Add current-draft diagnostic underlines and passive hover
Preserve raw include diagnostic provenance and derive bands from the existing shaped editor. Retain deferred tooltip paragraphs through rendering. Include source, regression, failure and native-trial evidence; corrected native acceptance remains pending.
This commit is contained in:
@@ -0,0 +1,387 @@
|
||||
"""Read-only, standard-library verification of this portable evidence archive."""
|
||||
import hashlib
|
||||
import json
|
||||
from pathlib import Path, PurePosixPath
|
||||
import re
|
||||
import sys
|
||||
import zipfile
|
||||
|
||||
|
||||
ROOT = Path(__file__).resolve().parent
|
||||
|
||||
|
||||
def require(condition, message):
|
||||
if not condition:
|
||||
raise ValueError(message)
|
||||
|
||||
|
||||
def relative(name):
|
||||
p = PurePosixPath(name)
|
||||
require(name and not p.is_absolute() and ".." not in p.parts
|
||||
and "\\" not in name and ":" not in name
|
||||
and str(p) == name, f"Unsafe relative path: {name!r}")
|
||||
return p
|
||||
|
||||
|
||||
def file(name):
|
||||
p = ROOT.joinpath(*relative(name).parts)
|
||||
require(p.resolve().is_relative_to(ROOT), f"Escaping file: {name}")
|
||||
return p
|
||||
|
||||
|
||||
def identity(data):
|
||||
return {"bytes": len(data), "sha256": hashlib.sha256(data).hexdigest()}
|
||||
|
||||
|
||||
def read_json(name):
|
||||
return json.loads(file(name).read_text(encoding="utf-8"))
|
||||
|
||||
|
||||
def check_file(name, expected):
|
||||
require(identity(file(name).read_bytes()) == expected, f"Hash mismatch: {name}")
|
||||
|
||||
|
||||
def unique(names):
|
||||
folded = [str(relative(n)).casefold() for n in names]
|
||||
require(len(folded) == len(set(folded)), "Duplicate/case-colliding paths")
|
||||
|
||||
|
||||
def verify_oracles(index):
|
||||
"""Check saved CLI reports and historical launch bindings, never binaries."""
|
||||
base = "native-preparation/"
|
||||
build = read_json("gates/windows-build-final-1/result.json")
|
||||
current = read_json(base + "current-oracle-1/result.json")
|
||||
candidate = read_json(base + "candidate-oracle-1/result.json")
|
||||
preserved = read_json(base + "windows-build-final-1-binaries/preserved.json")
|
||||
launch = read_json(base + "launch-manifest-final-1.json")
|
||||
# Resolve historical absolute evidence paths without accessing those paths.
|
||||
mapping = {}
|
||||
normalize = lambda path: path.replace("\\", "/").casefold()
|
||||
for group in index["payloadGroups"]:
|
||||
for name in group["files"]:
|
||||
mapping[normalize(group["sourceRoot"] + "/" + name)] = group["destinationPrefix"] + "/" + name
|
||||
for gate in index["completedGates"]:
|
||||
receipt = read_json("gates/" + gate["label"] + "/result.json")
|
||||
original = receipt["cwd"] + "/.local/text-diagnostic-gates/" + gate["label"]
|
||||
for name in ["inputs.json", "inputs.zip"]:
|
||||
mapping[normalize(original + "/" + name)] = gate["captureRef"] + "/" + name
|
||||
|
||||
def bound(item):
|
||||
target = mapping.get(normalize(item["path"]))
|
||||
require(target is not None, "Unresolved archived evidence: " + item["path"])
|
||||
actual = identity(file(target).read_bytes())
|
||||
require(all(actual[k] == item[k] for k in ["bytes", "sha256"] if k in item),
|
||||
"Historical evidence binding differs: " + target)
|
||||
|
||||
for item in [preserved["buildResult"], current["buildResult"], current["sourceResult"],
|
||||
candidate["priorOracle"], *launch["evidence"]]:
|
||||
bound(item)
|
||||
check_file(base + "build-and-preserve.py", preserved["helper"])
|
||||
require(all(x["sourceInputs"] == build["inputs"] for x in [preserved, current, candidate, launch]),
|
||||
"Oracle/build/launch source identities differ")
