Record corrected Windows diagnostic replay and final gates
This commit is contained in:
@@ -1,4 +1,5 @@
|
||||
"""Read-only, standard-library verification of this portable evidence archive."""
|
||||
from datetime import datetime
|
||||
import hashlib
|
||||
import json
|
||||
from pathlib import Path, PurePosixPath
|
||||
@@ -109,9 +110,79 @@ def verify_oracles(index):
|
||||
"Candidate DLL identity differs")
|
||||
else:
|
||||
bound({"path": path, **pin})
|
||||
oracle_cases = [("current-oracle-1", current, "current-oracle.py"),
|
||||
("candidate-oracle-1", candidate, "candidate-oracle.py")]
|
||||
if index.get("additionalCurrentOracle"):
|
||||
extra = index["additionalCurrentOracle"]
|
||||
current3 = read_json(extra["prefix"] + "/result.json")
|
||||
build3 = read_json("gates/" + extra["buildGate"] + "/result.json")
|
||||
preserved3 = read_json(extra["preserved"])
|
||||
for item in [current3["buildResult"], current3["sourceResult"], preserved3["buildResult"]]:
|
||||
bound(item)
|
||||
check_file(extra["preservationHelperRef"], preserved3["helper"])
|
||||
require(current3["sourceInputs"] == preserved3["sourceInputs"] == build3["inputs"],
|
||||
"Canonical oracle/build source binding differs")
|
||||
require(current3["sourceFiles"] == build3["inputCount"] == 604
|
||||
and current3["fixtures"] == current["fixtures"]
|
||||
and all(current3[k] is True for k in ["binaryUnchanged", "originalFixturesUnchanged",
|
||||
"dllUnchanged", "evidenceUnchanged"]),
|
||||
"Canonical oracle preservation scope differs")
|
||||
artifacts3 = []
|
||||
for line in file("gates/" + extra["buildGate"] + "/stdout.log").read_text(encoding="utf-8").splitlines():
|
||||
try:
|
||||
item = json.loads(line)
|
||||
except json.JSONDecodeError:
|
||||
continue
|
||||
if item.get("reason") == "compiler-artifact":
|
||||
artifacts3.append(item)
|
||||
require(len(preserved3["binaries"]) == 2, "Canonical preserved artifact count differs")
|
||||
for binary in preserved3["binaries"]:
|
||||
matches = [a for a in build3["artifacts"] if a["cargo"]["target"]["name"] == binary["name"]
|
||||
and a["cargo"]["profile"]["test"] is False]
|
||||
require(len(matches) == 1 and matches[0]["cargo"] in artifacts3
|
||||
and matches[0]["readback"] == {k: binary[k] for k in ["bytes", "sha256"]}
|
||||
and normalize(matches[0]["cargo"]["executable"]) == normalize(binary["source"]),
|
||||
"Canonical preserved artifact differs from build receipt")
|
||||
require(current3["artifact"] in build3["artifacts"]
|
||||
and current3["binary"] == current3["artifact"]["readback"], "Canonical oracle CLI differs")
|
||||
oracle_cases.append((extra["prefix"].split("/")[-1], current3, "current-oracle.py"))
|
||||
if index.get("additionalCandidateOracle"):
|
||||
require(index.get("additionalCurrentOracle"), "Candidate requires canonical current oracle")
|
||||
extra_candidate = index["additionalCandidateOracle"]
|
||||
candidate3 = read_json(extra_candidate["prefix"] + "/result.json")
|
||||
require(extra_candidate["priorPrefix"] == index["additionalCurrentOracle"]["prefix"]
|
||||
and candidate3["sourceInputs"] == current3["sourceInputs"]
|
||||
and candidate3["originalsUnchanged"] is True,
|
||||
"Canonical candidate source/original preservation differs")
|
||||
bound(candidate3["priorOracle"])
|
||||
require(mapping[normalize(candidate3["priorOracle"]["path"])]
|
||||
== extra_candidate["priorPrefix"] + "/result.json", "Candidate prior oracle differs")
