merge: integrate orchestration merge request lifecycle

# Conflicts:
#	resources/flows/coder-review.dcdl

crates/workspace-server/Cargo.toml

@@ -32,6 +32,7 @@ sha2.workspace = true
 thiserror.workspace = true
 ticket.workspace = true
 memory.workspace = true
+merge-request.workspace = true
 tokio = { workspace = true, features = ["fs", "macros", "net", "rt-multi-thread", "sync", "time"] }
 tokio-tungstenite.workspace = true
 worker.workspace = true

crates/workspace-server/src/authority.rs

@@ -131,7 +131,7 @@ impl SqliteWorkspaceAuthority {
         Ok(Self {
             workspace_id: workspace_id.clone(),
             store: SqliteWorkspaceStore::open(&database_path)?,
-            ticket_backend: SqliteTicketBackend::new(database_path, workspace_id),
+            ticket_backend: SqliteTicketBackend::open_verified(database_path, workspace_id)?,
         })
     }
 
@@ -725,7 +725,8 @@ mod tests {
         let dir = tempfile::tempdir().unwrap();
         write_ticket(dir.path(), "00000000001J2", "Read bridge", "ready");
         let db_path = dir.path().join("workspace.db");
-        SqliteTicketBackend::new(&db_path, "workspace-test")
+        SqliteTicketBackend::open(&db_path, "workspace-test")
+            .unwrap()
             .import_from_local_backend(&ticket::LocalTicketBackend::new(
                 dir.path().join(".yoi/tickets"),
             ))

crates/workspace-server/src/hosts.rs

@@ -54,8 +54,11 @@ use worker_runtime::interaction::{
 };
 use worker_runtime::management::{RuntimeOptions as EmbeddedRuntimeOptions, RuntimeStatus};
 use worker_runtime::profile_archive::{ProfileSourceArchive, ProfileSourceArchiveInput};
+use worker_runtime::retention::{
+    WorkerRetentionExecutionRequest, WorkerRetentionExecutionResult, WorkerRetentionInventory,
+};
 
-const EMBEDDED_RUNTIME_ID: &str = "embedded-worker-runtime";
+pub(crate) const EMBEDDED_RUNTIME_ID: &str = "embedded-worker-runtime";
 const EMBEDDED_HOST_KIND: &str = "embedded-worker-runtime-host";
 const REMOTE_HOST_KIND: &str = "remote-worker-runtime-host";
 const MAX_DIAGNOSTICS: usize = 16;
@@ -856,6 +859,25 @@ pub trait WorkspaceWorkerRuntime: Send + Sync {
         }
     }
 
+    fn worker_retention_inventory(
+        &self,
+        worker_id: &str,
+    ) -> Result<WorkerRetentionInventory, String> {
+        Err(format!(
+            "runtime does not implement retention inventory for '{worker_id}'"
+        ))
+    }
+
+    fn execute_worker_retention(
+        &self,
+        request: WorkerRetentionExecutionRequest,
+    ) -> Result<WorkerRetentionExecutionResult, String> {
+        Err(format!(
+            "runtime does not implement retention execution for '{}'",
+            request.worker_id
+        ))
+    }
+
     fn observation_source(
         &self,
         _worker_id: &str,
@@ -1399,6 +1421,44 @@ impl RuntimeRegistry {
         Ok(runtime.delete_worker(worker_id))
     }
 
+    pub fn worker_retention_inventory(
+        &self,
+        worker: &RuntimeWorkerRef,
+    ) -> Result<WorkerRetentionInventory, RuntimeRegistryError> {
+        validate_backend_identifier("runtime_id", &worker.runtime_id)?;
+        validate_backend_identifier("worker_id", &worker.worker_id)?;
+        self.runtime(&worker.runtime_id)?
+            .worker_retention_inventory(&worker.worker_id)
+            .map_err(|message| RuntimeRegistryError::RuntimeOperationFailed {
+                runtime_id: worker.runtime_id.clone(),
+                code: "worker_retention_inventory_failed".to_string(),
+                message,
+            })
+    }
+
+    pub fn execute_worker_retention(
+        &self,
+        worker: &RuntimeWorkerRef,
+        request: WorkerRetentionExecutionRequest,
+    ) -> Result<WorkerRetentionExecutionResult, RuntimeRegistryError> {
+        validate_backend_identifier("runtime_id", &worker.runtime_id)?;
+        validate_backend_identifier("worker_id", &worker.worker_id)?;
+        if request.worker_id.to_string() != worker.worker_id {
+            return Err(RuntimeRegistryError::RuntimeOperationFailed {
+                runtime_id: worker.runtime_id.clone(),
+                code: "worker_id_mismatch".to_string(),
+                message: "retention request worker_id does not match target".to_string(),
+            });
+        }
+        self.runtime(&worker.runtime_id)?
+            .execute_worker_retention(request)
+            .map_err(|message| RuntimeRegistryError::RuntimeOperationFailed {
+                runtime_id: worker.runtime_id.clone(),
+                code: "worker_retention_execution_failed".to_string(),
+                message,
+            })
+    }
+
     pub fn observation_source(
         &self,
         worker: &RuntimeWorkerRef,
@@ -1438,6 +1498,7 @@ impl RuntimeRegistry {
 