|
||||
raw_artifacts = []
|
||||
for line in file("gates/windows-build-final-1/stdout.log").read_text(encoding="utf-8").splitlines():
|
||||
try:
|
||||
value = json.loads(line)
|
||||
except json.JSONDecodeError:
|
||||
continue
|
||||
if value.get("reason") == "compiler-artifact":
|
||||
raw_artifacts.append(value)
|
||||
for binary in preserved["binaries"]:
|
||||
matches = [a for a in build["artifacts"] if a["cargo"]["target"]["name"] == binary["name"]
|
||||
and a["cargo"]["profile"]["test"] is False]
|
||||
require(len(matches) == 1 and matches[0]["cargo"] in raw_artifacts, "Build artifact missing")
|
||||
require(matches[0]["readback"] == {k: binary[k] for k in ["bytes", "sha256"]},
|
||||
"Preserved artifact receipt differs")
|
||||
require(normalize(binary["source"]) == normalize(matches[0]["cargo"]["executable"]),
|
||||
"Preserved source path differs")
|
||||
require(current["artifact"] in build["artifacts"]
|
||||
and current["binary"] == current["artifact"]["readback"], "CLI artifact binding differs")
|
||||
gui = next(b for b in preserved["binaries"] if b["name"] == "arcadia-studio")
|
||||
require(all(launch["binary"][k] == gui[k] for k in ["path", "bytes", "sha256"]),
|
||||
"Launch GUI receipt differs")
|
||||
# Executable/DLL bytes are deliberately external. Check only recorded identities.
|
||||
for path, pin in candidate["bindings"].items():
|
||||
if normalize(path) == normalize(current["binaryPath"]):
|
||||
require(pin == current["binary"], "Candidate CLI identity differs")
|
||||
elif normalize(path).endswith("/runtime/libunwind.dll"):
|
||||
require(pin == {"bytes": 190976, "sha256": "f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4"},
|
||||
"Candidate DLL identity differs")
|
||||
else:
|
||||
bound({"path": path, **pin})
|
||||
summaries = []
|
||||
for label, receipt, helper in [("current-oracle-1", current, "current-oracle.py"),
|
||||
("candidate-oracle-1", candidate, "candidate-oracle.py")]:
|
||||
require(receipt["passed"] is True, "Oracle failed")
|
||||
check_file(base + helper, receipt["helper"])
|
||||
for run in receipt["runs"]:
|
||||
prefix = base + label + "/"
|
||||
for field, suffix in [("stdout", ".stdout.json"), ("stderr", ".stderr.log")]:
|
||||
check_file(prefix + run["label"] + suffix, run[field])
|
||||
report = read_json(prefix + run["label"] + ".stdout.json")
|
||||
require(report == run["report"], "Raw/parsed oracle report differs")
|
||||
require(run["exitCode"] == run["expectedExitCode"] == report["exit_code"]
|
||||
and report["operation"] == "check" and report["written"] is False
|
||||
and report["changes"] == [], "Oracle outcome differs")
|
||||
inputs = run.get("inputFiles", receipt.get("preparedFixtures", {}).get(run["label"]))
|
||||
for name, pin in inputs.items():
|
||||
check_file(prefix + run["label"] + "/" + name, pin)
|
||||
for diagnostic in report["diagnostics"]:
|
||||
location = diagnostic["location"]
|
||||
raw = file(prefix + run["label"] + "/" + location["path"]).read_bytes()
|
||||
start, end = location["start"], location["end"]
|
||||
require(0 <= start <= end <= len(raw), "Diagnostic range outside source")
|
||||
before = raw[:start].decode("utf-8")
|
||||
raw[start:end].decode("utf-8")
|
||||
raw[end:].decode("utf-8")
|
||||
require(location["line"] == before.count("\n") + 1
|
||||
and location["column"] == len(before.rsplit("\n", 1)[-1]) + 1,
|
||||
"Diagnostic line/column differs")
|
||||
require(diagnostic["coordinate_space"] == "input" and diagnostic["related"] == [],
|
||||
"Unexpected oracle coordinate space or related locations")
|
||||
if "expectedSpan" in run:
|
||||
require(len(report["diagnostics"]) == 1, "Candidate diagnostic count differs")
|
||||