|
||||
for path, pin in candidate3["bindings"].items():
|
||||
if normalize(path) == normalize(current3["binaryPath"]):
|
||||
require(pin == current3["binary"], "Canonical candidate CLI identity differs")
|
||||
elif normalize(path).endswith("/runtime/libunwind.dll"):
|
||||
require(pin == {"bytes": 190976, "sha256": "f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4"},
|
||||
"Canonical candidate DLL identity differs")
|
||||
else:
|
||||
bound({"path": path, **pin})
|
||||
oracle_cases.append((extra_candidate["prefix"].split("/")[-1], candidate3, "candidate-oracle.py"))
|
||||
if index.get("additionalLaunchPreparation"):
|
||||
require(index.get("additionalCurrentOracle"), "Launch requires canonical build records")
|
||||
preparation = index["additionalLaunchPreparation"]
|
||||
launch3 = read_json(preparation["manifest"])
|
||||
gui3 = next(b for b in preserved3["binaries"] if b["name"] == "arcadia-studio")
|
||||
require(launch3["nativeReady"] is True and launch3["target"] == "x86_64-pc-windows-gnullvm"
|
||||
and launch3["sourceInputs"] == build3["inputs"]
|
||||
and all(launch3["binary"][k] == gui3[k] for k in ["path", "bytes", "sha256"]),
|
||||
"Canonical launch preparation binding differs")
|
||||
for item in launch3["evidence"]:
|
||||
bound(item)
|
||||
require(sum(mapping[normalize(item["path"])] == preparation["helperRef"]
|
||||
for item in launch3["evidence"]) == 1,
|
||||
"Canonical launch preparation must pin its executed helper")
|
||||
# nativeReady records preparation only; no native acceptance is inferred.
|
||||
summaries = []
|
||||
for label, receipt, helper in [("current-oracle-1", current, "current-oracle.py"),
|
||||
("candidate-oracle-1", candidate, "candidate-oracle.py")]:
|
||||
for label, receipt, helper in oracle_cases:
|
||||
require(receipt["passed"] is True, "Oracle failed")
|
||||
check_file(base + helper, receipt["helper"])
|
||||
for run in receipt["runs"]:
|
||||
@@ -143,21 +214,118 @@ def verify_oracles(index):
|
||||
require(len(report["diagnostics"]) == 1, "Candidate diagnostic count differs")
|
||||
loc = report["diagnostics"][0]["location"]
|
||||
require([loc["start"], loc["end"]] == run["expectedSpan"], "Candidate span differs")
|
||||
original = file(base + "current-oracle-1/complete/functions.arcadia").read_bytes()
|
||||
prior = (index["additionalCandidateOracle"]["priorPrefix"]
|
||||
if label == "candidate-oracle-3" else base + "current-oracle-1")
|
||||
original = file(prior + "/complete/functions.arcadia").read_bytes()
|
||||
raw = file(prefix + run["label"] + "/functions.arcadia").read_bytes()
|
||||
require(raw == original + bytes.fromhex(run["suffixHex"]), "Candidate literal edit differs")
|
||||
summaries.append({"oracle": label, "variant": run["label"], "exitCode": run["exitCode"],
|
||||
"diagnostics": len(report["diagnostics"])})
|
||||
require([s["diagnostics"] for s in summaries] == [2, 5, 1, 1], "Oracle diagnostic counts differ")
|
||||
expected_counts = ([2, 5, 1, 1] + ([2, 5] if index.get("additionalCurrentOracle") else [])
|
||||
+ ([1, 1] if index.get("additionalCandidateOracle") else []))
|
||||
require([s["diagnostics"] for s in summaries] == expected_counts, "Oracle diagnostic counts differ")
|
||||
return summaries
|
||||
|
||||
|
||||
def verify_closed_trial2(index, trial):
|
||||
"""Verify recorded closure and capture bytes; leave UI acceptance to review."""
