"""Root-authorized isolated source reconstruction; never writes the main index.""" import hashlib import json import pathlib import shutil import subprocess import traceback from datetime import datetime, timezone BASE = pathlib.Path(__file__).resolve().parent ROOT = BASE.parents[1] SOURCE = BASE / 'source' COMMIT = 'b2c3e54001fc19a05423bcd5808ceea78d13ff59' BRANCH = 'codex/contextual-prerelease-source-20260911' VERSION = '0.2.0-preview.contextual.20260911' def stamp(): return datetime.now(timezone.utc).isoformat() def sha(path): return hashlib.sha256(path.read_bytes()).hexdigest() def write_json(name, value): path = BASE / name with path.open('x', encoding='utf-8', newline='\n') as stream: json.dump(value, stream, indent=2) stream.write('\n') def git(cwd, *args): result = subprocess.run(['git', *args], cwd=cwd, capture_output=True, check=True) if result.stderr: print(result.stderr.decode('utf-8', errors='replace'), end='', flush=True) return result.stdout def load(path): return json.loads(path.read_text(encoding='utf-8-sig')) def blobs(cwd, revision, paths): result = subprocess.run(['git', 'cat-file', '--batch'], cwd=cwd, input=''.join(revision + ':' + p + '\n' for p in paths).encode(), capture_output=True, check=True).stdout position = 0 found = {} for path in paths: end = result.index(b'\n', position) header = result[position:end].decode().split() assert header[1] == 'blob', (path, header) length = int(header[2]) found[path] = result[end + 1:end + 1 + length] position = end + 2 + length return found def main(): assert SOURCE.resolve().is_relative_to(BASE.resolve()) assert not SOURCE.exists() assert not (BASE / 'preparation.json').exists() assert not git(ROOT, 'branch', '--list', BRANCH).strip() assert git(ROOT, 'rev-parse', 'HEAD').decode().strip() == COMMIT index = ROOT / git(ROOT, 'rev-parse', '--git-path', 'index').decode().strip() root_identity = {'head': COMMIT, 'index_sha256': sha(index), 'tracked_status': git(ROOT, 'status', '--porcelain', '-uno').decode()} assert not root_identity['tracked_status'] assert shutil.disk_usage(BASE).free >= 2 * 1024 ** 3 gui = load(ROOT / '.local/contextual-source-layout-20260911/inputs4.json') expected = {e['path'].replace('\\', '/'): e['sha256'].lower() for e in gui['inputs']} assert len(expected) == 238 for path, checksum in expected.items(): assert sha(ROOT / path) == checksum, path original = blobs(ROOT, COMMIT, list(expected)) differences = [] for path, checksum in expected.items(): raw = (ROOT / path).read_bytes() committed = original[path] if hashlib.sha256(committed).hexdigest() == checksum: continue assert committed.replace(b'\r\n', b'\n') == raw.replace(b'\r\n', b'\n'), path differences.append({'path': path, 'sha256': checksum, 'base_git_sha256': hashlib.sha256(committed).hexdigest(), 'raw_bytes': len(raw), 'crlf': raw.count(b'\r\n'), 'lf': raw.count(b'\n'), 'uniform_lf_to_crlf_matches': committed.replace(b'\n', b'\r\n') == raw}) assert len(differences) == 11 assert [d['path'] for d in differences if not d['uniform_lf_to_crlf_matches']] == [ 'crates/oa-desktop/src/behavior/creation.rs'] print('Admission PASS: exact base, clean main index, 238 live inputs, 11 newline restorations.', flush=True) git(ROOT, 'worktree', 'add', '-b', BRANCH, str(SOURCE), COMMIT) for item in differences: data = (ROOT / item['path']).read_bytes() assert hashlib.sha256(data).hexdigest() == item['sha256'] (SOURCE / item['path']).write_bytes(data) with (SOURCE / '.gitattributes').open('ab') as stream: stream.write(b'\n# Preserve exact frozen GUI5657 contextual milestone input bytes.