258 lines
17 KiB
Python
258 lines
17 KiB
Python
"""Read-only portable S3 evidence verification; never compiles or runs artifacts."""
|
|
import argparse
|
|
from datetime import datetime
|
|
import hashlib
|
|
import io
|
|
import json
|
|
from pathlib import Path, PurePosixPath, PureWindowsPath
|
|
import re
|
|
import subprocess
|
|
import zipfile
|
|
|
|
SOURCE = '1b1c3e3abb6fc3d0934c9dbfbd21fddc8ae4f594'
|
|
PRIOR = '90fae14818f684bf778640be2e613f34e3c7e999'
|
|
ZIP_SHA = '4486f4c42b140ae4b9b3caf0aacdf151a2acb1fd85eda09a57764fd69e980574'
|
|
RECORDER = '328970b226d9f4c3b8d3feb7d64478fb9756310ae5dfd3caa43b23c8b9d6f245'
|
|
PREFIX = ['cargo', 'test', '--locked', '--offline', '-p', 'oa-core', '--lib']
|
|
SCOPES = ['Cargo.toml', 'Cargo.lock', 'rust-toolchain.toml', '.cargo', 'build', 'crates', 'assets', 'docs', 'examples', 'harness/fixtures', 'vendor']
|
|
STACK = 'deep_parse_index_plan_and_failed_build_cleanup_on_128k_stack'
|
|
NEW = 'every_parent_shape_rejects_depth129_and_cleans_children_on_128k_stack'
|
|
PATHS = 'maximum_index_paths_compare_lookup_debug_and_drop_on_128k_stack'
|
|
OVERFLOW = 3221225725
|
|
|
|
|
|
def require(ok, message):
|
|
if not ok:
|
|
raise RuntimeError(message)
|
|
|
|
|
|
def sha(raw):
|
|
return hashlib.sha256(raw).hexdigest()
|
|
|
|
|
|
def unique(pairs):
|
|
value = {}
|
|
for key, item in pairs:
|
|
require(key not in value, 'Duplicate JSON key: ' + key)
|
|
value[key] = item
|
|
return value
|
|
|
|
|
|
def document(raw):
|
|
return json.loads(raw, object_pairs_hook=unique)
|
|
|
|
|
|
def git(repo, *args, data=None):
|
|
return subprocess.check_output(['git', *args], cwd=repo, input=data)
|
|
|
|
|
|
def source_inputs(repo, commit):
|
|
paths = git(repo, 'ls-tree', '-r', '--name-only', commit, '--', *SCOPES).decode().splitlines()
|
|
require(len(paths) == len(set(paths)) == 538, 'Exactly538 committed test inputs')
|
|
batch = git(repo, 'cat-file', '--batch', data=''.join(f'{commit}:{p}\n' for p in paths).encode())
|
|
offset, inputs, blobs = 0, [], {}
|
|
for path in paths:
|
|
end = batch.index(b'\n', offset)
|
|
_, kind, size = batch[offset:end].split()
|
|
size = int(size)
|
|
raw = batch[end + 1:end + 1 + size]
|
|
require(kind == b'blob' and len(raw) == size and batch[end + 1 + size:end + 2 + size] == b'\n', 'Git blob framing: ' + path)
|
|
inputs.append({'path': path, 'bytes': size, 'sha256': sha(raw)})
|
|
blobs[path] = raw
|
|
offset = end + size + 2
|
|
require(offset == len(batch), 'Complete Git blob stream')
|
|
return inputs, blobs
|
|
|
|
|
|
def archive_payload(raw):
|
|
require(sha(raw) == ZIP_SHA, 'Evidence ZIP SHA256 differs')
|
|
with zipfile.ZipFile(io.BytesIO(raw)) as archive:
|
|
names = archive.namelist()
|
|
require(len(names) == len(set(names)) == 61, 'Exact unique ZIP membership')
|
|
for name in names:
|
|
path = PurePosixPath(name)
|
|
require(not path.is_absolute() and '..' not in path.parts and str(path) == name and '\\' not in name and ':' not in name, 'Unsafe ZIP path')
|
|
payload = {name: archive.read(name) for name in names}
|
|
manifest = document(payload['manifest.json'])
|
|
require(manifest['source'] == SOURCE, 'Archive manifest source')
|
|
listed = [item['path'] for item in manifest['files']]
|
|
require(len(listed) == len(set(listed)) and set(listed) | {'manifest.json'} == set(payload), 'Archive manifest membership')
|
|
for item in manifest['files']:
|
|
require(len(payload[item['path']]) == item['bytes'] and sha(payload[item['path']]) == item['sha256'], 'Archive member binding: ' + item['path'])
|
|
return payload
|
|
|
|
|
|
def apply_recorded_diff(blobs, diff):
|
|
"""Reconstruct diagnostic source without touching an index or worktree."""
