lab: remove privileged repository staging fallback

Author: niakw

scripts/resolve_native_repository.sh

@@ -1,40 +1,24 @@
 #!/usr/bin/env bash
-# Source this file from a native client suite after WORKSPACE, NIAKVIO,
-# TARGET_MANIFEST, SOURCE_SHA and SOURCE_REPOSITORY are defined.
+# Source from a native client suite after WORKSPACE, NIAKVIO, TARGET_MANIFEST,
+# SOURCE_SHA and SOURCE_REPOSITORY are defined.
+#
+# Human-UX invariant: repository staging may make the NiakVIO candidate reachable,
+# but it must never grant the Nuvio process privileges or network capabilities that
+# a normal user process does not have. No sudo/root, proxy, DNS, TLS or OS-policy
+# bypass belongs here. If ordinary process access cannot reach the staged candidate,
+# the evidence is infrastructure-invalid and the suite must fail closed.
 
 NIAKVIO_RESOLVED_MANIFEST_URL=""
 NIAKVIO_RESOLVED_ALLOW_LOCAL="0"
 NIAKVIO_LOCAL_REPOSITORY_PID=""
 NIAKVIO_LOCAL_REPOSITORY_LOG=""
 NIAKVIO_LOCAL_REPOSITORY_ROOT=""
 NIAKVIO_LOCAL_REPOSITORY_KEY=""
-NIAKVIO_LOCAL_REPOSITORY_PRIVILEGED_CLIENT="0"
 
 probe_native_repository_loopback() {
   local port="${1:?port required}"
   local candidate_dir="${2:?candidate dir required}"
-  local use_privileged_client="${3:-0}"
-  local python_args=(python3 - "$port" "$candidate_dir")
-
-  if [[ "$use_privileged_client" == "1" ]]; then
-    sudo -n "${python_args[@]}" <<'PY'
-import http.client
-import sys
-
-port = int(sys.argv[1])
-candidate = sys.argv[2]
-connection = http.client.HTTPConnection("127.0.0.1", port, timeout=1.0)
-try:
-    connection.request("GET", f"/{candidate}/manifest.json", headers={"Connection": "close"})
-    response = connection.getresponse()
-    if response.status != 200:
-        raise SystemExit(1)
-    response.read(64)
-finally:
-    connection.close()
-PY
-  else
-    "${python_args[@]}" <<'PY'
+  python3 - "$port" "$candidate_dir" <<'PY'
 import http.client
 import sys
 
@@ -50,7 +34,6 @@ try:
 finally:
     connection.close()
 PY
-  fi
 }
 
 resolve_native_repository() {
@@ -61,14 +44,12 @@ resolve_native_repository() {
   if [[ -n "${NIAKVIO_MANIFEST_URL:-}" ]]; then
     NIAKVIO_RESOLVED_MANIFEST_URL="$NIAKVIO_MANIFEST_URL"
     NIAKVIO_RESOLVED_ALLOW_LOCAL="${NIAKVIO_ALLOW_LOCAL_MANIFEST:-0}"
-    echo "FIELD_NATIVE_REPOSITORY_SOURCE client=$client mode=explicit local=$NIAKVIO_RESOLVED_ALLOW_LOCAL"
+    echo "FIELD_NATIVE_REPOSITORY_SOURCE client=$client mode=explicit local=$NIAKVIO_RESOLVED_ALLOW_LOCAL observational=true"
     return 0
   fi
 
-  # raw.githubusercontent.com resolves repository-relative provider filenames only
-  # when the manifest itself is at the repository root. It must also be a tracked,
-  # unchanged file from the exact SOURCE_SHA under test. The SHA in the URL makes
-  # Nuvio's persistent repository/provider cache safe across CI runs.
+  # Prefer the exact SHA-pinned public repository whenever the selected manifest is
+  # a tracked unchanged root file. This is closest to what a real Nuvio user loads.
   local pinned=false
   if [[ "$TARGET_MANIFEST" != */* ]] \
     && git -C "$NIAKVIO" ls-files --error-unmatch "$TARGET_MANIFEST" >/dev/null 2>&1 \
@@ -80,19 +61,13 @@ resolve_native_repository() {
   if [[ "$pinned" == true ]]; then
     NIAKVIO_RESOLVED_MANIFEST_URL="https://raw.githubusercontent.com/${SOURCE_REPOSITORY}/${SOURCE_SHA}/${TARGET_MANIFEST}"
     NIAKVIO_RESOLVED_ALLOW_LOCAL="0"
-    echo "FIELD_NATIVE_REPOSITORY_SOURCE client=$client mode=pinned_github local=0 cache_key=${SOURCE_SHA}"
+    echo "FIELD_NATIVE_REPOSITORY_SOURCE client=$client mode=pinned_github local=0 cache_key=${SOURCE_SHA} observational=true"
     return 0
   fi
 
