"""Read-only portable S3 evidence verification; never compiles or runs artifacts.""" import argparse from datetime import datetime import hashlib import io import json from pathlib import Path, PurePosixPath, PureWindowsPath import re import subprocess import zipfile SOURCE = '1b1c3e3abb6fc3d0934c9dbfbd21fddc8ae4f594' PRIOR = '90fae14818f684bf778640be2e613f34e3c7e999' ZIP_SHA = '4486f4c42b140ae4b9b3caf0aacdf151a2acb1fd85eda09a57764fd69e980574' RECORDER = '328970b226d9f4c3b8d3feb7d64478fb9756310ae5dfd3caa43b23c8b9d6f245' PREFIX = ['cargo', 'test', '--locked', '--offline', '-p', 'oa-core', '--lib'] SCOPES = ['Cargo.toml', 'Cargo.lock', 'rust-toolchain.toml', '.cargo', 'build', 'crates', 'assets', 'docs', 'examples', 'harness/fixtures', 'vendor'] STACK = 'deep_parse_index_plan_and_failed_build_cleanup_on_128k_stack' NEW = 'every_parent_shape_rejects_depth129_and_cleans_children_on_128k_stack' PATHS = 'maximum_index_paths_compare_lookup_debug_and_drop_on_128k_stack' OVERFLOW = 3221225725 def require(ok, message): if not ok: raise RuntimeError(message) def sha(raw): return hashlib.sha256(raw).hexdigest() def unique(pairs): value = {} for key, item in pairs: require(key not in value, 'Duplicate JSON key: ' + key) value[key] = item return value def document(raw): return json.loads(raw, object_pairs_hook=unique) def git(repo, *args, data=None): return subprocess.check_output(['git', *args], cwd=repo, input=data) def source_inputs(repo, commit): paths = git(repo, 'ls-tree', '-r', '--name-only', commit, '--', *SCOPES).decode().splitlines() require(len(paths) == len(set(paths)) == 538, 'Exactly538 committed test inputs') batch = git(repo, 'cat-file', '--batch', data=''.join(f'{commit}:{p}\n' for p in paths).encode()) offset, inputs, blobs = 0, [], {} for path in paths: end = batch.index(b'\n', offset) _, kind, size = batch[offset:end].split() size = int(size) raw = batch[end + 1:end + 1 + size] require(kind == b'blob' and len(raw) == size and batch[end + 1 + size:end + 2 + size] == b'\n', 'Git blob framing: ' + path) inputs.append({'path': path, 'bytes': size, 'sha256': sha(raw)}) blobs[path] = raw offset = end + size + 2 require(offset == len(batch), 'Complete Git blob stream') return inputs, blobs def archive_payload(raw): require(sha(raw) == ZIP_SHA, 'Evidence ZIP SHA256 differs') with zipfile.ZipFile(io.BytesIO(raw)) as archive: names = archive.namelist() require(len(names) == len(set(names)) == 61, 'Exact unique ZIP membership') for name in names: path = PurePosixPath(name) require(not path.is_absolute() and '..' not in path.parts and str(path) == name and '\\' not in name and ':' not in name, 'Unsafe ZIP path') payload = {name: archive.read(name) for name in names} manifest = document(payload['manifest.json']) require(manifest['source'] == SOURCE, 'Archive manifest source') listed = [item['path'] for item in manifest['files']] require(len(listed) == len(set(listed)) and set(listed) | {'manifest.json'} == set(payload), 'Archive manifest membership') for item in manifest['files']: require(len(payload[item['path']]) == item['bytes'] and sha(payload[item['path']]) == item['sha256'], 'Archive member binding: ' + item['path']) return payload def apply_recorded_diff(blobs, diff): """Reconstruct diagnostic source without touching an index or worktree.""" changed = {} sections = re.split(r'(?m)^diff --git ', diff)[1:] require(sections, 'Missing dirty diff') for section in sections: lines = section.splitlines(keepends=True) names = re.fullmatch(r'a/(\S+) b/(\S+)\n', lines[0]) require(names is not None and names[1] == names[2] and names[1] in blobs, 'Unexpected diagnostic diff path') path = names[1] old = blobs[path].decode().splitlines(keepends=True) output, cursor, index = [], 0, 1 while index < len(lines) and not lines[index].startswith('@@ '): index += 1 require(index < len(lines), 'Missing diagnostic hunk') while index < len(lines): match = re.match(r'@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@', lines[index]) require(match