206 lines
12 KiB
Python
206 lines
12 KiB
Python
"""Root-authorized isolated source reconstruction; never writes the main index."""
|
|
import hashlib
|
|
import json
|
|
import pathlib
|
|
import shutil
|
|
import subprocess
|
|
import traceback
|
|
from datetime import datetime, timezone
|
|
|
|
BASE = pathlib.Path(__file__).resolve().parent
|
|
ROOT = BASE.parents[1]
|
|
SOURCE = BASE / 'source'
|
|
COMMIT = 'b2c3e54001fc19a05423bcd5808ceea78d13ff59'
|
|
BRANCH = 'codex/contextual-prerelease-source-20260911'
|
|
VERSION = '0.2.0-preview.contextual.20260911'
|
|
|
|
def stamp():
|
|
return datetime.now(timezone.utc).isoformat()
|
|
|
|
def sha(path):
|
|
return hashlib.sha256(path.read_bytes()).hexdigest()
|
|
|
|
def write_json(name, value):
|
|
path = BASE / name
|
|
with path.open('x', encoding='utf-8', newline='\n') as stream:
|
|
json.dump(value, stream, indent=2)
|
|
stream.write('\n')
|
|
|
|
def git(cwd, *args):
|
|
result = subprocess.run(['git', *args], cwd=cwd, capture_output=True, check=True)
|
|
if result.stderr:
|
|
print(result.stderr.decode('utf-8', errors='replace'), end='', flush=True)
|
|
return result.stdout
|
|
|
|
def load(path):
|
|
return json.loads(path.read_text(encoding='utf-8-sig'))
|
|
|
|
def blobs(cwd, revision, paths):
|
|
result = subprocess.run(['git', 'cat-file', '--batch'], cwd=cwd,
|
|
input=''.join(revision + ':' + p + '\n' for p in paths).encode(),
|
|
capture_output=True, check=True).stdout
|
|
position = 0
|
|
found = {}
|
|
for path in paths:
|
|
end = result.index(b'\n', position)
|
|
header = result[position:end].decode().split()
|
|
assert header[1] == 'blob', (path, header)
|
|
length = int(header[2])
|
|
found[path] = result[end + 1:end + 1 + length]
|
|
position = end + 2 + length
|
|
return found
|
|
|
|
def main():
|
|
assert SOURCE.resolve().is_relative_to(BASE.resolve())
|
|
assert not SOURCE.exists()
|
|
assert not (BASE / 'preparation.json').exists()
|
|
assert not git(ROOT, 'branch', '--list', BRANCH).strip()
|
|
assert git(ROOT, 'rev-parse', 'HEAD').decode().strip() == COMMIT
|
|
index = ROOT / git(ROOT, 'rev-parse', '--git-path', 'index').decode().strip()
|
|
root_identity = {'head': COMMIT, 'index_sha256': sha(index),
|
|
'tracked_status': git(ROOT, 'status', '--porcelain', '-uno').decode()}
|
|
assert not root_identity['tracked_status']
|
|
assert shutil.disk_usage(BASE).free >= 2 * 1024 ** 3
|
|
gui = load(ROOT / '.local/contextual-source-layout-20260911/inputs4.json')
|
|
expected = {e['path'].replace('\\', '/'): e['sha256'].lower() for e in gui['inputs']}
|
|
assert len(expected) == 238
|
|
for path, checksum in expected.items():
|
|
assert sha(ROOT / path) == checksum, path
|
|
original = blobs(ROOT, COMMIT, list(expected))
|
|
differences = []
|
|
for path, checksum in expected.items():
|
|
raw = (ROOT / path).read_bytes()
|
|
committed = original[path]
|
|
if hashlib.sha256(committed).hexdigest() == checksum:
|
|
continue
|
|
assert committed.replace(b'\r\n', b'\n') == raw.replace(b'\r\n', b'\n'), path
|
|
differences.append({'path': path, 'sha256': checksum,
|
|
'base_git_sha256': hashlib.sha256(committed).hexdigest(),
|
|
'raw_bytes': len(raw), 'crlf': raw.count(b'\r\n'), 'lf': raw.count(b'\n'),
|
|
'uniform_lf_to_crlf_matches': committed.replace(b'\n', b'\r\n') == raw})
|
|
assert len(differences) == 11
|
|
assert [d['path'] for d in differences if not d['uniform_lf_to_crlf_matches']] == [
|
|
'crates/oa-desktop/src/behavior/creation.rs']
|
|
print('Admission PASS: exact base, clean main index, 238 live inputs, 11 newline restorations.', flush=True)
|
|
git(ROOT, 'worktree', 'add', '-b', BRANCH, str(SOURCE), COMMIT)
|
|
for item in differences:
|
|
data = (ROOT / item['path']).read_bytes()
|
|
assert hashlib.sha256(data).hexdigest() == item['sha256']
|
|
(SOURCE / item['path']).write_bytes(data)
|
|
with (SOURCE / '.gitattributes').open('ab') as stream:
|
|
stream.write(b'\n# Preserve exact frozen GUI5657 contextual milestone input bytes.\n')
|
|
for item in differences:
|
|
stream.write((item['path'] + ' -text\n').encode())
|
|
prior = load(ROOT / '.local/authoring-prerelease-20260911/inventory.json')
|
|