loc = report["diagnostics"][0]["location"]
|
||||
require([loc["start"], loc["end"]] == run["expectedSpan"], "Candidate span differs")
|
||||
original = file(base + "current-oracle-1/complete/functions.arcadia").read_bytes()
|
||||
raw = file(prefix + run["label"] + "/functions.arcadia").read_bytes()
|
||||
require(raw == original + bytes.fromhex(run["suffixHex"]), "Candidate literal edit differs")
|
||||
summaries.append({"oracle": label, "variant": run["label"], "exitCode": run["exitCode"],
|
||||
"diagnostics": len(report["diagnostics"])})
|
||||
require([s["diagnostics"] for s in summaries] == [2, 5, 1, 1], "Oracle diagnostic counts differ")
|
||||
return summaries
|
||||
|
||||
|
||||
def verify_native_trials(index):
|
||||
summaries = []
|
||||
normalize = lambda path: path.replace("\\", "/").casefold()
|
||||
mapping = {normalize(g["sourceRoot"] + "/" + name): g["destinationPrefix"] + "/" + name
|
||||
for g in index["payloadGroups"] for name in g["files"]}
|
||||
for trial in index.get("nativeTrials", []):
|
||||
prefix = trial["prefix"]
|
||||
launch = read_json(prefix + "/launch.json")
|
||||
closed = read_json(prefix + "/closed.json")
|
||||
review = read_json(trial["review"])
|
||||
require(closed == review["closure"] and closed["pid"] == launch["pid"]
|
||||
and closed["exitCode"] == 0 and closed["launchReceiptError"] is None,
|
||||
"Native closure binding differs")
|
||||
require(all(closed[k] is True for k in ["binaryUnchanged", "preservedBinaryUnchanged",
|
||||
"sameFileAfterExit", "dllUnchanged"])
|
||||
and launch["sameFileBeforeLaunch"] is True, "Native readback receipt differs")
|
||||
for key in ["stdout", "stderr"]:
|
||||
check_file(prefix + "/" + key + ".log", closed[key])
|
||||
require(closed[key]["bytes"] == 0, "Initial native log is not empty")
|
||||
raw_manifest = file(prefix + "/launch-manifest.json").read_bytes()
|
||||
require(identity(raw_manifest)["sha256"] == launch["manifestSha256"]
|
||||
and raw_manifest == file("native-preparation/launch-manifest-final-1.json").read_bytes(),
|
||||
"Native launch manifest differs")
|
||||
manifest = json.loads(raw_manifest)
|
||||
require(launch["binary"] == {k: manifest["binary"][k] for k in ["bytes", "sha256"]}
|
||||
== review["binary"], "Native binary receipt differs")
|
||||
check_file("native-preparation/launch.py", launch["helper"])
|
||||
for original, pin in review["bindings"].items():
|
||||
target = mapping.get(normalize(original))
|
||||
require(target is not None, "Unresolved native review evidence")
|
||||
check_file(target, pin)
|
||||
screenshots = file(prefix + "/screenshots")
|
||||
images = {x.name for x in screenshots.iterdir() if x.suffix == ".jpg"}
|
||||
metadata = sorted(x for x in screenshots.iterdir() if x.suffix == ".json")
|
||||
require(len(images) == trial["screenshots"] == review["screenshotCount"] == 19
|
||||
and len(metadata) == trial["metadata"] == review["metadataCount"] == 15,
|
||||
"Native capture counts differ")
|
||||
linked_images = []
|
||||
for path in metadata:
|
||||
data = json.loads(path.read_text(encoding="utf-8"))
|
||||
for capture in data["screenshots"]:
|
||||
name = capture["file"]
|
||||
require(len(relative(name).parts) == 1 and name in images, "Missing screenshot reference")
|
||||
linked_images.append(name)
|
||||
require(len(linked_images) == len(images) and set(linked_images) == images,
|
||||
"Native screenshot/metadata membership differs")
|
||||
fixture = {x.relative_to(file(prefix + "/work-fixture")).as_posix(): identity(x.read_bytes())
|
||||
for x in file(prefix + "/work-fixture").rglob("*") if x.is_file()}
|
||||
current = read_json("native-preparation/current-oracle-1/result.json")
|
||||
