"""Read-only portable receipt/Git verifier. Never executes archived launchers.""" from pathlib import Path, PurePosixPath, PureWindowsPath from datetime import datetime import argparse import hashlib import io import json import re import subprocess import sys import zipfile SOURCE = 'a578ac98a06772a60bec00ae287e65650680d119' INTERMEDIATE = 'eeb1069cfcfc51e4cf73cff850adc2fabc8aae77' FAILED_SOURCE = '754a9b4b7caca2e848742f5194d98dc9aee7f674' PRIOR_SOURCE = '10d7f3340d5cd61a656dc0bcf7c143f8897c5551' BASELINE_SOURCE = 'f1d79df4979121335ed7b4ce4da84b2fca8a9ef4' SCOPE = ['Cargo.toml', 'Cargo.lock', 'rust-toolchain.toml', '.cargo', 'build', 'crates', 'assets', 'docs', 'examples', 'harness/fixtures', 'vendor'] PREFIX = ['cargo', 'test', '--locked', '--offline', '-p', 'oa-core', '--lib'] TYPED = 'language::analysis_source::' MIXED = TYPED + 'mixed::' HEADER_ERROR = 'Unsupported schema version: expected arcadia 3, 4, 5, 6 or 7.' def require(condition, message): if not condition: raise ValueError(message) def sha(data): return hashlib.sha256(data).hexdigest() def unique_object(pairs): result = {} for key, value in pairs: require(key not in result, 'Duplicate JSON key: ' + key) result[key] = value return result def document(raw): return json.loads(raw, object_pairs_hook=unique_object) def safe_name(name): require(isinstance(name, str) and name and '\\' not in name and ':' not in name, 'Unsafe archive name') p = PurePosixPath(name) require(not p.is_absolute() and str(p) == name and '..' not in p.parts, 'Unsafe archive path: ' + name) return name def git(repo, *arguments, data=None): return subprocess.check_output(['git', '-C', str(repo), *arguments], input=data) def git_inputs(repo, source, current, count): require(current['source'] == source, 'Input source mismatch') records = current['inputs'] require(len(records) == count, 'Unexpected input count') paths = git(repo, 'ls-tree', '-r', '--name-only', source, *SCOPE).decode().splitlines() require(paths == [item['path'] for item in records], 'Git input membership/order mismatch') raw = git(repo, 'cat-file', '--batch', data=''.join(f'{source}:{p}\n' for p in paths).encode()) offset = 0 for item in records: end = raw.index(b'\n', offset) _, kind, size = raw[offset:end].split() size = int(size) blob = raw[end + 1:end + 1 + size] require(kind == b'blob' and size == item['bytes'] and sha(blob) == item['sha256'], 'Git input bytes mismatch: ' + item['path']) offset = end + size + 2 require(offset == len(raw), 'Trailing Git batch bytes') def listing(log): names = re.findall(r'^([^\r\n]+): test\r?$', log, re.M) require(len(names) == len(set(names)), 'Duplicate listed test') summaries = re.findall(r'^(\d+) tests, (\d+) benchmarks\r?$', log, re.M) require(summaries == [(str(len(names)), '0')], 'Listing footer mismatch') return names def outcomes(log, expected, passed, failed, filtered): rows = re.findall(r'^test ([^\r\n]+) \.\.\. (ok|FAILED|ignored)\r?$', log, re.M) require(len(rows) == len({name for name, _ in rows}), 'Duplicate runtime outcome') actual = dict(rows) require(set(actual) == set(expected), 'Missing/extra runtime outcomes') require(sum(v == 'ok' for v in actual.values()) == passed and sum(v == 'FAILED' for v in actual.values()) == failed and 'ignored' not in actual.values(), 'Runtime status mismatch') summaries = re.findall(r'^test result: (ok|FAILED)\. (\d+) passed; (\d+) failed; ' r'(\d+) ignored; (\d+) measured; (\d+) filtered out;', log, re.M) require(summaries == [('FAILED' if failed else 'ok', str(passed), str(failed), '0', '0', str(filtered))], 'Runtime footer mismatch') return actual def failures(log, names): blocks = re.findall(r'^---- ([^\r\n]+) stdout ----\r?\n(.*?)(?=^---- |^failures:\r?