Making it through the full workflow run!

As in, incl a data transfer _and_ a transfer to the user. Yay!

Author: Lut99

Dockerfile.let

@@ -19,7 +19,7 @@ ARG USERID=1000
 ARG GROUPID=1000
 
 # Setup a user mirroring the main one
-RUN if [[ -z "$(cat /etc/group | grep ':20:')" ]]; then addgroup --gid $GROUPID brane && export GROUP=brane else export GROUP=$(getent group $GROUPID | cut -d: -f1); fi
+RUN if [[ ! "$(getent group $GROUPID)" ]]; then addgroup --gid $GROUPID brane && export GROUP=brane else export GROUP=$(getent group $GROUPID | cut -d: -f1); fi
 RUN adduser --uid $USERID --gid $GROUPID --gecos "Brane" --disabled-password brane
 
 # Install build dependencies

brane-chk/src/apis/deliberation.rs

@@ -4,7 +4,7 @@
 //  Created:
 //    28 Oct 2024, 20:44:52
 //  Last edited:
-//    29 Apr 2025, 23:33:44
+//    02 May 2025, 15:01:31
 //  Auto updated?
 //    Yes
 //
@@ -379,12 +379,21 @@ where
             };
 
             // Decide the input
-            let task_id: String = pc_to_id(&req.workflow, req.task);
-            let input: Input = Input {
-                store:    this.store.clone(),
-                usecase:  req.usecase,
-                workflow: req.workflow,
-                input:    QuestionInput::TransferInput { task: task_id, input: req.input },
+            let input: Input = if let Some(task) = req.task {
+                let task_id: String = pc_to_id(&req.workflow, task);
+                Input {
+                    store:    this.store.clone(),
+                    usecase:  req.usecase,
+                    workflow: req.workflow,
+                    input:    QuestionInput::TransferInput { task: task_id, input: req.input },
+                }
+            } else {
+                Input {
+                    store:    this.store.clone(),
+                    usecase:  req.usecase,
+                    workflow: req.workflow,
+                    input:    QuestionInput::TransferResult { result: req.input },
+                }
             };
 
             // Continue with the agnostic function for maintainability

brane-chk/src/question.rs

@@ -4,7 +4,7 @@
 //  Created:
 //    17 Oct 2024, 16:10:59
 //  Last edited:
-//    29 Apr 2025, 15:37:12
+//    02 May 2025, 14:59:38
 //  Auto updated?
 //    Yes
 //
@@ -15,7 +15,7 @@
 use std::fmt::{Formatter, Result as FResult};
 
 use policy_reasoner::reasoners::eflint_haskell::spec::EFlintable;
-use policy_reasoner::workflow::Workflow;
+use policy_reasoner::workflow::{Entity, Workflow};
 use serde::{Deserialize, Serialize};
 
 use crate::workflow;
@@ -46,6 +46,13 @@ pub enum Question {
         /// The input to that task that we want to validate.
         input:    String,
     },
+    /// Checks if a domain agrees with providing the given result to the end user of the workflow.
+    TransferResult {
+        /// The workflow that we want to validate.
+        workflow: Workflow,
+        /// The input to that task that we want to validate.
+        result:   String,
+    },
 }
 impl EFlintable for Question {
     #[inline]
@@ -66,6 +73,16 @@ impl EFlintable for Question {
                 writeln!(f, "?dataset-to-transfer(node-input(node(workflow({:?}), {:?}), asset({:?})))", workflow.id, task, input)?;
                 Ok(())
             },
+            Self::TransferResult { workflow, result } => {
+                workflow::eflint_fmt(workflow, f)?;
+                let user: &Entity = workflow.user.as_ref().unwrap_or_else(|| panic!("Cannot ask for a transfer result without a user in workflow"));
+                writeln!(
+                    f,
+                    "?result-to-transfer(workflow-result-recipient(workflow-result(workflow({:?}), asset({:?})), user({:?})))",
+                    workflow.id, result, user.id
+                )?;
+                Ok(())
+            },
         }
     }
 }

brane-chk/src/stateresolver.rs

@@ -4,7 +4,7 @@
 //  Created:
 //    17 Oct 2024, 16:09:36
 //  Last edited:
-//    01 May 2025, 17:14:40
+//    02 May 2025, 14:59:31
 //  Auto updated?
 //    Yes
 //
@@ -725,6 +725,7 @@ pub enum QuestionInput {
     ValidateWorkflow,
     ExecuteTask { task: String },
     TransferInput { task: String, input: String },
+    TransferResult { result: String },
 }
 
