485 lines
29 KiB
Python
485 lines
29 KiB
Python
"""Read-only portable receipt/Git verifier. Never executes archived launchers."""
|
|
from pathlib import Path, PurePosixPath, PureWindowsPath
|
|
from datetime import datetime
|
|
import argparse
|
|
import hashlib
|
|
import io
|
|
import json
|
|
import re
|
|
import subprocess
|
|
import sys
|
|
import zipfile
|
|
|
|
SOURCE = 'a578ac98a06772a60bec00ae287e65650680d119'
|
|
INTERMEDIATE = 'eeb1069cfcfc51e4cf73cff850adc2fabc8aae77'
|
|
FAILED_SOURCE = '754a9b4b7caca2e848742f5194d98dc9aee7f674'
|
|
PRIOR_SOURCE = '10d7f3340d5cd61a656dc0bcf7c143f8897c5551'
|
|
BASELINE_SOURCE = 'f1d79df4979121335ed7b4ce4da84b2fca8a9ef4'
|
|
SCOPE = ['Cargo.toml', 'Cargo.lock', 'rust-toolchain.toml', '.cargo', 'build',
|
|
'crates', 'assets', 'docs', 'examples', 'harness/fixtures', 'vendor']
|
|
PREFIX = ['cargo', 'test', '--locked', '--offline', '-p', 'oa-core', '--lib']
|
|
TYPED = 'language::analysis_source::'
|
|
MIXED = TYPED + 'mixed::'
|
|
HEADER_ERROR = 'Unsupported schema version: expected arcadia 3, 4, 5, 6 or 7.'
|
|
|
|
|
|
def require(condition, message):
|
|
if not condition:
|
|
raise ValueError(message)
|
|
|
|
|
|
def sha(data):
|
|
return hashlib.sha256(data).hexdigest()
|
|
|
|
|
|
def unique_object(pairs):
|
|
result = {}
|
|
for key, value in pairs:
|
|
require(key not in result, 'Duplicate JSON key: ' + key)
|
|
result[key] = value
|
|
return result
|
|
|
|
|
|
def document(raw):
|
|
return json.loads(raw, object_pairs_hook=unique_object)
|
|
|
|
|
|
def safe_name(name):
|
|
require(isinstance(name, str) and name and '\\' not in name and ':' not in name,
|
|
'Unsafe archive name')
|
|
p = PurePosixPath(name)
|
|
require(not p.is_absolute() and str(p) == name and '..' not in p.parts,
|
|
'Unsafe archive path: ' + name)
|
|
return name
|
|
|
|
|
|
def git(repo, *arguments, data=None):
|
|
return subprocess.check_output(['git', '-C', str(repo), *arguments], input=data)
|
|
|
|
|
|
def git_inputs(repo, source, current, count):
|
|
require(current['source'] == source, 'Input source mismatch')
|
|
records = current['inputs']
|
|
require(len(records) == count, 'Unexpected input count')
|
|
paths = git(repo, 'ls-tree', '-r', '--name-only', source, *SCOPE).decode().splitlines()
|
|
require(paths == [item['path'] for item in records], 'Git input membership/order mismatch')
|
|
raw = git(repo, 'cat-file', '--batch', data=''.join(f'{source}:{p}\n' for p in paths).encode())
|
|
offset = 0
|
|
for item in records:
|
|
end = raw.index(b'\n', offset)
|
|
_, kind, size = raw[offset:end].split()
|
|
size = int(size)
|
|
blob = raw[end + 1:end + 1 + size]
|
|
require(kind == b'blob' and size == item['bytes'] and sha(blob) == item['sha256'],
|
|
'Git input bytes mismatch: ' + item['path'])
|
|
offset = end + size + 2
|
|
require(offset == len(raw), 'Trailing Git batch bytes')
|
|
|
|
|
|
def listing(log):
|
|
names = re.findall(r'^([^\r\n]+): test\r?$', log, re.M)
|
|
require(len(names) == len(set(names)), 'Duplicate listed test')
|
|
summaries = re.findall(r'^(\d+) tests, (\d+) benchmarks\r?$', log, re.M)
|
|
require(summaries == [(str(len(names)), '0')], 'Listing footer mismatch')
|
|
return names
|
|
|
|
|
|
def outcomes(log, expected, passed, failed, filtered):
|
|
rows = re.findall(r'^test ([^\r\n]+) \.\.\. (ok|FAILED|ignored)\r?$', log, re.M)
|
|
require(len(rows) == len({name for name, _ in rows}), 'Duplicate runtime outcome')
|
|
actual = dict(rows)
|
|
require(set(actual) == set(expected), 'Missing/extra runtime outcomes')
|
|
require(sum(v == 'ok' for v in actual.values()) == passed and
|
|
sum(v == 'FAILED' for v in actual.values()) == failed and
|
|
'ignored' not in actual.values(), 'Runtime status mismatch')