$|\Z)', log, re.M | re.S) require(len(blocks) == len(names) and {name for name, _ in blocks} == set(names), 'Failure-block membership mismatch') for name, block in blocks: require(block.count(HEADER_ERROR) == 1 and 'invalid_source' in block, 'Failure cause changed: ' + name) tails = re.findall(r'^failures:\r?\n((?: [^\r\n]+\r?\n)+)', log, re.M) require(len(tails) == 1 and tails[0].split() == sorted(names), 'Failure footer changed') def formatting_evidence(payload, repo, final_log=None): note = document(payload['notes/analysis-mixed-syntax-formatting-disposition-20260923.json']) stem = 'gates/mixed-fmt-eeb1-1' receipt = document(payload[stem + '.result.json']) log = payload[stem + '.log'] require(note['source'] == INTERMEDIATE and note['prior_source'] == PRIOR_SOURCE and note['baseline_source'] == BASELINE_SOURCE and note['exit'] == receipt['exit'] == 1 and note['command'] == receipt['command'] == ['cargo', 'fmt', '--all', '--', '--check'] and note['changed_inputs'] == [] and note['input_count'] == 541, 'Formatting note scope mismatch') for field, suffix in (('receipt_sha256', '.result.json'), ('log_sha256', '.log'), ('inputs_sha256', '.inputs.json')): require(note[field] == sha(payload[stem + suffix]), 'Formatting note raw hash mismatch') blocks = re.findall(r'^Diff in ([^\r\n]+):(\d+):\r?$', log.decode(), re.M) normalized = [('crates/' + path.replace('\\', '/').split('/crates/', 1)[1], int(line)) for path, line in blocks] expected = ['crates/oa-core/src/' + name for name in ('model.rs', 'references.rs', 'semantic/catalog.rs', 'session.rs', 'transitions.rs', 'validation.rs')] require(len(blocks) == note['diff_blocks'] == 9 and sorted({path for path, _ in normalized}) == expected, 'Formatting failure changed scope') require([row['path'] for row in note['affected_files']] == expected, 'Formatting file inventory differs') for row in note['affected_files']: blobs = [git(repo, 'show', source + ':' + row['path']) for source in (SOURCE, INTERMEDIATE, PRIOR_SOURCE, BASELINE_SOURCE)] require(len(set(blobs)) == 1 and row['equal_at_all_three_pins'] is True and row['bytes'] == len(blobs[0]) and row['sha256'] == sha(blobs[0]), 'Formatting inheritance not supported: ' + row['path']) require(row['git_blob'] == git(repo, 'rev-parse', SOURCE + ':' + row['path']).decode().strip() and row['diff_lines'] == [line for path, line in normalized if path == row['path']], 'Formatting blob/line inventory differs') if final_log is not None: final_blocks = re.findall(r'^Diff in ([^\r\n]+):(\d+):\r?$', final_log, re.M) final_normalized = [('crates/' + path.replace('\\', '/').split('/crates/', 1)[1], int(line)) for path, line in final_blocks] require(final_normalized == normalized, 'Final formatting failure scope changed') return 'Formatting FAILED at eeb1069; six affected blobs byte-identical at a578ac9, eeb1069, 10d7f33 and f1d79df' DIRECT_RECORDER = '3043b4ca43f2fb581d9f77361830f0ea86425982d6dee40bc9d71a3444caa14a' def direct_evidence(payload, receipt, log): """Only the reviewed final direct list/full protocol; no archived code runs.""" require(receipt['source'] == SOURCE and receipt['mode'] in ('list', 'full') and receipt['filter'] == '' and receipt['cargo_invoked'] is False, 'Unsupported direct invocation scope') require(receipt['launch_error'] is None and receipt['verification_failures'] == [] and receipt['source_status_after'] == '', 'Direct invocation did not close cleanly') require(receipt['launcher_sha256'] == DIRECT_RECORDER and receipt['launcher_copy_sha256_after'] == DIRECT_RECORDER, 'Unreviewed or changed direct recorder') require(receipt['environment']['ARCADIA_CODEC_LIFECYCLE_PHASE'] is None and receipt['environment']['RUST_MIN_STACK'] is None, 'Direct parent/stack environment