 
@@ -813,6 +814,7 @@ impl StateResolver for BraneStateResolver {
                     }
                     Ok((policy, Question::TransferInput { workflow: wf, task, input }))
                 },
+                QuestionInput::TransferResult { result } => Ok((policy, Question::TransferResult { workflow: wf, result })),
             }
         }
     }

brane-chk/src/workflow/compiler.rs

@@ -4,7 +4,7 @@
 //  Created:
 //    21 Oct 2024, 10:47:42
 //  Last edited:
-//    29 Apr 2025, 23:37:33
+//    02 May 2025, 11:50:06
 //  Auto updated?
 //    Yes
 //
@@ -134,9 +134,9 @@ struct Arguments {
     #[clap(
         short = '2',
         long,
-        default_value = "eflint-json",
-        help = "The output language to compile to. Options are 'wf'/'workflow' for the policy reasoner's workflow representation, 'eflint-json' for \
-                eFLINT JSON Specification, or 'eflint'/'eflint-dsl' for the eFLINT DSL."
+        default_value = "eflint",
+        help = "The output language to compile to. Options are 'wf'/'workflow' for the policy reasoner's workflow representation, or \
+                'eflint'/'eflint-dsl' for the eFLINT DSL."
     )]
     output_lang: OutputLanguage,
 }

brane-cli-c/src/lib.rs

@@ -4,7 +4,7 @@
 //  Created:
 //    14 Jun 2023, 17:38:09
 //  Last edited:
-//    14 Nov 2024, 17:59:09
+//    02 May 2025, 15:05:31
 //  Auto updated?
 //    Yes
 //
@@ -1174,8 +1174,8 @@ pub unsafe extern "C" fn fvalue_serialize(fvalue: *const FullValue, data_dir: *c
 
     // Serialize the result only if there is anything to serialize
     let mut sfvalue: String = String::new();
-    if fvalue != &FullValue::Void {
-        writeln!(&mut sfvalue, "\nWorkflow returned value {}", style(format!("'{fvalue}'")).bold().cyan()).unwrap();
+    if !matches!(fvalue, FullValue::Void) {
+        writeln!(&mut sfvalue, "\nWorkflow returned value {}", style(format!("'{}'", fvalue)).bold().cyan()).unwrap();
 
         // Treat some values special
         match fvalue {
@@ -1342,7 +1342,7 @@ pub unsafe extern "C" fn vm_free(vm: *mut VirtualMachine) {
 /// - `vm`: The [`VirtualMachine`] that we execute with. This determines which backend to use.
 /// - `workflow`: The compiled workflow to execute.
 /// - `prints`: A newly allocated string which represents any stdout- or stderr prints done during workflow execution. Will be [`NULL`] if there is an error (see below).
-/// - `result`: A [`FullValue`] which represents the return value of the workflow. Will be [`NULL`] if there is an error (see below).
+/// - `result`: A [`FullValue`] which represents the return value of the workflow, and a [`ProgramCounter`] that denotes which instruction produced it (or [`None`] if the workflow was empty). Will be [`NULL`] if there is an error (see below).
 ///
 /// # Returns
 /// An [`Error`]-struct that contains the error occurred, or [`NULL`] otherwise.

brane-cli/src/data.rs

@@ -4,7 +4,7 @@
 //  Created:
 //    12 Sep 2022, 17:39:06
 //  Last edited:
-//    29 Apr 2025, 14:00:18
+//    02 May 2025, 15:03:01
 //  Auto updated?
 //    Yes
 //
@@ -56,6 +56,7 @@ use crate::utils::{ensure_dataset_dir, ensure_datasets_dir, get_dataset_dir};
 /// - `certs_dir`: The directory where certificates are stored. Expected to contain nested directories that store the certs by domain ID.
 /// - `data_dir`: The directory to download the dataset to.
 /// - `name`: The name of the dataset to download.
+/// - `workflow`: A workflow for which we're downloading a result.
 /// - `access`: The locations where it is available.
 ///
 /// # Returns

brane-cli/src/errors.rs

@@ -4,7 +4,7 @@
 //  Created:
 //    17 Feb 2022, 10:27:28
 //  Last edited:
-//    29 Apr 2025, 13:40:48
+//    02 May 2025, 14:16:13
 //  Auto updated?
 //    Yes
 //
@@ -15,6 +15,7 @@
 use std::error::Error;
 use std::path::PathBuf;
 