|
|
changed = {}
|
|
sections = re.split(r'(?m)^diff --git ', diff)[1:]
|
|
require(sections, 'Missing dirty diff')
|
|
for section in sections:
|
|
lines = section.splitlines(keepends=True)
|
|
names = re.fullmatch(r'a/(\S+) b/(\S+)\n', lines[0])
|
|
require(names is not None and names[1] == names[2] and names[1] in blobs, 'Unexpected diagnostic diff path')
|
|
path = names[1]
|
|
old = blobs[path].decode().splitlines(keepends=True)
|
|
output, cursor, index = [], 0, 1
|
|
while index < len(lines) and not lines[index].startswith('@@ '):
|
|
index += 1
|
|
require(index < len(lines), 'Missing diagnostic hunk')
|
|
while index < len(lines):
|
|
match = re.match(r'@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@', lines[index])
|
|
require(match is not None, 'Invalid diagnostic hunk header')
|
|
old_start, old_count = int(match[1]), int(match[2] or 1)
|
|
new_start, new_count = int(match[3]), int(match[4] or 1)
|
|
start = old_start - 1 if old_count else old_start
|
|
require(cursor <= start <= len(old), 'Diagnostic hunk position')
|
|
output.extend(old[cursor:start])
|
|
cursor = start
|
|
require(len(output) == (new_start - 1 if new_count else new_start), 'Diagnostic new hunk position')
|
|
consumed = emitted = 0
|
|
index += 1
|
|
while index < len(lines) and not lines[index].startswith('@@ '):
|
|
line = lines[index]
|
|
require(line[:1] in [' ', '+', '-'], 'Unsupported diagnostic patch line')
|
|
if line[0] in ' -':
|
|
require(cursor < len(old) and old[cursor] == line[1:], 'Diagnostic old source mismatch')
|
|
cursor += 1
|
|
consumed += 1
|
|
if line[0] in ' +':
|
|
output.append(line[1:])
|
|
emitted += 1
|
|
index += 1
|
|
require((consumed, emitted) == (old_count, new_count), 'Diagnostic hunk counts')
|
|
output.extend(old[cursor:])
|
|
require(path not in changed, 'Repeated diagnostic path')
|
|
changed[path] = ''.join(output).encode()
|
|
return changed
|
|
|
|
|
|
def audit(repo, payload):
|
|
read = lambda name: payload['raw/' + name]
|
|
doc = lambda name: document(read(name))
|
|
closure = document(payload['closure.json'])
|
|
expected, blobs = source_inputs(repo, SOURCE)
|
|
prior_inputs, prior_blobs = source_inputs(repo, PRIOR)
|
|
require(git(repo, 'rev-parse', SOURCE + '^').decode().strip() == PRIOR, 'Correction parent')
|
|
require(sha(payload['helpers/run-analysis-source3-gate-20260922.py']) == RECORDER, 'Recorder bytes')
|
|
for manifest_name, commit, count in [
|
|
('analysis-source8-s3-index-source-manifest-20260913.json', '1f8283236f8ccdefca13814003e7f046860b4f22', 7),
|
|
('analysis-source8-s3-index-correction-source-manifest-20260913.json', PRIOR, 2),
|
|
]:
|
|
manifest = document(payload['notes/' + manifest_name])
|
|
require(manifest['source'] == commit and len(manifest['files']) == count, 'Historical source artifact manifest')
|
|
for item in manifest['files']:
|
|
raw = git(repo, 'show', commit + ':' + item['path'])
|
|
require(len(raw) == item['bytes'] and sha(raw) == item['sha256'] and git(repo, 'rev-parse', commit + ':' + item['path']).decode().strip() == item['git_blob'], 'Historical source artifact: ' + item['path'])
|
|
names = re.findall(r'^([^\r\n]+): test\r?$', read('list-fixed-1b1c3e3.log').decode(), re.M)
|
|
old_names = re.findall(r'^([^\r\n]+): test\r?$', read('list-90fae148.log').decode(), re.M)
|
|
