"""Read-only, standard-library verification of this portable evidence archive.""" from datetime import datetime import hashlib import json from pathlib import Path, PurePosixPath import re import sys import zipfile ROOT = Path(__file__).resolve().parent def require(condition, message): if not condition: raise ValueError(message) def relative(name): p = PurePosixPath(name) require(name and not p.is_absolute() and ".." not in p.parts and "\\" not in name and ":" not in name and str(p) == name, f"Unsafe relative path: {name!r}") return p def file(name): p = ROOT.joinpath(*relative(name).parts) require(p.resolve().is_relative_to(ROOT), f"Escaping file: {name}") return p def identity(data): return {"bytes": len(data), "sha256": hashlib.sha256(data).hexdigest()} def read_json(name): return json.loads(file(name).read_text(encoding="utf-8")) def check_file(name, expected): require(identity(file(name).read_bytes()) == expected, f"Hash mismatch: {name}") def unique(names): folded = [str(relative(n)).casefold() for n in names] require(len(folded) == len(set(folded)), "Duplicate/case-colliding paths") def verify_oracles(index): """Check saved CLI reports and historical launch bindings, never binaries.""" base = "native-preparation/" build = read_json("gates/windows-build-final-1/result.json") current = read_json(base + "current-oracle-1/result.json") candidate = read_json(base + "candidate-oracle-1/result.json") preserved = read_json(base + "windows-build-final-1-binaries/preserved.json") launch = read_json(base + "launch-manifest-final-1.json") # Resolve historical absolute evidence paths without accessing those paths. mapping = {} normalize = lambda path: path.replace("\\", "/").casefold() for group in index["payloadGroups"]: for name in group["files"]: mapping[normalize(group["sourceRoot"] + "/" + name)] = group["destinationPrefix"] + "/" + name for gate in index["completedGates"]: receipt = read_json("gates/" + gate["label"] + "/result.json") original = receipt["cwd"] + "/.local/text-diagnostic-gates/" + gate["label"] for name in ["inputs.json", "inputs.zip"]: mapping[normalize(original + "/" + name)] = gate["captureRef"] + "/" + name def bound(item): target = mapping.get(normalize(item["path"])) require(target is not None, "Unresolved archived evidence: " + item["path"]) actual = identity(file(target).read_bytes()) require(all(actual[k] == item[k] for k in ["bytes", "sha256"] if k in item), "Historical evidence binding differs: " + target) for item in [preserved["buildResult"], current["buildResult"], current["sourceResult"], candidate["priorOracle"], *launch["evidence"]]: bound(item) check_file(base + "build-and-preserve.py", preserved["helper"]) require(all(x["sourceInputs"] == build["inputs"] for x in [preserved, current, candidate, launch]), "Oracle/build/launch source identities differ") raw_artifacts = [] for line in file("gates/windows-build-final-1/stdout.log").read_text(encoding="utf-8").splitlines(): try: value = json.loads(line) except json.JSONDecodeError: continue if value.get("reason") == "compiler-artifact": raw_artifacts.append(value) for binary in preserved["binaries"]: matches = [a for a in build["artifacts"] if a["cargo"]["target"]["name"] == binary["name"] and a["cargo"]["profile"]["test"] is False] require(len(matches) == 1 and matches[0]["cargo"] in raw_artifacts, "Build artifact missing") require(matches[0]["readback"] == {k: binary[k] for k in ["bytes", "sha256"]}, "Preserved artifact receipt differs") require(normalize(binary["source"]) == normalize(matches[0]["cargo"]["executable"]), "Preserved source path differs") require(current["artifact"] in build["artifacts"] and current["binary"] == current["artifact"]["readback"], "CLI artifact binding differs") gui = next(b for b in preserved["binaries"] if b["name"] == "arcadia-studio") require(all(launch["binary"][k] == gui[k] for k in ["path", "bytes", "sha256"]), "Launch GUI receipt differs") # Executable/DLL bytes are deliberately external. Check only recorded identities. for path, pin in candidate["bindings"].items(): if