+use brane_exe::value::DataId;
 use brane_shr::formatters::{BlockFormatter, PrettyListFormatter};
 use reqwest::StatusCode;
 use specifications::address::Address;
@@ -867,6 +868,9 @@ pub enum RunError {
     /// Failed to download remote dataset.
     #[error("Failed to download remote dataset")]
     DataDownloadError { source: DataError },
+    /// Workflow returned result without PC.
+    #[error("Workflow returned data \"{data}\" without providing information where in the workflow it's downloaded from.")]
+    DataDownloadWithoutPc { data: DataId },
 
     /// Failed to read the source from stdin
     #[error("Failed to read source from stdin")]

brane-cli/src/repl.rs

@@ -4,7 +4,7 @@
 //  Created:
 //    12 Sep 2022, 16:42:47
 //  Last edited:
-//    29 Apr 2025, 11:58:06
+//    02 May 2025, 14:38:28
 //  Auto updated?
 //    Yes
 //
@@ -24,6 +24,7 @@ use brane_dsl::Language;
 use brane_exe::FullValue;
 use brane_tsk::docker::DockerOptions;
 use brane_tsk::spec::AppId;
+use error_trace::ErrorTrace as _;
 use log::warn;
 use rustyline::completion::{Completer, FilenameCompleter, Pair};
 use rustyline::error::ReadlineError;
@@ -425,7 +426,7 @@ async fn remote_repl(
 
                 // Then, we collect and process the result
                 if let Err(source) = process_instance_result(&api_address, &proxy_addr, use_case.clone(), snippet.workflow, res).await {
-                    error!("{}", Error::ProcessError { what: "remote instance VM", source });
+                    error!("{}", Error::ProcessError { what: "remote instance VM", source }.trace());
                     continue;
                 }
 
@@ -513,7 +514,7 @@ async fn local_repl(
 
                 // Then, we collect and process the result
                 if let Err(source) = process_offline_result(res) {
-                    error!("{}", Error::ProcessError { what: "offline VM", source });
+                    error!("{}", Error::ProcessError { what: "offline VM", source }.trace());
                     continue;
                 }
 

brane-cli/src/run.rs

@@ -4,7 +4,7 @@
 //  Created:
 //    12 Sep 2022, 16:42:57
 //  Last edited:
-//    29 Apr 2025, 14:00:29
+//    05 May 2025, 11:15:39
 //  Auto updated?
 //    Yes
 //
@@ -128,7 +128,7 @@ pub async fn initialize_instance<O: Write, E: Write>(
 /// - `profile`: If given, prints the profile timings to stdout if reported by the remote.
 ///
 /// # Returns
-/// A [`FullValue`] carrying the result of the snippet (or [`FullValue::Void`]).
+/// A [`FullValue`] carrying the result of the snippet (or [`FullValue::Void`]), and a [`ProgramCounter`] in case a [`FullValue::Data`] is returned telling us which edge downloaded it.
 ///
 /// # Errors
 /// This function may error if anything in the whole shebang crashed. This can be things client-side, but also remote-side.
@@ -219,7 +219,7 @@ pub async fn run_instance<O: Write, E: Write>(
 /// - `proxy_addr`: If given, proxies all data transfers through the proxy at the given location.
 /// - `certs_dir`: The directory where certificates are stored. Expected to contain nested directories that store the certs by domain ID.
 /// - `datasets_dir`: The directory where we will download the data to. It will be added under a new folder with its own name.
-/// - `result`: The value to process.
+/// - `result`: The value to process, together with a program counter if it was the result of a toplevel return.
 ///
 /// # Returns
 /// Nothing, but does print any result to stdout. It may also download a remote dataset if one is given.
@@ -240,8 +240,8 @@ pub async fn process_instance(
     let datasets_dir: &Path = datasets_dir.as_ref();
 
     // We only print
-    if result != FullValue::Void {
-        println!("\nWorkflow returned value {}", style(format!("'{result}'")).bold().cyan());
+    if !matches!(result, FullValue::Void) {
+        println!("\nWorkflow returned value {}", style(format!("'{}'", result)).bold().cyan());
 
         // FIXME: Clean up this blob
         // Treat some values special