differs') require(receipt['utc_clock_went_backwards'] is False, 'Direct gate cannot inherit original listing clock exception') require(not re.search(r'^\s*Running unittests\b', log, re.M), 'Direct output contains a fabricated Cargo invocation line') watched = {} def bound(field, fixed_name=None, fixed_hash=None): descriptor = receipt[field] result_name = safe_name(descriptor['result']) require(result_name.endswith('.result.json'), 'Invalid direct bound result name') stem = result_name[:-len('.result.json')] raw = payload['gates/' + result_name] if fixed_name is not None: require(result_name == fixed_name and sha(raw) == fixed_hash, 'Direct historical binding differs') record = document(raw) require(record['source'] == record['head_after'] == SOURCE and record['exit'] == 0 and record['changed_inputs'] == [] and record['inputs'] == stem + '.inputs.json', 'Direct bound checkpoint is not successful unchanged source') expected = { 'result': result_name, 'result_sha256': sha(raw), 'log': stem + '.log', 'log_sha256': record['log_sha256'], 'inputs': stem + '.inputs.json', 'inputs_sha256': record['inputs_sha256'], 'source': SOURCE, 'launcher_copy': record['launcher_copy'], 'launcher_sha256': record['launcher_sha256'], 'artifacts': record['artifacts'], 'listing_count': record['listing_count'], 'listing_members': record['listing_members'], } require(descriptor == expected, 'Direct descriptor differs from actual bound receipt') for key in ('result', 'log', 'inputs'): relative = safe_name(expected[key]) digest = expected[key + '_sha256'] require(sha(payload['gates/' + relative]) == digest, 'Direct bound payload hash mismatch') watched[relative] = digest launcher = safe_name(record['launcher_copy'].replace('\\', '/')) require(launcher == 'launchers/' + record['launcher_sha256'] + '.py' and sha(payload['gates/' + launcher]) == record['launcher_sha256'] == record['launcher_sha256_after'], 'Direct bound launcher differs') watched[launcher] = record['launcher_sha256'] return record, payload['gates/' + stem + '.log'].decode('utf-8') original, original_log = bound('bound_original_listing', 'mixed-list-a578-1.result.json', 'adae5f2c78302616e853765fe1c7e61d026610cb3cb3fa312b727e5c28a92100') focused, _ = bound('bound_focused', 'mixed-focused-a578-1.result.json', 'fa586319f22c7eb1bd75e9d9da6784cff8cc897b6b93205c84f6591fa9c76b85') require(len(focused['artifacts']) == 1, 'Focused artifact missing') artifact = focused['artifacts'][0] require(artifact['bytes'] == 39706624 and artifact['sha256'] == '089d7b0389bb3f4e98fd350d4d7504294087ce3fc84035672c781547c8a71881', 'Rebuilt focused artifact differs') require(receipt['artifact_before'] == artifact and receipt['artifacts'] == [artifact], 'Direct artifact changed or differs from focused binary') command = receipt['command'] require(isinstance(command, list) and len(command) == 2 and PureWindowsPath(command[0]) == PureWindowsPath(artifact['path']) and command[1] == ('--list' if receipt['mode'] == 'list' else '--test-threads=1'), 'Unexpected direct executable argv') require(PureWindowsPath(receipt['cwd']) == PureWindowsPath( 'C:/Users/User/Documents/Git/ARCADIA-Studio/.local/as3batch/crates/oa-core'), 'Direct working directory is not the recorded Cargo package root') if receipt['mode'] == 'list': require(receipt['bound_listing'] is None, 'Direct listing unexpectedly borrows another listing') require(listing(log) == listing(original_log), 'Direct listing differs from original test inventory') else: direct, direct_log = bound('bound_listing') require(direct['mode'] == 'list' and direct['invocation'] == 'direct-executable' and direct['launcher_sha256'] == DIRECT_RECORDER and direct['artifacts'] == [artifact] and direct['listing_members'] == listing(direct_log) == listing(original_log), 