normalize(path) == normalize(current["binaryPath"]): require(pin == current["binary"], "Candidate CLI identity differs") elif normalize(path).endswith("/runtime/libunwind.dll"): require(pin == {"bytes": 190976, "sha256": "f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4"}, "Candidate DLL identity differs") else: bound({"path": path, **pin}) oracle_cases = [("current-oracle-1", current, "current-oracle.py"), ("candidate-oracle-1", candidate, "candidate-oracle.py")] if index.get("additionalCurrentOracle"): extra = index["additionalCurrentOracle"] current3 = read_json(extra["prefix"] + "/result.json") build3 = read_json("gates/" + extra["buildGate"] + "/result.json") preserved3 = read_json(extra["preserved"]) for item in [current3["buildResult"], current3["sourceResult"], preserved3["buildResult"]]: bound(item) check_file(extra["preservationHelperRef"], preserved3["helper"]) require(current3["sourceInputs"] == preserved3["sourceInputs"] == build3["inputs"], "Canonical oracle/build source binding differs") require(current3["sourceFiles"] == build3["inputCount"] == 604 and current3["fixtures"] == current["fixtures"] and all(current3[k] is True for k in ["binaryUnchanged", "originalFixturesUnchanged", "dllUnchanged", "evidenceUnchanged"]), "Canonical oracle preservation scope differs") artifacts3 = [] for line in file("gates/" + extra["buildGate"] + "/stdout.log").read_text(encoding="utf-8").splitlines(): try: item = json.loads(line) except json.JSONDecodeError: continue if item.get("reason") == "compiler-artifact": artifacts3.append(item) require(len(preserved3["binaries"]) == 2, "Canonical preserved artifact count differs") for binary in preserved3["binaries"]: matches = [a for a in build3["artifacts"] if a["cargo"]["target"]["name"] == binary["name"] and a["cargo"]["profile"]["test"] is False] require(len(matches) == 1 and matches[0]["cargo"] in artifacts3 and matches[0]["readback"] == {k: binary[k] for k in ["bytes", "sha256"]} and normalize(matches[0]["cargo"]["executable"]) == normalize(binary["source"]), "Canonical preserved artifact differs from build receipt") require(current3["artifact"] in build3["artifacts"] and current3["binary"] == current3["artifact"]["readback"], "Canonical oracle CLI differs") oracle_cases.append((extra["prefix"].split("/")[-1], current3, "current-oracle.py")) if index.get("additionalCandidateOracle"): require(index.get("additionalCurrentOracle"), "Candidate requires canonical current oracle") extra_candidate = index["additionalCandidateOracle"] candidate3 = read_json(extra_candidate["prefix"] + "/result.json") require(extra_candidate["priorPrefix"] == index["additionalCurrentOracle"]["prefix"] and candidate3["sourceInputs"] == current3["sourceInputs"] and candidate3["originalsUnchanged"] is True, "Canonical candidate source/original preservation differs") bound(candidate3["priorOracle"]) require(mapping[normalize(candidate3["priorOracle"]["path"])] == extra_candidate["priorPrefix"] + "/result.json", "Candidate prior oracle differs") for path, pin in candidate3["bindings"].items(): if normalize(path) == normalize(current3["binaryPath"]): require(pin == current3["binary"], "Canonical candidate CLI identity differs") elif normalize(path).endswith("/runtime/libunwind.dll"): require(pin == {"bytes": 190976, "sha256": "f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4"}, "Canonical candidate DLL identity differs") else: bound({"path": path, **pin}) oracle_cases.append((extra_candidate["prefix"].split("/")[-1], candidate3, "candidate-oracle.py")) if index.get("additionalLaunchPreparation"): require(index.get("additionalCurrentOracle"), "Launch requires canonical build records") preparation = index["additionalLaunchPreparation"] launch3 = read_json(preparation["manifest"]) gui3 = next(b for b in preserved3["binaries"] if b["name"] == "arcadia-studio") require(launch3["nativeReady"] is True and launch3["target"] == "x86_64-pc-windows-gnullvm" and launch3["sourceInputs"] == build3["inputs"] and all(launch3["binary"][k] == gui3[k] for