\n') for item in differences: stream.write((item['path'] + ' -text\n').encode()) prior = load(ROOT / '.local/authoring-prerelease-20260911/inventory.json') notice = load(ROOT / '.local/authoring-prerelease-20260911/packages/ArcadiaStudio-0.2.0-preview.authoring.20260911-x86_64-pc-windows-gnullvm/dependency-notices.json') server = {e['path']: e['recorded_sha256'] for e in prior['server_source_file_comparisons']} assert len(server) == 120 for package in notice['packages']: if package['name'] not in ('oa-core', 'oa-server') or package['source']: continue crate = SOURCE / 'crates' / package['name'] actual = {p.relative_to(crate).as_posix() for p in crate.rglob('*') if p.is_file() and not p.relative_to(crate).as_posix().startswith('target/') and p.name != '.cargo-ok'} assert actual == set(package['local_source_sha256']), package['name'] shared = {p: h for p, h in notice['workspace_build_inputs_sha256'].items() if p not in ('Cargo.toml', 'Cargo.lock')} checks = dict(expected) for inventory in (server, shared): for path, checksum in inventory.items(): assert path not in checks or checks[path] == checksum checks[path] = checksum for path, checksum in checks.items(): assert sha(SOURCE / path) == checksum, path git(SOURCE, 'add', '--', '.gitattributes', *[e['path'] for e in differences]) git(SOURCE, '-c', 'user.name=Codex-9e8r6t', '-c', 'user.email=codex-9e8r6t@local.invalid', 'commit', '-m', 'Preserve exact GUI5657 contextual prerelease input bytes') reconstruction = git(SOURCE, 'rev-parse', 'HEAD').decode().strip() committed = blobs(SOURCE, 'HEAD', list(checks)) fresh = BASE / 'source-roundtrip' fresh.mkdir() git(SOURCE, 'checkout-index', '--all', '--prefix=' + fresh.as_posix() + '/') roundtrip = [] for path, checksum in checks.items(): assert hashlib.sha256(committed[path]).hexdigest() == sha(fresh / path) == checksum, path roundtrip.append({'path': path, 'sha256': checksum}) assert not git(SOURCE, 'status', '--porcelain').strip() write_json('committed-roundtrip.json', {'commit': reconstruction, 'base_commit': COMMIT, 'branch': BRANCH, 'checks': roundtrip, 'gui_inputs': 238, 'server_inputs': 120, 'shared_non_cargo_inputs': 5, 'isolated_clean': True}) binaries = { '.local/contextual-source-layout-20260911/gui-verified/arcadia-studio.exe': '5657bab5c841939b66f901efe6c0ffb2d7cbbe8cc5f111a0ca3de8073d3846ce', '.local/native-qa/bin-source7-post-routing/arcadia-server.exe': 'efeeb89c0d2e0f93df4472cb3e9f48b2b722a37ae1043c90a5a56f2e845fe665', '.local/contextual-source-layout-20260911/gui-verified/libunwind.dll': 'f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4'} binary_dir = BASE / 'bin' binary_dir.mkdir() artifact_records = [] for path, checksum in binaries.items(): source = ROOT / path destination = binary_dir / source.name assert sha(source) == checksum shutil.copyfile(source, destination) assert sha(destination) == sha(source) == checksum artifact_records.append({'source': path, 'destination': destination.relative_to(BASE).as_posix(), 'sha256': checksum, 'bytes': destination.stat().st_size}) provenance = { 'gui-inputs4.json': '.local/contextual-source-layout-20260911/inputs4.json', 'gui-stage-manifest.json': '.local/contextual-source-layout-20260911/gui-verified/manifest.json', 'gui-build-status.json': '.local/contextual-source-layout-20260911/gui1-status.json', 'gui-build.log': '.local/contextual-source-layout-20260911/gui1.log', 'gui-clippy-status.json': '.local/contextual-source-layout-20260911/clippy1-status.json', 'gui-fmt-status.json': '.local/contextual-source-layout-20260911/fmt1-status.json', 'gui-focused26-status.json': '.local/contextual-source-layout-20260911/focused4-status.json', 'gui-full679-result.json': 'harness/experiments/contextual-source-layout-full-20260911/full-result.json', 'server-original-gates.json': '.local/source7-post-routing-gates-status.json', 'server-original-binary-hashes.json': '.local/native-qa/source7-post-routing-binary-hashes.json', 'server-prior-input-comparisons.json': '.local/authoring-prerelease-20260911/inventory.json', 'server-source-snapshot.tar.gz': '.local/linux-qa/runtime/source7-20260907T082753190288Z.tar.gz', 'prior-dependency-notices.json': '.local/authoring-prerelease-20260911/packages/ArcadiaStudio-0.2.0-preview.authoring.20260911-x86_64-pc-windows-gnullvm/dependency-notices.json', 