'Full run does not bind actual direct listing of rebuilt binary') rows = receipt['bound_files_after'] observed = {} for row in rows: path = safe_name(row['path'].replace('\\', '/')) require(path not in observed, 'Duplicate direct bound-file postcheck') require(row['expected_sha256'] == row['sha256_after'], 'Direct bound file changed') observed[path] = row['sha256_after'] require(observed == watched, 'Direct bound-file postcheck coverage differs') def runtime_checkpoint(by_mode, prior_names, old, old_failures, final): require(all(len(by_mode.get(k, [])) == 1 for k in ('full', 'clippy', 'fmt')), 'Required checkpoint gates missing/ambiguous') lists = by_mode.get('list', []) if final: cargo_lists = [(r, log) for r, log in lists if r.get('invocation') is None] direct_lists = [(r, log) for r, log in lists if r.get('invocation') == 'direct-executable'] require(len(lists) == 2 and len(cargo_lists) == len(direct_lists) == 1, 'Final requires original Cargo listing and actual rebuilt-binary direct listing') chronology_listing, original_log = cargo_lists[0] listed_receipt, log = direct_lists[0] original_names = listing(original_log) require(chronology_listing['exit'] == 0 and chronology_listing['listing_count'] == 194 and chronology_listing['listing_members'] == original_names == listing(log), 'Original/direct listing membership mismatch') require(by_mode['full'][0][0].get('invocation') == 'direct-executable', 'Final full run must use the declared direct recorder') else: require(len(lists) == 1, 'Intermediate listing missing/ambiguous') listed_receipt, log = lists[0] chronology_listing = listed_receipt names = listing(log) require(listed_receipt['exit'] == 0 and listed_receipt['listing_members'] == names and listed_receipt['listing_count'] == len(names) == 194, 'Checkpoint listing not accepted') require(set(prior_names) <= set(names), 'Prior173 membership lost') typed = {n for n in names if n.startswith(TYPED)} mixed = {n for n in names if n.startswith(MIXED)} require(len(typed) == 85 and len(mixed) == 20, 'Typed/mixed membership differs') require({n for n in prior_names if n.startswith(TYPED)} <= typed, 'Prior typed/stack controls missing') artifacts = listed_receipt['artifacts'] require(len(artifacts) == 1 and artifacts[0]['bytes'] > 0 and re.fullmatch('[0-9a-f]{64}', artifacts[0]['sha256']), 'Listing binary witness missing') mixed_runs = 0 for receipt, log in by_mode.get('focused', []): selected = {n for n in names if receipt['filter'] in n} require(selected and receipt['exit'] == 0 and receipt['artifacts'] == artifacts, 'Focused binary/exit mismatch') outcomes(log, selected, len(selected), 0, len(names) - len(selected)) if selected == mixed: mixed_runs += 1 require(mixed_runs >= 1, 'Completed focused mixed gate missing') full_receipt, full_log = by_mode['full'][0] require(full_receipt['exit'] == 101 and full_receipt['artifacts'] == artifacts, 'Full diagnostic gate mismatch') full = outcomes(full_log, names, 178, 16, 0) require(all(full.get(n) == status for n, status in old.items()), 'Old152 statuses changed') new = set(full) - set(old) require(len(new) == 42 and all(full[n] == 'ok' for n in new), 'Later42 cases did not all pass') require(all(full[n] == 'ok' for n in typed), 'Typed controls not all passing') failures(full_log, old_failures) strict, strict_log = by_mode['clippy'][0] if final: require(strict['exit'] == 0 and 'Finished' in strict_log and not re.search(r'^error(?:\[|:)', strict_log, re.M), 'Final strict core gate failed') require(datetime.fromisoformat(strict['end']) <= datetime.fromisoformat(chronology_listing['start']), 'Final listing preceded successful strict closure') else: require(strict['exit'] == 101 and 'unnecessary_unwrap' in