 #[derive(Clone)]
 pub struct EmbeddedWorkerRuntime {
+    workspace_id: String,
     runtime_id: String,
     host_id: String,
     runtime: worker_runtime::Runtime,
@@ -1497,9 +1558,13 @@ impl EmbeddedWorkerRuntime {
 
     pub fn from_runtime(workspace_id: impl AsRef<str>, runtime: worker_runtime::Runtime) -> Self {
         let workspace_id = workspace_id.as_ref().to_string();
+        runtime
+            .bind_runtime_identity(EMBEDDED_RUNTIME_ID)
+            .expect("fresh embedded Runtime must accept its Backend-owned identity");
         Self {
-            runtime_id: EMBEDDED_RUNTIME_ID.to_string(),
             host_id: host_id_for_embedded_workspace(&workspace_id),
+            workspace_id,
+            runtime_id: EMBEDDED_RUNTIME_ID.to_string(),
             runtime,
             execution_enabled: false,
             resource_broker: BackendResourceBroker::default(),
@@ -2103,6 +2168,30 @@ impl WorkspaceWorkerRuntime for EmbeddedWorkerRuntime {
         }
     }
 
+    fn worker_retention_inventory(
+        &self,
+        worker_id: &str,
+    ) -> Result<WorkerRetentionInventory, String> {
+        let worker_ref = self
+            .worker_ref(worker_id)
+            .ok_or_else(|| format!("invalid embedded Worker id '{worker_id}'"))?;
+        self.runtime
+            .worker_retention_inventory(&self.workspace_id, &worker_ref)
+            .map_err(|error| error.to_string())
+    }
+
+    fn execute_worker_retention(
+        &self,
+        request: WorkerRetentionExecutionRequest,
+    ) -> Result<WorkerRetentionExecutionResult, String> {
+        if request.workspace_id != self.workspace_id {
+            return Err("retention request Workspace does not match embedded Runtime".to_string());
+        }
+        self.runtime
+            .execute_worker_retention(&request)
+            .map_err(|error| error.to_string())
+    }
+
     fn observation_source(
         &self,
         worker_id: &str,
@@ -3125,6 +3214,28 @@ impl WorkspaceWorkerRuntime for RemoteWorkerRuntime {
         }
     }
 
+    fn worker_retention_inventory(
+        &self,
+        worker_id: &str,
+    ) -> Result<WorkerRetentionInventory, String> {
+        self.get_json::<WorkerRetentionInventory>(&format!(
+            "/v1/workers/{worker_id}/retention/inventory"
+        ))
+        .map_err(|diagnostic| diagnostic.message)
+    }
+
+    fn execute_worker_retention(
+        &self,
+        request: WorkerRetentionExecutionRequest,
+    ) -> Result<WorkerRetentionExecutionResult, String> {
+        let worker_id = request.worker_id.to_string();
+        self.post_json::<_, WorkerRetentionExecutionResult>(
+            &format!("/v1/workers/{worker_id}/retention/execute"),
+            &request,
+        )
+        .map_err(|diagnostic| diagnostic.message)
+    }
+
     fn observation_source(
         &self,
         worker_id: &str,
@@ -4036,7 +4147,6 @@ mod tests {
         WorkspaceApiRef {
             workspace_id: "workspace-test".to_string(),
             base_url: "http://127.0.0.1:8787".to_string(),
-            runtime_id: Some("runtime-test".to_string()),
         }
     }
 

crates/workspace-server/src/lib.rs

@@ -19,10 +19,12 @@ pub mod records;
 pub use records::ticket_api_typescript;
 pub mod repositories;
 pub mod resource_broker;
+pub mod retention;
 pub mod runtime_subscription;
 pub mod server;
 pub mod skills;
 pub mod store;
+pub mod worker_source;
 mod workspace_subscription;
 