is not None, 'Invalid diagnostic hunk header') old_start, old_count = int(match[1]), int(match[2] or 1) new_start, new_count = int(match[3]), int(match[4] or 1) start = old_start - 1 if old_count else old_start require(cursor <= start <= len(old), 'Diagnostic hunk position') output.extend(old[cursor:start]) cursor = start require(len(output) == (new_start - 1 if new_count else new_start), 'Diagnostic new hunk position') consumed = emitted = 0 index += 1 while index < len(lines) and not lines[index].startswith('@@ '): line = lines[index] require(line[:1] in [' ', '+', '-'], 'Unsupported diagnostic patch line') if line[0] in ' -': require(cursor < len(old) and old[cursor] == line[1:], 'Diagnostic old source mismatch') cursor += 1 consumed += 1 if line[0] in ' +': output.append(line[1:]) emitted += 1 index += 1 require((consumed, emitted) == (old_count, new_count), 'Diagnostic hunk counts') output.extend(old[cursor:]) require(path not in changed, 'Repeated diagnostic path') changed[path] = ''.join(output).encode() return changed def audit(repo, payload): read = lambda name: payload['raw/' + name] doc = lambda name: document(read(name)) closure = document(payload['closure.json']) expected, blobs = source_inputs(repo, SOURCE) prior_inputs, prior_blobs = source_inputs(repo, PRIOR) require(git(repo, 'rev-parse', SOURCE + '^').decode().strip() == PRIOR, 'Correction parent') require(sha(payload['helpers/run-analysis-source3-gate-20260922.py']) == RECORDER, 'Recorder bytes') for manifest_name, commit, count in [ ('analysis-source8-s3-index-source-manifest-20260913.json', '1f8283236f8ccdefca13814003e7f046860b4f22', 7), ('analysis-source8-s3-index-correction-source-manifest-20260913.json', PRIOR, 2), ]: manifest = document(payload['notes/' + manifest_name]) require(manifest['source'] == commit and len(manifest['files']) == count, 'Historical source artifact manifest') for item in manifest['files']: raw = git(repo, 'show', commit + ':' + item['path']) require(len(raw) == item['bytes'] and sha(raw) == item['sha256'] and git(repo, 'rev-parse', commit + ':' + item['path']).decode().strip() == item['git_blob'], 'Historical source artifact: ' + item['path']) names = re.findall(r'^([^\r\n]+): test\r?$', read('list-fixed-1b1c3e3.log').decode(), re.M) old_names = re.findall(r'^([^\r\n]+): test\r?$', read('list-90fae148.log').decode(), re.M) require(len(names) == len(set(names)) == 167 and len(old_names) == len(set(old_names)) == 166, 'Actual listing sizes') qualified_new = 'language::analysis_source::tests::' + NEW require(set(names) == set(old_names) | {qualified_new} and qualified_new not in old_names, 'Retained166 plus one new case') require(len([n for n in names if 'language::analysis_source' in n]) == 59 and len([n for n in names if 'language::raw_tokens' in n]) == 1, 'Typed/token listing counts') for module, count in [('index', 9), ('update', 5)]: path = f'crates/oa-core/src/language/analysis_source/{module}/tests.rs' authored = [f'language::analysis_source::{module}::tests::{name}' for name in re.findall(r'#\[test\]\s*fn (\w+)\(', blobs[path].decode())] require(len(authored) == count and set(authored) == {n for n in names if n.startswith(f'language::analysis_source::{module}::tests::')}, 'Source-derived membership: ' + module) selectors = {'stack-fixed-original-1b1c3e3': STACK, 'stack-fixed-shapes-1b1c3e3': NEW, 'stack-fixed-paths-1b1c3e3': PATHS, 'typed-fixed-1b1c3e3': 'language::analysis_source', 'token-fixed-1b1c3e3': 'language::raw_tokens', 'list-fixed-1b1c3e3': None, 'strict-fixed-1b1c3e3': 'clippy'} environment, artifacts, last_end = None, {}, None for stem, selector in selectors.items(): record, log = doc(stem + '.result.json'), read(stem + '.log').decode() require(record['source'] == record['head_after'] == SOURCE and type(record['exit']) is int and record['exit'] == 0 and record['changed_inputs'] == [], 'Clean source/result: ' + stem) require(record['inputs'] == stem + '.inputs.json' and