strict_log and 'collapsible_if' in strict_log and 'due to 2 previous errors' in strict_log and strict['artifacts'] == [], 'Intermediate failed strict evidence changed') require(artifacts[0]['bytes'] == 39708672 and artifacts[0]['sha256'] == '5482a24e86d6f102c34dec6be9904726488963e8552e514253efbf03dfbcd98c', 'Intermediate observed artifact changed') fmt, fmt_log = by_mode['fmt'][0] require(fmt['exit'] == 1, 'Formatting status differs from inherited-failure scope') return names, { 'source': SOURCE if final else INTERMEDIATE, 'full_suite': 'FAILED', 'full_exit': 101, 'listed': len(names), 'prior_173_retained': len(prior_names), 'typed_passed_in_full': len(typed), 'mixed_focused_passed': len(mixed), 'full_passed': 178, 'full_failed': 16, 'old_152_statuses_unchanged': len(old), 'new_42_passes': sorted(new), 'known_failure_names': old_failures, 'new_since_173': sorted(set(names) - set(prior_names)), 'test_artifact': artifacts[0], 'strict_core_all_targets': 'PASS' if final else 'FAILED', 'strict_exit': strict['exit'], 'fmt_exit': 1, 'full_invocation': full_receipt.get('invocation', 'cargo'), 'listing_artifacts': [{'invocation': r.get('invocation', 'cargo'), 'artifacts': r['artifacts']} for r, _ in lists], }, fmt_log def verify_payload(payload, manifest, repo): require(manifest['schema'] == 1 and manifest['source'] == SOURCE, 'Wrong package schema/source') require(set(payload) == set(manifest['payloads']), 'Payload membership mismatch') for name, raw in payload.items(): safe_name(name) require(manifest['payloads'][name] == {'bytes': len(raw), 'sha256': sha(raw)}, 'Payload hash mismatch: ' + name) # Historical records are anchored to immutable documentation Git objects, # independently of this package's editable manifest hashes. origins = manifest['git_origins'] for name, origin in origins.items(): require(name in payload and re.fullmatch('[0-9a-f]{40}', origin['commit']), 'Bad Git origin') raw = git(repo, 'show', origin['commit'] + ':' + safe_name(origin['path'])) if 'member' in origin: with zipfile.ZipFile(io.BytesIO(raw)) as archive: require(len(archive.namelist()) == len(set(archive.namelist())), 'Duplicate origin ZIP member') raw = archive.read(safe_name(origin['member'])) require(raw == payload[name], 'Historical Git evidence mismatch: ' + name) historical = { 'baseline/full-f1d79df.log', 'baseline/full-f1d79df.result.json', 'baseline/full-f1d79df.inputs.json', 'baseline/full-f1d79df.comparison.json', 'prior/list-10d7f33.log', 'prior/list-10d7f33.result.json', 'prior/list-10d7f33.inputs.json', } require(historical <= set(origins), 'Missing immutable historical origins') prior = document(payload['prior/list-10d7f33.result.json']) prior_names = listing(payload['prior/list-10d7f33.log'].decode()) require(prior['source'] == prior['head_after'] == PRIOR_SOURCE and prior['exit'] == 0 and prior['changed_inputs'] == [] and prior['listing_members'] == prior_names and prior['listing_count'] == len(prior_names) == 173, 'Prior listing invalid') git_inputs(repo, PRIOR_SOURCE, document(payload['prior/list-10d7f33.inputs.json']), 538) baseline = document(payload['baseline/full-f1d79df.result.json']) require(baseline['source'] == baseline['head_after'] == BASELINE_SOURCE and baseline['exit'] == 101 and baseline['changed_inputs'] == [] and baseline['command'] == ['cargo', 'test', '--locked', '-p', 'oa-core', '--lib', '--', '--test-threads=1'], 'Historical full receipt invalid') git_inputs(repo, BASELINE_SOURCE, document(payload['baseline/full-f1d79df.inputs.json']), 534) baseline_log = payload['baseline/full-f1d79df.log'].decode() baseline_names = re.findall(r'^test ([^\r\n]+) \.\.