k in ["path", "bytes", "sha256"]), "Canonical launch preparation binding differs") for item in launch3["evidence"]: bound(item) require(sum(mapping[normalize(item["path"])] == preparation["helperRef"] for item in launch3["evidence"]) == 1, "Canonical launch preparation must pin its executed helper") # nativeReady records preparation only; no native acceptance is inferred. summaries = [] for label, receipt, helper in oracle_cases: require(receipt["passed"] is True, "Oracle failed") check_file(base + helper, receipt["helper"]) for run in receipt["runs"]: prefix = base + label + "/" for field, suffix in [("stdout", ".stdout.json"), ("stderr", ".stderr.log")]: check_file(prefix + run["label"] + suffix, run[field]) report = read_json(prefix + run["label"] + ".stdout.json") require(report == run["report"], "Raw/parsed oracle report differs") require(run["exitCode"] == run["expectedExitCode"] == report["exit_code"] and report["operation"] == "check" and report["written"] is False and report["changes"] == [], "Oracle outcome differs") inputs = run.get("inputFiles", receipt.get("preparedFixtures", {}).get(run["label"])) for name, pin in inputs.items(): check_file(prefix + run["label"] + "/" + name, pin) for diagnostic in report["diagnostics"]: location = diagnostic["location"] raw = file(prefix + run["label"] + "/" + location["path"]).read_bytes() start, end = location["start"], location["end"] require(0 <= start <= end <= len(raw), "Diagnostic range outside source") before = raw[:start].decode("utf-8") raw[start:end].decode("utf-8") raw[end:].decode("utf-8") require(location["line"] == before.count("\n") + 1 and location["column"] == len(before.rsplit("\n", 1)[-1]) + 1, "Diagnostic line/column differs") require(diagnostic["coordinate_space"] == "input" and diagnostic["related"] == [], "Unexpected oracle coordinate space or related locations") if "expectedSpan" in run: require(len(report["diagnostics"]) == 1, "Candidate diagnostic count differs") loc = report["diagnostics"][0]["location"] require([loc["start"], loc["end"]] == run["expectedSpan"], "Candidate span differs") prior = (index["additionalCandidateOracle"]["priorPrefix"] if label == "candidate-oracle-3" else base + "current-oracle-1") original = file(prior + "/complete/functions.arcadia").read_bytes() raw = file(prefix + run["label"] + "/functions.arcadia").read_bytes() require(raw == original + bytes.fromhex(run["suffixHex"]), "Candidate literal edit differs") summaries.append({"oracle": label, "variant": run["label"], "exitCode": run["exitCode"], "diagnostics": len(report["diagnostics"])}) expected_counts = ([2, 5, 1, 1] + ([2, 5] if index.get("additionalCurrentOracle") else []) + ([1, 1] if index.get("additionalCandidateOracle") else [])) require([s["diagnostics"] for s in summaries] == expected_counts, "Oracle diagnostic counts differ") return summaries def verify_closed_trial2(index, trial): """Verify recorded closure and capture bytes; leave UI acceptance to review.""" prefix = trial["prefix"] launch = read_json(prefix + "/launch.json") closed = read_json(prefix + "/closed.json") post = read_json(prefix + "/post-exit-verification.json") close_ui = read_json(prefix + "/close-ui-observation.json") check_file(trial["closureHelper"], post["helper"]) check_file(prefix + "/closed.json", post["closure"]) require(closed["pid"] == launch["pid"] and closed["exitCode"] == 0 and closed["launchReceiptError"] is None and all(closed[k] is True for k in ["binaryUnchanged", "preservedBinaryUnchanged", "sameFileAfterExit", "dllUnchanged"]) and launch["sameFileBeforeLaunch"] is True, "Native2 closure receipt differs") for key in ["stdout", "stderr"]: check_file(prefix + "/" + key + ".log", closed[key]) require(closed[key]["bytes"] == 0, "Native2 log is not empty") manifest_bytes = file(prefix + "/launch-manifest.json").read_bytes() require(manifest_bytes == file(trial["manifestRef"]).read_bytes() and identity(manifest_bytes)["sha256"] == launch["manifestSha256"], "Native2 launch manifest differs") manifest = json.loads(manifest_bytes) require(launch["binary"] == {k: manifest["binary"][k] for k in ["bytes", "sha256"]} and launch["preservedExecutable"] == manifest["binary"]["path"], "Native2 GUI recorded identity differs") check_file("native-preparation/launch.py", launch["helper"]) # The immediately preceding window list is not process-exit proof. require(datetime.fromisoformat(launch["started"]) < datetime.fromisoformat(close_ui["atUtc"].replace("Z", "+00:00")) < datetime.fromisoformat(closed["finished"]) < datetime.fromisoformat(post["atUtc"]), "Native2 closure chronology differs") require(any(w["app"] == "process:" + launch["executable"] for w in close_ui["windows"]), "Native2 closing window observation differs") current = read_json(trial["oracleRef"] + "/result.json") expected = current["preparedFixtures"]["complete"] require({x.name for x in file(prefix + "/work-fixture").iterdir()} == set(expected), "Native2 saved fixture membership differs") require(len(post["files"]) == len(expected) and {x["file"] for x in post["files"]} == set(expected), "Native2 postcheck files differ") for item in post["files"]: require(item["exactEqual"] is True and item["actual"] == item["original"] == expected[item["file"]], "Native2 original fixture identity differs") check_file(prefix + "/work-fixture/" + item["file"], item["actual"]) directory = file(prefix + "/screenshots") names = {x.name for x in directory.iterdir()} expected_names = [] for observation in post["observations"]: name = observation["file"] require(len(relative(name).parts) == 1 and name.endswith(".json"), "Unsafe native2 metadata name") expected_names.append(name) check_file(prefix + "/screenshots/" + name, {k: observation[k] for k in ["bytes", "sha256"]}) metadata = read_json(prefix + "/screenshots/" + name) require([x["file"] for x in metadata["screenshots"]] == [x["file"] for x in observation["screenshots"]], "Native2 screenshot references differ") for shot in observation["screenshots"]: name = shot["file"] require(len(relative(name).parts) == 1 and name.endswith(".jpg"), "Unsafe native2 image name") expected_names.append(name) check_file(prefix + "/screenshots/" + name, {k: shot[k] for k in ["bytes", "sha256"]}) unique(expected_names) require(set(expected_names) == names and len(post["observations"]) == trial["metadata"] == 49 and len(names) - len(post["observations"]) == trial["screenshots"] == 53, "Native2 exact capture membership differs") review = read_json(trial["review"]) acceptance = read_json(trial["acceptance"]) require(review["launch"] == launch and review["closure"] == closed and review["sourceInputs"] == manifest["sourceInputs"] and review["jpegCount"] == 53 and review["metadataCount"] == 49, "Native2 independent review receipt differs") normalize = lambda path: path.replace("\\", "/").casefold() mapping = {normalize(g["sourceRoot"] + "/" + name): g["destinationPrefix"] + "/" + name for g in index["payloadGroups"] for name in g["files"]} for original, pin in review["bindings"].items(): target = mapping.get(normalize(original)) require(target is not None, "Unresolved native2 independent review binding") check_file(target, pin) for label, summary in review["oracleSummaries"].items(): oracle = read_json("native-preparation/" + label + "/result.json") require(summary == {"sourceInputs": oracle["sourceInputs"], "runs": [ {"label": x["label"], "exit": x["exitCode"], "diagnostics": x["report"]["diagnostics"]} for x in oracle["runs"]]}, "Native2 review oracle summary differs") require(acceptance["decision"] == "accepted_with_explicit_scope_limits" and acceptance["sourceInputSha256"] == manifest["sourceInputs"]["sha256"] and acceptance["guiSha256"] == launch["binary"]["sha256"] and acceptance["independentReviewSha256"] == identity(file(trial["review"]).read_bytes())["sha256"] and acceptance["postExitVerificationSha256"] == identity(file(prefix + "/post-exit-verification.json").read_bytes())["sha256"], "Native2 parent acceptance binding differs") return {"prefix": prefix, "exitCode": 0, "screenshots": 53, "metadata": 