sorokin.oleg.edu
9fd76aef3a
Preserve raw include diagnostic provenance and derive bands from the existing shaped editor. Retain deferred tooltip paragraphs through rendering. Include source, regression, failure and native-trial evidence; corrected native acceptance remains pending.
388 lines
22 KiB
Python
388 lines
22 KiB
Python
"""Read-only, standard-library verification of this portable evidence archive."""
|
|
import hashlib
|
|
import json
|
|
from pathlib import Path, PurePosixPath
|
|
import re
|
|
import sys
|
|
import zipfile
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parent
|
|
|
|
|
|
def require(condition, message):
|
|
if not condition:
|
|
raise ValueError(message)
|
|
|
|
|
|
def relative(name):
|
|
p = PurePosixPath(name)
|
|
require(name and not p.is_absolute() and ".." not in p.parts
|
|
and "\\" not in name and ":" not in name
|
|
and str(p) == name, f"Unsafe relative path: {name!r}")
|
|
return p
|
|
|
|
|
|
def file(name):
|
|
p = ROOT.joinpath(*relative(name).parts)
|
|
require(p.resolve().is_relative_to(ROOT), f"Escaping file: {name}")
|
|
return p
|
|
|
|
|
|
def identity(data):
|
|
return {"bytes": len(data), "sha256": hashlib.sha256(data).hexdigest()}
|
|
|
|
|
|
def read_json(name):
|
|
return json.loads(file(name).read_text(encoding="utf-8"))
|
|
|
|
|
|
def check_file(name, expected):
|
|
require(identity(file(name).read_bytes()) == expected, f"Hash mismatch: {name}")
|
|
|
|
|
|
def unique(names):
|
|
folded = [str(relative(n)).casefold() for n in names]
|
|
require(len(folded) == len(set(folded)), "Duplicate/case-colliding paths")
|
|
|
|
|
|
def verify_oracles(index):
|
|
"""Check saved CLI reports and historical launch bindings, never binaries."""
|
|
base = "native-preparation/"
|
|
build = read_json("gates/windows-build-final-1/result.json")
|
|
current = read_json(base + "current-oracle-1/result.json")
|
|
candidate = read_json(base + "candidate-oracle-1/result.json")
|
|
preserved = read_json(base + "windows-build-final-1-binaries/preserved.json")
|
|
launch = read_json(base + "launch-manifest-final-1.json")
|
|
# Resolve historical absolute evidence paths without accessing those paths.
|
|
mapping = {}
|
|
normalize = lambda path: path.replace("\\", "/").casefold()
|
|
for group in index["payloadGroups"]:
|
|
for name in group["files"]:
|
|
mapping[normalize(group["sourceRoot"] + "/" + name)] = group["destinationPrefix"] + "/" + name
|
|
for gate in index["completedGates"]:
|
|
receipt = read_json("gates/" + gate["label"] + "/result.json")
|
|
original = receipt["cwd"] + "/.local/text-diagnostic-gates/" + gate["label"]
|
|
for name in ["inputs.json", "inputs.zip"]:
|
|
mapping[normalize(original + "/" + name)] = gate["captureRef"] + "/" + name
|
|
|
|
def bound(item):
|
|
target = mapping.get(normalize(item["path"]))
|
|
require(target is not None, "Unresolved archived evidence: " + item["path"])
|
|
actual = identity(file(target).read_bytes())
|
|
require(all(actual[k] == item[k] for k in ["bytes", "sha256"] if k in item),
|
|
"Historical evidence binding differs: " + target)
|
|
|
|
for item in [preserved["buildResult"], current["buildResult"], current["sourceResult"],
|
|
candidate["priorOracle"], *launch["evidence"]]:
|
|
bound(item)
|
|
check_file(base + "build-and-preserve.py", preserved["helper"])
|
|
require(all(x["sourceInputs"] == build["inputs"] for x in [preserved, current, candidate, launch]),
|
|
"Oracle/build/launch source identities differ")
|
|
raw_artifacts = []
|
|
