Довёл fix20: firewall-mode, staged state, diagnostics, readiness и build-gate

orchestrator/src/platform/assert.ts

@@ -25,7 +25,9 @@ export async function assertPlatform(options: AssertPlatformOptions): Promise<vo
   }
 
   if (!profile.capabilities.systemd) {
-    fail("required capability missing: systemd");
+    fail(
+      `required capability missing: systemd (${profile.capabilityDetails.systemdReason}; pid1=${profile.capabilityDetails.pid1}; state=${profile.capabilityDetails.systemdState})`
+    );
   }
   if (!profile.capabilities.systemdRun) {
     fail("required capability missing: systemd-run");

orchestrator/src/platform/profile.ts

@@ -1,4 +1,4 @@
-import { exists, readText } from "../lib/fs";
+import { dirExists, readText } from "../lib/fs";
 import { run } from "../lib/process";
 
 export type PlatformProfile = {
@@ -12,6 +12,11 @@ export type PlatformProfile = {
     systemdRun: boolean;
     nftAtomicReplace: boolean;
   };
+  capabilityDetails: {
+    systemdReason: string;
+    systemdState: string;
+    pid1: string;
+  };
 };
 
 function parseOsRelease(content: string): Record<string, string> {
@@ -51,6 +56,40 @@ async function detectOpenSsl3(): Promise<boolean> {
   }
 }
 
+async function detectSystemd(): Promise<{ ok: boolean; reason: string; state: string; pid1: string }> {
+  if (!(await commandExists("systemctl"))) {
+    return { ok: false, reason: "systemctl not found", state: "unknown", pid1: "unknown" };
+  }
+
+  let pid1 = "unknown";
+  try {
+    pid1 = (await run`ps -p 1 -o comm=`).trim();
+  } catch {
+    return { ok: false, reason: "unable to inspect PID 1", state: "unknown", pid1: "unknown" };
+  }
+
+  if (pid1 !== "systemd") {
+    return { ok: false, reason: `PID 1 is ${pid1}, not systemd`, state: "unknown", pid1 };
+  }
+
+  if (!(await dirExists("/run/systemd/system"))) {
+    return { ok: false, reason: "/run/systemd/system is missing", state: "unknown", pid1 };
+  }
+
+  let state = "unknown";
+  try {
+    state = (await run`systemctl is-system-running || true`).trim();
+  } catch {
+    state = "unknown";
+  }
+
+  if (state !== "running" && state !== "degraded") {
+    return { ok: false, reason: `systemd state is ${state || "unknown"}`, state, pid1 };
+  }
+
+  return { ok: true, reason: "ok", state, pid1 };
+}
+
 export async function getPlatformProfile(): Promise<PlatformProfile> {
   const osReleaseRaw = await readText("/etc/os-release");
   const parsed = parseOsRelease(osReleaseRaw);
@@ -61,7 +100,8 @@ export async function getPlatformProfile(): Promise<PlatformProfile> {
   const architecture: PlatformProfile["architecture"] = archRaw.trim() === "x86_64" ? "amd64" : "unsupported";
 
   const nftables = await commandExists("nft");
-  const systemd = await commandExists("systemctl") && (await exists("/run/systemd/system"));
+  const systemdCheck = await detectSystemd();
+  const systemd = systemdCheck.ok;
   const systemdRun = await commandExists("systemd-run");
   const openssl3 = await detectOpenSsl3();
   const nftAtomicReplace = nftables;
@@ -76,6 +116,11 @@ export async function getPlatformProfile(): Promise<PlatformProfile> {
       openssl3,
       systemdRun,
       nftAtomicReplace
+    },
+    capabilityDetails: {
+      systemdReason: systemdCheck.reason,
+      systemdState: systemdCheck.state,
+      pid1: systemdCheck.pid1
     }
   };
 }