doc(record['inputs']) == {'source': SOURCE, 'inputs': expected}, 'Exact538 source bindings: ' + stem) require(record['launcher_sha256'] == RECORDER, 'Recorded launcher') start, end = (datetime.fromisoformat(record[k]) for k in ['start', 'end']) require(start.tzinfo is not None and end.tzinfo is not None and start <= end and (last_end is None or last_end <= start), 'Closed ordered gate times') last_end = end if environment is None: environment = record['environment'] require(record['environment'] == environment and environment['CARGO_BUILD_JOBS'] == '1' and PureWindowsPath(environment['CARGO_TARGET_DIR']).name == 'analysis-checked-save-target-20260913', 'Recorded environment') if selector == 'clippy': command = ['cargo', 'clippy', '--locked', '--offline', '-p', 'oa-core', '--all-targets', '--', '-D', 'warnings'] require(record['artifacts'] == [] and 'Finished `dev` profile [unoptimized]' in log and not re.search(r'^\s*(warning|error)(\[|:)', log, re.M), 'Closed clean strict log') selected = [] else: require(len(record['artifacts']) == 1, 'One recorded test artifact') artifact = record['artifacts'][0] emitted = re.findall(r'Running unittests [^\r\n]+ \(([^\r\n]+\.exe)\)', log) require(len(emitted) == 1 and PureWindowsPath(emitted[0]) == PureWindowsPath(artifact['path']) and artifact['bytes'] > 0 and re.fullmatch('[0-9a-f]{64}', artifact['sha256']), 'Recorded executable/log binding') artifacts[stem] = artifact if selector is None: command = PREFIX + ['--', '--list'] selected = names require(record['listing_members'] == names and record['listing_count'] == 167 and re.findall(r'^(\d+) tests, (\d+) benchmarks\s*$', log, re.M) == [('167', '0')], 'Listing receipt and summary') else: command = PREFIX + [selector, '--', '--test-threads=1'] selected = [name for name in names if selector in name] rows = re.findall(r'^test ([^\r\n]+) \.\.\. (ok|FAILED|ignored)\r?$', log, re.M) require(rows == [(name, 'ok') for name in selected], 'Exact ordered runtime results: ' + stem) require(re.findall(r'^test result: ok\. (\d+) passed; (\d+) failed; (\d+) ignored; (\d+) measured; (\d+) filtered out;', log, re.M) == [(str(len(selected)), '0', '0', '0', str(167-len(selected)))], 'Runtime summary') require(record['command'] == command, 'Exact command: ' + stem) if selector is not None: require(record['listing_count'] == 0 and record['listing_members'] == [], 'Non-list metadata') saved = closure['gates'][stem] require([saved[k] for k in ['command', 'exit', 'start', 'end', 'names']] == [command, 0, record['start'], record['end'], selected], 'Closure gate facts') require(saved['pins'] == {stem+s: sha(read(stem+s)) for s in ['.inputs.json', '.log', '.result.json']}, 'Closure raw pins') require(artifacts['stack-fixed-original-1b1c3e3'] == artifacts['stack-fixed-shapes-1b1c3e3'] == artifacts['stack-fixed-paths-1b1c3e3'], 'First focused build receipt') require(artifacts['typed-fixed-1b1c3e3'] == artifacts['token-fixed-1b1c3e3'] == artifacts['list-fixed-1b1c3e3'], 'Final restored clean build receipt') require([closure[k] for k in ['source', 'parent', 'verified_inputs', 'listing', 'typed_pass', 'index_pass', 'update_pass', 'token_pass', 'strict_exit']] == [SOURCE, PRIOR, 538, 167, 59, 9, 5, 1, 0], 'Closure counts') for stem, mode in [('list-90fae148', 'list'), ('typed-90fae148', 'failed')]: record, log = doc(stem + '.result.json'), read(stem + '.log').decode() require(record['source'] == record['head_after'] == PRIOR and record['changed_inputs'] == [] and record['launcher_sha256'] == RECORDER, 'Historical frozen source') require(doc(stem + '.inputs.json') == {'source': PRIOR, 'inputs': prior_inputs}, 'Historical538 inputs') if mode == 'list': require(record['exit'] == 0 and record['listing_members'] == old_names and record['listing_count'] == 166 and record['command'] == PREFIX + ['--', '--list'], 'Historical listing') else: require(record['exit'] == OVERFLOW and record['command'] == PREFIX + ['language::analysis_source', '--', '--test-threads=1'] and 'STATUS_STACK_OVERFLOW' in log and STACK + ' ...' in log and 'test result:' not in log, 'Historical aborted gate') selected = [n for n in old_names if 'language::analysis_source' in n] failing = 'language::analysis_source::index::tests::' + STACK rows = re.findall(r'^test ([^\r\n]+) \.