"""Verify archived records without executing archived code or extracting files. Python standard library only. Optional --repo checks the captured760 source blobs against Git at the recorded commit; it never launches a subject executable. """ import argparse,copy,hashlib,json,math,pathlib,shutil,subprocess,zipfile HERE=pathlib.Path(__file__).resolve().parent SOURCE='e34ba27e26ede3ab55f276acc250d92b2e0c3204' CATALOG='096efcb770ab383b0e293d689d6485da9066e791b35247e1232d724f89f2b09d' INPUTS='2387e1652853389857f436ed026ec89a3dec1ae40496dcf28083be04dcb47eb6' TRANSITION='a7a16bc291e132eaf69e1c42aa45a1440388cdf4bfb1dd4867d76f3ee7146d9a' SNAPSHOT='60e1f5807f4959676798482c8269fe1023507ad3ac305b5750eab192e1a4d2d4' TRACE='d278274e-8153-44e7-8b38-a48f5ad73c3c' IDENTITIES={'source':'8eb83649-2810-58e1-94cd-71e25422658e','trace':TRACE} def require(ok,message): if not ok:raise ValueError(message) def pin(raw):return {'bytes':len(raw),'sha256':hashlib.sha256(raw).hexdigest()} def pairs(items): d={} for k,v in items: require(k not in d,'duplicate JSON key: '+k);d[k]=v return d def load(raw):return json.loads(raw,object_pairs_hook=pairs,parse_constant=lambda v:(_ for _ in ()).throw(ValueError(v))) def exact(a,b): if type(a) is not type(b):return False if isinstance(a,dict):return a.keys()==b.keys() and all(exact(a[k],b[k]) for k in a) if isinstance(a,list):return len(a)==len(b) and all(exact(x,y) for x,y in zip(a,b)) if isinstance(a,float):return math.isfinite(a) and math.isfinite(b) and a.hex()==b.hex() return a==b def base(path):return path.replace('\\','/').rsplit('/',1)[-1] def main(): ap=argparse.ArgumentParser(description=__doc__);ap.add_argument('--repo',type=pathlib.Path);args=ap.parse_args() m=load((HERE/'manifest.json').read_bytes()) require(m['source']==SOURCE and m['schema']=='arcadia-native-e34-recorded-evidence-v1','manifest scope/source') require(pin(pathlib.Path(__file__).read_bytes())==m['verifier'],'verifier pin') require(pin((HERE/'evidence.zip').read_bytes())==m['archive'],'archive pin') z=zipfile.ZipFile(HERE/'evidence.zip');names=z.namelist() require(len(names)==len(set(names))==m['member_count'],'ZIP duplicate/count') require(set(names)==set(m['files']),'ZIP inventory') for name in names: require(not name.startswith('/') and '\\' not in name and '..' not in pathlib.PurePosixPath(name).parts,'unsafe member path') require(pathlib.PurePosixPath(name).suffix.lower() not in ('.exe','.dll','.pdb','.rlib','.lib','.a'),'unexpected binary') require(pin(z.read(name))==m['files'][name],'member pin: '+name) require(sum(x['bytes'] for x in m['files'].values())==m['payload_bytes'],'payload size') def raw(n):return z.read(n) def obj(n):return load(raw(n)) def checked(n,expected):require(pin(raw(n))=={k:expected[k] for k in ('bytes','sha256')},'recorded pin: '+n) def inventory(prefix):return {n[len(prefix):]:pin(raw(n)) for n in names if n.startswith(prefix)} require(pin(raw('preparation/comparator-manifest.json'))['sha256']==CATALOG,'fixed catalog') catalog=obj('preparation/comparator-manifest.json') for group in ('models','sources','negatives'): for item in catalog[group].values():checked('preparation/'+item['path'],item) require(pin(raw('native/build-evidence/native/combined-native-e34-1.inputs.json'))['sha256']==INPUTS,'fixed build inputs') inputs=obj('native/build-evidence/native/combined-native-e34-1.inputs.json') require(inputs['source']==SOURCE and len(inputs['inputs'])==760 and len({p['path'] for p in inputs['inputs']})==760,'source input count') review=obj('review/audit.json');run_names=[r['run'] for r in review['receipts']] require(m['source_runs']==run_names and len(run_names)==34 and len(set(run_names))==34,'source run inventory') failures=[];source_pins={} for name in run_names: prefix='native/runs/'+name+'/';r=obj(prefix+'runner-receipt.json');cp=r['checkpoint'] require(r['subject_commit']==SOURCE and r['committed_source_binding']['source']==SOURCE,'run source') require(r['committed_source_binding']['inputs']==760 and r['committed_source_binding']['exit']==0,'run