-  # Generated, modified, or nested manifests are materialized as a root repository
-  # and served only on the runner bridge. Android emulators must reach the host at
-  # 10.0.2.2, so they bind all interfaces. Desktop only consumes 127.0.0.1 and is
-  # deliberately bound to loopback; this avoids macOS Local Network Privacy treating
-  # an otherwise local-only CI repository as a LAN listener.
-  #
-  # IMPORTANT: the URL path is content-addressed from manifest + every provider
-  # byte. A persisted AVD/profile may therefore reuse the cache for the exact same
-  # candidate, but can never silently reuse old JS after the candidate changes.
+  # Generated/modified manifests must still resolve repository-relative provider
+  # filenames. Materialize manifest + every provider into a content-addressed local
+  # repository so persistent Nuvio caches cannot reuse stale JS.
   local serve_root="${WORKSPACE}/native-candidate-repository-${client}"
   local prepared_root="${serve_root}.prepared"
   local server_log="${WORKSPACE}/native-candidate-repository-${client}.server.log"
@@ -104,7 +79,9 @@ resolve_native_repository() {
   local content_key
   content_key="$(python3 - "$prepared_root" <<'PY'
 from pathlib import Path
-import hashlib, sys
+import hashlib
+import sys
+
 root = Path(sys.argv[1]).resolve()
 h = hashlib.sha256()
 files = sorted((p for p in root.rglob('*') if p.is_file()), key=lambda p: p.relative_to(root).as_posix())
@@ -142,16 +119,6 @@ PY
   NIAKVIO_LOCAL_REPOSITORY_PID=$!
   NIAKVIO_LOCAL_REPOSITORY_LOG="$server_log"
 
-  # Readiness always starts through the same unprivileged loopback path the client
-  # should use. On macOS CI only, sudo is a bounded fallback after several ordinary
-  # attempts; it is never required just because the runner happens to be macOS.
-  local allow_privileged_probe=0
-  if [[ "$client" == "desktop" && "$(uname -s)" == "Darwin" && "${CI:-}" == "true" ]]; then
-    if sudo -n true >/dev/null 2>&1; then
-      allow_privileged_probe=1
-    fi
-  fi
-
   local ready=0
   local attempt
   for attempt in $(seq 1 40); do
@@ -162,29 +129,24 @@ PY
       NIAKVIO_LOCAL_REPOSITORY_PID=""
       return 2
     fi
-    if probe_native_repository_loopback "$port" "$candidate_dir" 0 >/dev/null 2>&1; then
-      ready=1
-      break
-    fi
-    if [[ "$allow_privileged_probe" == "1" && "$attempt" -ge 5 ]] \
-      && probe_native_repository_loopback "$port" "$candidate_dir" 1 >/dev/null 2>&1; then
+    if probe_native_repository_loopback "$port" "$candidate_dir" >/dev/null 2>&1; then
       ready=1
-      NIAKVIO_LOCAL_REPOSITORY_PRIVILEGED_CLIENT="1"
       break
     fi
     sleep 0.2
   done
   if [[ "$ready" != "1" ]]; then
-    echo "FIELD_NATIVE_REPOSITORY_SOURCE_ERROR client=$client reason=local_server_not_ready cache_key=$content_key bind_host=$bind_host privileged_fallback=$allow_privileged_probe" >&2
+    echo "FIELD_NATIVE_REPOSITORY_SOURCE_ERROR client=$client reason=local_server_not_ready_unprivileged cache_key=$content_key bind_host=$bind_host" >&2
     cat "$server_log" >&2 2>/dev/null || true
     kill "$NIAKVIO_LOCAL_REPOSITORY_PID" 2>/dev/null || true
     rm -rf "$serve_root"
+    NIAKVIO_LOCAL_REPOSITORY_PID=""
     return 2
   fi
 
   NIAKVIO_RESOLVED_MANIFEST_URL="http://${device_host}:${port}/${candidate_dir}/manifest.json"
   NIAKVIO_RESOLVED_ALLOW_LOCAL="1"
-  echo "FIELD_NATIVE_REPOSITORY_SOURCE client=$client mode=local_candidate local=1 port=$port bind_host=$bind_host cache_key=$content_key privileged_client=$NIAKVIO_LOCAL_REPOSITORY_PRIVILEGED_CLIENT"
+  echo "FIELD_NATIVE_REPOSITORY_SOURCE client=$client mode=local_candidate local=1 port=$port bind_host=$bind_host cache_key=$content_key observational=true privileged=false"
 }
 
 cleanup_native_repository() {