for line in file("gates/windows-build-final-1/stdout.log").read_text(encoding="utf-8").splitlines():
|
|
try:
|
|
value = json.loads(line)
|
|
except json.JSONDecodeError:
|
|
continue
|
|
if value.get("reason") == "compiler-artifact":
|
|
raw_artifacts.append(value)
|
|
for binary in preserved["binaries"]:
|
|
matches = [a for a in build["artifacts"] if a["cargo"]["target"]["name"] == binary["name"]
|
|
and a["cargo"]["profile"]["test"] is False]
|
|
require(len(matches) == 1 and matches[0]["cargo"] in raw_artifacts, "Build artifact missing")
|
|
require(matches[0]["readback"] == {k: binary[k] for k in ["bytes", "sha256"]},
|
|
"Preserved artifact receipt differs")
|
|
require(normalize(binary["source"]) == normalize(matches[0]["cargo"]["executable"]),
|
|
"Preserved source path differs")
|
|
require(current["artifact"] in build["artifacts"]
|
|
and current["binary"] == current["artifact"]["readback"], "CLI artifact binding differs")
|
|
gui = next(b for b in preserved["binaries"] if b["name"] == "arcadia-studio")
|
|
require(all(launch["binary"][k] == gui[k] for k in ["path", "bytes", "sha256"]),
|
|
"Launch GUI receipt differs")
|
|
# Executable/DLL bytes are deliberately external. Check only recorded identities.
|
|
for path, pin in candidate["bindings"].items():
|
|
if normalize(path) == normalize(current["binaryPath"]):
|
|
require(pin == current["binary"], "Candidate CLI identity differs")
|
|
elif normalize(path).endswith("/runtime/libunwind.dll"):
|
|
require(pin == {"bytes": 190976, "sha256": "f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4"},
|
|
"Candidate DLL identity differs")
|
|
else:
|
|
bound({"path": path, **pin})
|
|
summaries = []
|
|
for label, receipt, helper in [("current-oracle-1", current, "current-oracle.py"),
|
|
("candidate-oracle-1", candidate, "candidate-oracle.py")]:
|
|
require(receipt["passed"] is True, "Oracle failed")
|
|
check_file(base + helper, receipt["helper"])
|
|
for run in receipt["runs"]:
|
|
prefix = base + label + "/"
|
|
for field, suffix in [("stdout", ".stdout.json"), ("stderr", ".stderr.log")]:
|
|
check_file(prefix + run["label"] + suffix, run[field])
|
|
report = read_json(prefix + run["label"] + ".stdout.json")
|
|
require(report == run["report"], "Raw/parsed oracle report differs")
|
|
require(run["exitCode"] == run["expectedExitCode"] == report["exit_code"]
|
|
and report["operation"] == "check" and report["written"] is False
|
|
and report["changes"] == [], "Oracle outcome differs")
|
|
inputs = run.get("inputFiles", receipt.get("preparedFixtures", {}).get(run["label"]))
|
|
for name, pin in inputs.items():
|
|
check_file(prefix + run["label"] + "/" + name, pin)
|
|
for diagnostic in report["diagnostics"]:
|
|
location = diagnostic["location"]
|
|
raw = file(prefix + run["label"] + "/" + location["path"]).read_bytes()
|
|
start, end = location["start"], location["end"]
|
|
require(0 <= start <= end <= len(raw), "Diagnostic range outside source")
|
|
before = raw[:start].decode("utf-8")
|
|
raw[start:end].decode("utf-8")
|
|
raw[end:].decode("utf-8")
|
|
require(location["line"] == before.count("\n") + 1
|
|
and location["column"] == len(before.rsplit("\n", 1)[-1]) + 1,
|
|
"Diagnostic line/column differs")
|
|
require(diagnostic["coordinate_space"] == "input" and diagnostic["related"] == [],
|
|
"Unexpected oracle coordinate space or related locations")
|
|
if "expectedSpan" in run:
|
|
require(len(report["diagnostics"]) == 1, "Candidate diagnostic count differs")
|
|
loc = report["diagnostics"][0]["location"]
|
|
