docs: publish State multiselect verification and native evidence

2026-09-23 04:41:42 -07:00
parent 3480b54201
commit bed7f825fd
42 changed files with 6496 additions and 5 deletions
@@ -0,0 +1,33 @@
+"""Prepare pinned source receipts after raw/sibling capture validation; never build."""
+from pathlib import Path
+import argparse, json
+from verify import HERE, SPECS, TOOLS, FILES, need, pin, verify_data, raw_captures, packaged, verify_package
+
+def main():
+    parser=argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--raw-gates',type=Path,required=True,help='original raw gates and source-RUN.json receipts')
+    parser.add_argument('--checks',type=Path,help='completed sibling checks package; required when writing')
+    parser.add_argument('--repo',type=Path,help='optionally rerun exact committed Git-blob comparison')
+    parser.add_argument('--output',type=Path,help='new source package directory')
+    parser.add_argument('--check-only',action='store_true')
+    args=parser.parse_args()
+    receipts={run:(args.raw_gates/('source-'+run+'.json')).read_bytes() for run in SPECS}
+    captured=packaged(args.checks) if args.checks else raw_captures(args.raw_gates)
+    summary=verify_data(receipts,captured,args.repo)
+    if args.check_only:
+        print('PASS source check-only; no package written:',summary); return
+    need(args.checks is not None,'written portable source package requires completed --checks package')
+    need(args.output is not None,'explicit new --output required')
+    out=args.output.resolve(); need(not out.exists(),'existing package refused')
+    payload={name:(HERE/name).read_bytes() for name in TOOLS}
+    payload.update({'source-'+run+'.json':data for run,data in receipts.items()})
+    need(set(payload)==FILES,'exact source files')
+    out.mkdir(parents=True)
+    for name,data in payload.items():
+        with (out/name).open('xb') as stream: stream.write(data)
+    with (out/'files.json').open('x',encoding='utf-8') as stream:
+        json.dump({name:pin(data) for name,data in sorted(payload.items())},stream,indent=2)
+    # Git comparison was already performed above when requested; readback is byte-only.
+    verify_package(out,args.checks)
+    print('PASS written source package readback:',out,summary)
+if __name__=='__main__': main()