51 lines
3.7 KiB
Python
51 lines
3.7 KiB
Python
"""Read only archive bytes and recorded receipt relationships; never publish."""
|
|
from pathlib import Path
|
|
import hashlib
|
|
import json
|
|
|
|
BASE = Path(__file__).resolve().parent
|
|
def sha(p):
|
|
return hashlib.sha256(p.read_bytes()).hexdigest()
|
|
def read(p):
|
|
return json.loads((BASE/p).read_text(encoding='utf-8'))
|
|
def check(ok, label):
|
|
if not ok:
|
|
raise SystemExit('FAIL: '+label)
|
|
|
|
manifest = read('MANIFEST.json')
|
|
check({p.relative_to(BASE).as_posix() for p in BASE.rglob('*') if p.is_file()} - {'MANIFEST.json'} == {r['path'] for r in manifest['files']}, 'file set')
|
|
for r in manifest['files']:
|
|
p = BASE/r['path']
|
|
check(p.resolve().is_relative_to(BASE) and p.stat().st_size == r['bytes'] and sha(p) == r['sha256'], r['path'])
|
|
check(sha(BASE/'ORIGINALS.json') == '1c6eedd5a7c0937eda5961db48d1107fd4b005d47c026936d248b7aa1d86a300', 'original whitelist pin')
|
|
originals = read('ORIGINALS.json')['files']
|
|
check(len(originals) == 34, 'original count')
|
|
for r in originals:
|
|
check(sha(BASE/r['path']) == r['sha256'] and (BASE/r['path']).stat().st_size == r['bytes'], 'original '+r['path'])
|
|
p = 'payload/publication/'
|
|
target = '802855f7e6f2f00a107a12196b458b267f586b8d'
|
|
tag = 'v0.2.0-preview.navigation.20260911'
|
|
bindings = read(p+'bindings.json')
|
|
check(sha(BASE/p/'RELEASE-NOTES.md') == bindings['notesSha256'], 'notes binding')
|
|
check(sha(BASE/p/'VALIDATION.md') == bindings['validationSha256'], 'validation binding')
|
|
failed = read(p+'runs/tag-first-20260912/result.json')
|
|
check(failed['success'] is False and failed['error'] == 'Published source branch changed', 'failed first preflight')
|
|
for attempt in ['tag-inspected-source-20260912','create-first-20260912','upload-first-20260912','publish-first-20260912']:
|
|
r = read(p+'runs/'+attempt+'/result.json')
|
|
check(r['success'] is True and r['target'] == target and r['tag'] == tag, attempt)
|
|
upload = read(p+'runs/upload-first-20260912/result.json')
|
|
published = read(p+'runs/publish-first-20260912/result.json')
|
|
check(published['releaseId'] == read(p+'release-created.json')['releaseId'] == 4 and published['draft'] is False and published['prerelease'] is True, 'published prerelease ownership')
|
|
check(upload['assets'] == published['assets'] and len(published['assets']) == 3, 'asset consistency')
|
|
expected = [(10,32971712,'d7228c542f162663933ea002739a78c722bcca41e437df63b7c868ea2af201f1'),(11,144,'435b6fff3fbc1640b4db31c5d848dbcde101aa54cc86fe0eef9c8da6a501ccac'),(12,6987,'9abcb45e665e2bf553a6ef91f1e73fd403d7c9552b01962d0d9713cf52660ff2')]
|
|
check([(a['id'],a['bytes'],a['sha256']) for a in published['assets']] == expected, 'asset pins')
|
|
check(published['finished'] == '2026-09-12T10:54:02.303380+00:00', 'terminal publication time')
|
|
raw = (BASE/p/'before-source-advance/publish.py').read_bytes()
|
|
guard = b"if not __debug__:\n raise RuntimeError('Publication requires Python assertions; optimized execution is refused.')\n\n"
|
|
check(raw.count(guard) == 1, 'exact reconstruction guard')
|
|
reconstructed = BASE/'reconstructed/original-reviewed-publish.py'
|
|
check(reconstructed.read_bytes() == raw.replace(guard,b'',1) and sha(reconstructed) == 'e679a84845303db6582753b525bb3c2d184e6139e5651560fce8c876eae42c99', 'byte-proved reconstruction')
|
|
check('SOURCE_BRANCH_HEAD = ' in (BASE/p/'publish.py').read_text(encoding='utf-8') and '0c9ee1505774a0f64c5f3a58b0da64a4673d5000' in (BASE/p/'publish.py').read_text(encoding='utf-8'), 'separate source branch pin')
|
|
check(read(p+'acceptance-records-push-result.json')['target'] == 'f5e1c734dadd6e0203288065dac7b2e3f140cacf' and read(p+'acceptance-records-push-result.json')['success'], 'acceptance record push')
|
|
print('PASS publication archive: 34 originals; exact reconstructed initial adapter; failed preflight retained; tag/release 4/three asset receipt relationships. No network or runtime work rerun.')
|