require([loc["start"], loc["end"]] == run["expectedSpan"], "Candidate span differs")
|
|
original = file(base + "current-oracle-1/complete/functions.arcadia").read_bytes()
|
|
raw = file(prefix + run["label"] + "/functions.arcadia").read_bytes()
|
|
require(raw == original + bytes.fromhex(run["suffixHex"]), "Candidate literal edit differs")
|
|
summaries.append({"oracle": label, "variant": run["label"], "exitCode": run["exitCode"],
|
|
"diagnostics": len(report["diagnostics"])})
|
|
require([s["diagnostics"] for s in summaries] == [2, 5, 1, 1], "Oracle diagnostic counts differ")
|
|
return summaries
|
|
|
|
|
|
def verify_native_trials(index):
|
|
summaries = []
|
|
normalize = lambda path: path.replace("\\", "/").casefold()
|
|
mapping = {normalize(g["sourceRoot"] + "/" + name): g["destinationPrefix"] + "/" + name
|
|
for g in index["payloadGroups"] for name in g["files"]}
|
|
for trial in index.get("nativeTrials", []):
|
|
prefix = trial["prefix"]
|
|
launch = read_json(prefix + "/launch.json")
|
|
closed = read_json(prefix + "/closed.json")
|
|
review = read_json(trial["review"])
|
|
require(closed == review["closure"] and closed["pid"] == launch["pid"]
|
|
and closed["exitCode"] == 0 and closed["launchReceiptError"] is None,
|
|
"Native closure binding differs")
|
|
require(all(closed[k] is True for k in ["binaryUnchanged", "preservedBinaryUnchanged",
|
|
"sameFileAfterExit", "dllUnchanged"])
|
|
and launch["sameFileBeforeLaunch"] is True, "Native readback receipt differs")
|
|
for key in ["stdout", "stderr"]:
|
|
check_file(prefix + "/" + key + ".log", closed[key])
|
|
require(closed[key]["bytes"] == 0, "Initial native log is not empty")
|
|
raw_manifest = file(prefix + "/launch-manifest.json").read_bytes()
|
|
require(identity(raw_manifest)["sha256"] == launch["manifestSha256"]
|
|
and raw_manifest == file("native-preparation/launch-manifest-final-1.json").read_bytes(),
|
|
"Native launch manifest differs")
|
|
manifest = json.loads(raw_manifest)
|
|
require(launch["binary"] == {k: manifest["binary"][k] for k in ["bytes", "sha256"]}
|
|
== review["binary"], "Native binary receipt differs")
|
|
check_file("native-preparation/launch.py", launch["helper"])
|
|
for original, pin in review["bindings"].items():
|
|
target = mapping.get(normalize(original))
|
|
require(target is not None, "Unresolved native review evidence")
|
|
check_file(target, pin)
|
|
screenshots = file(prefix + "/screenshots")
|
|
images = {x.name for x in screenshots.iterdir() if x.suffix == ".jpg"}
|
|
metadata = sorted(x for x in screenshots.iterdir() if x.suffix == ".json")
|
|
require(len(images) == trial["screenshots"] == review["screenshotCount"] == 19
|
|
and len(metadata) == trial["metadata"] == review["metadataCount"] == 15,
|
|
"Native capture counts differ")
|
|
linked_images = []
|
|
for path in metadata:
|
|
data = json.loads(path.read_text(encoding="utf-8"))
|
|
for capture in data["screenshots"]:
|
|
name = capture["file"]
|
|
require(len(relative(name).parts) == 1 and name in images, "Missing screenshot reference")
|
|
linked_images.append(name)
|
|
require(len(linked_images) == len(images) and set(linked_images) == images,
|
|
"Native screenshot/metadata membership differs")
|
|
fixture = {x.relative_to(file(prefix + "/work-fixture")).as_posix(): identity(x.read_bytes())
|
|
for x in file(prefix + "/work-fixture").rglob("*") if x.is_file()}
|
|
current = read_json("native-preparation/current-oracle-1/result.json")
|
|
require(fixture == review["workFixture"] == current["preparedFixtures"]["complete"],