require(len(names) == len(set(names)) == 167 and len(old_names) == len(set(old_names)) == 166, 'Actual listing sizes')
|
|
qualified_new = 'language::analysis_source::tests::' + NEW
|
|
require(set(names) == set(old_names) | {qualified_new} and qualified_new not in old_names, 'Retained166 plus one new case')
|
|
require(len([n for n in names if 'language::analysis_source' in n]) == 59 and len([n for n in names if 'language::raw_tokens' in n]) == 1, 'Typed/token listing counts')
|
|
for module, count in [('index', 9), ('update', 5)]:
|
|
path = f'crates/oa-core/src/language/analysis_source/{module}/tests.rs'
|
|
authored = [f'language::analysis_source::{module}::tests::{name}' for name in re.findall(r'#\[test\]\s*fn (\w+)\(', blobs[path].decode())]
|
|
require(len(authored) == count and set(authored) == {n for n in names if n.startswith(f'language::analysis_source::{module}::tests::')}, 'Source-derived membership: ' + module)
|
|
selectors = {'stack-fixed-original-1b1c3e3': STACK, 'stack-fixed-shapes-1b1c3e3': NEW, 'stack-fixed-paths-1b1c3e3': PATHS, 'typed-fixed-1b1c3e3': 'language::analysis_source', 'token-fixed-1b1c3e3': 'language::raw_tokens', 'list-fixed-1b1c3e3': None, 'strict-fixed-1b1c3e3': 'clippy'}
|
|
environment, artifacts, last_end = None, {}, None
|
|
for stem, selector in selectors.items():
|
|
record, log = doc(stem + '.result.json'), read(stem + '.log').decode()
|
|
require(record['source'] == record['head_after'] == SOURCE and type(record['exit']) is int and record['exit'] == 0 and record['changed_inputs'] == [], 'Clean source/result: ' + stem)
|
|
require(record['inputs'] == stem + '.inputs.json' and doc(record['inputs']) == {'source': SOURCE, 'inputs': expected}, 'Exact538 source bindings: ' + stem)
|
|
require(record['launcher_sha256'] == RECORDER, 'Recorded launcher')
|
|
start, end = (datetime.fromisoformat(record[k]) for k in ['start', 'end'])
|
|
require(start.tzinfo is not None and end.tzinfo is not None and start <= end and (last_end is None or last_end <= start), 'Closed ordered gate times')
|
|
last_end = end
|
|
if environment is None:
|
|
environment = record['environment']
|
|
require(record['environment'] == environment and environment['CARGO_BUILD_JOBS'] == '1' and PureWindowsPath(environment['CARGO_TARGET_DIR']).name == 'analysis-checked-save-target-20260913', 'Recorded environment')
|
|
if selector == 'clippy':
|
|
command = ['cargo', 'clippy', '--locked', '--offline', '-p', 'oa-core', '--all-targets', '--', '-D', 'warnings']
|
|
require(record['artifacts'] == [] and 'Finished `dev` profile [unoptimized]' in log and not re.search(r'^\s*(warning|error)(\[|:)', log, re.M), 'Closed clean strict log')
|
|
selected = []
|
|
else:
|
|
require(len(record['artifacts']) == 1, 'One recorded test artifact')
|
|
artifact = record['artifacts'][0]
|
|
emitted = re.findall(r'Running unittests [^\r\n]+ \(([^\r\n]+\.exe)\)', log)
|
|
require(len(emitted) == 1 and PureWindowsPath(emitted[0]) == PureWindowsPath(artifact['path']) and artifact['bytes'] > 0 and re.fullmatch('[0-9a-f]{64}', artifact['sha256']), 'Recorded executable/log binding')
|
|
artifacts[stem] = artifact
|
|
if selector is None:
|
|
command = PREFIX + ['--', '--list']
|
|
selected = names
|
|