|
|
summaries = re.findall(r'^test result: (ok|FAILED)\. (\d+) passed; (\d+) failed; '
|
|
r'(\d+) ignored; (\d+) measured; (\d+) filtered out;', log, re.M)
|
|
require(summaries == [('FAILED' if failed else 'ok', str(passed), str(failed),
|
|
'0', '0', str(filtered))], 'Runtime footer mismatch')
|
|
return actual
|
|
|
|
|
|
def failures(log, names):
|
|
blocks = re.findall(r'^---- ([^\r\n]+) stdout ----\r?\n(.*?)(?=^---- |^failures:\r?$|\Z)',
|
|
log, re.M | re.S)
|
|
require(len(blocks) == len(names) and {name for name, _ in blocks} == set(names),
|
|
'Failure-block membership mismatch')
|
|
for name, block in blocks:
|
|
require(block.count(HEADER_ERROR) == 1 and 'invalid_source' in block,
|
|
'Failure cause changed: ' + name)
|
|
tails = re.findall(r'^failures:\r?\n((?: [^\r\n]+\r?\n)+)', log, re.M)
|
|
require(len(tails) == 1 and tails[0].split() == sorted(names), 'Failure footer changed')
|
|
|
|
|
|
def formatting_evidence(payload, repo, final_log=None):
|
|
note = document(payload['notes/analysis-mixed-syntax-formatting-disposition-20260923.json'])
|
|
stem = 'gates/mixed-fmt-eeb1-1'
|
|
receipt = document(payload[stem + '.result.json'])
|
|
log = payload[stem + '.log']
|
|
require(note['source'] == INTERMEDIATE and note['prior_source'] == PRIOR_SOURCE and
|
|
note['baseline_source'] == BASELINE_SOURCE and note['exit'] == receipt['exit'] == 1 and
|
|
note['command'] == receipt['command'] == ['cargo', 'fmt', '--all', '--', '--check'] and
|
|
note['changed_inputs'] == [] and note['input_count'] == 541, 'Formatting note scope mismatch')
|
|
for field, suffix in (('receipt_sha256', '.result.json'), ('log_sha256', '.log'), ('inputs_sha256', '.inputs.json')):
|
|
require(note[field] == sha(payload[stem + suffix]), 'Formatting note raw hash mismatch')
|
|
blocks = re.findall(r'^Diff in ([^\r\n]+):(\d+):\r?$', log.decode(), re.M)
|
|
normalized = [('crates/' + path.replace('\\', '/').split('/crates/', 1)[1], int(line))
|
|
for path, line in blocks]
|
|
expected = ['crates/oa-core/src/' + name for name in
|
|
('model.rs', 'references.rs', 'semantic/catalog.rs', 'session.rs', 'transitions.rs', 'validation.rs')]
|
|
require(len(blocks) == note['diff_blocks'] == 9 and sorted({path for path, _ in normalized}) == expected,
|
|
'Formatting failure changed scope')
|
|
require([row['path'] for row in note['affected_files']] == expected, 'Formatting file inventory differs')
|
|
for row in note['affected_files']:
|
|
blobs = [git(repo, 'show', source + ':' + row['path']) for source in (SOURCE, INTERMEDIATE, PRIOR_SOURCE, BASELINE_SOURCE)]
|
|
require(len(set(blobs)) == 1 and row['equal_at_all_three_pins'] is True and
|
|
row['bytes'] == len(blobs[0]) and row['sha256'] == sha(blobs[0]),
|
|
'Formatting inheritance not supported: ' + row['path'])
|
|
require(row['git_blob'] == git(repo, 'rev-parse', SOURCE + ':' + row['path']).decode().strip() and
|
|
row['diff_lines'] == [line for path, line in normalized if path == row['path']],
|
|
'Formatting blob/line inventory differs')
|
|
if final_log is not None:
|
|
final_blocks = re.findall(r'^Diff in ([^\r\n]+):(\d+):\r?$', final_log, re.M)
|
|
final_normalized = [('crates/' + path.replace('\\', '/').split('/crates/', 1)[1], int(line))
|
|
for path, line in final_blocks]
|
|
require(final_normalized == normalized, 'Final formatting failure scope changed')
|
|
return 'Formatting FAILED at eeb1069; six affected blobs byte-identical at a578ac9, eeb1069, 10d7f33 and f1d79df'
|
|
|
|
|
|
DIRECT_RECORDER = '3043b4ca43f2fb581d9f77361830f0ea86425982d6dee40bc9d71a3444caa14a'
|
|
|
|
|
|
def direct_evidence(payload, receipt, log):
|
|
"""Only the reviewed final direct list/full protocol; no archived code runs."""