require(fixture == review["workFixture"] == current["preparedFixtures"]["complete"],
|
||||
"Native saved fixture differs")
|
||||
require(review["originalFixtures"] == current["fixtures"], "Original fixture review differs")
|
||||
summaries.append({"prefix": prefix, "exitCode": 0, "screenshots": len(images),
|
||||
"metadata": len(metadata), "acceptance": False})
|
||||
return summaries
|
||||
|
||||
|
||||
def verify_resource_recovery(index):
|
||||
record = index.get("resourceRecovery")
|
||||
if not record:
|
||||
return None
|
||||
reclaim = read_json(record["reclaimedZIPReceipt"])
|
||||
require(len(reclaim["files"]) == 11, "Reclaimed ZIP receipt count differs")
|
||||
seen = set()
|
||||
for item in reclaim["files"]:
|
||||
original = item["path"].replace("\\", "/")
|
||||
require(original not in seen and original.endswith("/inputs.zip"), "Duplicate reclaimed path")
|
||||
seen.add(original)
|
||||
label = original.split("/")[-2]
|
||||
gate = next(g for g in index["completedGates"] if g["label"] == label)
|
||||
relative_zip = gate["captureRef"] + "/inputs.zip"
|
||||
require(item["retained"].replace("\\", "/").endswith(
|
||||
"/harness/experiments/text-diagnostics-20260913/" + relative_zip),
|
||||
"Reclaimed ZIP retained path differs")
|
||||
pin = {k: item[k] for k in ["bytes", "sha256"]}
|
||||
check_file(relative_zip, pin)
|
||||
require(pin == read_json("gates/" + label + "/result.json")["archive"],
|
||||
"Reclaimed ZIP gate binding differs")
|
||||
require(sum(x["bytes"] for x in reclaim["files"]) == reclaim["reclaimed"],
|
||||
"Reclaimed byte total differs")
|
||||
before = read_json(record["compressionBefore"])
|
||||
result = read_json(record["compressionResult"])
|
||||
require(len(before) == result["files"] == 1040
|
||||
and len({x["path"].casefold() for x in before}) == len(before)
|
||||
and sum(x["bytes"] for x in before) == result["bytes"], "Compression inventory differs")
|
||||
require(result["exitCodes"] == [0, 0] and result["allFileBytesUnchanged"] is True,
|
||||
"Compression receipt did not report successful unchanged bytes")
|
||||
require(all(any(x["path"].casefold().startswith(root.casefold() + "\\")
|
||||
for root in result["paths"]) for x in before), "Compression inventory outside recorded roots")
|
||||
second_summary = None
|
||||
if record.get("secondCompression"):
|
||||
second = record["secondCompression"]
|
||||
inventory = read_json(second["before"])
|
||||
receipt = read_json(second["result"])
|
||||
plan = read_json(second["plan"])
|
||||
require(identity(file(second["plan"]).read_bytes())["sha256"] == receipt["planSha256"],
|
||||
"Second compression plan hash differs")
|
||||
require(len(inventory) == receipt["files"] == 1048
|
||||
and sum(x["bytes"] for x in inventory) == receipt["bytes"],
|
||||
"Second compression count/size differs")
|
||||
by_path = {x["path"].casefold(): x for x in inventory}
|
||||
require(len(by_path) == len(inventory), "Duplicate second compression file")
|
||||
binaries = {x["path"].casefold(): x for x in plan["binaries"]}
|
||||
for path, binary in binaries.items():
|
||||
require(path in by_path and all(by_path[path][k] == binary[k] for k in ["bytes", "sha256"]),
|
||||
"Second compression binary inventory differs")
|
||||
require(all(path in binaries or any(path.startswith(x["path"].casefold() + "\\")
|
||||
for x in plan["caches"]) for path in by_path), "Second compression file outside plan")
|
||||
require(len(plan["binaries"]) + len(plan["caches"]) == 9
|
||||
and receipt["exitCodes"] == [0] * 9 and receipt["allFileBytesUnchanged"] is True,
|
||||
"Second compression receipt did not report successful unchanged bytes")
|
||||
second_summary = {"filesRecorded": 1048, "operationsRecorded": 9,
|
||||