\. ', baseline_log, re.M) require(len(baseline_names) == 152, 'Historical outcome count changed') old = outcomes(baseline_log, baseline_names, 136, 16, 0) old_failures = sorted(n for n, v in old.items() if v == 'FAILED') failures(baseline_log, old_failures) comparison = document(payload['baseline/full-f1d79df.comparison.json']) require(comparison['source'] == BASELINE_SOURCE and comparison['failures'] == old_failures and comparison['cargo_exit'] == 101 and comparison['passed'] == 136 and comparison['failed'] == 16, 'Historical comparison disagrees') for leaf in ('full-f1d79df.log', 'full-f1d79df.result.json', 'full-f1d79df.inputs.json'): require(comparison['pins'][leaf] == sha(payload['baseline/' + leaf]), 'Historical comparison hash mismatch') receipt_names = sorted(n for n in payload if n.startswith('gates/') and n.endswith('.result.json')) require(receipt_names, 'No completed current gates') consumed = set() by_source = {} inputs_by_source = {} for name in receipt_names: receipt = document(payload[name]) source = receipt['source'] require(source in (SOURCE, INTERMEDIATE, FAILED_SOURCE) and receipt['head_after'] == source and receipt['changed_inputs'] == [], 'Gate source drift') started = datetime.fromisoformat(receipt['start']) ended = datetime.fromisoformat(receipt['end']) known_clock_jump = (name == 'gates/mixed-list-a578-1.result.json' and sha(payload[name]) == 'adae5f2c78302616e853765fe1c7e61d026610cb3cb3fa312b727e5c28a92100') require((started < ended or known_clock_jump) and receipt['elapsed_monotonic_seconds'] > 0, 'Gate not closed') env = receipt['environment'] require(env['CARGO_BUILD_JOBS'] == '1' and env['CARGO_INCREMENTAL'] == '0', 'Gate environment changed') require(all(env.get(k) is None for k in ('RUSTFLAGS', 'RUSTC', 'RUSTUP_TOOLCHAIN')), 'Unrecorded compiler override') stem = name[:-len('.result.json')] log_name = stem + '.log' input_name = 'gates/' + safe_name(receipt['inputs']) require(input_name == stem + '.inputs.json', 'Input receipt belongs to another run') launcher = 'gates/' + safe_name(receipt['launcher_copy'].replace('\\', '/')) require(launcher == 'gates/launchers/' + receipt['launcher_sha256'] + '.py', 'Launcher name mismatch') require(sha(payload[launcher]) == receipt['launcher_sha256'] == receipt['launcher_sha256_after'], 'Launcher changed') require(sha(payload[log_name]) == receipt['log_sha256'] and sha(payload[input_name]) == receipt['inputs_sha256'], 'Log/input hash mismatch') consumed.update((name, log_name, input_name, launcher)) current = document(payload[input_name]) if source not in inputs_by_source: git_inputs(repo, source, current, 541) inputs_by_source[source] = current require(current == inputs_by_source[source], 'Gate input sets differ at same source') log = payload[log_name].decode('utf-8') mode = receipt['mode'] require(mode == 'focused' or receipt['filter'] == '', 'Unexpected filter on unfiltered gate') if receipt.get('invocation') == 'direct-executable': direct_evidence(payload, receipt, log) else: require('invocation' not in receipt and 'cargo_invoked' not in receipt, 'Unexpected invocation marker on Cargo receipt') command = { 'list': PREFIX + ['--', '--list'], 'focused': PREFIX + [receipt['filter'], '--', '--test-threads=1'], 'full': PREFIX + ['--', '--test-threads=1'], 'clippy': ['cargo', 'clippy', '--locked', '--offline', '-p', 'oa-core', '--all-targets', '--', '-D', 'warnings'], 'fmt': ['cargo', 'fmt', '--all', '--', '--check'], }.get(mode) require(command is not None and receipt['command'] == command, 'Unexpected gate command') binary_lines = re.findall(r'Running unittests [^\r\n]+ \(([^\r\n]+\.exe)\)', log) require(len(binary_lines) == len(receipt['artifacts']), 'Log/artifact occurrence mismatch') for logged, artifact in zip(binary_lines, receipt['artifacts']): require(logged.replace('\\', '/').rsplit('/', 