49, "recordedAcceptance": acceptance["decision"], "uiAcceptanceReevaluated": False} def verify_native_trials(index): summaries = [] normalize = lambda path: path.replace("\\", "/").casefold() mapping = {normalize(g["sourceRoot"] + "/" + name): g["destinationPrefix"] + "/" + name for g in index["payloadGroups"] for name in g["files"]} for trial in index.get("nativeTrials", []): if trial.get("closureHelper"): summaries.append(verify_closed_trial2(index, trial)) continue prefix = trial["prefix"] launch = read_json(prefix + "/launch.json") closed = read_json(prefix + "/closed.json") review = read_json(trial["review"]) require(closed == review["closure"] and closed["pid"] == launch["pid"] and closed["exitCode"] == 0 and closed["launchReceiptError"] is None, "Native closure binding differs") require(all(closed[k] is True for k in ["binaryUnchanged", "preservedBinaryUnchanged", "sameFileAfterExit", "dllUnchanged"]) and launch["sameFileBeforeLaunch"] is True, "Native readback receipt differs") for key in ["stdout", "stderr"]: check_file(prefix + "/" + key + ".log", closed[key]) require(closed[key]["bytes"] == 0, "Initial native log is not empty") raw_manifest = file(prefix + "/launch-manifest.json").read_bytes() require(identity(raw_manifest)["sha256"] == launch["manifestSha256"] and raw_manifest == file("native-preparation/launch-manifest-final-1.json").read_bytes(), "Native launch manifest differs") manifest = json.loads(raw_manifest) require(launch["binary"] == {k: manifest["binary"][k] for k in ["bytes", "sha256"]} == review["binary"], "Native binary receipt differs") check_file("native-preparation/launch.py", launch["helper"]) for original, pin in review["bindings"].items(): target = mapping.get(normalize(original)) require(target is not None, "Unresolved native review evidence") check_file(target, pin) screenshots = file(prefix + "/screenshots") images = {x.name for x in screenshots.iterdir() if x.suffix == ".jpg"} metadata = sorted(x for x in screenshots.iterdir() if x.suffix == ".json") require(len(images) == trial["screenshots"] == review["screenshotCount"] == 19 and len(metadata) == trial["metadata"] == review["metadataCount"] == 15, "Native capture counts differ") linked_images = [] for path in metadata: data = json.loads(path.read_text(encoding="utf-8")) for capture in data["screenshots"]: name = capture["file"] require(len(relative(name).parts) == 1 and name in images, "Missing screenshot reference") linked_images.append(name) require(len(linked_images) == len(images) and set(linked_images) == images, "Native screenshot/metadata membership differs") fixture = {x.relative_to(file(prefix + "/work-fixture")).as_posix(): identity(x.read_bytes()) for x in file(prefix + "/work-fixture").rglob("*") if x.is_file()} current = read_json("native-preparation/current-oracle-1/result.json") require(fixture == review["workFixture"] == current["preparedFixtures"]["complete"], "Native saved fixture differs") require(review["originalFixtures"] == current["fixtures"], "Original fixture review differs") summaries.append({"prefix": prefix, "exitCode": 0, "screenshots": len(images), "metadata": len(metadata), "acceptance": False}) return summaries def verify_resource_recovery(index): record = index.get("resourceRecovery") if not record: return None reclaim = read_json(record["reclaimedZIPReceipt"]) require(len(reclaim["files"]) == 11, "Reclaimed ZIP receipt count differs") seen = set() for item in reclaim["files"]: original = item["path"].replace("\\", "/") require(original not in seen and original.endswith("/inputs.zip"), "Duplicate reclaimed path") seen.add(original) label = original.split("/")[-2] gate = next(g for g in index["completedGates"] if g["label"] == label) relative_zip = gate["captureRef"] + "/inputs.zip" require(item["retained"].replace("\\", "/").endswith( "/harness/experiments/text-diagnostics-20260913/" + relative_zip), "Reclaimed ZIP retained path differs") pin = {k: item[k] for k in ["bytes", "sha256"]} check_file(relative_zip, pin) require(pin == read_json("gates/" + label + "/result.json")["archive"], "Reclaimed ZIP gate binding differs") require(sum(x["bytes"] for x in reclaim["files"]) == reclaim["reclaimed"], "Reclaimed byte total differs") before = read_json(record["compressionBefore"]) result = read_json(record["compressionResult"]) require(len(before) == result["files"] == 1040 and len({x["path"].casefold() for x in before}) == len(before) and sum(x["bytes"] for x in before) == result["bytes"], "Compression inventory differs") require(result["exitCodes"] == [0, 0] and result["allFileBytesUnchanged"] is True, "Compression receipt did not report successful unchanged bytes") require(all(any(x["path"].casefold().startswith(root.casefold() + "\\") for root in result["paths"]) for x in before), "Compression inventory outside recorded roots") second_summary = None if record.get("secondCompression"): second = record["secondCompression"] inventory = read_json(second["before"]) receipt = read_json(second["result"]) plan = read_json(second["plan"]) require(identity(file(second["plan"]).read_bytes())["sha256"] == receipt["planSha256"], "Second compression plan hash differs") require(len(inventory) == receipt["files"] == 1048 and sum(x["bytes"] for x in inventory) == receipt["bytes"], "Second compression count/size differs") by_path = {x["path"].casefold(): x for x in inventory} require(len(by_path) == len(inventory), "Duplicate second compression file") binaries = {x["path"].casefold(): x for x in plan["binaries"]} for path, binary in binaries.items(): require(path in by_path and all(by_path[path][k] == binary[k] for k in ["bytes", "sha256"]), "Second compression binary inventory differs") require(all(path in binaries or any(path.startswith(x["path"].casefold() + "\\") for x in plan["caches"]) for path in by_path), "Second compression file outside plan") require(len(plan["binaries"]) + len(plan["caches"]) == 9 and receipt["exitCodes"] == [0] * 9 and receipt["allFileBytesUnchanged"] is True, "Second compression receipt did not report successful unchanged bytes") second_summary = {"filesRecorded": 1048, "operationsRecorded": 9, "freeBytesAtReceipt": receipt["freeBytes"], "externalFilesRehashed": False} user_removal = None if record.get("userRemoval"): removal = read_json(record["userRemoval"]) normalize = lambda path: path.replace("\\", "/").casefold() require(len(removal["paths"]) == 2 and {normalize(x["path"]) for x in removal["paths"]} == {normalize(path) for path in result["paths"]} and all(x["exists"] is False for x in removal["paths"]), "User removal absence receipt differs from older desktop cache paths") require(removal["actor"] == "User reported deletion; agent verified absence only", "User removal actor scope differs") user_removal = {"actor": removal["actor"], "pathsReportedAbsent": 2, "freeBytesAtReceipt": removal["freeBytes"], "currentPathsInspected": False} core_summary = None if record.get("coreCompression"): core = record["coreCompression"] inventory = read_json(core["before"]) receipt = read_json(core["result"]) correction = read_json(core["correction"]) require(identity(file(core["before"]).read_bytes())["sha256"] == correction["beforeSha256"] and identity(file(core["result"]).read_bytes())["sha256"] == correction["resultSha256"], "Core compression correction pins differ") require(receipt["bytes"] is None, "Original null compression total was rewritten") require(len(inventory) == receipt["files"] == correction["files"] == 2086 and len({x["path"].casefold() for x in inventory}) == len(inventory) and sum(x["bytes"] for x in inventory) == correction["logicalBytesFromInventory"], "Core compression corrected inventory total differs") require(len(receipt["paths"]) == 4 and receipt["exitCodes"] == [0] * 4 and receipt["filter"] == "*.o" and receipt["allFileBytesUnchanged"] is True, "Core compression recorded operation differs") require(all(any(x["path"].casefold().startswith(root.casefold() + "\\") for root in receipt["paths"]) for x in inventory), "Core compression inventory outside recorded roots") objects = [x for x in inventory if x["path"].endswith(".o")] core_summary = {"inventoryFiles": 2086, "objectFilesInInventory": len(objects), "logicalBytesDerived": correction["logicalBytesFromInventory"], "originalTotalStillNull": True, "freeBytesAtReceipt": receipt["freeBytes"], "externalFilesRehashed": False, "historicalSessionAttributionProved": False} return {"reclaimedPrivateZIPs": 11, "retainedZIPBytesVerified": reclaim["reclaimed"], "compressionFilesRecorded": 1040, "externalCacheRehashed": False, "recoveryHelpersExecutedByVerifier": False, "secondCompression": second_summary, "userRemoval": user_removal, "coreCompression": core_summary} def verify(): manifest = read_json("files.json") unique(manifest) actual = {p.relative_to(ROOT).as_posix() for p in ROOT.rglob("*") if p.is_file()} require(actual == set(manifest) | {"files.json"}, "Archive file membership differs") for name, pin in manifest.items(): check_file(name, pin) index = read_json("index.json") payload = {} for group in index["payloadGroups"]: require(len(group["files"]) == group["fileCount"], "Group count differs") require(sum(x["bytes"] for x in group["files"].values()) == group["bytes"], "Group size differs") for name, pin in group["files"].items(): target = group["destinationPrefix"] + "/" + name require(target not in payload, "Duplicate payload") require(manifest.get(target) == pin, f"Payload binding differs: {target}") payload[target] = pin require(len(payload) == index["totals"]["requiredPayloadFiles"], "Payload count differs") require(sum(p["bytes"] for p in payload.values()) == index["totals"]["requiredPayloadBytes"], "Payload total size differs") copies = read_json("copy-record.json")["files"] require(len(copies) == len(payload), "Copy receipt count differs") require({x["path"]: x["before"] for x in copies} == payload, "Copy source pins differ") require(all(x["before"] == x["after"] for x in copies), "Copy readbacks differ") members = 0 for sha, capture in index["captures"].items(): prefix = "captures/" + sha check_file(prefix + "/inputs.json", capture["inputsIdentity"]) require(manifest[prefix + "/inputs.zip"]["sha256"] == sha, "Capture key differs") inputs = read_json(prefix + "/inputs.json") unique(inputs) require(len(inputs) == capture["inputCount"], "Captured input count differs") with zipfile.ZipFile(file(prefix + "/inputs.zip")) as archive: unique(archive.namelist()) require(set(archive.namelist()) == set(inputs), "ZIP membership differs") for name, pin in inputs.items(): # Reading each complete member also validates its ZIP CRC. require(identity(archive.read(name)) == pin, f"ZIP content differs: {name}") members += len(inputs) for gate in index["completedGates"]: prefix = "gates/" + gate["label"] result = read_json(prefix + "/result.json") started = read_json(prefix + "/started.json") require(all(result.get(k) == v for k, v in started.items()), "Started/result binding differs") capture = gate["captureRef"] require(capture == "captures/" + result["archive"]["sha256"], "Capture reference differs") require(gate["label"] in index["captures"][result["archive"]["sha256"]]["originalRuns"], "Capture run mapping differs") for field, name in [("inputs", capture + "/inputs.json"), ("archive", capture + "/inputs.zip"), ("stdout", prefix + "/stdout.log"), ("stderr", prefix + "/stderr.log")]: check_file(name, result[field]) for key in ["command", "inputCount", "exitCode", "inputsUnchanged"]: require(gate[key] == result[key], f"Gate summary differs: {key}") if result.get("helper"): require(gate.get("helperRef") is not None, "Execution-pinned helper is unresolved") check_file(gate["helperRef"], result["helper"]) require(result["environment"]["CARGO_INCREMENTAL"] == "0", "Runner environment differs") output = file(prefix + "/stdout.log").read_text(encoding="utf-8") groups = re.findall(r"test result: \w+\. (\d+) passed; (\d+) failed; (\d+) ignored; (\d+) measured; (\d+) filtered out", output) totals = dict(zip(["passed", "failed", "ignored", "measured", "filtered"], [sum(int(m[i]) for m in groups) for i in range(5)])) require(totals == gate["totals"] and