"""Copy the frozen topology sources and run the existing identified admission oracle. No compilation, UI interaction, network access, or existing-file replacement. """ from datetime import datetime, timezone import hashlib import json import os from pathlib import Path import subprocess import sys import time ROOT = Path(__file__).resolve().parent.parent TRIAL = ROOT / '.local/native-qa/lifecycle-palette-20260913-01' SOURCE = ROOT / 'harness/fixtures/source7-native/base' STRONG = ROOT / '.local/nested-lifecycle-native-fixture-20260912/strong-preflight-d61-r1' ORACLE_DIR = ROOT / '.local/native-qa/delete-oracle-warning-fix-42511f0' ORACLE = ORACLE_DIR / 'delete-oracle-warning-fix-42511f0.exe' ORACLE_SHA = '9796aa73544c6414003e6230a668a6cf1435978a310187ef2560af67e35f3466' OLD = '42511f0f8ae46f29e11ae18c1030face654c2994' D61 = 'd61f1f38779ab70a77efcde523ae31c432aefcfd' def read(path): return json.loads(path.read_text(encoding='utf-8-sig')) def identity(path): raw = path.read_bytes() return {'path': str(path.relative_to(ROOT)), 'bytes': len(raw), 'sha256': hashlib.sha256(raw).hexdigest()} def write_new(path, value): with path.open('x', encoding='utf-8', newline='\n') as handle: json.dump(value, handle, indent=2) handle.write('\n') def git(*args): return subprocess.check_output(['git', '-C', str(ROOT), *args]) def scoped(path): return path.startswith(('crates/oa-core/', '.cargo/')) or path in ( 'Cargo.toml', 'Cargo.lock', 'rust-toolchain.toml') def main(): baseline, work = TRIAL / 'topology-baseline', TRIAL / 'topology-work' run_dir = TRIAL / 'topology-admission-42511f0-r1' preparation = TRIAL / 'topology-preparation.json' for target in (baseline, work, run_dir, preparation): assert target.resolve().is_relative_to(TRIAL.resolve()) assert not target.exists(), f'Refuse existing target: {target}' initial_preparation = identity(TRIAL / 'preparation.json') fixture_manifest_path = SOURCE.parent / 'manifest.json' fixture_manifest = read(fixture_manifest_path) for name in ('project.arcadia', 'rationale.arcadia', 'expected-baseline.json'): actual = identity(SOURCE / name) assert actual['sha256'] == fixture_manifest[name]['sha256'], name assert actual['bytes'] == fixture_manifest[name]['bytes'], name strong_build = read(STRONG / 'build.json') strong_run = read(STRONG / 'run.json') assert strong_build['exit'] == strong_run['exit'] == 0 assert strong_build['full_gate_source'] == D61 assert strong_build['verified_input_count'] == 110 closed = read(STRONG / 'closed-full-d61-result.json') assert closed['source'] == D61 and closed['exit'] == 0 and not closed['changed_inputs'] recorded = read(STRONG / 'verified-core-config-inputs.json') assert len(recorded) == len({item['path'] for item in recorded}) == 110 assert all(scoped(item['path']) for item in recorded) gate_path = ROOT / '.local/allocation-union-20260912' / closed['inputs'] old_gate_path = ROOT / '.local/allocation-union-20260912/full-42511f0.inputs.json' d61_inputs, old_inputs = read(gate_path), read(old_gate_path) assert d61_inputs['source'] == D61 and old_inputs['source'] == OLD by_path = {item['path']: item for item in recorded} for manifest in (d61_inputs, old_inputs): selected = {item['path']: item for item in manifest['inputs'] if scoped(item['path'])} assert selected == by_path, 'Recorded core/config chain differs' head = git('rev-parse', 'HEAD').decode().strip() tracked = git('ls-tree', '-r', '--name-only', head, '--', 'crates/oa-core', '.cargo', 'Cargo.toml', 'Cargo.lock', 'rust-toolchain.toml') assert set(tracked.decode().splitlines()) == set(by_path), 'Core/config tracked set changed' requests = ''.join(f'{head}:{item["path"]}\n' for item in recorded).encode() batch = subprocess.run(['git', '-C', str(ROOT), 'cat-file', '--batch'], input=requests, capture_output=True, check=True).stdout offset = 0 for item in recorded: end = batch.index(b'\n', offset) header = batch[offset:end].split() assert len(header) == 3 and header[1] == b'blob' length = int(header[2]) raw = batch[end + 1:end + 1 + length] assert batch[end + 1 + length:end + 2 + length] == b'\n' offset = end + 2 + length assert raw == (ROOT / item['path']).read_bytes(), item['path'] assert length == item['bytes'] and hashlib.sha256(raw).hexdigest() == item['sha256'] assert offset == len(batch) assert not git('status', '--porcelain', '--untracked-files=all', '--', 'crates/oa-core', '.cargo', 'Cargo.toml', 