116 lines
6.6 KiB
Python
116 lines
6.6 KiB
Python
"""Package explicitly named closed Process native runs; never execute archived helpers."""
|
|
from pathlib import Path
|
|
import argparse
|
|
import io
|
|
import json
|
|
import re
|
|
import zipfile
|
|
from verify import pin, parsed, need, norm, relative, safe, zip_inventory, verify_data, verify_package
|
|
|
|
HERE = Path(__file__).resolve().parent
|
|
FAILED_RUN_ONE = "Observed Back restored qualified highlight with outer-reference editable Properties; reorder and Undo/Redo/reopen history were not performed. Failed native workflow, despite three positive unchanged Project reports."
|
|
|
|
|
|
def collect(root, runs, extra_helpers=()):
|
|
native = root / ".local/process-multiselect-native"
|
|
candidates = [p for p in native.iterdir() if p.is_file()]
|
|
candidates += sorted((root / ".local/process-group-gates").glob("*.py"))
|
|
candidates += list(extra_helpers)
|
|
helpers = [(p.suffix, p.read_bytes()) for p in candidates]
|
|
payload, specs = {}, {}
|
|
def add(name, data):
|
|
need(safe(name) and (name not in payload or payload[name] == data), "member collision: " + name)
|
|
payload[name] = data
|
|
return name
|
|
def helper(expected):
|
|
matches = [(suffix, data) for suffix, data in helpers if pin(data) == expected]
|
|
need(matches, "exact historical helper unavailable: " + str(expected))
|
|
suffix, data = matches[0]
|
|
return add("helpers/" + expected["sha256"] + suffix, data)
|
|
def tree(folder, prefix):
|
|
need(folder.is_dir(), "missing directory: " + str(folder))
|
|
for path in sorted(folder.rglob("*")):
|
|
need(not path.is_symlink() and not getattr(path, "is_junction", lambda: False)(), "linked evidence input")
|
|
if path.is_file():
|
|
add(prefix + path.relative_to(folder).as_posix(), path.read_bytes())
|
|
for run in runs:
|
|
folder = native / run
|
|
need((folder / "finished.json").is_file(), "open/unlaunched run refused: " + run)
|
|
prepared = parsed((folder / "prepared.json").read_bytes())
|
|
tree(folder, "runs/" + run + "/raw/")
|
|
spec = {"originalRun": norm(prepared["cwd"]) + "/.local/process-multiselect-native/" + run,
|
|
"reviewStatus": "failed" if run == "run-1" else "unreviewed",
|
|
"reviewNote": FAILED_RUN_ONE if run == "run-1" else "Packaging consistency does not decide native acceptance. Consult the independent parent review.",
|
|
"helpers": {name: helper(expected) for name, expected in prepared["helpers"].items()},
|
|
"executedCapture": pin((folder / "capture-executed.js").read_bytes()), "builds": {}}
|
|
for kind in ("gui", "checker"):
|
|
recorded = prepared[kind]
|
|
rel = relative(recorded["receipt"], prepared["cwd"])
|
|
need(rel.startswith(".local/process-group-gates/") and rel.endswith("/result.json"), "unexpected receipt location")
|
|
receipt = root / rel
|
|
result_data = receipt.read_bytes()
|
|
need(pin(result_data) == recorded["receiptPin"], "historical build receipt changed")
|
|
result = parsed(result_data)
|
|
prefix = "builds/" + pin(result_data)["sha256"] + "/"
|
|
build = {"originalRelative": rel, "helper": helper(result["helper"])}
|
|
for name in ("started.json", "process.json", "result.json", "stdout.log", "stderr.log", "inputs.json", "inputs.zip"):
|
|
data = (receipt.parent / name).read_bytes()
|
|
# Deduplicate source capsules independently of differing build receipts.
|
|
member = ("inputs/" + pin(data)["sha256"] + Path(name).suffix) if name.startswith("inputs.") else prefix + name
|
|
build[name] = add(member, data)
|
|
spec["builds"][kind] = build
|
|
if kind == "checker":
|
|
capsule = payload[build["inputs.zip"]]
|
|
need(pin(capsule) == result["archive"], "historical checker capsule pin")
|
|
inputs = parsed(payload[build["inputs.json"]])
|
|
with zipfile.ZipFile(io.BytesIO(capsule)) as archive:
|
|
zip_inventory(archive, inputs)
|
|
source = archive.read("crates/oa-core/examples/process_multiselect_native.rs")
|
|
spec["checkerSource"] = add("checker-source/" + pin(source)["sha256"] + ".rs", source)
|
|
specs[run] = spec
|
|
manifest = {"schema": 1, "kind": "process-multiselect-native", "runs": specs,
|
|
"members": {name: pin(data) for name, data in sorted(payload.items())}}
|
|
return payload, manifest, verify_data(manifest, payload.__getitem__)
|
|
|
|
|
|
def write_json(path, value):
|
|
with path.open("xb") as stream:
|
|
stream.write((json.dumps(value, indent=2) + "\n").encode())
|
|
|
|
|
|
def main():
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument("--root", type=Path, required=True)
|
|
parser.add_argument("--runs", nargs="+", required=True)
|
|
parser.add_argument("--output", type=Path)
|
|
parser.add_argument("--check-only", action="store_true")
|
|
parser.add_argument("--helper", type=Path, action="append", default=[], help="Exact historical helper bytes if current helper changed")
|
|
args = parser.parse_args()
|
|
need(len(args.runs) == len(set(args.runs)) and all(re.fullmatch(r"run-[0-9]+", name) for name in args.runs), "explicit unique run-N names required")
|
|
need(args.check_only or args.output is not None, "--output or --check-only required")
|
|
if args.output is not None:
|
|
need(not args.output.exists(), "fresh nonexistent output directory required")
|
|
payload, manifest, summary = collect(args.root.resolve(), args.runs, args.helper)
|
|
if args.check_only:
|
|
print("PASS raw consistency; no archive written:", summary)
|
|
return
|
|
out = args.output.resolve()
|
|
out.mkdir(parents=True, exist_ok=False)
|
|
for name in ("prepare.py", "verify.py", "README.md"):
|
|
with (out / name).open("xb") as stream:
|
|
stream.write((HERE / name).read_bytes())
|
|
with zipfile.ZipFile(out / "evidence.zip", "x", compression=zipfile.ZIP_DEFLATED, compresslevel=9) as archive:
|
|
for name, data in sorted(payload.items()):
|
|
info = zipfile.ZipInfo(name, date_time=(2026, 9, 23, 0, 0, 0))
|
|
info.compress_type = zipfile.ZIP_DEFLATED
|
|
info.external_attr = 0o100644 << 16
|
|
archive.writestr(info, data)
|
|
write_json(out / "manifest.json", manifest)
|
|
write_json(out / "files.json", {name: pin((out / name).read_bytes()) for name in ("prepare.py", "verify.py", "README.md", "manifest.json", "evidence.zip")})
|
|
need(verify_package(out) == summary, "written package differs from raw evidence")
|
|
print("PASS package readback:", out, summary)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|