docs: publish Process multiselect verification and native correction evidence

2026-09-23 06:51:41 -07:00
parent b743a10d51
commit 6d99aacab8
48 changed files with 4921 additions and 0 deletions
@@ -0,0 +1,115 @@
+"""Package explicitly named closed Process native runs; never execute archived helpers."""
+from pathlib import Path
+import argparse
+import io
+import json
+import re
+import zipfile
+from verify import pin, parsed, need, norm, relative, safe, zip_inventory, verify_data, verify_package
+
+HERE = Path(__file__).resolve().parent
+FAILED_RUN_ONE = "Observed Back restored qualified highlight with outer-reference editable Properties; reorder and Undo/Redo/reopen history were not performed. Failed native workflow, despite three positive unchanged Project reports."
+
+
+def collect(root, runs, extra_helpers=()):
+    native = root / ".local/process-multiselect-native"
+    candidates = [p for p in native.iterdir() if p.is_file()]
+    candidates += sorted((root / ".local/process-group-gates").glob("*.py"))
+    candidates += list(extra_helpers)
+    helpers = [(p.suffix, p.read_bytes()) for p in candidates]
+    payload, specs = {}, {}
+    def add(name, data):
+        need(safe(name) and (name not in payload or payload[name] == data), "member collision: " + name)
+        payload[name] = data
+        return name
+    def helper(expected):
+        matches = [(suffix, data) for suffix, data in helpers if pin(data) == expected]
+        need(matches, "exact historical helper unavailable: " + str(expected))
+        suffix, data = matches[0]
+        return add("helpers/" + expected["sha256"] + suffix, data)
+    def tree(folder, prefix):
+        need(folder.is_dir(), "missing directory: " + str(folder))
+        for path in sorted(folder.rglob("*")):
+            need(not path.is_symlink() and not getattr(path, "is_junction", lambda: False)(), "linked evidence input")
+            if path.is_file():
+                add(prefix + path.relative_to(folder).as_posix(), path.read_bytes())
+    for run in runs:
+        folder = native / run
+        need((folder / "finished.json").is_file(), "open/unlaunched run refused: " + run)
+        prepared = parsed((folder / "prepared.json").read_bytes())
+        tree(folder, "runs/" + run + "/raw/")
+        spec = {"originalRun": norm(prepared["cwd"]) + "/.local/process-multiselect-native/" + run,
+                "reviewStatus": "failed" if run == "run-1" else "unreviewed",
+                "reviewNote": FAILED_RUN_ONE if run == "run-1" else "Packaging consistency does not decide native acceptance. Consult the independent parent review.",
+                "helpers": {name: helper(expected) for name, expected in prepared["helpers"].items()},
+                "executedCapture": pin((folder / "capture-executed.js").read_bytes()), "builds": {}}
+        for kind in ("gui", "checker"):
+            recorded = prepared[kind]
+            rel = relative(recorded["receipt"], prepared["cwd"])
+            need(rel.startswith(".local/process-group-gates/") and rel.endswith("/result.json"), "unexpected receipt location")
+            receipt = root / rel
+            result_data = receipt.read_bytes()
+            need(pin(result_data) == recorded["receiptPin"], "historical build receipt changed")
+            result = parsed(result_data)
+            prefix = "builds/" + pin(result_data)["sha256"] + "/"
+            build = {"originalRelative": rel, "helper": helper(result["helper"])}
+            for name in ("started.json", "process.json", "result.json", "stdout.log", "stderr.log", "inputs.json", "inputs.zip"):
+                data = (receipt.parent / name).read_bytes()
+                # Deduplicate source capsules independently of differing build receipts.
+                member = ("inputs/" + pin(data)["sha256"] + Path(name).suffix) if name.startswith("inputs.") else prefix + name
+                build[name] = add(member, data)
+            spec["builds"][kind] = build
+            if kind == "checker":
+                capsule = payload[build["inputs.zip"]]
+                need(pin(capsule) == result["archive"], "historical checker capsule pin")
+                inputs = parsed(payload[build["inputs.json"]])
+                with zipfile.ZipFile(io.BytesIO(capsule)) as archive:
+                    zip_inventory(archive, inputs)
+                    source = archive.read("crates/oa-core/examples/process_multiselect_native.rs")
+                spec["checkerSource"] = add("checker-source/" + pin(source)["sha256"] + ".rs", source)
+        specs[run] = spec
+    manifest = {"schema": 1, "kind": "process-multiselect-native", "runs": specs,
+                "members": {name: pin(data) for name, data in sorted(payload.items())}}
+    return payload, manifest, verify_data(manifest, payload.__getitem__)
+
+
+def write_json(path, value):
+    with path.open("xb") as stream:
+        stream.write((json.dumps(value, indent=2) + "\n").encode())
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--root", type=Path, required=True)
+    parser.add_argument("--runs", nargs="+", required=True)
+    parser.add_argument("--output", type=Path)
+    parser.add_argument("--check-only", action="store_true")
+    parser.add_argument("--helper", type=Path, action="append", default=[], help="Exact historical helper bytes if current helper changed")
+    args = parser.parse_args()
+    need(len(args.runs) == len(set(args.runs)) and all(re.fullmatch(r"run-[0-9]+", name) for name in args.runs), "explicit unique run-N names required")
+    need(args.check_only or args.output is not None, "--output or --check-only required")
+    if args.output is not None:
+        need(not args.output.exists(), "fresh nonexistent output directory required")
+    payload, manifest, summary = collect(args.root.resolve(), args.runs, args.helper)
+    if args.check_only:
+        print("PASS raw consistency; no archive written:", summary)
+        return
+    out = args.output.resolve()
+    out.mkdir(parents=True, exist_ok=False)
+    for name in ("prepare.py", "verify.py", "README.md"):
+        with (out / name).open("xb") as stream:
+            stream.write((HERE / name).read_bytes())
+    with zipfile.ZipFile(out / "evidence.zip", "x", compression=zipfile.ZIP_DEFLATED, compresslevel=9) as archive:
+        for name, data in sorted(payload.items()):
+            info = zipfile.ZipInfo(name, date_time=(2026, 9, 23, 0, 0, 0))
+            info.compress_type = zipfile.ZIP_DEFLATED
+            info.external_attr = 0o100644 << 16
+            archive.writestr(info, data)
+    write_json(out / "manifest.json", manifest)
+    write_json(out / "files.json", {name: pin((out / name).read_bytes()) for name in ("prepare.py", "verify.py", "README.md", "manifest.json", "evidence.zip")})
+    need(verify_package(out) == summary, "written package differs from raw evidence")
+    print("PASS package readback:", out, summary)
+
+
+if __name__ == "__main__":
+    main()