|
||||
prefix = trial["prefix"]
|
||||
launch = read_json(prefix + "/launch.json")
|
||||
closed = read_json(prefix + "/closed.json")
|
||||
post = read_json(prefix + "/post-exit-verification.json")
|
||||
close_ui = read_json(prefix + "/close-ui-observation.json")
|
||||
check_file(trial["closureHelper"], post["helper"])
|
||||
check_file(prefix + "/closed.json", post["closure"])
|
||||
require(closed["pid"] == launch["pid"] and closed["exitCode"] == 0
|
||||
and closed["launchReceiptError"] is None
|
||||
and all(closed[k] is True for k in ["binaryUnchanged", "preservedBinaryUnchanged",
|
||||
"sameFileAfterExit", "dllUnchanged"])
|
||||
and launch["sameFileBeforeLaunch"] is True, "Native2 closure receipt differs")
|
||||
for key in ["stdout", "stderr"]:
|
||||
check_file(prefix + "/" + key + ".log", closed[key])
|
||||
require(closed[key]["bytes"] == 0, "Native2 log is not empty")
|
||||
manifest_bytes = file(prefix + "/launch-manifest.json").read_bytes()
|
||||
require(manifest_bytes == file(trial["manifestRef"]).read_bytes()
|
||||
and identity(manifest_bytes)["sha256"] == launch["manifestSha256"],
|
||||
"Native2 launch manifest differs")
|
||||
manifest = json.loads(manifest_bytes)
|
||||
require(launch["binary"] == {k: manifest["binary"][k] for k in ["bytes", "sha256"]}
|
||||
and launch["preservedExecutable"] == manifest["binary"]["path"],
|
||||
"Native2 GUI recorded identity differs")
|
||||
check_file("native-preparation/launch.py", launch["helper"])
|
||||
# The immediately preceding window list is not process-exit proof.
|
||||
require(datetime.fromisoformat(launch["started"]) < datetime.fromisoformat(close_ui["atUtc"].replace("Z", "+00:00"))
|
||||
< datetime.fromisoformat(closed["finished"]) < datetime.fromisoformat(post["atUtc"]),
|
||||
"Native2 closure chronology differs")
|
||||
require(any(w["app"] == "process:" + launch["executable"] for w in close_ui["windows"]),
|
||||
"Native2 closing window observation differs")
|
||||
current = read_json(trial["oracleRef"] + "/result.json")
|
||||
expected = current["preparedFixtures"]["complete"]
|
||||
require({x.name for x in file(prefix + "/work-fixture").iterdir()} == set(expected),
|
||||
"Native2 saved fixture membership differs")
|
||||
require(len(post["files"]) == len(expected)
|
||||
and {x["file"] for x in post["files"]} == set(expected), "Native2 postcheck files differ")
|
||||
for item in post["files"]:
|
||||
require(item["exactEqual"] is True and item["actual"] == item["original"] == expected[item["file"]],
|
||||
"Native2 original fixture identity differs")
|
||||
check_file(prefix + "/work-fixture/" + item["file"], item["actual"])
|
||||
directory = file(prefix + "/screenshots")
|
||||
names = {x.name for x in directory.iterdir()}
|
||||
expected_names = []
|
||||
for observation in post["observations"]:
|
||||
name = observation["file"]
|
||||
require(len(relative(name).parts) == 1 and name.endswith(".json"), "Unsafe native2 metadata name")
|
||||
expected_names.append(name)
|
||||
check_file(prefix + "/screenshots/" + name, {k: observation[k] for k in ["bytes", "sha256"]})
|
||||
metadata = read_json(prefix + "/screenshots/" + name)
|
||||
require([x["file"] for x in metadata["screenshots"]]
|
||||
== [x["file"] for x in observation["screenshots"]], "Native2 screenshot references differ")
|
||||
for shot in observation["screenshots"]:
|
||||
name = shot["file"]
|
||||
require(len(relative(name).parts) == 1 and name.endswith(".jpg"), "Unsafe native2 image name")
|
||||
expected_names.append(name)
|
||||
check_file(prefix + "/screenshots/" + name, {k: shot[k] for k in ["bytes", "sha256"]})
|
||||
unique(expected_names)
|
||||
require(set(expected_names) == names and len(post["observations"]) == trial["metadata"] == 49
|
||||
and len(names) - len(post["observations"]) == trial["screenshots"] == 53,
|
||||
"Native2 exact capture membership differs")
|
||||
review = read_json(trial["review"])
|
||||
acceptance = read_json(trial["acceptance"])
|
||||
require(review["launch"] == launch and review["closure"] == closed