|
|
require(receipt['source'] == SOURCE and receipt['mode'] in ('list', 'full') and
|
|
receipt['filter'] == '' and receipt['cargo_invoked'] is False,
|
|
'Unsupported direct invocation scope')
|
|
require(receipt['launch_error'] is None and receipt['verification_failures'] == [] and
|
|
receipt['source_status_after'] == '', 'Direct invocation did not close cleanly')
|
|
require(receipt['launcher_sha256'] == DIRECT_RECORDER and
|
|
receipt['launcher_copy_sha256_after'] == DIRECT_RECORDER,
|
|
'Unreviewed or changed direct recorder')
|
|
require(receipt['environment']['ARCADIA_CODEC_LIFECYCLE_PHASE'] is None and
|
|
receipt['environment']['RUST_MIN_STACK'] is None,
|
|
'Direct parent/stack environment differs')
|
|
require(receipt['utc_clock_went_backwards'] is False,
|
|
'Direct gate cannot inherit original listing clock exception')
|
|
require(not re.search(r'^\s*Running unittests\b', log, re.M),
|
|
'Direct output contains a fabricated Cargo invocation line')
|
|
watched = {}
|
|
|
|
def bound(field, fixed_name=None, fixed_hash=None):
|
|
descriptor = receipt[field]
|
|
result_name = safe_name(descriptor['result'])
|
|
require(result_name.endswith('.result.json'), 'Invalid direct bound result name')
|
|
stem = result_name[:-len('.result.json')]
|
|
raw = payload['gates/' + result_name]
|
|
if fixed_name is not None:
|
|
require(result_name == fixed_name and sha(raw) == fixed_hash,
|
|
'Direct historical binding differs')
|
|
record = document(raw)
|
|
require(record['source'] == record['head_after'] == SOURCE and record['exit'] == 0 and
|
|
record['changed_inputs'] == [] and record['inputs'] == stem + '.inputs.json',
|
|
'Direct bound checkpoint is not successful unchanged source')
|
|
expected = {
|
|
'result': result_name, 'result_sha256': sha(raw),
|
|
'log': stem + '.log', 'log_sha256': record['log_sha256'],
|
|
'inputs': stem + '.inputs.json', 'inputs_sha256': record['inputs_sha256'],
|
|
'source': SOURCE, 'launcher_copy': record['launcher_copy'],
|
|
'launcher_sha256': record['launcher_sha256'], 'artifacts': record['artifacts'],
|
|
'listing_count': record['listing_count'], 'listing_members': record['listing_members'],
|
|
}
|
|
require(descriptor == expected, 'Direct descriptor differs from actual bound receipt')
|
|
for key in ('result', 'log', 'inputs'):
|
|
relative = safe_name(expected[key])
|
|
digest = expected[key + '_sha256']
|
|
require(sha(payload['gates/' + relative]) == digest, 'Direct bound payload hash mismatch')
|
|
watched[relative] = digest
|
|
launcher = safe_name(record['launcher_copy'].replace('\\', '/'))
|
|
require(launcher == 'launchers/' + record['launcher_sha256'] + '.py' and
|
|
sha(payload['gates/' + launcher]) == record['launcher_sha256'] == record['launcher_sha256_after'],
|
|
'Direct bound launcher differs')
|
|
watched[launcher] = record['launcher_sha256']
|
|
return record, payload['gates/' + stem + '.log'].decode('utf-8')
|
|
|
|
original, original_log = bound('bound_original_listing', 'mixed-list-a578-1.result.json',
|
|
'adae5f2c78302616e853765fe1c7e61d026610cb3cb3fa312b727e5c28a92100')
|
|
focused, _ = bound('bound_focused', 'mixed-focused-a578-1.result.json',
|
|
'fa586319f22c7eb1bd75e9d9da6784cff8cc897b6b93205c84f6591fa9c76b85')
|
|
require(len(focused['artifacts']) == 1, 'Focused artifact missing')
|
|
artifact = focused['artifacts'][0]
|
|
require(artifact['bytes'] == 39706624 and artifact['sha256'] ==
|
|
'089d7b0389bb3f4e98fd350d4d7504294087ce3fc84035672c781547c8a71881',
|
