77 lines
4.3 KiB
Python
77 lines
4.3 KiB
Python
"""Read-only integrity verification of four isolated policy gates."""
|
|
from pathlib import Path
|
|
import hashlib
|
|
import json
|
|
import zipfile
|
|
|
|
root = Path(__file__).resolve().parent
|
|
|
|
|
|
def require(condition, message):
|
|
if not condition:
|
|
raise SystemExit(message)
|
|
|
|
|
|
def digest(data):
|
|
return {'bytes': len(data), 'sha256': hashlib.sha256(data).hexdigest()}
|
|
|
|
|
|
def read_json(path):
|
|
return json.loads(path.read_text(encoding='utf-8'))
|
|
|
|
|
|
manifest = read_json(root / 'files.json')
|
|
paths = {p.relative_to(root).as_posix() for p in root.rglob('*') if p.is_file() and p.name != 'files.json' and '__pycache__' not in p.parts}
|
|
require(paths == set(manifest), 'Archive membership mismatch')
|
|
for name, expected in manifest.items():
|
|
require(digest((root / name).read_bytes()) == expected, f'File mismatch: {name}')
|
|
captured = {}
|
|
outcomes = {}
|
|
for name, count in [('policy-1', 16), ('policy-clippy-1', None), ('policy-2', 18), ('policy-clippy-2', None)]:
|
|
gate = root / name
|
|
result = read_json(gate / 'result.json')
|
|
require(all(result[k] == v for k, v in read_json(gate / 'started.json').items()), f'{name}: start mismatch')
|
|
require(result['exitCode'] == 0 and result['inputsUnchanged'], f'{name}: failed/changed inputs')
|
|
for key, filename in [('inputs','inputs.json'),('archive','inputs.zip'),('stdout','stdout.log'),('stderr','stderr.log')]:
|
|
require(digest((gate / filename).read_bytes()) == result[key], f'{name}: {key} mismatch')
|
|
require(digest((root / 'gate-policy.py').read_bytes()) == result['helper'], f'{name}: runner mismatch')
|
|
inputs = read_json(gate / 'inputs.json')
|
|
captured[name] = inputs
|
|
require(len(inputs) == result['inputCount'] == 608, f'{name}: input count')
|
|
require('harness/prototypes/source-defaults-20260913.rs' in inputs, f'{name}: compiled prototype missing')
|
|
with zipfile.ZipFile(gate / 'inputs.zip') as archive:
|
|
require(len(archive.namelist()) == len(inputs) and set(archive.namelist()) == set(inputs), f'{name}: ZIP membership')
|
|
for path, expected in inputs.items():
|
|
require(digest(archive.read(path)) == expected, f'{name}: input mismatch {path}')
|
|
stdout = (gate / 'stdout.log').read_text(encoding='utf-8')
|
|
if count is not None:
|
|
require(f'test result: ok. {count} passed; 0 failed; 0 ignored;' in stdout, f'{name}: test summary')
|
|
tests = [s for s in stdout.splitlines() if s.startswith('test ') and ' ... ' in s]
|
|
require(len(tests) == count and all(s.endswith(' ... ok') for s in tests), f'{name}: named outcomes')
|
|
outcomes[name] = {s.split()[1] for s in tests}
|
|
else:
|
|
require(result['command'][1] == 'clippy' and result['command'][-3:] == ['--','-D','warnings'], f'{name}: strict command')
|
|
artifacts = []
|
|
finished = False
|
|
for line in stdout.splitlines():
|
|
try:
|
|
item = json.loads(line)
|
|
except json.JSONDecodeError:
|
|
continue
|
|
if isinstance(item, dict) and item.get('reason') == 'compiler-artifact' and item.get('executable'):
|
|
artifacts.append(item)
|
|
if isinstance(item, dict) and item.get('reason') == 'build-finished':
|
|
finished = item.get('success') is True
|
|
require(finished, f'{name}: successful Cargo build record missing')
|
|
require(artifacts == [a['cargo'] for a in result['artifacts']], f'{name}: artifacts mismatch')
|
|
require(len(artifacts) == (1 if count else 0), f'{name}: artifact count')
|
|
for suffix in ['1','2']:
|
|
require(captured['policy-'+suffix] == captured['policy-clippy-'+suffix], f'Iteration {suffix}: test/lint inputs differ')
|
|
before, after = captured['policy-1'], captured['policy-2']
|
|
changed = {p for p in before.keys() | after.keys() if before.get(p) != after.get(p)}
|
|
require(changed == {'crates/oa-core/tests/default_omission_policy.rs'}, 'Prototype/production changed between iterations')
|
|
require(outcomes['policy-2'] - outcomes['policy-1'] == {'nested_future_fields_prevent_whole_default_removal','unknown_and_multikey_constructor_wrappers_are_not_reinterpreted'}, 'Unexpected added tests')
|
|
require(outcomes['policy-1'] <= outcomes['policy-2'], 'An original test disappeared')
|
|
print(f'Verified {len(manifest)} pinned files, four 608-input gates, final 18 passing map tests and strict targeted Clippy.')
|
|
print('This is recorded experimental policy evidence, not public formatter/editor or source8 acceptance.')
|