 pub use authority::{
@@ -55,6 +57,8 @@ pub enum Error {
     Sqlite(#[from] rusqlite::Error),
     #[error("ticket error: {0}")]
     Ticket(#[from] ticket::TicketError),
+    #[error("merge request error: {0}")]
+    MergeRequest(#[from] merge_request::MergeRequestError),
     #[error("yaml error: {0}")]
     Yaml(#[from] serde_yaml::Error),
     #[error("invalid input: {0}")]
@@ -88,6 +92,14 @@ pub enum Error {
     },
     #[error("unknown local repository `{0}`")]
     UnknownRepository(String),
+    #[error(
+        "merge confirmation requires an authenticated Browser session; API tokens and Worker actors are not accepted"
+    )]
+    BrowserMergeConfirmationRequired,
+    #[error(
+        "Merge Request reopen requires an authenticated Browser session and explicit confirmation"
+    )]
+    BrowserReopenConfirmationRequired,
     #[error("workspace id does not match this Workspace backend")]
     WorkspaceIdMismatch,
     #[error("Ticket assignment conflict: {0}")]

crates/workspace-server/src/worker_source.rs

@@ -0,0 +1,325 @@
+use std::sync::{Arc, OnceLock};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use axum::http::HeaderMap;
+use worker_runtime::auth::{
+    WorkerMutationActorKind, WorkerMutationOperation, WorkerMutationSourceClaims,
+    WorkerMutationSourceExpectation, decode_worker_mutation_source_claims,
+    verify_worker_mutation_source_proof,
+};
+use worker_runtime::worker_source::InProcessWorkerMutationProof;
+
+use crate::hosts::RemoteRuntimeConfig;
+use crate::server::WorkspaceApi;
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum PresentedWorkerMutationSourceProof<'a> {
+    Remote(&'a str),
+    InProcess(InProcessWorkerMutationProof),
+}
+
+pub fn presented_worker_remove_source<'a>(
+    headers: &'a HeaderMap,
+    in_process: Option<InProcessWorkerMutationProof>,
+) -> Result<PresentedWorkerMutationSourceProof<'a>, WorkerMutationSourceProofError> {
+    if let Some(claims) = in_process {
+        return Ok(PresentedWorkerMutationSourceProof::InProcess(claims));
+    }
+    headers
+        .get(worker_runtime::auth::WORKER_MUTATION_SOURCE_PROOF_HEADER)
+        .and_then(|value| value.to_str().ok())
+        .filter(|value| !value.trim().is_empty())
+        .map(PresentedWorkerMutationSourceProof::Remote)
+        .ok_or(WorkerMutationSourceProofError::Missing)
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct VerifiedWorkerMutationSource {
+    pub runtime_id: String,
+    pub worker_id: String,
+    pub actor_kind: WorkerMutationActorKind,
+    pub permission: String,
+    pub jti: String,
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum WorkerMutationSourceProofError {
+    #[error("Worker mutation source proof is required")]
+    Missing,
+    #[error("Worker mutation source proof is invalid")]
+    Invalid,
+    #[error("Worker mutation source proof is not authorized for this Server")]
+    WrongAudience,
+    #[error("Worker mutation source proof is not authorized for this Workspace")]
+    WrongWorkspace,
+    #[error("Worker mutation source proof actor is not allowed")]
+    WrongActor,
+    #[error("Worker mutation source proof lacks `{0}` permission")]
+    MissingPermission(String),
+    #[error("Worker mutation source proof is expired")]
+    Expired,
+    #[error("Runtime trust is missing or revoked")]
+    RevokedRuntimeTrust,
+    #[error("Worker mutation source proof was already consumed")]
+    Replay,
+    #[error("source Worker is not a current member of this Workspace Runtime catalog")]
+    WorkerCatalogMembership,
+    #[error("source proof authority failed: {0}")]
+    Authority(String),
+}
+
+pub async fn verify_worker_remove_source(
+    api: &WorkspaceApi,
+    proof: PresentedWorkerMutationSourceProof<'_>,
+    target_runtime_id: &str,
+    target_worker_id: &str,
+) -> Result<VerifiedWorkerMutationSource, WorkerMutationSourceProofError> {
+    verify_worker_remove_source_with(
+        &api.config,
+        &api.store,
+        proof,
+        target_runtime_id,
+        target_worker_id,
+    )
+    .await
+}
+
+async fn verify_worker_remove_source_with(
+    config: &crate::server::ServerConfig,
+    store: &std::sync::Arc<dyn crate::store::ControlPlaneStore>,
+    proof: PresentedWorkerMutationSourceProof<'_>,
+    target_runtime_id: &str,
+    target_worker_id: &str,