|
'Rebuilt focused artifact differs')
|
|
require(receipt['artifact_before'] == artifact and receipt['artifacts'] == [artifact],
|
|
'Direct artifact changed or differs from focused binary')
|
|
command = receipt['command']
|
|
require(isinstance(command, list) and len(command) == 2 and
|
|
PureWindowsPath(command[0]) == PureWindowsPath(artifact['path']) and
|
|
command[1] == ('--list' if receipt['mode'] == 'list' else '--test-threads=1'),
|
|
'Unexpected direct executable argv')
|
|
require(PureWindowsPath(receipt['cwd']) == PureWindowsPath(
|
|
'C:/Users/User/Documents/Git/ARCADIA-Studio/.local/as3batch/crates/oa-core'),
|
|
'Direct working directory is not the recorded Cargo package root')
|
|
if receipt['mode'] == 'list':
|
|
require(receipt['bound_listing'] is None, 'Direct listing unexpectedly borrows another listing')
|
|
require(listing(log) == listing(original_log), 'Direct listing differs from original test inventory')
|
|
else:
|
|
direct, direct_log = bound('bound_listing')
|
|
require(direct['mode'] == 'list' and direct['invocation'] == 'direct-executable' and
|
|
direct['launcher_sha256'] == DIRECT_RECORDER and direct['artifacts'] == [artifact] and
|
|
direct['listing_members'] == listing(direct_log) == listing(original_log),
|
|
'Full run does not bind actual direct listing of rebuilt binary')
|
|
rows = receipt['bound_files_after']
|
|
observed = {}
|
|
for row in rows:
|
|
path = safe_name(row['path'].replace('\\', '/'))
|
|
require(path not in observed, 'Duplicate direct bound-file postcheck')
|
|
require(row['expected_sha256'] == row['sha256_after'], 'Direct bound file changed')
|
|
observed[path] = row['sha256_after']
|
|
require(observed == watched, 'Direct bound-file postcheck coverage differs')
|
|
|
|
|
|
|
|
def runtime_checkpoint(by_mode, prior_names, old, old_failures, final):
|
|
require(all(len(by_mode.get(k, [])) == 1 for k in ('full', 'clippy', 'fmt')),
|
|
'Required checkpoint gates missing/ambiguous')
|
|
lists = by_mode.get('list', [])
|
|
if final:
|
|
cargo_lists = [(r, log) for r, log in lists if r.get('invocation') is None]
|
|
direct_lists = [(r, log) for r, log in lists if r.get('invocation') == 'direct-executable']
|
|
require(len(lists) == 2 and len(cargo_lists) == len(direct_lists) == 1,
|
|
'Final requires original Cargo listing and actual rebuilt-binary direct listing')
|
|
chronology_listing, original_log = cargo_lists[0]
|
|
listed_receipt, log = direct_lists[0]
|
|
original_names = listing(original_log)
|
|
require(chronology_listing['exit'] == 0 and chronology_listing['listing_count'] == 194 and
|
|
chronology_listing['listing_members'] == original_names == listing(log),
|
|
'Original/direct listing membership mismatch')
|
|
require(by_mode['full'][0][0].get('invocation') == 'direct-executable',
|
|
'Final full run must use the declared direct recorder')
|
|
else:
|
|
require(len(lists) == 1, 'Intermediate listing missing/ambiguous')
|
|
listed_receipt, log = lists[0]
|
|
chronology_listing = listed_receipt
|
|
names = listing(log)
|
|
require(listed_receipt['exit'] == 0 and listed_receipt['listing_members'] == names and
|
|
listed_receipt['listing_count'] == len(names) == 194, 'Checkpoint listing not accepted')
|
|
require(set(prior_names) <= set(names), 'Prior173 membership lost')
|
|
typed = {n for n in names if n.startswith(TYPED)}
|
|
mixed = {n for n in names if n.startswith(MIXED)}
|
|
require(len(typed) == 85 and len(mixed) == 20, 'Typed/mixed membership differs')
|