|
|
"Native saved fixture differs")
|
|
require(review["originalFixtures"] == current["fixtures"], "Original fixture review differs")
|
|
summaries.append({"prefix": prefix, "exitCode": 0, "screenshots": len(images),
|
|
"metadata": len(metadata), "acceptance": False})
|
|
return summaries
|
|
|
|
|
|
def verify_resource_recovery(index):
|
|
record = index.get("resourceRecovery")
|
|
if not record:
|
|
return None
|
|
reclaim = read_json(record["reclaimedZIPReceipt"])
|
|
require(len(reclaim["files"]) == 11, "Reclaimed ZIP receipt count differs")
|
|
seen = set()
|
|
for item in reclaim["files"]:
|
|
original = item["path"].replace("\\", "/")
|
|
require(original not in seen and original.endswith("/inputs.zip"), "Duplicate reclaimed path")
|
|
seen.add(original)
|
|
label = original.split("/")[-2]
|
|
gate = next(g for g in index["completedGates"] if g["label"] == label)
|
|
relative_zip = gate["captureRef"] + "/inputs.zip"
|
|
require(item["retained"].replace("\\", "/").endswith(
|
|
"/harness/experiments/text-diagnostics-20260913/" + relative_zip),
|
|
"Reclaimed ZIP retained path differs")
|
|
pin = {k: item[k] for k in ["bytes", "sha256"]}
|
|
check_file(relative_zip, pin)
|
|
require(pin == read_json("gates/" + label + "/result.json")["archive"],
|
|
"Reclaimed ZIP gate binding differs")
|
|
require(sum(x["bytes"] for x in reclaim["files"]) == reclaim["reclaimed"],
|
|
"Reclaimed byte total differs")
|
|
before = read_json(record["compressionBefore"])
|
|
result = read_json(record["compressionResult"])
|
|
require(len(before) == result["files"] == 1040
|
|
and len({x["path"].casefold() for x in before}) == len(before)
|
|
and sum(x["bytes"] for x in before) == result["bytes"], "Compression inventory differs")
|
|
require(result["exitCodes"] == [0, 0] and result["allFileBytesUnchanged"] is True,
|
|
"Compression receipt did not report successful unchanged bytes")
|
|
require(all(any(x["path"].casefold().startswith(root.casefold() + "\\")
|
|
for root in result["paths"]) for x in before), "Compression inventory outside recorded roots")
|
|
second_summary = None
|
|
if record.get("secondCompression"):
|
|
second = record["secondCompression"]
|
|
inventory = read_json(second["before"])
|
|
receipt = read_json(second["result"])
|
|
plan = read_json(second["plan"])
|
|
require(identity(file(second["plan"]).read_bytes())["sha256"] == receipt["planSha256"],
|
|
"Second compression plan hash differs")
|
|
require(len(inventory) == receipt["files"] == 1048
|
|
and sum(x["bytes"] for x in inventory) == receipt["bytes"],
|
|
"Second compression count/size differs")
|
|
by_path = {x["path"].casefold(): x for x in inventory}
|
|
require(len(by_path) == len(inventory), "Duplicate second compression file")
|
|
binaries = {x["path"].casefold(): x for x in plan["binaries"]}
|
|
for path, binary in binaries.items():
|
|
require(path in by_path and all(by_path[path][k] == binary[k] for k in ["bytes", "sha256"]),
|
|
"Second compression binary inventory differs")
|
|
require(all(path in binaries or any(path.startswith(x["path"].casefold() + "\\")
|
|
for x in plan["caches"]) for path in by_path), "Second compression file outside plan")
|
|
require(len(plan["binaries"]) + len(plan["caches"]) == 9
|
|
and receipt["exitCodes"] == [0] * 9 and receipt["allFileBytesUnchanged"] is True,
|
|
"Second compression receipt did not report successful unchanged bytes")
|
|
second_summary = {"filesRecorded": 1048, "operationsRecorded": 9,
|
|