|
||||
and review["sourceInputs"] == manifest["sourceInputs"]
|
||||
and review["jpegCount"] == 53 and review["metadataCount"] == 49,
|
||||
"Native2 independent review receipt differs")
|
||||
normalize = lambda path: path.replace("\\", "/").casefold()
|
||||
mapping = {normalize(g["sourceRoot"] + "/" + name): g["destinationPrefix"] + "/" + name
|
||||
for g in index["payloadGroups"] for name in g["files"]}
|
||||
for original, pin in review["bindings"].items():
|
||||
target = mapping.get(normalize(original))
|
||||
require(target is not None, "Unresolved native2 independent review binding")
|
||||
check_file(target, pin)
|
||||
for label, summary in review["oracleSummaries"].items():
|
||||
oracle = read_json("native-preparation/" + label + "/result.json")
|
||||
require(summary == {"sourceInputs": oracle["sourceInputs"], "runs": [
|
||||
{"label": x["label"], "exit": x["exitCode"], "diagnostics": x["report"]["diagnostics"]}
|
||||
for x in oracle["runs"]]}, "Native2 review oracle summary differs")
|
||||
require(acceptance["decision"] == "accepted_with_explicit_scope_limits"
|
||||
and acceptance["sourceInputSha256"] == manifest["sourceInputs"]["sha256"]
|
||||
and acceptance["guiSha256"] == launch["binary"]["sha256"]
|
||||
and acceptance["independentReviewSha256"] == identity(file(trial["review"]).read_bytes())["sha256"]
|
||||
and acceptance["postExitVerificationSha256"] == identity(file(prefix + "/post-exit-verification.json").read_bytes())["sha256"],
|
||||
"Native2 parent acceptance binding differs")
|
||||
return {"prefix": prefix, "exitCode": 0, "screenshots": 53, "metadata": 49,
|
||||
"recordedAcceptance": acceptance["decision"], "uiAcceptanceReevaluated": False}
|
||||
|
||||
|
||||
def verify_native_trials(index):
|
||||
summaries = []
|
||||
normalize = lambda path: path.replace("\\", "/").casefold()
|
||||
mapping = {normalize(g["sourceRoot"] + "/" + name): g["destinationPrefix"] + "/" + name
|
||||
for g in index["payloadGroups"] for name in g["files"]}
|
||||
for trial in index.get("nativeTrials", []):
|
||||
if trial.get("closureHelper"):
|
||||
summaries.append(verify_closed_trial2(index, trial))
|
||||
continue
|
||||
prefix = trial["prefix"]
|
||||
launch = read_json(prefix + "/launch.json")
|
||||
closed = read_json(prefix + "/closed.json")
|
||||
@@ -265,9 +433,48 @@ def verify_resource_recovery(index):
|
||||
"Second compression receipt did not report successful unchanged bytes")
|
||||
second_summary = {"filesRecorded": 1048, "operationsRecorded": 9,
|
||||
"freeBytesAtReceipt": receipt["freeBytes"], "externalFilesRehashed": False}
|
||||
user_removal = None
|
||||
if record.get("userRemoval"):
|
||||
removal = read_json(record["userRemoval"])
|
||||
normalize = lambda path: path.replace("\\", "/").casefold()
|
||||
require(len(removal["paths"]) == 2
|
||||
and {normalize(x["path"]) for x in removal["paths"]}
|
||||
== {normalize(path) for path in result["paths"]}
|
||||
and all(x["exists"] is False for x in removal["paths"]),
|
||||
"User removal absence receipt differs from older desktop cache paths")
|
||||
require(removal["actor"] == "User reported deletion; agent verified absence only",
|
||||
"User removal actor scope differs")
|
||||
user_removal = {"actor": removal["actor"], "pathsReportedAbsent": 2,
|
||||
"freeBytesAtReceipt": removal["freeBytes"], "currentPathsInspected": False}
|
||||
core_summary = None
|
||||
if record.get("coreCompression"):
|
||||
core = record["coreCompression"]
|
||||
inventory = read_json(core["before"])
|
||||
receipt = read_json(core["result"])
|
||||
correction = read_json(core["correction"])
|
||||
require(identity(file(core["before"]).read_bytes())["sha256"] == correction["beforeSha256"]
|
||||
and identity(file(core["result"]).read_bytes())["sha256"] == correction["resultSha256"],
|
||||
"Core compression correction pins differ")
|
||||
require(receipt["bytes"] is None, "Original null compression total was rewritten")
|
||||
