feat(polymarket): publish source-bound quote runner

.github/scripts/polymarket-market-recorder-release-artifact.sh

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+mode=${1:?expected create or verify}
+release=${2:?expected release directory}
+source_revision=${3:?expected source revision}
+image_digest=${4:?expected image digest}
+manifest="$release/polymarket-market-recorder-release.json"
+binary="$release/new-ploy-runner"
+
+[[ $source_revision =~ ^[0-9a-f]{40}$ ]] || {
+  printf 'invalid source revision: %s\n' "$source_revision" >&2
+  exit 1
+}
+[[ $image_digest =~ ^sha256:[0-9a-f]{64}$ ]] || {
+  printf 'invalid image digest: %s\n' "$image_digest" >&2
+  exit 1
+}
+
+verify_binary() {
+  local expected_sha actual_sha
+  [[ -f $binary && -x $binary && ! -L $binary ]]
+  "$binary" --version | grep -Fqx "new-ploy-runner $source_revision"
+  expected_sha=$(awk 'NR == 1 && NF == 2 && $2 == "new-ploy-runner" {print $1}' \
+    "$release/new-ploy-runner.sha256")
+  [[ $expected_sha =~ ^[0-9a-f]{64}$ ]]
+  actual_sha=$(sha256sum "$binary" | awk '{print $1}')
+  [[ $actual_sha == "$expected_sha" ]]
+}
+
+case "$mode" in
+  create)
+    [[ -d $release && ! -e $manifest ]]
+    [[ -f $binary && -x $binary && ! -L $binary ]]
+    "$binary" --version | grep -Fqx "new-ploy-runner $source_revision"
+    (
+      cd "$release"
+      sha256sum new-ploy-runner > new-ploy-runner.sha256
+    )
+    candidate_sha=$(awk '{print $1}' "$release/new-ploy-runner.sha256")
+    jq -S -n \
+      --arg source_revision "$source_revision" \
+      --arg candidate_sha256 "$candidate_sha" \
+      --arg image_digest "$image_digest" \
+      '{schema:"monday.polymarket_market_recorder_release.v1",
+        source_revision:$source_revision,
+        candidate:{file:"new-ploy-runner",sha256:$candidate_sha256},
+        image_digest:$image_digest,
+        platform:{os:"linux",architecture:"amd64"}}' > "$manifest"
+    (
+      cd "$release"
+      sha256sum polymarket-market-recorder-release.json \
+        > polymarket-market-recorder-release.json.sha256
+    )
+    ;;
+  verify)
+    expected_files=$'new-ploy-runner\nnew-ploy-runner.sha256\npolymarket-market-recorder-release.json\npolymarket-market-recorder-release.json.sha256'
+    actual_files=$(find "$release" -mindepth 1 -maxdepth 1 -print \
+      | sed 's|.*/||' | sort)
+    [[ $actual_files == "$expected_files" ]]
+    verify_binary
+    (
+      cd "$release"
+      sha256sum --check --strict polymarket-market-recorder-release.json.sha256 \
+        >/dev/null
+    )
+    candidate_sha=$(sha256sum "$binary" | awk '{print $1}')
+    jq -e \
+      --arg source_revision "$source_revision" \
+      --arg candidate_sha256 "$candidate_sha" \
+      --arg image_digest "$image_digest" '
+      (keys | sort) == ["candidate", "image_digest", "platform", "schema", "source_revision"]
+      and .schema == "monday.polymarket_market_recorder_release.v1"
+      and .source_revision == $source_revision
+      and .candidate == {file:"new-ploy-runner",sha256:$candidate_sha256}
+      and .image_digest == $image_digest
+      and .platform == {os:"linux",architecture:"amd64"}' "$manifest" >/dev/null
+    ;;
+  *)
+    printf 'unsupported artifact mode: %s\n' "$mode" >&2
+    exit 2
+    ;;
+esac

.github/workflows/acr-publish.yml

@@ -306,6 +306,36 @@ jobs:
           docker run --rm "$IMAGE" --dry-run --help 2>&1 \
             | grep -Fq -- '--dry-run'
 
+      - name: Extract bare-metal Polymarket market recorder
+        if: matrix.repository == 'polymarket-market-recorder'
+        env:
+          IMAGE: ${{ vars.ACR_REGISTRY }}/wildcard0923/${{ matrix.repository }}@${{ steps.build.outputs.digest }}
+          SOURCE_REVISION: ${{ needs.selector.outputs.source_sha }}
+          IMAGE_DIGEST: ${{ steps.build.outputs.digest }}
+        run: |
+          set -euo pipefail
+          mkdir -p polymarket-market-recorder-artifact
+          container_id=$(docker create "$IMAGE")
+          trap 'docker rm -f "$container_id" >/dev/null 2>&1 || true' EXIT
+          docker cp "$container_id:/usr/local/bin/new-ploy-runner" \
+            polymarket-market-recorder-artifact/new-ploy-runner
+          chmod 0755 polymarket-market-recorder-artifact/new-ploy-runner
+          .github/scripts/polymarket-market-recorder-release-artifact.sh create \
+            polymarket-market-recorder-artifact "$SOURCE_REVISION" "$IMAGE_DIGEST"
+          .github/scripts/polymarket-market-recorder-release-artifact.sh verify \
+            polymarket-market-recorder-artifact "$SOURCE_REVISION" "$IMAGE_DIGEST"
+          tar --format=ustar -cf polymarket-market-recorder-linux-amd64.tar \
+            -C polymarket-market-recorder-artifact .
+
+      - name: Upload bare-metal Polymarket market recorder
+        if: matrix.repository == 'polymarket-market-recorder'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: polymarket-market-recorder-linux-amd64-${{ needs.selector.outputs.source_sha }}
+          path: polymarket-market-recorder-linux-amd64.tar
+          if-no-files-found: error
+          retention-days: 90
+
       - name: Verify research runner image
         if: matrix.repository == 'research-runner'
         env:

.github/workflows/ci.yml

@@ -360,6 +360,8 @@ jobs:
           ../deployment/aliyun/test-rust-lob-control-plane.sh
           ../deployment/aliyun/test-rust-lob-release-adoption.sh
           ../deployment/aliyun/test-polymarket-raw-ops-control-plane.sh
+          MONDAY_TEST_RECORDER_IMAGE=1 SOURCE_REVISION="$GITHUB_SHA" \
+            ../deployment/aliyun/test-polymarket-market-recorder-release.sh
           ../deployment/aliyun/test-trading-ecs-host-contract.sh
           cargo test -p hft-collector --lib systemd_reference_resource_envelope_is_pinned --locked
 

deployment/aliyun/test-polymarket-market-recorder-release.sh

@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+# Static contract greps intentionally use literal shell expressions.
+# shellcheck disable=SC2016
+set -euo pipefail
+
+SCRIPT_DIR=$(cd -- "$(dirname -- "$0")" && pwd)
+readonly SCRIPT_DIR
+readonly WORKFLOW="$SCRIPT_DIR/../../.github/workflows/acr-publish.yml"
+readonly ARTIFACT_HELPER="$SCRIPT_DIR/../../.github/scripts/polymarket-market-recorder-release-artifact.sh"
+readonly DOCKERFILE="$SCRIPT_DIR/../../rust_hft/deployment/docker/Dockerfile.polymarket-market-recorder"
+readonly RUNNER="$SCRIPT_DIR/../../rust_hft/prediction-markets/apps/new-ploy-runner/src/main.rs"
+
+shellcheck "$0"
+test -x "$ARTIFACT_HELPER"
+
+grep -Fq 'ARG SOURCE_REVISION' "$DOCKERFILE"
+grep -Fq "grep -Eq '^[0-9a-f]{40}$'" "$DOCKERFILE"
+grep -Fq 'MONDAY_SOURCE_REVISION="$SOURCE_REVISION" cargo' "$DOCKERFILE"
+
+grep -Fq 'option_env!("MONDAY_SOURCE_REVISION")' "$RUNNER"
+grep -Fq 'std::env::args_os()' "$RUNNER"
+grep -Fq 'new-ploy-runner {BUILD_SOURCE_REVISION}' "$RUNNER"
+
+grep -Fq 'Extract bare-metal Polymarket market recorder' "$WORKFLOW"
+grep -Fq 'polymarket-market-recorder-release-artifact.sh create' "$WORKFLOW"
+grep -Fq 'polymarket-market-recorder-release-artifact.sh verify' "$WORKFLOW"
+grep -Fq 'new-ploy-runner $source_revision' "$ARTIFACT_HELPER"
+grep -Fq 'monday.polymarket_market_recorder_release.v1' "$ARTIFACT_HELPER"
+grep -Fq 'polymarket-market-recorder-linux-amd64-${{ needs.selector.outputs.source_sha }}' "$WORKFLOW"
+grep -Fq 'tar --format=ustar -cf polymarket-market-recorder-linux-amd64.tar' "$WORKFLOW"
+grep -Fq 'path: polymarket-market-recorder-linux-amd64.tar' "$WORKFLOW"
+
+if [[ ${MONDAY_TEST_RECORDER_IMAGE:-0} == 1 ]]; then
+  : "${SOURCE_REVISION:?set SOURCE_REVISION for the image contract test}"
+  [[ $SOURCE_REVISION =~ ^[0-9a-f]{40}$ ]]
+  for command in docker jq sha256sum tar; do
+    command -v "$command" >/dev/null
+  done
+
+  tmp_root=$(mktemp -d)
+  release_dir="$tmp_root/release"
+  mkdir "$release_dir"
+  trap 'rm -rf "$tmp_root"' EXIT
+  image="monday-polymarket-market-recorder-test:$SOURCE_REVISION"
+  docker build --quiet \
+    --build-arg "SOURCE_REVISION=$SOURCE_REVISION" \
+    -f "$DOCKERFILE" \
+    -t "$image" \
+    "$SCRIPT_DIR/../../rust_hft" >/dev/null
+  if docker build --quiet \
+    --build-arg SOURCE_REVISION=invalid \
+    -f "$DOCKERFILE" \
+    -t monday-polymarket-market-recorder-invalid-test \
+    "$SCRIPT_DIR/../../rust_hft" >/dev/null 2>&1; then
+    printf 'market-recorder image accepted an invalid source revision\n' >&2
+    exit 1
+  fi
+
+  container_id=$(docker create "$image")
+  trap 'docker rm -f "$container_id" >/dev/null 2>&1 || true; rm -rf "$tmp_root"' EXIT
+  docker cp "$container_id:/usr/local/bin/new-ploy-runner" \
+    "$release_dir/new-ploy-runner"
+  chmod 0755 "$release_dir/new-ploy-runner"
+  image_id=$(docker image inspect --format '{{.Id}}' "$image")
+  "$ARTIFACT_HELPER" create "$release_dir" "$SOURCE_REVISION" "$image_id"
+  "$ARTIFACT_HELPER" verify "$release_dir" "$SOURCE_REVISION" "$image_id"
+
+  archive="$tmp_root/polymarket-market-recorder-linux-amd64.tar"
+  transported_release="$tmp_root/transported-release"
+  tar --format=ustar -cf "$archive" -C "$release_dir" .
+  chmod 0644 "$release_dir/new-ploy-runner"
+  mkdir "$transported_release"
+  tar -xf "$archive" -C "$transported_release"
+  "$ARTIFACT_HELPER" verify \
+    "$transported_release" "$SOURCE_REVISION" "$image_id"
+  chmod 0755 "$release_dir/new-ploy-runner"
+
+  cp "$release_dir/polymarket-market-recorder-release.json" \
+    "$tmp_root/release.json.good"
+  jq '.source_revision = "0000000000000000000000000000000000000000"' \
+    "$tmp_root/release.json.good" \
+    > "$release_dir/polymarket-market-recorder-release.json"
+  (
+    cd "$release_dir"
+    sha256sum polymarket-market-recorder-release.json \
+      > polymarket-market-recorder-release.json.sha256
+  )
+  if "$ARTIFACT_HELPER" verify "$release_dir" "$SOURCE_REVISION" "$image_id"; then
+    printf 'release verifier accepted the wrong source revision\n' >&2
+    exit 1
+  fi
+fi
+
+printf 'Polymarket market-recorder release contract tests passed\n'

