perf(delivery): use bounded native cold restore copies

backend/tests/test_delivery_io.py

@@ -1437,3 +1437,35 @@ def test_proxy_previous_snapshot_retains_the_legacy_unit_and_binding_format(tmp_
     unit.chmod(0o644)
     assert proxy_install.known_snapshot(directory) == selected
     assert "--previous-certificate" not in unit.read_text()
+
+
+@pytest.mark.parametrize("support", ["legacy", "complete", "binary-only", "transport-only"])
+def test_native_restore_capability_requires_a_complete_pair_but_keeps_legacy(
+    ordinary_bundle, support
+):
+    bundle, _ = ordinary_bundle
+    data = json.loads((bundle / "manifest.json").read_bytes())
+    names = {
+        "legacy": [],
+        "complete": ["bin/kf-restore-io", "delivery/scripts/release/restore_native.py"],
+        "binary-only": ["bin/kf-restore-io"],
+        "transport-only": ["delivery/scripts/release/restore_native.py"],
+    }[support]
+    parents = set(data["directories"])
+    for name in names:
+        data["files"].append(
+            {
+                "path": name,
+                "bytes": 1,
+                "sha256": "b" * 64,
+                "mode": "0555" if name.startswith("bin/") else "0444",
+            }
+        )
+        data["payload_bytes"] += 1
+        parents.update(str(p) for p in Path(name).parents if str(p) != ".")
+    data["directories"] = sorted(parents)
+    if support in {"legacy", "complete"}:
+        assert manifest.validate(data) is data
+    else:
+        with pytest.raises(policy.DeliveryError, match="incomplete application bundle"):
+            manifest.validate(data)

backend/tests/test_restore_io_contracts.py

@@ -0,0 +1,23 @@
+"""Shared ordinary wire examples; no privileged copy or execution acceptance."""
+
+import json
+from pathlib import Path
+
+import pytest
+from pydantic import ValidationError
+
+from kf_oj.contracts.restore_io import RestoreIOReply, RestoreIORequest
+
+CASES = json.loads(
+    (Path(__file__).resolve().parents[2] / "tests/fixtures/restore-io/examples.json").read_bytes()
+)
+
+
+@pytest.mark.parametrize("case", CASES, ids=lambda c: c["name"])
+def test_shared_restore_io_examples(case):
+    model = RestoreIORequest if case["direction"] == "request" else RestoreIOReply
+    if case["valid"]:
+        assert model.model_validate(case["value"]).model_dump(mode="json") == case["value"]
+    else:
+        with pytest.raises(ValidationError):
+            model.model_validate(case["value"])

backend/tests/test_restore_native_transport.py

@@ -0,0 +1,115 @@
+"""Ordinary pipe fixtures only; no Root, filesystem-copy or VM acceptance."""
+
+import json
+import subprocess
+import sys
+import time
+
+import pytest
+from scripts.release import restore_native
+from scripts.release.policy import DeliveryError
+
+
+@pytest.fixture
+def transport(tmp_path, monkeypatch):
+    helper = tmp_path / "bin/kf-restore-io"
+    helper.parent.mkdir()
+    helper.write_bytes(b"ordinary metadata fixture, never executed\n")
+    helper.chmod(0o555)
+    monkeypatch.setattr(restore_native.preflight, "protected", lambda *_a, **_kw: None)
+    original = subprocess.Popen
+    children = []
+
+    def start(program):
+        def popen(args, **options):
+            assert args == [str(helper), "--stdio-v1"]
+            assert options["start_new_session"] and options["close_fds"]
+            assert set(options["env"]) == {"PATH", "LC_ALL", "LD_LIBRARY_PATH"}
+            child = original([sys.executable, "-c", program], **options)
+            children.append(child)
+            return child
+
+        monkeypatch.setattr(restore_native.subprocess, "Popen", popen)
+
+    yield tmp_path, start, children
+    assert all(p.poll() is not None for p in children)
+    assert all(h.closed for p in children for h in (p.stdin, p.stdout, p.stderr))
+
+
+def test_transport_counts_and_child_join_without_execution_claim(transport):
+    payload, start, children = transport
+    start("""
+import json,sys
+count=total=batch=0
+for line in sys.stdin:
+ value=json.loads(line)
+ kind=value['kind']
+ stage='opened'
+ if kind=='restore.io.batch':
+  count+=len(value['files'])
+  total+=sum(r['bytes'] for r in value['files'])
+  batch=value['batch_id']
+  stage='verified'
+ if kind=='restore.io.finish':stage='finished'
+ reply={'schema_version':1,'kind':'restore.io.reply','stage':stage,'batch_id':batch,'verified_files':count,'verified_logical_bytes':total,'execution_verified':False,'error':'none'}
+ print(json.dumps(reply),flush=True)
+ if stage=='finished':break
+""")
+    session = restore_native.Session(
+        payload, "bk-" + "1" * 32, "rr-" + "2" * 32, 2, 7, time.monotonic() + 10
+    )
+    try:
+        session.materialize(
+            [
+                {"path": "artifacts/a", "bytes": 3, "sha256": "1" * 64},
+                {"path": "artifacts/b", "bytes": 4, "sha256": "2" * 64},
+            ]
+        )
+        session.finish()
+        assert session.finished and children[0].returncode == 0
+    finally:
+        session.close()
+
+
+@pytest.mark.parametrize(
+    "response",
+    [
+        b"",
+        b"not-json\n",
+        b"{}\n{}\n",
+        b"x" * (64 * 1024 + 1),
+        json.dumps(
+            {
+                "schema_version": 1,
+                "kind": "restore.io.reply",
+                "stage": "opened",
+                "batch_id": 0,
+                "verified_files": 0,
+                "verified_logical_bytes": 0,
+                "execution_verified": True,
+                "error": "none",
+            }
+        ).encode()
+        + b"\n",
+    ],
+)
+def test_transport_refuses_eof_malformed_unbounded_or_authority_reply(transport, response):
+    payload, start, _ = transport
+    start(
+        "import sys;sys.stdin.readline();sys.stdout.buffer.write("
+        + repr(response)
+        + ");sys.stdout.flush()"
+    )
+    with pytest.raises(DeliveryError):
+        restore_native.Session(
+            payload, "bk-" + "1" * 32, "rr-" + "2" * 32, 1, 0, time.monotonic() + 10
+        )
+
+
+def test_transport_deadline_reaps_its_owned_waiting_child(transport):
+    payload, start, _ = transport
+    start("import sys,time;sys.stdin.readline();time.sleep(10)")
+    then = time.monotonic()
+    with pytest.raises(DeliveryError):
+        restore_native.Session(payload, "bk-" + "1" * 32, "rr-" + "2" * 32, 1, 0, then + 0.2)
+    assert time.monotonic() - then < 5