|
require({n for n in prior_names if n.startswith(TYPED)} <= typed, 'Prior typed/stack controls missing')
|
|
artifacts = listed_receipt['artifacts']
|
|
require(len(artifacts) == 1 and artifacts[0]['bytes'] > 0 and
|
|
re.fullmatch('[0-9a-f]{64}', artifacts[0]['sha256']), 'Listing binary witness missing')
|
|
mixed_runs = 0
|
|
for receipt, log in by_mode.get('focused', []):
|
|
selected = {n for n in names if receipt['filter'] in n}
|
|
require(selected and receipt['exit'] == 0 and receipt['artifacts'] == artifacts, 'Focused binary/exit mismatch')
|
|
outcomes(log, selected, len(selected), 0, len(names) - len(selected))
|
|
if selected == mixed:
|
|
mixed_runs += 1
|
|
require(mixed_runs >= 1, 'Completed focused mixed gate missing')
|
|
full_receipt, full_log = by_mode['full'][0]
|
|
require(full_receipt['exit'] == 101 and full_receipt['artifacts'] == artifacts, 'Full diagnostic gate mismatch')
|
|
full = outcomes(full_log, names, 178, 16, 0)
|
|
require(all(full.get(n) == status for n, status in old.items()), 'Old152 statuses changed')
|
|
new = set(full) - set(old)
|
|
require(len(new) == 42 and all(full[n] == 'ok' for n in new), 'Later42 cases did not all pass')
|
|
require(all(full[n] == 'ok' for n in typed), 'Typed controls not all passing')
|
|
failures(full_log, old_failures)
|
|
strict, strict_log = by_mode['clippy'][0]
|
|
if final:
|
|
require(strict['exit'] == 0 and 'Finished' in strict_log and
|
|
not re.search(r'^error(?:\[|:)', strict_log, re.M), 'Final strict core gate failed')
|
|
require(datetime.fromisoformat(strict['end']) <= datetime.fromisoformat(chronology_listing['start']),
|
|
'Final listing preceded successful strict closure')
|
|
else:
|
|
require(strict['exit'] == 101 and 'unnecessary_unwrap' in strict_log and
|
|
'collapsible_if' in strict_log and 'due to 2 previous errors' in strict_log and
|
|
strict['artifacts'] == [], 'Intermediate failed strict evidence changed')
|
|
require(artifacts[0]['bytes'] == 39708672 and artifacts[0]['sha256'] ==
|
|
'5482a24e86d6f102c34dec6be9904726488963e8552e514253efbf03dfbcd98c',
|
|
'Intermediate observed artifact changed')
|
|
fmt, fmt_log = by_mode['fmt'][0]
|
|
require(fmt['exit'] == 1, 'Formatting status differs from inherited-failure scope')
|
|
return names, {
|
|
'source': SOURCE if final else INTERMEDIATE, 'full_suite': 'FAILED', 'full_exit': 101,
|
|
'listed': len(names), 'prior_173_retained': len(prior_names),
|
|
'typed_passed_in_full': len(typed), 'mixed_focused_passed': len(mixed),
|
|
'full_passed': 178, 'full_failed': 16, 'old_152_statuses_unchanged': len(old),
|
|
'new_42_passes': sorted(new), 'known_failure_names': old_failures,
|
|
'new_since_173': sorted(set(names) - set(prior_names)), 'test_artifact': artifacts[0],
|
|
'strict_core_all_targets': 'PASS' if final else 'FAILED', 'strict_exit': strict['exit'],
|
|
'fmt_exit': 1,
|
|
'full_invocation': full_receipt.get('invocation', 'cargo'),
|
|
'listing_artifacts': [{'invocation': r.get('invocation', 'cargo'), 'artifacts': r['artifacts']}
|
|
for r, _ in lists],
|
|
}, fmt_log
|
|
|
|
|
|
def verify_payload(payload, manifest, repo):
|
|
require(manifest['schema'] == 1 and manifest['source'] == SOURCE, 'Wrong package schema/source')
|
|
require(set(payload) == set(manifest['payloads']), 'Payload membership mismatch')
|
|
for name, raw in payload.items():
|
|
safe_name(name)
|
|
require(manifest['payloads'][name] == {'bytes': len(raw), 'sha256': sha(raw)},
|
|
'Payload hash mismatch: ' + name)