require(record['listing_members'] == names and record['listing_count'] == 167 and re.findall(r'^(\d+) tests, (\d+) benchmarks\s*$', log, re.M) == [('167', '0')], 'Listing receipt and summary')
|
|
else:
|
|
command = PREFIX + [selector, '--', '--test-threads=1']
|
|
selected = [name for name in names if selector in name]
|
|
rows = re.findall(r'^test ([^\r\n]+) \.\.\. (ok|FAILED|ignored)\r?$', log, re.M)
|
|
require(rows == [(name, 'ok') for name in selected], 'Exact ordered runtime results: ' + stem)
|
|
require(re.findall(r'^test result: ok\. (\d+) passed; (\d+) failed; (\d+) ignored; (\d+) measured; (\d+) filtered out;', log, re.M) == [(str(len(selected)), '0', '0', '0', str(167-len(selected)))], 'Runtime summary')
|
|
require(record['command'] == command, 'Exact command: ' + stem)
|
|
if selector is not None:
|
|
require(record['listing_count'] == 0 and record['listing_members'] == [], 'Non-list metadata')
|
|
saved = closure['gates'][stem]
|
|
require([saved[k] for k in ['command', 'exit', 'start', 'end', 'names']] == [command, 0, record['start'], record['end'], selected], 'Closure gate facts')
|
|
require(saved['pins'] == {stem+s: sha(read(stem+s)) for s in ['.inputs.json', '.log', '.result.json']}, 'Closure raw pins')
|
|
require(artifacts['stack-fixed-original-1b1c3e3'] == artifacts['stack-fixed-shapes-1b1c3e3'] == artifacts['stack-fixed-paths-1b1c3e3'], 'First focused build receipt')
|
|
require(artifacts['typed-fixed-1b1c3e3'] == artifacts['token-fixed-1b1c3e3'] == artifacts['list-fixed-1b1c3e3'], 'Final restored clean build receipt')
|
|
require([closure[k] for k in ['source', 'parent', 'verified_inputs', 'listing', 'typed_pass', 'index_pass', 'update_pass', 'token_pass', 'strict_exit']] == [SOURCE, PRIOR, 538, 167, 59, 9, 5, 1, 0], 'Closure counts')
|
|
for stem, mode in [('list-90fae148', 'list'), ('typed-90fae148', 'failed')]:
|
|
record, log = doc(stem + '.result.json'), read(stem + '.log').decode()
|
|
require(record['source'] == record['head_after'] == PRIOR and record['changed_inputs'] == [] and record['launcher_sha256'] == RECORDER, 'Historical frozen source')
|
|
require(doc(stem + '.inputs.json') == {'source': PRIOR, 'inputs': prior_inputs}, 'Historical538 inputs')
|
|
if mode == 'list':
|
|
require(record['exit'] == 0 and record['listing_members'] == old_names and record['listing_count'] == 166 and record['command'] == PREFIX + ['--', '--list'], 'Historical listing')
|
|
else:
|
|
require(record['exit'] == OVERFLOW and record['command'] == PREFIX + ['language::analysis_source', '--', '--test-threads=1'] and 'STATUS_STACK_OVERFLOW' in log and STACK + ' ...' in log and 'test result:' not in log, 'Historical aborted gate')
|
|
selected = [n for n in old_names if 'language::analysis_source' in n]
|
|
failing = 'language::analysis_source::index::tests::' + STACK
|
|
rows = re.findall(r'^test ([^\r\n]+) \.\.\. (ok|FAILED|ignored)\r?$', log, re.M)
|
|
require(rows == [(n, 'ok') for n in selected[:selected.index(failing)]] and 'running 58 tests' in log, 'Historical completed prefix before abort')
|
|
dirty = ['stack-diag-01-dirty', 'stack-diag-02-dirty', 'stack-probe-sum-01-dirty', 'stack-probe-if-01-dirty', 'stack-probe-power-01-dirty', 'stack-probe-trailing-01-dirty']
|
|
for index, stem in enumerate(dirty):
|
|
capture, result, log = doc(stem + '.inputs.json'), doc(stem + '.result.json'), read(stem + '.log').decode()
|
|