require(len(inventory) == receipt["files"] == correction["files"] == 2086
|
||||
and len({x["path"].casefold() for x in inventory}) == len(inventory)
|
||||
and sum(x["bytes"] for x in inventory) == correction["logicalBytesFromInventory"],
|
||||
"Core compression corrected inventory total differs")
|
||||
require(len(receipt["paths"]) == 4 and receipt["exitCodes"] == [0] * 4
|
||||
and receipt["filter"] == "*.o" and receipt["allFileBytesUnchanged"] is True,
|
||||
"Core compression recorded operation differs")
|
||||
require(all(any(x["path"].casefold().startswith(root.casefold() + "\\")
|
||||
for root in receipt["paths"]) for x in inventory),
|
||||
"Core compression inventory outside recorded roots")
|
||||
objects = [x for x in inventory if x["path"].endswith(".o")]
|
||||
core_summary = {"inventoryFiles": 2086, "objectFilesInInventory": len(objects),
|
||||
"logicalBytesDerived": correction["logicalBytesFromInventory"],
|
||||
"originalTotalStillNull": True, "freeBytesAtReceipt": receipt["freeBytes"],
|
||||
"externalFilesRehashed": False, "historicalSessionAttributionProved": False}
|
||||
return {"reclaimedPrivateZIPs": 11, "retainedZIPBytesVerified": reclaim["reclaimed"],
|
||||
"compressionFilesRecorded": 1040, "externalCacheRehashed": False,
|
||||
"recoveryHelpersExecutedByVerifier": False, "secondCompression": second_summary}
|
||||
"recoveryHelpersExecutedByVerifier": False, "secondCompression": second_summary,
|
||||
"userRemoval": user_removal, "coreCompression": core_summary}
|
||||
|
||||
|
||||
def verify():
|
||||
@@ -370,13 +577,33 @@ def verify():
|
||||
lines = [number for number, line in enumerate(before.splitlines(keepends=True), 1) if line.endswith(b"\r\n")]
|
||||
require(lines == receipt["lines"] == [423, 424, 425]
|
||||
and before.replace(b"\r\n", b"\n") == after, "Normalization is not the exact three-pair change")
|
||||
outcome_comparison = index.get("fullOutcomeComparison")
|
||||
if outcome_comparison:
|
||||
receipt = read_json(outcome_comparison["receipt"])
|
||||
after_prefix = "gates/" + outcome_comparison["afterGate"]
|
||||
require(identity(file(after_prefix + "/result.json").read_bytes())["sha256"] == receipt["resultSha256"],
|
||||
"Named outcome comparison result pin differs")
|
||||
named = lambda label: re.findall(r"^test (.+?) \.\.\. (ok|FAILED|ignored)",
|
||||
file("gates/" + label + "/stdout.log").read_text(encoding="utf-8"), re.MULTILINE)
|
||||
before_outcomes = named(outcome_comparison["beforeGate"])
|
||||
after_outcomes = named(outcome_comparison["afterGate"])
|
||||
require(len(after_outcomes) == receipt["testOutcomeLines"] == 912
|
||||
and sorted(before_outcomes) == sorted(after_outcomes)
|
||||
and receipt["sameNamedOutcomesAsPriorCorrectedGate"] is True,
|
||||
"Named outcome comparison differs")
|
||||
require(all(tuple(x) in after_outcomes for x in receipt["newWeakTests"]),
|
||||
"Named lifetime test outcome missing")
|
||||
gate = next(g for g in index["completedGates"] if g["label"] == outcome_comparison["afterGate"])
|
||||
require(gate["totals"] == receipt["totals"] and gate["exitCode"] == receipt["exitCode"] == 0,
|
||||
"Named outcome acceptance totals differ")
|
||||
return {"status": "PASS", "scope": "Archive bytes, ZIP members/CRC/content, gate/probe/oracle/native receipt bindings, saved spans and capture membership; no execution or binary revalidation",
|
||||
"manifestSha256": identity(file("files.json").read_bytes())["sha256"],
|
||||
"pinnedFiles": len(manifest), "payloadFiles": len(payload),
|
||||
"sourceCaptures": len(index["captures"]), "verifiedZIPMembers": members,
|
||||
"completedGates": len(index["completedGates"]), "probeInputs": len(inputs),
|
||||
"savedOracles": oracles, "closedNativeTrials": trials, "resourceRecovery": recovery,
|
||||
"sourceNormalizationVerified": bool(normalization)}
|
||||
"sourceNormalizationVerified": bool(normalization),
|
||||
"namedFullOutcomesCompared": 912 if outcome_comparison else 0}
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
|
||||
Reference in New Issue
Block a user