len(groups) == gate["groups"], "Test summary differs") prefix = "probe/records/attempt-1" result = read_json(prefix + "/result.json") for field, name in [("inputs", "inputs.json"), ("stdout", "stdout.log"), ("stderr", "stderr.log")]: check_file(prefix + "/" + name, result[field]) inputs = read_json(prefix + "/inputs.json") require(len(inputs) == index["probe"]["frozenInputs"] == 77, "Probe count differs") for name, pin in inputs.items(): check_file("probe/" + name, pin) require(result["exitCode"] == 0 and result["inputsUnchanged"], "Probe receipt differs") lines = file(prefix + "/stdout.log").read_text(encoding="utf-8").splitlines() require([line for line in lines if line.startswith("PASS ")] == result["passLine"], "Probe PASS binding differs") oracles = verify_oracles(index) if index.get("oracleRecords") else [] trials = verify_native_trials(index) recovery = verify_resource_recovery(index) normalization = index.get("sourceNormalization") if normalization: receipt = read_json(normalization["receipt"]) before_manifest = read_json(normalization["beforeCapture"] + "/inputs.json") after_manifest = read_json(normalization["afterCapture"] + "/inputs.json") member = normalization["member"] require(set(before_manifest) == set(after_manifest) and [name for name in before_manifest if before_manifest[name] != after_manifest[name]] == [member], "Normalization changed another input") with zipfile.ZipFile(file(normalization["beforeCapture"] + "/inputs.zip")) as archive: before = archive.read(member) with zipfile.ZipFile(file(normalization["afterCapture"] + "/inputs.zip")) as archive: after = archive.read(member) require(identity(before) == receipt["before"] and identity(after) == receipt["after"], "Normalization receipt source pins differ") lines = [number for number, line in enumerate(before.splitlines(keepends=True), 1) if line.endswith(b"\r\n")] require(lines == receipt["lines"] == [423, 424, 425] and before.replace(b"\r\n", b"\n") == after, "Normalization is not the exact three-pair change") outcome_comparison = index.get("fullOutcomeComparison") if outcome_comparison: receipt = read_json(outcome_comparison["receipt"]) after_prefix = "gates/" + outcome_comparison["afterGate"] require(identity(file(after_prefix + "/result.json").read_bytes())["sha256"] == receipt["resultSha256"], "Named outcome comparison result pin differs") named = lambda label: re.findall(r"^test (.+?) \.\.\. (ok|FAILED|ignored)", file("gates/" + label + "/stdout.log").read_text(encoding="utf-8"), re.MULTILINE) before_outcomes = named(outcome_comparison["beforeGate"]) after_outcomes = named(outcome_comparison["afterGate"]) require(len(after_outcomes) == receipt["testOutcomeLines"] == 912 and sorted(before_outcomes) == sorted(after_outcomes) and receipt["sameNamedOutcomesAsPriorCorrectedGate"] is True, "Named outcome comparison differs") require(all(tuple(x) in after_outcomes for x in receipt["newWeakTests"]), "Named lifetime test outcome missing") gate = next(g for g in index["completedGates"] if g["label"] == outcome_comparison["afterGate"]) require(gate["totals"] == receipt["totals"] and gate["exitCode"] == receipt["exitCode"] == 0, "Named outcome acceptance totals differ") return {"status": "PASS", "scope": "Archive bytes, ZIP members/CRC/content, gate/probe/oracle/native receipt bindings, saved spans and capture membership; no execution or binary revalidation", "manifestSha256": identity(file("files.json").read_bytes())["sha256"], "pinnedFiles": len(manifest), "payloadFiles": len(payload), "sourceCaptures": len(index["captures"]), "verifiedZIPMembers": members, "completedGates": len(index["completedGates"]), "probeInputs": len(inputs), "savedOracles": oracles, "closedNativeTrials": trials, "resourceRecovery": recovery, "sourceNormalizationVerified": bool(normalization), "namedFullOutcomesCompared": 912 if outcome_comparison else 0} if __name__ == "__main__": try: print(json.dumps(verify(), indent=2)) except (OSError, ValueError, KeyError, zipfile.BadZipFile) as error: print(f"FAIL: {error}", file=sys.stderr) sys.exit(1)