notice = load(ROOT / '.local/authoring-prerelease-20260911/packages/ArcadiaStudio-0.2.0-preview.authoring.20260911-x86_64-pc-windows-gnullvm/dependency-notices.json')
|
|
server = {e['path']: e['recorded_sha256'] for e in prior['server_source_file_comparisons']}
|
|
assert len(server) == 120
|
|
for package in notice['packages']:
|
|
if package['name'] not in ('oa-core', 'oa-server') or package['source']:
|
|
continue
|
|
crate = SOURCE / 'crates' / package['name']
|
|
actual = {p.relative_to(crate).as_posix() for p in crate.rglob('*')
|
|
if p.is_file() and not p.relative_to(crate).as_posix().startswith('target/')
|
|
and p.name != '.cargo-ok'}
|
|
assert actual == set(package['local_source_sha256']), package['name']
|
|
shared = {p: h for p, h in notice['workspace_build_inputs_sha256'].items()
|
|
if p not in ('Cargo.toml', 'Cargo.lock')}
|
|
checks = dict(expected)
|
|
for inventory in (server, shared):
|
|
for path, checksum in inventory.items():
|
|
assert path not in checks or checks[path] == checksum
|
|
checks[path] = checksum
|
|
for path, checksum in checks.items():
|
|
assert sha(SOURCE / path) == checksum, path
|
|
git(SOURCE, 'add', '--', '.gitattributes', *[e['path'] for e in differences])
|
|
git(SOURCE, '-c', 'user.name=Codex-9e8r6t', '-c', 'user.email=codex-9e8r6t@local.invalid',
|
|
'commit', '-m', 'Preserve exact GUI5657 contextual prerelease input bytes')
|
|
reconstruction = git(SOURCE, 'rev-parse', 'HEAD').decode().strip()
|
|
committed = blobs(SOURCE, 'HEAD', list(checks))
|
|
fresh = BASE / 'source-roundtrip'
|
|
fresh.mkdir()
|
|
git(SOURCE, 'checkout-index', '--all', '--prefix=' + fresh.as_posix() + '/')
|
|
roundtrip = []
|
|
for path, checksum in checks.items():
|
|
assert hashlib.sha256(committed[path]).hexdigest() == sha(fresh / path) == checksum, path
|
|
roundtrip.append({'path': path, 'sha256': checksum})
|
|
assert not git(SOURCE, 'status', '--porcelain').strip()
|
|
write_json('committed-roundtrip.json', {'commit': reconstruction, 'base_commit': COMMIT,
|
|
'branch': BRANCH, 'checks': roundtrip, 'gui_inputs': 238, 'server_inputs': 120,
|
|
'shared_non_cargo_inputs': 5, 'isolated_clean': True})
|
|
binaries = {
|
|
'.local/contextual-source-layout-20260911/gui-verified/arcadia-studio.exe': '5657bab5c841939b66f901efe6c0ffb2d7cbbe8cc5f111a0ca3de8073d3846ce',
|
|
'.local/native-qa/bin-source7-post-routing/arcadia-server.exe': 'efeeb89c0d2e0f93df4472cb3e9f48b2b722a37ae1043c90a5a56f2e845fe665',
|
|
'.local/contextual-source-layout-20260911/gui-verified/libunwind.dll': 'f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4'}
|
|
binary_dir = BASE / 'bin'
|
|
binary_dir.mkdir()
|
|
artifact_records = []
|
|
for path, checksum in binaries.items():
|
|
source = ROOT / path
|
|
destination = binary_dir / source.name
|
|
assert sha(source) == checksum
|
|
shutil.copyfile(source, destination)
|
|
assert sha(destination) == sha(source) == checksum
|
|
artifact_records.append({'source': path, 'destination': destination.relative_to(BASE).as_posix(),
|
|
'sha256': checksum, 'bytes': destination.stat().st_size})
|
|
provenance = {
|
|
'gui-inputs4.json': '.local/contextual-source-layout-20260911/inputs4.json',
|
|
'gui-stage-manifest.json': '.local/contextual-source-layout-20260911/gui-verified/manifest.json',
|
|
'gui-build-status.json': '.local/contextual-source-layout-20260911/gui1-status.json',
|
|
'gui-build.log': '.local/contextual-source-layout-20260911/gui1.log',
|
|
'gui-clippy-status.json': '.local/contextual-source-layout-20260911/clippy1-status.json',
|
|
'gui-fmt-status.json': '.local/contextual-source-layout-20260911/fmt1-status.json',
|
|
'gui-focused26-status.json': '.local/contextual-source-layout-20260911/focused4-status.json',
|
|
'gui-full679-result.json': 'harness/experiments/contextual-source-layout-full-20260911/full-result.json',
|
|
'server-original-gates.json': '.local/source7-post-routing-gates-status.json',
|
|
'server-original-binary-hashes.json': '.local/native-qa/source7-post-routing-binary-hashes.json',
|
|
'server-prior-input-comparisons.json': '.local/authoring-prerelease-20260911/inventory.json',
|
|
'server-source-snapshot.tar.gz': '.local/linux-qa/runtime/source7-20260907T082753190288Z.tar.gz',
|
|