+) -> Result<VerifiedWorkerMutationSource, WorkerMutationSourceProofError> {
+    let required_permission = worker_runtime::auth::WORKER_REMOVE_PERMISSION;
+    let now = unix_now_seconds();
+    let claims = match proof {
+        PresentedWorkerMutationSourceProof::Remote(token) => {
+            let unverified = decode_worker_mutation_source_claims(token)
+                .map_err(|_| WorkerMutationSourceProofError::Invalid)?;
+            let audience = remote_audience(config, &unverified.iss)?;
+            let trusted = store
+                .get_trusted_runtime(&unverified.iss)
+                .await
+                .map_err(|error| WorkerMutationSourceProofError::Authority(error.to_string()))?
+                .filter(|record| record.revoked_at.is_none())
+                .ok_or(WorkerMutationSourceProofError::RevokedRuntimeTrust)?;
+            let expected = WorkerMutationSourceExpectation {
+                runtime_id: &unverified.iss,
+                audience,
+                workspace_id: &config.workspace_id,
+                worker_id: None,
+                actor_kind: WorkerMutationActorKind::Worker,
+                operation: WorkerMutationOperation::WorkerRemove,
+                target_runtime_id,
+                target_worker_id,
+                permission: required_permission,
+            };
+            verify_worker_mutation_source_proof(&trusted.public_key, token, &expected, now)
+                .map_err(map_auth_error)?
+        }
+        PresentedWorkerMutationSourceProof::InProcess(proof) => {
+            let claims = proof.into_claims();
+            if config
+                .remote_runtime_sources
+                .iter()
+                .any(|runtime| runtime.runtime_id == claims.iss)
+            {
+                return Err(WorkerMutationSourceProofError::Invalid);
+            }
+            validate_in_process_claims(
+                &claims,
+                &format!("embedded:{}", config.workspace_id),
+                &config.workspace_id,
+                target_runtime_id,
+                target_worker_id,
+                required_permission,
+                now,
+            )?;
+            claims
+        }
+    };
+
+    let worker = worker_runtime::identity::RuntimeWorkerRef {
+        runtime_id: claims.iss.clone(),
+        worker_id: claims.worker_id.clone(),
+    };
+    let member = store
+        .get_worker_registry(&config.workspace_id, &worker)
+        .map_err(|error| WorkerMutationSourceProofError::Authority(error.to_string()))?;
+    if member.is_none() {
+        return Err(WorkerMutationSourceProofError::WorkerCatalogMembership);
+    }
+
+    let consumed_at = chrono::Utc::now().to_rfc3339();
+    let consumed = store
+        .consume_worker_mutation_source_jti(&claims.iss, &claims.jti, claims.exp, now, &consumed_at)
+        .await
+        .map_err(|error| WorkerMutationSourceProofError::Authority(error.to_string()))?;
+    if !consumed {
+        return Err(WorkerMutationSourceProofError::Replay);
+    }
+
+    Ok(VerifiedWorkerMutationSource {
+        runtime_id: claims.iss,
+        worker_id: claims.worker_id,
+        actor_kind: claims.actor_kind,
+        permission: claims.permission,
+        jti: claims.jti,
+    })
+}
+
+pub(crate) trait VerifiedWorkerRemoveExecutor: Send + Sync {
+    fn execute(
+        &self,
+        source: VerifiedWorkerMutationSource,
+        target_runtime_id: &str,
+        target_worker_id: &str,
+        expected_worker_revision: &str,
+        reason: &str,
+    ) -> Result<worker::WorkspaceResponse, String>;
+}
+
+#[derive(Clone)]
+pub(crate) struct EmbeddedServerWorkerMutationDispatcher {
+    config: crate::server::ServerConfig,
+    store: Arc<dyn crate::store::ControlPlaneStore>,
+    executor: Arc<OnceLock<Arc<dyn VerifiedWorkerRemoveExecutor>>>,
+}
+
+impl EmbeddedServerWorkerMutationDispatcher {
+    pub(crate) fn new(
+        config: crate::server::ServerConfig,
+        store: Arc<dyn crate::store::ControlPlaneStore>,
+    ) -> Self {
+        Self {
+            config,
+            store,
+            executor: Arc::new(OnceLock::new()),
+        }
+    }
+
+    pub(crate) fn install_executor(
+        &self,
+        executor: Arc<dyn VerifiedWorkerRemoveExecutor>,
+    ) -> Result<(), &'static str> {