\.\. (ok|FAILED|ignored)\r?$', log, re.M) require(rows == [(n, 'ok') for n in selected[:selected.index(failing)]] and 'running 58 tests' in log, 'Historical completed prefix before abort') dirty = ['stack-diag-01-dirty', 'stack-diag-02-dirty', 'stack-probe-sum-01-dirty', 'stack-probe-if-01-dirty', 'stack-probe-power-01-dirty', 'stack-probe-trailing-01-dirty'] for index, stem in enumerate(dirty): capture, result, log = doc(stem + '.inputs.json'), doc(stem + '.result.json'), read(stem + '.log').decode() diagnostic = index < 2 commit, original = (PRIOR, prior_blobs) if diagnostic else (SOURCE, blobs) require(capture['head'] == commit and result['changed'] == [], 'Dirty capture identity/stability') patched = apply_recorded_diff(original, capture['dirty']) expected_paths = {'crates/oa-core/src/language/analysis_source/index/tests.rs'} if diagnostic else {'crates/oa-core/src/language/analysis_source/tests.rs'} if index == 1: expected_paths.add('crates/oa-core/src/language/analysis_source/syntax.rs') require(set(patched) == expected_paths, 'Bounded diagnostic paths') for path, raw in original.items(): require(capture['inputs'][path] == sha(patched.get(path, raw)), 'Reconstructed diagnostic input: ' + path) expected_filter = STACK if diagnostic else 'diagnostic_malformed_cleanup_on_128k_stack' require(capture['command'] == PREFIX + [expected_filter, '--', '--test-threads=1', '--nocapture'], 'Diagnostic command') if diagnostic: require(result['exit'] == OVERFLOW and 'STATUS_STACK_OVERFLOW' in log and 'STAGE failed builds dropped' in log and 'STAGE finished' not in log, 'Diagnostic abort') if index == 1: require('STAGE node rejecting depth 129 before kind drop' in log and 'STAGE node rejected kind dropped' not in log, 'Isolated rejected-kind cleanup') else: case = index - 2 require(result['exit'] == 0 and f'PROBE before malformed case {case}' in log and f'PROBE after malformed case {case}:' in log and '1 passed; 0 failed; 0 ignored' in log, 'Dirty probe result/case') return {'source': SOURCE, 'verified_git_inputs': 538, 'listing': 167, 'typed_pass': 59, 'index_pass': 9, 'update_pass': 5, 'token_pass': 1, 'strict_exit': 0, 'historical_overflow_retained': True, 'dirty_diagnostics': 2, 'dirty_direct_parser_probes_pass': 4, 'recorded_test_artifacts': artifacts, 'scope': 'Private S3 only; no full-core runtime/public8/integration/native/release acceptance. Recorded binary identities verified against receipts, not rehashed executable bytes; binaries intentionally absent.'} def verify_package(directory): manifest = document((directory / 'manifest.json').read_bytes()) require(manifest['source'] == SOURCE and manifest['archive_sha256'] == ZIP_SHA, 'Outer manifest identity') names = [item['path'] for item in manifest['files']] require(set(names) == {'.gitattributes', 'README.md', 'verify.py', 'negative_controls.py', 'checks.json', 'evidence.zip'} and len(names) == len(set(names)), 'Outer manifest membership') for item in manifest['files']: raw = (directory / item['path']).read_bytes() require(len(raw) == item['bytes'] and sha(raw) == item['sha256'], 'Outer manifest bytes: ' + item['path']) return archive_payload((directory / 'evidence.zip').read_bytes()) def main(): require(__debug__, 'Optimized Python refused') parser = argparse.ArgumentParser(description=__doc__) parser.add_argument('--repo', type=Path, required=True, help='Git repo containing immutable source commits; current checkout is not used') parser.add_argument('--evidence-dir', type=Path, default=Path(__file__).resolve().parent) args = parser.parse_args() print(json.dumps(audit(args.repo, verify_package(args.evidence_dir)), indent=2)) if __name__ == '__main__': main()