deployment/aliyun/test-trading-ecs-host-contract.sh

@@ -1205,7 +1205,7 @@ grep -Fq \
   "$WORKFLOW"
 [[ $(grep -Fc \
   'uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' \
-  "$WORKFLOW") -eq 3 ]]
+  "$WORKFLOW") -eq 4 ]]
 if grep -Eq \
   'uses: (actions/(checkout|upload-artifact)|docker/(setup-buildx-action|login-action|build-push-action))@v[0-9]' \
   "$WORKFLOW"; then

rust_hft/deployment/docker/Dockerfile.polymarket-market-recorder

@@ -2,6 +2,7 @@
 
 FROM rust:1.91-bookworm AS builder
 
+ARG SOURCE_REVISION
 WORKDIR /work
 RUN apt-get update && apt-get install -y --no-install-recommends \
     clang \
@@ -15,12 +16,13 @@ WORKDIR /work/prediction-markets
 RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
     --mount=type=cache,target=/usr/local/cargo/git,sharing=locked \
     --mount=type=cache,target=/work/prediction-markets/target,sharing=locked \
-    if cargo tree --locked -p new-ploy-runner --features full -e features \
+    printf '%s\n' "$SOURCE_REVISION" | grep -Eq '^[0-9a-f]{40}$' \
+    && if cargo tree --locked -p new-ploy-runner --features full -e features \
       | grep -q 'live-execution'; then \
       echo "new-ploy-runner full feature must not enable live-execution" >&2; \
       exit 1; \
     fi \
-    && cargo --config 'build.rustc-wrapper=""' build \
+    && MONDAY_SOURCE_REVISION="$SOURCE_REVISION" cargo --config 'build.rustc-wrapper=""' build \
       --release \
       --locked \
       -p new-ploy-runner \

rust_hft/prediction-markets/apps/new-ploy-runner/src/main.rs

@@ -1,4 +1,16 @@
+const BUILD_SOURCE_REVISION: &str = match option_env!("MONDAY_SOURCE_REVISION") {
+    Some(value) => value,
+    None => "unbound-source-revision",
+};
+
 #[tokio::main]
 async fn main() {
-    ploy_runner_host::run_with_implicit_run_args(std::env::args().collect()).await;
+    let args: Vec<String> = std::env::args_os()
+        .map(|arg| arg.into_string().expect("arguments must be valid UTF-8"))
+        .collect();
+    if matches!(args.get(1).map(String::as_str), Some("--version" | "-V")) {
+        println!("new-ploy-runner {BUILD_SOURCE_REVISION}");
+        return;
+    }
+    ploy_runner_host::run_with_implicit_run_args(args).await;
 }