"freeBytesAtReceipt": receipt["freeBytes"], "externalFilesRehashed": False}
|
|
return {"reclaimedPrivateZIPs": 11, "retainedZIPBytesVerified": reclaim["reclaimed"],
|
|
"compressionFilesRecorded": 1040, "externalCacheRehashed": False,
|
|
"recoveryHelpersExecutedByVerifier": False, "secondCompression": second_summary}
|
|
|
|
|
|
def verify():
|
|
manifest = read_json("files.json")
|
|
unique(manifest)
|
|
actual = {p.relative_to(ROOT).as_posix() for p in ROOT.rglob("*") if p.is_file()}
|
|
require(actual == set(manifest) | {"files.json"}, "Archive file membership differs")
|
|
for name, pin in manifest.items():
|
|
check_file(name, pin)
|
|
index = read_json("index.json")
|
|
payload = {}
|
|
for group in index["payloadGroups"]:
|
|
require(len(group["files"]) == group["fileCount"], "Group count differs")
|
|
require(sum(x["bytes"] for x in group["files"].values()) == group["bytes"],
|
|
"Group size differs")
|
|
for name, pin in group["files"].items():
|
|
target = group["destinationPrefix"] + "/" + name
|
|
require(target not in payload, "Duplicate payload")
|
|
require(manifest.get(target) == pin, f"Payload binding differs: {target}")
|
|
payload[target] = pin
|
|
require(len(payload) == index["totals"]["requiredPayloadFiles"], "Payload count differs")
|
|
require(sum(p["bytes"] for p in payload.values()) == index["totals"]["requiredPayloadBytes"],
|
|
"Payload total size differs")
|
|
copies = read_json("copy-record.json")["files"]
|
|
require(len(copies) == len(payload), "Copy receipt count differs")
|
|
require({x["path"]: x["before"] for x in copies} == payload, "Copy source pins differ")
|
|
require(all(x["before"] == x["after"] for x in copies), "Copy readbacks differ")
|
|
|
|
members = 0
|
|
for sha, capture in index["captures"].items():
|
|
prefix = "captures/" + sha
|
|
check_file(prefix + "/inputs.json", capture["inputsIdentity"])
|
|
require(manifest[prefix + "/inputs.zip"]["sha256"] == sha, "Capture key differs")
|
|
inputs = read_json(prefix + "/inputs.json")
|
|
unique(inputs)
|
|
require(len(inputs) == capture["inputCount"], "Captured input count differs")
|
|
with zipfile.ZipFile(file(prefix + "/inputs.zip")) as archive:
|
|
unique(archive.namelist())
|
|
require(set(archive.namelist()) == set(inputs), "ZIP membership differs")
|
|
for name, pin in inputs.items():
|
|
# Reading each complete member also validates its ZIP CRC.
|
|
require(identity(archive.read(name)) == pin, f"ZIP content differs: {name}")
|
|
members += len(inputs)
|
|
|
|
for gate in index["completedGates"]:
|
|
prefix = "gates/" + gate["label"]
|
|
result = read_json(prefix + "/result.json")
|
|
started = read_json(prefix + "/started.json")
|
|
require(all(result.get(k) == v for k, v in started.items()), "Started/result binding differs")
|
|
capture = gate["captureRef"]
|
|
require(capture == "captures/" + result["archive"]["sha256"], "Capture reference differs")
|
|
require(gate["label"] in index["captures"][result["archive"]["sha256"]]["originalRuns"],
|
|
"Capture run mapping differs")
|
|
for field, name in [("inputs", capture + "/inputs.json"),
|
|
("archive", capture + "/inputs.zip"),
|
|
("stdout", prefix + "/stdout.log"), ("stderr", prefix + "/stderr.log")]:
|
|
check_file(name, result[field])
|
|
for key in ["command", "inputCount", "exitCode", "inputsUnchanged"]:
|
|
require(gate[key] == result[key], f"Gate summary differs: {key}")
|
|
if result.get("helper"):
|
|
require(gate.get("helperRef") is not None, "Execution-pinned helper is unresolved")
|
|