diagnostic = index < 2
|
|
commit, original = (PRIOR, prior_blobs) if diagnostic else (SOURCE, blobs)
|
|
require(capture['head'] == commit and result['changed'] == [], 'Dirty capture identity/stability')
|
|
patched = apply_recorded_diff(original, capture['dirty'])
|
|
expected_paths = {'crates/oa-core/src/language/analysis_source/index/tests.rs'} if diagnostic else {'crates/oa-core/src/language/analysis_source/tests.rs'}
|
|
if index == 1:
|
|
expected_paths.add('crates/oa-core/src/language/analysis_source/syntax.rs')
|
|
require(set(patched) == expected_paths, 'Bounded diagnostic paths')
|
|
for path, raw in original.items():
|
|
require(capture['inputs'][path] == sha(patched.get(path, raw)), 'Reconstructed diagnostic input: ' + path)
|
|
expected_filter = STACK if diagnostic else 'diagnostic_malformed_cleanup_on_128k_stack'
|
|
require(capture['command'] == PREFIX + [expected_filter, '--', '--test-threads=1', '--nocapture'], 'Diagnostic command')
|
|
if diagnostic:
|
|
require(result['exit'] == OVERFLOW and 'STATUS_STACK_OVERFLOW' in log and 'STAGE failed builds dropped' in log and 'STAGE finished' not in log, 'Diagnostic abort')
|
|
if index == 1:
|
|
require('STAGE node rejecting depth 129 before kind drop' in log and 'STAGE node rejected kind dropped' not in log, 'Isolated rejected-kind cleanup')
|
|
else:
|
|
case = index - 2
|
|
require(result['exit'] == 0 and f'PROBE before malformed case {case}' in log and f'PROBE after malformed case {case}:' in log and '1 passed; 0 failed; 0 ignored' in log, 'Dirty probe result/case')
|
|
return {'source': SOURCE, 'verified_git_inputs': 538, 'listing': 167, 'typed_pass': 59, 'index_pass': 9, 'update_pass': 5, 'token_pass': 1, 'strict_exit': 0, 'historical_overflow_retained': True, 'dirty_diagnostics': 2, 'dirty_direct_parser_probes_pass': 4, 'recorded_test_artifacts': artifacts, 'scope': 'Private S3 only; no full-core runtime/public8/integration/native/release acceptance. Recorded binary identities verified against receipts, not rehashed executable bytes; binaries intentionally absent.'}
|
|
|
|
|
|
def verify_package(directory):
|
|
manifest = document((directory / 'manifest.json').read_bytes())
|
|
require(manifest['source'] == SOURCE and manifest['archive_sha256'] == ZIP_SHA, 'Outer manifest identity')
|
|
names = [item['path'] for item in manifest['files']]
|
|
require(set(names) == {'.gitattributes', 'README.md', 'verify.py', 'negative_controls.py', 'checks.json', 'evidence.zip'} and len(names) == len(set(names)), 'Outer manifest membership')
|
|
for item in manifest['files']:
|
|
raw = (directory / item['path']).read_bytes()
|
|
require(len(raw) == item['bytes'] and sha(raw) == item['sha256'], 'Outer manifest bytes: ' + item['path'])
|
|
return archive_payload((directory / 'evidence.zip').read_bytes())
|
|
|
|
|
|
def main():
|
|
require(__debug__, 'Optimized Python refused')
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument('--repo', type=Path, required=True, help='Git repo containing immutable source commits; current checkout is not used')
|
|
parser.add_argument('--evidence-dir', type=Path, default=Path(__file__).resolve().parent)
|
|
args = parser.parse_args()
|
|
print(json.dumps(audit(args.repo, verify_package(args.evidence_dir)), indent=2))
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main()
|