-    VerifiedLabWorkspaceProvenance,
+    workspace_content_hash_algorithm, VerifiedLabWorkspaceProvenance,
+    WORKSPACE_CONTENT_DEFAULT_PERMISSION_POLICY,
 };
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]

src/core/runner/workspace/mod.rs

@@ -46,6 +46,7 @@ pub(crate) use provenance::{
 pub(crate) use snapshot::{
     copy_snapshot_to_directory, effective_snapshot_excludes, local_snapshot_stats,
     materialize_snapshot, materialize_snapshot_git, snapshot_identity, workspace_content_hash,
+    workspace_content_hash_algorithm, WORKSPACE_CONTENT_DEFAULT_PERMISSION_POLICY,
 };
 pub(crate) use types::{canonical_workspace_path, DEFAULT_EXCLUDES};
 pub(crate) use util::{