"freeBytesAtReceipt": receipt["freeBytes"], "externalFilesRehashed": False}
|
||||
return {"reclaimedPrivateZIPs": 11, "retainedZIPBytesVerified": reclaim["reclaimed"],
|
||||
"compressionFilesRecorded": 1040, "externalCacheRehashed": False,
|
||||
"recoveryHelpersExecutedByVerifier": False, "secondCompression": second_summary}
|
||||
|
||||
|
||||
def verify():
|
||||
manifest = read_json("files.json")
|
||||
unique(manifest)
|
||||
actual = {p.relative_to(ROOT).as_posix() for p in ROOT.rglob("*") if p.is_file()}
|
||||
require(actual == set(manifest) | {"files.json"}, "Archive file membership differs")
|
||||
for name, pin in manifest.items():
|
||||
check_file(name, pin)
|
||||
index = read_json("index.json")
|
||||
payload = {}
|
||||
for group in index["payloadGroups"]:
|
||||
require(len(group["files"]) == group["fileCount"], "Group count differs")
|
||||
require(sum(x["bytes"] for x in group["files"].values()) == group["bytes"],
|
||||
"Group size differs")
|
||||
for name, pin in group["files"].items():
|
||||
target = group["destinationPrefix"] + "/" + name
|
||||
require(target not in payload, "Duplicate payload")
|
||||
require(manifest.get(target) == pin, f"Payload binding differs: {target}")
|
||||
payload[target] = pin
|
||||
require(len(payload) == index["totals"]["requiredPayloadFiles"], "Payload count differs")
|
||||
require(sum(p["bytes"] for p in payload.values()) == index["totals"]["requiredPayloadBytes"],
|
||||
"Payload total size differs")
|
||||
copies = read_json("copy-record.json")["files"]
|
||||
require(len(copies) == len(payload), "Copy receipt count differs")
|
||||
require({x["path"]: x["before"] for x in copies} == payload, "Copy source pins differ")
|
||||
require(all(x["before"] == x["after"] for x in copies), "Copy readbacks differ")
|
||||
|
||||
members = 0
|
||||
for sha, capture in index["captures"].items():
|
||||
prefix = "captures/" + sha
|
||||
check_file(prefix + "/inputs.json", capture["inputsIdentity"])
|
||||
require(manifest[prefix + "/inputs.zip"]["sha256"] == sha, "Capture key differs")
|
||||
inputs = read_json(prefix + "/inputs.json")
|
||||
unique(inputs)
|
||||
require(len(inputs) == capture["inputCount"], "Captured input count differs")
|
||||
with zipfile.ZipFile(file(prefix + "/inputs.zip")) as archive:
|
||||
unique(archive.namelist())
|
||||
require(set(archive.namelist()) == set(inputs), "ZIP membership differs")
|
||||
for name, pin in inputs.items():
|
||||
# Reading each complete member also validates its ZIP CRC.
|
||||
require(identity(archive.read(name)) == pin, f"ZIP content differs: {name}")
|
||||
members += len(inputs)
|
||||
|
||||
for gate in index["completedGates"]:
|
||||
prefix = "gates/" + gate["label"]
|
||||
result = read_json(prefix + "/result.json")
|
||||
started = read_json(prefix + "/started.json")
|
||||
require(all(result.get(k) == v for k, v in started.items()), "Started/result binding differs")
|
||||
capture = gate["captureRef"]
|
||||
require(capture == "captures/" + result["archive"]["sha256"], "Capture reference differs")
|
||||
require(gate["label"] in index["captures"][result["archive"]["sha256"]]["originalRuns"],
|
||||
"Capture run mapping differs")
|
||||
for field, name in [("inputs", capture + "/inputs.json"),
|
||||
("archive", capture + "/inputs.zip"),
|
||||
("stdout", prefix + "/stdout.log"), ("stderr", prefix + "/stderr.log")]:
|
||||
check_file(name, result[field])
|
||||
for key in ["command", "inputCount", "exitCode", "inputsUnchanged"]:
|
||||
require(gate[key] == result[key], f"Gate summary differs: {key}")
|
||||
if result.get("helper"):
|
||||
require(gate.get("helperRef") is not None, "Execution-pinned helper is unresolved")
|
||||
check_file(gate["helperRef"], result["helper"])