Git admission') require(r['evaluator_exit']==0 and r['evaluator_before']==r['evaluator_after'] and r['evaluator_before']['sha256']==SNAPSHOT,'evaluator binding') require(base(r['evaluator_argv'][0])=='attachment_snapshot.exe' and base(r['evaluator_argv'][1])=='project.arcadia' and base(r['evaluator_argv'][2])=='actual.project.json','evaluator command') require(r['input_before']==r['input_after'],'source changed during check') checked(prefix+'input-before.arcadia',r['input_before']);checked(prefix+'input-after.arcadia',r['input_after']) source_pins[name]=r['input_before'] for rel,p in r['outputs'].items():checked(prefix+rel,p) golden='preparation/'+catalog['models'][cp]['path'] require(raw(prefix+'comparison/expected.project.json')==raw(golden),'expected copied model') require(raw(prefix+'comparison/actual.project.json')==raw(prefix+'actual.project.json'),'actual copied model') expected=obj(golden);actual=obj(prefix+'actual.project.json');equal=exact(expected,actual) cr=obj(prefix+'comparison/receipt.json') require(cr['full_project_json_exact']==equal and cr['inputs_unchanged'] is True,'comparison receipt') require(r['status']==('PASS' if equal else 'FAIL') and r['comparator_exit']==(0 if equal else 1),'source outcome') if not equal: failures.append(name);require(name=='native-g2-1' and cp=='G2','unexpected source failure') bad=copy.deepcopy(expected);point=bad['diagrams']['ea202922-0033-4000-8000-000000000200']['routes'][0]['waypoints'][1] point.update(x=526.25,y=309.06247) require(exact(bad,actual),'failed G2 differs beyond recorded coordinates') if r['source_checkpoint']: require(raw(prefix+'input-before.arcadia')==raw('preparation/'+catalog['sources'][r['source_checkpoint']]['path']),'source preservation') require(cr['source_bytes_exact'] is True,'source comparison receipt') require(failures==['native-g2-1'],'retained negative trial') for group in review['equal_source_groups'].values():require(all(source_pins[n]==source_pins[group[0]] for n in group),'Undo/Redo/reopen source equality') frame_count=0 for stream,count in [('initial',40),('resumed',199)]: prefix='native/captures/'+stream+'/';a=obj(prefix+'actions.json');require(len(a)==count,'action count') for action in a: for frame in action.get('frames',[]):checked(prefix+frame['path'],frame);frame_count+=1 if stream=='resumed': require(pin(raw(prefix+'actions.json'))['sha256']=='7b76d8db4b7fdfad0e4c455ad6b2fdfa6de4cf2f517c81e81599b03aa957c1fe','final action pin') require(a[188]['closedNormally'] is False and a[189]['closedNormally'] is True,'close observation sequence') require(a[-1]['label']=='transition-final-exit-observed' and a[-1]['closedNormally'] is True,'final observed close') require(frame_count==245,'capture count') require(obj('native/interruption-resume.json')['closedNormally'] is False,'original interruption boundary') require(pin(raw('transition-admission/manifest.json'))['sha256']=='4bff0e62ed2e43f8bb10c0f47b53c356b66cead88a57bd1c9409f3b700a18cb9','admission manifest') admission=obj('transition-admission/manifest.json') for rel,p in admission['files'].items():checked('transition-admission/'+rel,p) phases={'baseline':'oa-recreated','cancel':'oa-recreated','relink':'oa-relinked','reopened':'oa-reopened','noop':'oa-noop'} require(set(m['transition_runs'])=={'native-transition-'+p+'-1' for p in phases},'transition inventory') first=None;baseline=None for phase,state in phases.items(): prefix='native/runs/native-transition-'+phase+'-1/';r=obj(prefix+'result.json');report=obj(prefix+'stdout.log') require(r['source']==SOURCE and r['state']==state and r['exit']==0,'transition receipt') require(r['binary_before']==r['binary_after']==admission['binary'] and r['binary_before']['sha256']==TRANSITION,'transition binary') checked(prefix+'runner.py',r['runner']);checked(prefix+'stdout.log',r['stdout']);checked(prefix+'stderr.log',r['stderr']) require(not raw(prefix+'stderr.log'),'transition stderr') require(r['bundle_before']==r['bundle_after']==inventory(prefix+'input-before/'),'complete