|
|
# Historical records are anchored to immutable documentation Git objects,
|
|
# independently of this package's editable manifest hashes.
|
|
origins = manifest['git_origins']
|
|
for name, origin in origins.items():
|
|
require(name in payload and re.fullmatch('[0-9a-f]{40}', origin['commit']), 'Bad Git origin')
|
|
raw = git(repo, 'show', origin['commit'] + ':' + safe_name(origin['path']))
|
|
if 'member' in origin:
|
|
with zipfile.ZipFile(io.BytesIO(raw)) as archive:
|
|
require(len(archive.namelist()) == len(set(archive.namelist())), 'Duplicate origin ZIP member')
|
|
raw = archive.read(safe_name(origin['member']))
|
|
require(raw == payload[name], 'Historical Git evidence mismatch: ' + name)
|
|
historical = {
|
|
'baseline/full-f1d79df.log', 'baseline/full-f1d79df.result.json',
|
|
'baseline/full-f1d79df.inputs.json', 'baseline/full-f1d79df.comparison.json',
|
|
'prior/list-10d7f33.log', 'prior/list-10d7f33.result.json', 'prior/list-10d7f33.inputs.json',
|
|
}
|
|
require(historical <= set(origins), 'Missing immutable historical origins')
|
|
prior = document(payload['prior/list-10d7f33.result.json'])
|
|
prior_names = listing(payload['prior/list-10d7f33.log'].decode())
|
|
require(prior['source'] == prior['head_after'] == PRIOR_SOURCE and prior['exit'] == 0 and
|
|
prior['changed_inputs'] == [] and prior['listing_members'] == prior_names and
|
|
prior['listing_count'] == len(prior_names) == 173, 'Prior listing invalid')
|
|
git_inputs(repo, PRIOR_SOURCE, document(payload['prior/list-10d7f33.inputs.json']), 538)
|
|
baseline = document(payload['baseline/full-f1d79df.result.json'])
|
|
require(baseline['source'] == baseline['head_after'] == BASELINE_SOURCE and
|
|
baseline['exit'] == 101 and baseline['changed_inputs'] == [] and
|
|
baseline['command'] == ['cargo', 'test', '--locked', '-p', 'oa-core', '--lib', '--', '--test-threads=1'],
|
|
'Historical full receipt invalid')
|
|
git_inputs(repo, BASELINE_SOURCE, document(payload['baseline/full-f1d79df.inputs.json']), 534)
|
|
baseline_log = payload['baseline/full-f1d79df.log'].decode()
|
|
baseline_names = re.findall(r'^test ([^\r\n]+) \.\.\. ', baseline_log, re.M)
|
|
require(len(baseline_names) == 152, 'Historical outcome count changed')
|
|
old = outcomes(baseline_log, baseline_names, 136, 16, 0)
|
|
old_failures = sorted(n for n, v in old.items() if v == 'FAILED')
|
|
failures(baseline_log, old_failures)
|
|
comparison = document(payload['baseline/full-f1d79df.comparison.json'])
|
|
require(comparison['source'] == BASELINE_SOURCE and comparison['failures'] == old_failures and
|
|
comparison['cargo_exit'] == 101 and comparison['passed'] == 136 and comparison['failed'] == 16,
|
|
'Historical comparison disagrees')
|
|
for leaf in ('full-f1d79df.log', 'full-f1d79df.result.json', 'full-f1d79df.inputs.json'):
|
|
require(comparison['pins'][leaf] == sha(payload['baseline/' + leaf]), 'Historical comparison hash mismatch')
|
|
|
|
receipt_names = sorted(n for n in payload if n.startswith('gates/') and n.endswith('.result.json'))
|
|
require(receipt_names, 'No completed current gates')
|
|
consumed = set()
|
|
by_source = {}
|
|
inputs_by_source = {}
|
|
for name in receipt_names:
|
|
receipt = document(payload[name])
|
|
source = receipt['source']
|
|
require(source in (SOURCE, INTERMEDIATE, FAILED_SOURCE) and receipt['head_after'] == source and
|
|