'prior-dependency-notices.json': '.local/authoring-prerelease-20260911/packages/ArcadiaStudio-0.2.0-preview.authoring.20260911-x86_64-pc-windows-gnullvm/dependency-notices.json',
|
|
'update-audit.md': 'harness/release-contextual-source-windows-update-plan-20260911.md'}
|
|
evidence_dir = BASE / 'evidence'
|
|
evidence_dir.mkdir()
|
|
evidence_records = []
|
|
for name, path in provenance.items():
|
|
source = ROOT / path
|
|
destination = evidence_dir / name
|
|
before = sha(source)
|
|
shutil.copyfile(source, destination)
|
|
assert sha(source) == sha(destination) == before
|
|
evidence_records.append({'source': path, 'destination': 'evidence/' + name,
|
|
'sha256': before, 'bytes': destination.stat().st_size})
|
|
write_json('evidence-manifest.json', evidence_records)
|
|
evidence = {
|
|
'source_identity': f'Exact-byte reconstruction {reconstruction}, derived from verified checkpoint {COMMIT} by eleven documented newline restorations and precise preservation attributes. All 238 GUI inputs and 120 core/server files plus shared build resources match; committed Git bytes and fresh checkout match. This is an input-preservation commit, not the original build commit. Server core/dependency sources remain unchanged; current Cargo manifests add only the separate local oa-cli member/lock entry.',
|
|
'profile': 'Prebuilt Windows development-profile artifacts. GUI5657: September 11 final matching desktop build after focused26, strict Clippy and fmt; exact matching test artifact subsequently passed full679. EFEE server: unchanged September 7 workspace-bins build and its historical server gates. Neither a new server build nor release-profile/reproducible-build acceptance is claimed.',
|
|
'compiler': 'Recorded rustc 1.98.1, commit 48a229ceaefd4985c50990b14116b6d856af0985, x86_64-pc-windows-gnullvm, LLVM 22.1.8. Audit matched all 58 recorded target-library hashes; package inventory separately records current read-only compiler/sysroot facts. Original per-binary build records remain in evidence/.',
|
|
'target': 'x86_64-pc-windows-gnullvm',
|
|
'provenance_reference_base': 'Paths in per_binary_provenance refer to the separately retained preparation evidence directory, not files inside the distributable ZIP.',
|
|
'binary_sha256': {pathlib.Path(p).name: h for p, h in binaries.items() if p.endswith('.exe')},
|
|
'per_binary_provenance': {
|
|
'arcadia-studio.exe': {'original_build_status': 'evidence/gui-build-status.json', 'original_stage': 'evidence/gui-stage-manifest.json', 'exact_inputs': 'evidence/gui-inputs4.json', 'later_full_test': 'evidence/gui-full679-result.json'},
|
|
'arcadia-server.exe': {'original_build_status': 'evidence/server-original-gates.json', 'original_hash': 'evidence/server-original-binary-hashes.json', 'source_comparison': 'evidence/server-prior-input-comparisons.json', 'scope': 'Unchanged preserved artifact; historical original build and acceptance, no new build/test run.'}}}
|
|
write_json('build-evidence.json', evidence)
|
|
after = {'head': git(ROOT, 'rev-parse', 'HEAD').decode().strip(), 'index_sha256': sha(index),
|
|
'tracked_status': git(ROOT, 'status', '--porcelain', '-uno').decode()}
|
|
assert after == root_identity, (root_identity, after)
|
|
write_json('preparation.json', {'base_commit': COMMIT, 'reconstruction_commit': reconstruction,
|
|
'branch': BRANCH, 'version': VERSION, 'restorations': differences, 'gui_inputs': expected,
|
|
'server_inputs': server, 'shared_non_cargo_inputs': shared, 'artifacts': artifact_records,
|
|
'root_before': root_identity, 'root_after': after, 'prepared': stamp(),
|
|
'scope': 'Exact isolated source/bin preparation and commit/checkout verification only; no Cargo, compilation, package or runtime execution.'})
|
|
print(f'PASS: reconstruction {reconstruction}; 238 GUI / 120 server / 5 shared inputs and checkout bytes; main HEAD/index unchanged.', flush=True)
|
|
|
|
status = {'started': stamp()}
|
|
try:
|
|
main()
|
|
status['success'] = True
|
|
except BaseException as error:
|
|
status['success'] = False
|
|
status['error'] = repr(error)
|
|
traceback.print_exc()
|
|
raise
|
|
finally:
|
|
status['finished'] = stamp()
|
|
write_json('prepare-result.json', status)
|