source bundle') require(report['status']=='PASS' and report['state']==state and report['comparison']=='complete Project equality','transition report') require(report['trace_identity_pinned']==(phase in ('reopened','noop')) and report['recreated_id_matches_snippet'] is True,'transition identity flags') require(r['command'][1:3]==['check',state] and base(r['command'][0])=='transition-native-lifecycle.exe' and base(r['command'][3])=='oa-recreated.arcadia','transition command') if phase in ('baseline','cancel'): require(r['receipt_before'] is None and r['receipt_after'] is None and len(r['command'])==4,'baseline identities') require(report['new_ids']=={'source':IDENTITIES['source']},'recreated identity') require(raw(prefix+'input-before/oa-recreated.arcadia')==raw('transition-admission/fixtures/oa-recreated.arcadia'),'baseline entry') if baseline is None:baseline=r['bundle_after'] else:require(baseline==r['bundle_after'],'Cancel altered bundle') else: checked(prefix+'identities.json',r['receipt_after']) require(report['new_ids']==obj(prefix+'identities.json')==IDENTITIES,'native trace identity') require(raw(prefix+'identities.json')==raw('native/native-first-relink.identities.json'),'first identity bytes') if phase=='relink': require(r['receipt_before'] is None and r['command'][4]=='--write-identities','first relink command') require(set(r['bundle_after'])-set(baseline)=={'traceability.arcadia'},'new trace source member') require([n for n in baseline if baseline[n]!=r['bundle_after'].get(n)]==['oa-recreated.arcadia'],'unrelated bundle mutation') first=r else:require(r['receipt_before']==r['receipt_after']==first['receipt_after'] and r['bundle_after']==first['bundle_after'] and r['command'][4]=='--identities','reopen/no-op retention') controls=obj('runtime-controls/summary.json') require(pin(raw('runtime-controls/summary.json'))['sha256']=='b3eac94621f1e5fd963858c45bcee9445ce020593feae14a830eaed5bf967851','fixed admitted controls') require(controls['status']=='PASS' and len(controls['trials'])==17 and controls['all_watched_unchanged'] is True,'control summary') positive=negative=0 for trial in controls['trials']: prefix='runtime-controls/trials/'+trial['label']+'/' require(obj(prefix+'result.json')==trial,'control raw receipt') checked(prefix+'stdout.log',trial['stdout']);checked(prefix+'stderr.log',trial['stderr']) require(trial['exit']==trial['expected_exit'] and trial['binary_before']==trial['binary_after']==admission['binary'],'control outcome/binary') require(trial['input_before']==trial['input_after'],'control input changed') if trial['expected_exit']==0: positive+=1;require(not raw(prefix+'stderr.log') and obj(prefix+'stdout.log')['status']=='PASS','positive control') else: negative+=1;require(not raw(prefix+'stdout.log') and trial['expected_stderr'] in raw(prefix+'stderr.log').decode('utf-8'),'negative rejection boundary') require((positive,negative)==(4,13),'control counts') git_checked=False if args.repo: git=shutil.which('git');require(git is not None,'Git missing') query=''.join(SOURCE+':'+p['path']+'\n' for p in inputs['inputs']).encode() proc=subprocess.run([git,'-C',str(args.repo),'cat-file','--batch'],input=query,capture_output=True,check=True,timeout=60) pos=0 for item in inputs['inputs']: end=proc.stdout.index(b'\n',pos);head=proc.stdout[pos:end].split();require(len(head)==3 and head[1]==b'blob','Git blob response') size=int(head[2]);body=proc.stdout[end+1:end+1+size];pos=end+size+2 require(pin(body)=={k:item[k] for k in ('bytes','sha256')},'Git source bytes: '+item['path']) require(pos==len(proc.stdout),'Git trailing output');git_checked=True print(json.dumps({'status':'PASS','scope':'Recorded evidence integrity and semantic checkpoint recheck; no native replay','source':SOURCE,'members':len(names),'frames':frame_count,'source_pass':33,'retained_source_fail':1,'native_transition_pass':5,'runtime_positive':positive,'runtime_negative':negative,'git_blobs_checked':760 if git_checked else 0},indent=2)) if __name__=='__main__':main()