receipt['changed_inputs'] == [], 'Gate source drift')
|
|
started = datetime.fromisoformat(receipt['start'])
|
|
ended = datetime.fromisoformat(receipt['end'])
|
|
known_clock_jump = (name == 'gates/mixed-list-a578-1.result.json' and
|
|
sha(payload[name]) == 'adae5f2c78302616e853765fe1c7e61d026610cb3cb3fa312b727e5c28a92100')
|
|
require((started < ended or known_clock_jump) and
|
|
receipt['elapsed_monotonic_seconds'] > 0, 'Gate not closed')
|
|
env = receipt['environment']
|
|
require(env['CARGO_BUILD_JOBS'] == '1' and env['CARGO_INCREMENTAL'] == '0', 'Gate environment changed')
|
|
require(all(env.get(k) is None for k in ('RUSTFLAGS', 'RUSTC', 'RUSTUP_TOOLCHAIN')), 'Unrecorded compiler override')
|
|
stem = name[:-len('.result.json')]
|
|
log_name = stem + '.log'
|
|
input_name = 'gates/' + safe_name(receipt['inputs'])
|
|
require(input_name == stem + '.inputs.json', 'Input receipt belongs to another run')
|
|
launcher = 'gates/' + safe_name(receipt['launcher_copy'].replace('\\', '/'))
|
|
require(launcher == 'gates/launchers/' + receipt['launcher_sha256'] + '.py', 'Launcher name mismatch')
|
|
require(sha(payload[launcher]) == receipt['launcher_sha256'] == receipt['launcher_sha256_after'], 'Launcher changed')
|
|
require(sha(payload[log_name]) == receipt['log_sha256'] and
|
|
sha(payload[input_name]) == receipt['inputs_sha256'], 'Log/input hash mismatch')
|
|
consumed.update((name, log_name, input_name, launcher))
|
|
current = document(payload[input_name])
|
|
if source not in inputs_by_source:
|
|
git_inputs(repo, source, current, 541)
|
|
inputs_by_source[source] = current
|
|
require(current == inputs_by_source[source], 'Gate input sets differ at same source')
|
|
log = payload[log_name].decode('utf-8')
|
|
mode = receipt['mode']
|
|
require(mode == 'focused' or receipt['filter'] == '', 'Unexpected filter on unfiltered gate')
|
|
if receipt.get('invocation') == 'direct-executable':
|
|
direct_evidence(payload, receipt, log)
|
|
else:
|
|
require('invocation' not in receipt and 'cargo_invoked' not in receipt,
|
|
'Unexpected invocation marker on Cargo receipt')
|
|
command = {
|
|
'list': PREFIX + ['--', '--list'],
|
|
'focused': PREFIX + [receipt['filter'], '--', '--test-threads=1'],
|
|
'full': PREFIX + ['--', '--test-threads=1'],
|
|
'clippy': ['cargo', 'clippy', '--locked', '--offline', '-p', 'oa-core', '--all-targets', '--', '-D', 'warnings'],
|
|
'fmt': ['cargo', 'fmt', '--all', '--', '--check'],
|
|
}.get(mode)
|
|
require(command is not None and receipt['command'] == command, 'Unexpected gate command')
|
|
binary_lines = re.findall(r'Running unittests [^\r\n]+ \(([^\r\n]+\.exe)\)', log)
|
|
require(len(binary_lines) == len(receipt['artifacts']), 'Log/artifact occurrence mismatch')
|
|
for logged, artifact in zip(binary_lines, receipt['artifacts']):
|
|
require(logged.replace('\\', '/').rsplit('/', 1)[-1] ==
|
|
artifact['path'].replace('\\', '/').rsplit('/', 1)[-1],
|
|
'Log/artifact executable name mismatch')
|
|
if source == FAILED_SOURCE:
|
|
require(name == 'gates/mixed-list-754a-1.result.json' and mode == 'list' and receipt['exit'] == 101,
|
|
'Unexpected earlier-source gate')
|
|
require('error[E0063]' in log and 'missing field `mixed`' in log and
|
|
'semantic_source.rs:191' in log and receipt['artifacts'] == [] and
|
|
receipt['listing_members'] == [] and receipt['listing_count'] == 0,
|
|
'Original initializer failure evidence changed')