1)[-1] == artifact['path'].replace('\\', '/').rsplit('/', 1)[-1], 'Log/artifact executable name mismatch') if source == FAILED_SOURCE: require(name == 'gates/mixed-list-754a-1.result.json' and mode == 'list' and receipt['exit'] == 101, 'Unexpected earlier-source gate') require('error[E0063]' in log and 'missing field `mixed`' in log and 'semantic_source.rs:191' in log and receipt['artifacts'] == [] and receipt['listing_members'] == [] and receipt['listing_count'] == 0, 'Original initializer failure evidence changed') continue by_source.setdefault(source, {}).setdefault(mode, []).append((receipt, log)) if mode != 'list': require(receipt['listing_members'] == [] and receipt['listing_count'] == 0, 'Non-list fabricated membership') require({SOURCE, INTERMEDIATE, FAILED_SOURCE} == set(inputs_by_source), 'All three source pins required') require({n for n in payload if n.startswith('gates/')} == consumed, 'Unclosed/unreferenced gate payload') eeb_names, intermediate, _ = runtime_checkpoint(by_source[INTERMEDIATE], prior_names, old, old_failures, False) names, final, fmt_log = runtime_checkpoint(by_source[SOURCE], prior_names, old, old_failures, True) require(names == eeb_names, 'Final listing membership/order changed from observed intermediate') earlier = inputs_by_source[INTERMEDIATE]['inputs'] later = inputs_by_source[SOURCE]['inputs'] require([item['path'] for item in earlier] == [item['path'] for item in later] and [a['path'] for a, b in zip(earlier, later) if a != b] == ['crates/oa-core/src/language.rs'], 'Final input delta is not the one-file guard correction') require(git(repo, 'diff', '--name-only', INTERMEDIATE, SOURCE).decode().splitlines() == ['AGENTS.md', 'crates/oa-core/src/language.rs'], 'Final source delta expanded') require(git(repo, 'rev-parse', SOURCE + ':AGENTS.md').decode().strip() == '767be18f086c04b7a688b107808e97ac98881356', 'Final shared instructions differ') final['intermediate_checkpoint'] = intermediate final['formatting_disposition'] = formatting_evidence(payload, repo, fmt_log) + '; final fmt also FAILED exit 1 with identical nine blocks' final['unchanged_inputs_from_intermediate'] = 540 final['clock_discontinuity'] = 'Raw final listing UTC end precedes start after host clock moved backward; exact immutable receipt retained; elapsed_monotonic_seconds=768.4220000000059 is the duration evidence. No wall-clock duration inferred.' final['limits'] = 'Receipt/Git consistency only; no archived code or binaries executed. No public source8, semantic/compositor or full-suite PASS claim.' return final def main(): parser = argparse.ArgumentParser(description=__doc__) parser.add_argument('--repo', type=Path, required=True) parser.add_argument('--package', type=Path, default=Path(__file__).resolve().parent) args = parser.parse_args() manifest = document((args.package / 'manifest.json').read_bytes()) with zipfile.ZipFile(args.package / 'evidence.zip') as archive: names = archive.namelist() require(len(names) == len(set(names)), 'Duplicate ZIP members') require(len(names) <= 512 and sum(item.file_size for item in archive.infolist()) <= 64 * 1024 * 1024, 'Archive exceeds bounded evidence size') for name in names: safe_name(name) payload = {name: archive.read(name) for name in names} result = verify_payload(payload, manifest, args.repo) require(result == manifest['verified_summary'], 'Manifest summary differs from evidence') print(json.dumps(result, indent=2)) print('VERIFIED evidence consistency; full core suite FAILED (178/16); formatting FAILED (inherited six-file debt).') if __name__ == '__main__': try: main() except (ValueError, KeyError, OSError, zipfile.BadZipFile, subprocess.CalledProcessError) as error: raise SystemExit('REFUSED: ' + str(error))