+        self.executor
+            .set(executor)
+            .map_err(|_| "WorkerRemove executor is already installed")
+    }
+}
+
+impl worker_runtime::worker_source::EmbeddedWorkerMutationDispatcher
+    for EmbeddedServerWorkerMutationDispatcher
+{
+    fn execute_worker_remove(
+        &self,
+        proof: InProcessWorkerMutationProof,
+        target_runtime_id: &str,
+        target_worker_id: &str,
+        expected_worker_revision: &str,
+        reason: &str,
+    ) -> Result<
+        worker::WorkspaceResponse,
+        worker_runtime::worker_source::RuntimeWorkerMutationForwardError,
+    > {
+        let source = futures::executor::block_on(verify_worker_remove_source_with(
+            &self.config,
+            &self.store,
+            PresentedWorkerMutationSourceProof::InProcess(proof),
+            target_runtime_id,
+            target_worker_id,
+        ))
+        .map_err(|error| {
+            worker_runtime::worker_source::RuntimeWorkerMutationForwardError::Embedded(
+                error.to_string(),
+            )
+        })?;
+        let executor = self.executor.get().ok_or_else(|| {
+            worker_runtime::worker_source::RuntimeWorkerMutationForwardError::Embedded(
+                "WorkerRemove executor is unavailable".to_string(),
+            )
+        })?;
+        executor
+            .execute(
+                source,
+                target_runtime_id,
+                target_worker_id,
+                expected_worker_revision,
+                reason,
+            )
+            .map_err(worker_runtime::worker_source::RuntimeWorkerMutationForwardError::Embedded)
+    }
+}
+
+fn remote_audience<'a>(
+    config: &'a crate::server::ServerConfig,
+    runtime_id: &str,
+) -> Result<&'a str, WorkerMutationSourceProofError> {
+    config
+        .remote_runtime_sources
+        .iter()
+        .find(|runtime| runtime.runtime_id == runtime_id)
+        .and_then(|runtime: &RemoteRuntimeConfig| runtime.auth.as_ref())
+        .map(|auth| auth.server_id.as_str())
+        .ok_or(WorkerMutationSourceProofError::RevokedRuntimeTrust)
+}
+
+fn validate_in_process_claims(
+    claims: &WorkerMutationSourceClaims,
+    audience: &str,
+    workspace_id: &str,
+    target_runtime_id: &str,
+    target_worker_id: &str,
+    permission: &str,
+    now: u64,
+) -> Result<(), WorkerMutationSourceProofError> {
+    if claims.aud != audience {
+        return Err(WorkerMutationSourceProofError::WrongAudience);
+    }
+    if claims.workspace_id != workspace_id {
+        return Err(WorkerMutationSourceProofError::WrongWorkspace);
+    }
+    if claims.actor_kind != WorkerMutationActorKind::Worker {
+        return Err(WorkerMutationSourceProofError::WrongActor);
+    }
+    if claims.operation != WorkerMutationOperation::WorkerRemove
+        || claims.target_runtime_id != target_runtime_id
+        || claims.target_worker_id != target_worker_id
+    {
+        return Err(WorkerMutationSourceProofError::Invalid);
+    }
+    if claims.permission != permission {
+        return Err(WorkerMutationSourceProofError::MissingPermission(
+            permission.to_string(),
+        ));
+    }
+    if claims.exp <= now || claims.iat > now.saturating_add(60) || claims.jti.trim().is_empty() {
+        return Err(WorkerMutationSourceProofError::Expired);
+    }
+    Ok(())
+}
+
+fn map_auth_error(error: worker_runtime::auth::RuntimeAuthError) -> WorkerMutationSourceProofError {
+    use worker_runtime::auth::RuntimeAuthError;
+    match error {
+        RuntimeAuthError::WrongAudience { .. } => WorkerMutationSourceProofError::WrongAudience,
+        RuntimeAuthError::WrongWorkspace { .. } => WorkerMutationSourceProofError::WrongWorkspace,
+        RuntimeAuthError::WrongActorKind => WorkerMutationSourceProofError::WrongActor,
+        RuntimeAuthError::WrongOperation | RuntimeAuthError::WrongMutationTarget => {
+            WorkerMutationSourceProofError::Invalid
+        }
+        RuntimeAuthError::MissingPermission(permission) => {
+            WorkerMutationSourceProofError::MissingPermission(permission)
+        }
+        RuntimeAuthError::Expired => WorkerMutationSourceProofError::Expired,
+        _ => WorkerMutationSourceProofError::Invalid,
+    }
+}
+
+fn unix_now_seconds() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
+}