'update-audit.md': 'harness/release-contextual-source-windows-update-plan-20260911.md'} evidence_dir = BASE / 'evidence' evidence_dir.mkdir() evidence_records = [] for name, path in provenance.items(): source = ROOT / path destination = evidence_dir / name before = sha(source) shutil.copyfile(source, destination) assert sha(source) == sha(destination) == before evidence_records.append({'source': path, 'destination': 'evidence/' + name, 'sha256': before, 'bytes': destination.stat().st_size}) write_json('evidence-manifest.json', evidence_records) evidence = { 'source_identity': f'Exact-byte reconstruction {reconstruction}, derived from verified checkpoint {COMMIT} by eleven documented newline restorations and precise preservation attributes. All 238 GUI inputs and 120 core/server files plus shared build resources match; committed Git bytes and fresh checkout match. This is an input-preservation commit, not the original build commit. Server core/dependency sources remain unchanged; current Cargo manifests add only the separate local oa-cli member/lock entry.', 'profile': 'Prebuilt Windows development-profile artifacts. GUI5657: September 11 final matching desktop build after focused26, strict Clippy and fmt; exact matching test artifact subsequently passed full679. EFEE server: unchanged September 7 workspace-bins build and its historical server gates. Neither a new server build nor release-profile/reproducible-build acceptance is claimed.', 'compiler': 'Recorded rustc 1.98.1, commit 48a229ceaefd4985c50990b14116b6d856af0985, x86_64-pc-windows-gnullvm, LLVM 22.1.8. Audit matched all 58 recorded target-library hashes; package inventory separately records current read-only compiler/sysroot facts. Original per-binary build records remain in evidence/.', 'target': 'x86_64-pc-windows-gnullvm', 'provenance_reference_base': 'Paths in per_binary_provenance refer to the separately retained preparation evidence directory, not files inside the distributable ZIP.', 'binary_sha256': {pathlib.Path(p).name: h for p, h in binaries.items() if p.endswith('.exe')}, 'per_binary_provenance': { 'arcadia-studio.exe': {'original_build_status': 'evidence/gui-build-status.json', 'original_stage': 'evidence/gui-stage-manifest.json', 'exact_inputs': 'evidence/gui-inputs4.json', 'later_full_test': 'evidence/gui-full679-result.json'}, 'arcadia-server.exe': {'original_build_status': 'evidence/server-original-gates.json', 'original_hash': 'evidence/server-original-binary-hashes.json', 'source_comparison': 'evidence/server-prior-input-comparisons.json', 'scope': 'Unchanged preserved artifact; historical original build and acceptance, no new build/test run.'}}} write_json('build-evidence.json', evidence) after = {'head': git(ROOT, 'rev-parse', 'HEAD').decode().strip(), 'index_sha256': sha(index), 'tracked_status': git(ROOT, 'status', '--porcelain', '-uno').decode()} assert after == root_identity, (root_identity, after) write_json('preparation.json', {'base_commit': COMMIT, 'reconstruction_commit': reconstruction, 'branch': BRANCH, 'version': VERSION, 'restorations': differences, 'gui_inputs': expected, 'server_inputs': server, 'shared_non_cargo_inputs': shared, 'artifacts': artifact_records, 'root_before': root_identity, 'root_after': after, 'prepared': stamp(), 'scope': 'Exact isolated source/bin preparation and commit/checkout verification only; no Cargo, compilation, package or runtime execution.'}) print(f'PASS: reconstruction {reconstruction}; 238 GUI / 120 server / 5 shared inputs and checkout bytes; main HEAD/index unchanged.', flush=True) status = {'started': stamp()} try: main() status['success'] = True except BaseException as error: status['success'] = False status['error'] = repr(error) traceback.print_exc() raise finally: status['finished'] = stamp() write_json('prepare-result.json', status)