check_file(gate["helperRef"], result["helper"])
|
|
require(result["environment"]["CARGO_INCREMENTAL"] == "0", "Runner environment differs")
|
|
output = file(prefix + "/stdout.log").read_text(encoding="utf-8")
|
|
groups = re.findall(r"test result: \w+\. (\d+) passed; (\d+) failed; (\d+) ignored; (\d+) measured; (\d+) filtered out", output)
|
|
totals = dict(zip(["passed", "failed", "ignored", "measured", "filtered"],
|
|
[sum(int(m[i]) for m in groups) for i in range(5)]))
|
|
require(totals == gate["totals"] and len(groups) == gate["groups"], "Test summary differs")
|
|
|
|
prefix = "probe/records/attempt-1"
|
|
result = read_json(prefix + "/result.json")
|
|
for field, name in [("inputs", "inputs.json"), ("stdout", "stdout.log"), ("stderr", "stderr.log")]:
|
|
check_file(prefix + "/" + name, result[field])
|
|
inputs = read_json(prefix + "/inputs.json")
|
|
require(len(inputs) == index["probe"]["frozenInputs"] == 77, "Probe count differs")
|
|
for name, pin in inputs.items():
|
|
check_file("probe/" + name, pin)
|
|
require(result["exitCode"] == 0 and result["inputsUnchanged"], "Probe receipt differs")
|
|
lines = file(prefix + "/stdout.log").read_text(encoding="utf-8").splitlines()
|
|
require([line for line in lines if line.startswith("PASS ")] == result["passLine"],
|
|
"Probe PASS binding differs")
|
|
oracles = verify_oracles(index) if index.get("oracleRecords") else []
|
|
trials = verify_native_trials(index)
|
|
recovery = verify_resource_recovery(index)
|
|
normalization = index.get("sourceNormalization")
|
|
if normalization:
|
|
receipt = read_json(normalization["receipt"])
|
|
before_manifest = read_json(normalization["beforeCapture"] + "/inputs.json")
|
|
after_manifest = read_json(normalization["afterCapture"] + "/inputs.json")
|
|
member = normalization["member"]
|
|
require(set(before_manifest) == set(after_manifest)
|
|
and [name for name in before_manifest if before_manifest[name] != after_manifest[name]] == [member],
|
|
"Normalization changed another input")
|
|
with zipfile.ZipFile(file(normalization["beforeCapture"] + "/inputs.zip")) as archive:
|
|
before = archive.read(member)
|
|
with zipfile.ZipFile(file(normalization["afterCapture"] + "/inputs.zip")) as archive:
|
|
after = archive.read(member)
|
|
require(identity(before) == receipt["before"] and identity(after) == receipt["after"],
|
|
"Normalization receipt source pins differ")
|
|
lines = [number for number, line in enumerate(before.splitlines(keepends=True), 1) if line.endswith(b"\r\n")]
|
|
require(lines == receipt["lines"] == [423, 424, 425]
|
|
and before.replace(b"\r\n", b"\n") == after, "Normalization is not the exact three-pair change")
|
|
return {"status": "PASS", "scope": "Archive bytes, ZIP members/CRC/content, gate/probe/oracle/native receipt bindings, saved spans and capture membership; no execution or binary revalidation",
|
|
"manifestSha256": identity(file("files.json").read_bytes())["sha256"],
|
|
"pinnedFiles": len(manifest), "payloadFiles": len(payload),
|
|
"sourceCaptures": len(index["captures"]), "verifiedZIPMembers": members,
|
|
"completedGates": len(index["completedGates"]), "probeInputs": len(inputs),
|
|
"savedOracles": oracles, "closedNativeTrials": trials, "resourceRecovery": recovery,
|
|
"sourceNormalizationVerified": bool(normalization)}
|
|
|
|
|
|
if __name__ == "__main__":
|
|
try:
|
|
print(json.dumps(verify(), indent=2))
|
|
except (OSError, ValueError, KeyError, zipfile.BadZipFile) as error:
|
|
print(f"FAIL: {error}", file=sys.stderr)
|
|
sys.exit(1)
|