'Cargo.lock', 'rust-toolchain.toml') oracle_build_path = ORACLE_DIR / 'build.json' oracle_build = read(oracle_build_path) assert oracle_build['source'] == OLD and oracle_build['exit'] == 0 strong_files = {Path(item['path']): item for item in strong_build['files']} assert identity(oracle_build_path)['sha256'] == strong_files[oracle_build_path]['sha256'] assert identity(gate_path)['sha256'] == strong_files[gate_path]['sha256'] oracle_files = {str(item['path']).replace('\\', '/'): item for item in oracle_build['files']} oracle_id = identity(ORACLE) assert oracle_id['sha256'] == ORACLE_SHA assert oracle_id['sha256'] == oracle_files[str(ORACLE.relative_to(ROOT)).replace('\\', '/')]['sha256'] oracle_source = ROOT / '.local/delete-native-oracle.rs' assert identity(oracle_source)['sha256'] == oracle_files['.local/delete-native-oracle.rs']['sha256'] core_record = oracle_files['target/debug/deps/liboa_core-145180297aa692e4.rlib'] assert core_record['sha256'] == strong_run['core_rlib_sha256_after'] assert core_record['sha256'] == strong_files[ROOT / core_record['path']]['sha256'] # The running executable is self-contained apart from the documented runtime; # do not read or rebuild mutable target artifacts during the desktop gate. prefixes = strong_build['path_prefixes'] assert all(Path(path).is_dir() for path in prefixes) runtime = Path(prefixes[0]) / 'libunwind.dll' assert identity(runtime)['sha256'] == strong_files[runtime]['sha256'] baseline.mkdir() work.mkdir() run_dir.mkdir() copies = [] for target in (baseline, work): for name in ('project.arcadia', 'rationale.arcadia'): raw = (SOURCE / name).read_bytes() with (target / name).open('xb') as handle: handle.write(raw) row = identity(target / name) row['source'] = identity(SOURCE / name) assert (target / name).read_bytes() == raw copies.append(row) provenance = [STRONG / name for name in ( 'build.json', 'run.json', 'verified-core-config-inputs.json', 'closed-full-d61-result.json')] provenance += [oracle_build_path, oracle_source, gate_path, old_gate_path, fixture_manifest_path, SOURCE.parent / 'README.md', SOURCE / 'expected-baseline.json'] receipt = {'utc': datetime.now(timezone.utc).isoformat(), 'current_head': head, 'scope': 'Exact source copies and current-core admission only; same-mode equality is not independent canonical or GUI acceptance.', 'original_preparation': initial_preparation, 'files': copies, 'verified_core_config_input_count': 110, 'oracle': oracle_id, 'oracle_core_source': OLD, 'closed_full_gate_source': D61, 'path_prefixes': prefixes, 'runtime': identity(runtime), 'provenance': [identity(path) for path in provenance], 'helper': identity(Path(__file__).resolve()), 'run_directory': str(run_dir.relative_to(ROOT))} write_new(preparation, receipt) write_new(run_dir / 'verified-current-core-config-inputs.json', recorded) command = [str(ORACLE), 'same', str(baseline / 'project.arcadia'), str(work / 'project.arcadia')] env = os.environ.copy() env['PATH'] = os.pathsep.join(prefixes + [env.get('PATH', '')]) start = datetime.now(timezone.utc).isoformat() timer = time.monotonic() result = subprocess.run(command, cwd=ROOT, env=env, capture_output=True) for name, raw in (('stdout.log', result.stdout), ('stderr.log', result.stderr)): with (run_dir / name).open('xb') as handle: handle.write(raw) unchanged = identity(TRIAL / 'preparation.json') == initial_preparation unchanged = unchanged and identity(ORACLE) == oracle_id unchanged = unchanged and all(identity(ROOT / row['path'])['sha256'] == row['sha256'] for row in copies) unchanged = unchanged and all(identity(ROOT / item['path'])['sha256'] == item['sha256'] for item in recorded) run = {'start': start, 'end': datetime.now(timezone.utc).isoformat(), 'elapsed_seconds': time.monotonic() - timer, 'command': command, 'exit': result.returncode, 'oracle_sha256': ORACLE_SHA, 'inputs_unchanged': unchanged, 'stdout': identity(run_dir / 'stdout.log'), 'stderr': identity(run_dir / 'stderr.log'), 'non_error_diagnostic_lines': sum(line.startswith(b'Permitted non-error diagnostic') for line in result.stderr.splitlines())} write_new(run_dir / 'run.json', run) print(result.stdout.decode('utf-8', errors='replace')) print(result.stderr.decode('utf-8', errors='replace')) print(json.dumps(run, indent=2)) assert unchanged, 'An identified input changed during admission' return result.returncode if __name__ == '__main__': sys.exit(main())