|
|
continue
|
|
by_source.setdefault(source, {}).setdefault(mode, []).append((receipt, log))
|
|
if mode != 'list':
|
|
require(receipt['listing_members'] == [] and receipt['listing_count'] == 0, 'Non-list fabricated membership')
|
|
require({SOURCE, INTERMEDIATE, FAILED_SOURCE} == set(inputs_by_source), 'All three source pins required')
|
|
require({n for n in payload if n.startswith('gates/')} == consumed, 'Unclosed/unreferenced gate payload')
|
|
eeb_names, intermediate, _ = runtime_checkpoint(by_source[INTERMEDIATE], prior_names, old, old_failures, False)
|
|
names, final, fmt_log = runtime_checkpoint(by_source[SOURCE], prior_names, old, old_failures, True)
|
|
require(names == eeb_names, 'Final listing membership/order changed from observed intermediate')
|
|
earlier = inputs_by_source[INTERMEDIATE]['inputs']
|
|
later = inputs_by_source[SOURCE]['inputs']
|
|
require([item['path'] for item in earlier] == [item['path'] for item in later] and
|
|
[a['path'] for a, b in zip(earlier, later) if a != b] == ['crates/oa-core/src/language.rs'],
|
|
'Final input delta is not the one-file guard correction')
|
|
require(git(repo, 'diff', '--name-only', INTERMEDIATE, SOURCE).decode().splitlines() ==
|
|
['AGENTS.md', 'crates/oa-core/src/language.rs'], 'Final source delta expanded')
|
|
require(git(repo, 'rev-parse', SOURCE + ':AGENTS.md').decode().strip() ==
|
|
'767be18f086c04b7a688b107808e97ac98881356', 'Final shared instructions differ')
|
|
final['intermediate_checkpoint'] = intermediate
|
|
final['formatting_disposition'] = formatting_evidence(payload, repo, fmt_log) + '; final fmt also FAILED exit 1 with identical nine blocks'
|
|
final['unchanged_inputs_from_intermediate'] = 540
|
|
final['clock_discontinuity'] = 'Raw final listing UTC end precedes start after host clock moved backward; exact immutable receipt retained; elapsed_monotonic_seconds=768.4220000000059 is the duration evidence. No wall-clock duration inferred.'
|
|
final['limits'] = 'Receipt/Git consistency only; no archived code or binaries executed. No public source8, semantic/compositor or full-suite PASS claim.'
|
|
return final
|
|
|
|
|
|
def main():
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument('--repo', type=Path, required=True)
|
|
parser.add_argument('--package', type=Path, default=Path(__file__).resolve().parent)
|
|
args = parser.parse_args()
|
|
manifest = document((args.package / 'manifest.json').read_bytes())
|
|
with zipfile.ZipFile(args.package / 'evidence.zip') as archive:
|
|
names = archive.namelist()
|
|
require(len(names) == len(set(names)), 'Duplicate ZIP members')
|
|
require(len(names) <= 512 and sum(item.file_size for item in archive.infolist()) <= 64 * 1024 * 1024,
|
|
'Archive exceeds bounded evidence size')
|
|
for name in names:
|
|
safe_name(name)
|
|
payload = {name: archive.read(name) for name in names}
|
|
result = verify_payload(payload, manifest, args.repo)
|
|
require(result == manifest['verified_summary'], 'Manifest summary differs from evidence')
|
|
print(json.dumps(result, indent=2))
|
|
print('VERIFIED evidence consistency; full core suite FAILED (178/16); formatting FAILED (inherited six-file debt).')
|
|
|
|
|
|
if __name__ == '__main__':
|
|
try:
|
|
main()
|
|
except (ValueError, KeyError, OSError, zipfile.BadZipFile, subprocess.CalledProcessError) as error:
|
|
raise SystemExit('REFUSED: ' + str(error))
|