|
||||
require(result["environment"]["CARGO_INCREMENTAL"] == "0", "Runner environment differs")
|
||||
output = file(prefix + "/stdout.log").read_text(encoding="utf-8")
|
||||
groups = re.findall(r"test result: \w+\. (\d+) passed; (\d+) failed; (\d+) ignored; (\d+) measured; (\d+) filtered out", output)
|
||||
totals = dict(zip(["passed", "failed", "ignored", "measured", "filtered"],
|
||||
[sum(int(m[i]) for m in groups) for i in range(5)]))
|
||||
require(totals == gate["totals"] and len(groups) == gate["groups"], "Test summary differs")
|
||||
|
||||
prefix = "probe/records/attempt-1"
|
||||
result = read_json(prefix + "/result.json")
|
||||
for field, name in [("inputs", "inputs.json"), ("stdout", "stdout.log"), ("stderr", "stderr.log")]:
|
||||
check_file(prefix + "/" + name, result[field])
|
||||
inputs = read_json(prefix + "/inputs.json")
|
||||
require(len(inputs) == index["probe"]["frozenInputs"] == 77, "Probe count differs")
|
||||
for name, pin in inputs.items():
|
||||
check_file("probe/" + name, pin)
|
||||
require(result["exitCode"] == 0 and result["inputsUnchanged"], "Probe receipt differs")
|
||||
lines = file(prefix + "/stdout.log").read_text(encoding="utf-8").splitlines()
|
||||
require([line for line in lines if line.startswith("PASS ")] == result["passLine"],
|
||||
"Probe PASS binding differs")
|
||||
oracles = verify_oracles(index) if index.get("oracleRecords") else []
|
||||
trials = verify_native_trials(index)
|
||||
recovery = verify_resource_recovery(index)
|
||||
normalization = index.get("sourceNormalization")
|
||||
if normalization:
|
||||
receipt = read_json(normalization["receipt"])
|
||||
before_manifest = read_json(normalization["beforeCapture"] + "/inputs.json")
|
||||
after_manifest = read_json(normalization["afterCapture"] + "/inputs.json")
|
||||
member = normalization["member"]
|
||||
require(set(before_manifest) == set(after_manifest)
|
||||
and [name for name in before_manifest if before_manifest[name] != after_manifest[name]] == [member],
|
||||
"Normalization changed another input")
|
||||
with zipfile.ZipFile(file(normalization["beforeCapture"] + "/inputs.zip")) as archive:
|
||||
before = archive.read(member)
|
||||
with zipfile.ZipFile(file(normalization["afterCapture"] + "/inputs.zip")) as archive:
|
||||
after = archive.read(member)
|
||||
require(identity(before) == receipt["before"] and identity(after) == receipt["after"],
|
||||
"Normalization receipt source pins differ")
|
||||
lines = [number for number, line in enumerate(before.splitlines(keepends=True), 1) if line.endswith(b"\r\n")]
|
||||
require(lines == receipt["lines"] == [423, 424, 425]
|
||||
and before.replace(b"\r\n", b"\n") == after, "Normalization is not the exact three-pair change")
|
||||
return {"status": "PASS", "scope": "Archive bytes, ZIP members/CRC/content, gate/probe/oracle/native receipt bindings, saved spans and capture membership; no execution or binary revalidation",
|
||||
"manifestSha256": identity(file("files.json").read_bytes())["sha256"],
|
||||
"pinnedFiles": len(manifest), "payloadFiles": len(payload),
|
||||
"sourceCaptures": len(index["captures"]), "verifiedZIPMembers": members,
|
||||
"completedGates": len(index["completedGates"]), "probeInputs": len(inputs),
|
||||
"savedOracles": oracles, "closedNativeTrials": trials, "resourceRecovery": recovery,
|
||||
"sourceNormalizationVerified": bool(normalization)}
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
try:
|
||||
print(json.dumps(verify(), indent=2))
|
||||
except (OSError, ValueError, KeyError, zipfile.BadZipFile) as error:
|
||||
print(f"FAIL: {error}", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
Reference in New Issue
Block a user