75 lines
5.3 KiB
PowerShell
75 lines
5.3 KiB
PowerShell
#Requires -Version 7.0
|
|
Set-StrictMode -Version Latest
|
|
$ErrorActionPreference='Stop'
|
|
$files=@('verify.ps1','stage.ps1','launch.ps1','validate-scripts.ps1')
|
|
$records=@()
|
|
foreach($name in $files) {
|
|
$path=Join-Path $PSScriptRoot $name
|
|
$tokens=$null;$errors=$null
|
|
[void][Management.Automation.Language.Parser]::ParseFile($path,[ref]$tokens,[ref]$errors)
|
|
if(@($errors).Count){throw ($errors|Out-String)}
|
|
$records+=[ordered]@{path=$name;bytes=(Get-Item -LiteralPath $path).Length;sha256=(Get-FileHash -LiteralPath $path -Algorithm SHA256).Hash.ToLowerInvariant()}
|
|
}
|
|
. (Join-Path $PSScriptRoot 'verify.ps1')
|
|
$nativePin='b10b28cefd1d0794073ba241a0c8de9a83e85f68';$nativeInputCount=2
|
|
$hash='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
|
|
$fixture=[pscustomobject]@{base=$nativePin;count=2;files=@([pscustomobject]@{path='a';bytes=1;sha256=$hash},[pscustomobject]@{path='b';bytes=2;sha256=$hash})}
|
|
$cases=[Collections.Generic.List[string]]::new()
|
|
function Must-Reject([string]$Name,[scriptblock]$Body) {
|
|
$rejected=$false
|
|
try {& $Body} catch {$rejected=$true}
|
|
if(-not $rejected){throw "Synthetic refusal failed: $Name"}
|
|
$cases.Add($Name)
|
|
}
|
|
Assert-InputPair $fixture $fixture;$cases.Add('exact_source_pair_accepts')
|
|
$wrongPin=$fixture|ConvertTo-Json -Depth 5|ConvertFrom-Json;$wrongPin.base='2222222222222222222222222222222222222222'
|
|
Must-Reject 'wrong_pin' {Assert-InputPair $fixture $wrongPin}
|
|
$changed=$fixture|ConvertTo-Json -Depth 5|ConvertFrom-Json;$changed.files[1].bytes=3
|
|
Must-Reject 'changed_source_bytes' {Assert-InputPair $fixture $changed}
|
|
$duplicate=$fixture|ConvertTo-Json -Depth 5|ConvertFrom-Json;$duplicate.files[1].path='a'
|
|
Must-Reject 'duplicate_source_path' {Assert-InputPair $fixture $duplicate}
|
|
Assert-NativeNames @('a','b') @('b','a');$cases.Add('reordered_exact_names_accept')
|
|
Must-Reject 'duplicate_test_name' {Assert-NativeNames @('a','b') @('a','a')}
|
|
$binary=[pscustomobject]@{path='C:/isolated/test.exe';bytes=3;sha256=$hash}
|
|
Assert-NativeBinaries @($binary) @($binary);$cases.Add('same_binary_accepts')
|
|
$other=[pscustomobject]@{path=$binary.path;bytes=3;sha256=('b'*64)}
|
|
Must-Reject 'changed_binary_hash' {Assert-NativeBinaries @($binary) @($other)}
|
|
Must-Reject 'missing_binary' {Assert-NativeBinaries @($binary) @()}
|
|
|
|
|
|
$gate='C:/Users/User/Documents/Git/ARCADIA-Studio/.local/scenario-validation-gates-b10b28c-20260913'
|
|
$nativeInputCount=612
|
|
$initial=Read-NativeJson (Join-Path $gate 'inputs-complete-before.json')
|
|
Assert-StrictPreflightEvidence $gate $initial
|
|
$cases.Add('actual_closed_b10_strict_preflight_binding_accepts_only')
|
|
$strictRecord=Read-NativeJson (Join-Path $gate 'strict-preflight-receipt.json')
|
|
function Invoke-MutatedPreflight($Changed) {
|
|
function Read-NativeJson([string]$Path){if([IO.Path]::GetFileName($Path) -ceq 'strict-preflight-receipt.json'){return $Changed};Get-Content -Raw -LiteralPath $Path|ConvertFrom-Json}
|
|
Assert-StrictPreflightEvidence $gate $initial
|
|
}
|
|
foreach($case in @(
|
|
@{name='preflight_wrong_pin';field='base';value=('2'*40)},
|
|
@{name='preflight_failed';field='passed';value=$false},
|
|
@{name='preflight_cargo_failed';field='cargoExitCode';value=101},
|
|
@{name='preflight_wrong_command';field='command';value='cargo check'},
|
|
@{name='preflight_environment_changed';field='externalEnvironmentSha256';value=('b'*64)},
|
|
@{name='preflight_capture_changed';field='afterCaptureSha256';value=('b'*64)},
|
|
@{name='preflight_wrong_workspace';field='workspace';value='C:/other'},
|
|
@{name='preflight_wrong_target';field='target';value='C:/other'}
|
|
)){$changed=$strictRecord|ConvertTo-Json -Depth 20|ConvertFrom-Json;$changed.($case.field)=$case.value;Must-Reject $case.name {Invoke-MutatedPreflight $changed}}
|
|
# Check the real current recipe's statically declared common files are copied.
|
|
$runner=Get-Content -Raw -LiteralPath (Join-Path $gate 'run.ps1')
|
|
$common=[regex]::Match($runner,'(?m)^\$commonFiles=@\(([^\r\n]+)\)').Groups[1].Value
|
|
if([string]::IsNullOrEmpty($common)){throw 'Gate common-file list missing'}
|
|
$extensions=@('.json','.ps1','.log','.md')
|
|
foreach($m in [regex]::Matches($common,"'([^']+)'")){if([IO.Path]::GetExtension($m.Groups[1].Value) -notin $extensions){throw 'Staging filter would omit bound input'}}
|
|
$cases.Add('current_regular_recipe_bound_files_covered_by_copy_extensions')
|
|
$plan=Read-NativeJson (Join-Path $gate 'batches.json')
|
|
Assert-NativeNames @((Read-NativeJson (Join-Path $gate 'expected-tests.json')).tests) @($plan.batches|ForEach-Object {$_.tests})
|
|
if(@($plan.batches.tests).Count -ne 301 -or @($plan.batches).Count -ne 3){throw 'Wrong current batch plan'}
|
|
for($i=0;$i -lt 3;$i++){if(@($plan.batches[$i].tests).Count -ne @(107,101,93)[$i]){throw 'Wrong partition'}}
|
|
$cases.Add('current301_unique_partition107_101_93')
|
|
if((Get-NativeHash (Join-Path $PSScriptRoot 'verify.ps1')) -cne '8306f4d4a1dde1c075a47994cd9d92738803c8b3b255b3e9907f0cb24749d91d'){throw 'Frozen new verifier changed'}
|
|
$cases.Add('frozen_new_verifier_exact')
|
|
[ordered]@{status='passed';utc=[DateTime]::UtcNow.ToString('o');parsed_scripts=$records;synthetic_cases=$cases.ToArray();preflight_receipt_sha256=(Get-NativeHash (Join-Path $gate 'strict-preflight-receipt.json'));stage_executed=$false;launch_executed=$false;compiler_executed=$false;scope='AST, pure guards, actual closed strict-preflight readback with mutated refusal controls, and current static batch/copy membership only. No five-stage admission, staging, native launch or comparator acceptance.'}|ConvertTo-Json -Depth 8
|