diff --git a/research/h25-v03-prefix-supervision/ARTIFACTS.json b/research/h25-v03-prefix-supervision/ARTIFACTS.json new file mode 100644 index 0000000000..53ee79ee9a --- /dev/null +++ b/research/h25-v03-prefix-supervision/ARTIFACTS.json @@ -0,0 +1,441 @@ +{ + "schema": "prefix-supervision-export-artifacts-v1", + "scope": "Exact complete archive except this manifest; no deployment/runtime/scientific admission.", + "files": [ + { + "path": "EQUIVALENCE.json", + "bytes": 1801, + "sha256": "0830be293a3dc25d18a4d4a25610139bded4e8ac9eabf8629e29461506ccb233" + }, + { + "path": "LICENSE", + "bytes": 11357, + "sha256": "c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4" + }, + { + "path": "NOTICE.md", + "bytes": 1262, + "sha256": "458c9fd9939474c9ace7a650732efe836cc5e8bbae22cd1484230e5fa569b425" + }, + { + "path": "README.md", + "bytes": 8214, + "sha256": "2d39d34a1e3d6401df62ef2b7b8ab84b08230517427943b9662252c9ffd1a5f0" + }, + { + "path": "REPLAY-SCOPE.json", + "bytes": 1309, + "sha256": "17fc5c1479228ccdee6cdb3dab5d7473a4606f3b13b49b0f6daacf1a5a7ce905" + }, + { + "path": "SOURCE-ORIGIN.json", + "bytes": 38756, + "sha256": "7f52e3291f219518730b3373cf385648ed323dd47415376ee59f305bf8046ec0" + }, + { + "path": "SOURCES.json", + "bytes": 584, + "sha256": "911ffe8b456c49ccd19ee42c8e21b226a56dacba515e857300aa28cc1db87be7" + }, + { + "path": "TASK.json", + "bytes": 5047, + "sha256": "96cf120cf81b8de94c799964b56616f0c55099558a2f28b6e4f0ea1d7a82444b" + }, + { + "path": "VERIFY.json", + "bytes": 778, + "sha256": "ac503db5871c8ffb91c6c2ac2991b655a55d07b921941ff262cd1b30b21053f0" + }, + { + "path": "basis/parent_closure_v1.py.txt", + "bytes": 13400, + "sha256": "2d831cff8bd444de2d6941645d571e07618ede404a1f45692b557f61494b334a" + }, + { + "path": "basis/parent_completion_v1.py.txt", + "bytes": 54168, + "sha256": "d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5" + }, + { + "path": "basis/parent_domain_v1.py.txt", + "bytes": 20456, + "sha256": "9205e14d6661fb5df0597f0ad7b2206006f2d31f01f784805f64c13875663282" + }, + { + "path": "run.py", + "bytes": 2007, + "sha256": "0d73a147089e71cb79d31179bca932925107e7bb04c92a6517040688bb8e49da" + }, + { + "path": "unit05/AUTHOR-RECEIPT-v1.json", + "bytes": 5666, + "sha256": "5cdaf0437a4453c0584859b15be288b7a0770e5a729a5eb364e2797e511028ff" + }, + { + "path": "unit05/AUTHOR-RECEIPT-v2.json", + "bytes": 10784, + "sha256": "9563e2b533ce5b06bf72911c2ad66ee389ef14119b423a7cd3309b521c4db02e" + }, + { + "path": "unit05/INPUT-GATE-EVIDENCE-LINKAGE-v1.json", + "bytes": 1393, + "sha256": "1f2d33b65f1c765d1252dd34927c83c1f9d01b0477ea5c9ff209bab4f4556399" + }, + { + "path": "unit05/INPUT-GATE-v1.json", + "bytes": 2166, + "sha256": "d768b3ea5f27c53e498b7ead16f89862dbe82258b017f11ada9e638d10acc3ad" + }, + { + "path": "unit05/PROPOSAL-SOURCE-MANIFEST-v1.json", + "bytes": 1674, + "sha256": "627fd8b7c8439851b9afcde92cbc5110b72aa957c3663dabf377482c4ebf5f44" + }, + { + "path": "unit05/REPAIR-WINDOW-v1.json", + "bytes": 1057, + "sha256": "ca419a99d405063d11404f163935f0ad97399b8f5f19c5052da3a2d5254111af" + }, + { + "path": "unit05/SOURCE-CLOSE-v1.json", + "bytes": 2797, + "sha256": "e551cf038bde7c4fc1aa8e7b29846f158632f2d1cc7bbe3981d3d35ff7831390" + }, + { + "path": "unit05/fixtures/ASSEMBLY-v1.json", + "bytes": 6294, + "sha256": "fcb9d53fbb77583a12ace09ebec7edb9e9820d7eeb00e15b6b7410888738763b" + }, + { + "path": "unit05/fixtures/DERIVATION-v2-normal.txt", + "bytes": 984, + "sha256": "d1bf5239bc1f28c3d9c0335905cc68403962ead056c55f6d85ec70e96e9ebd44" + }, + { + "path": "unit05/fixtures/DERIVATION-v2-optimized.txt", + "bytes": 984, + "sha256": "5e1c3982013b93f186fe0b6264d838afa2ce4eb71235b1f166dd7f77dd97eaf9" + }, + { + "path": "unit05/fixtures/ORCHESTRATION-v2-initial-fixture-errors-normal.txt", + "bytes": 6574, + "sha256": "883b2e4d35155f2d57b31c7c6c7740121cac9a87f98de421c3c8b18e72048e4d" + }, + { + "path": "unit05/fixtures/ORCHESTRATION-v2-initial-fixture-errors-optimized.txt", + "bytes": 6574, + "sha256": "1d9aa5d591af2337f41b4acc2b535d1e03d344ecb1dc707c19062f645df9670c" + }, + { + "path": "unit05/fixtures/ORCHESTRATION-v2-normal.txt", + "bytes": 1755, + "sha256": "8f8900c0604a2f63cb4234a16749915cdbe8d2a617b4f76dc88a9f256c10835f" + }, + { + "path": "unit05/fixtures/ORCHESTRATION-v2-optimized.txt", + "bytes": 1755, + "sha256": "fb797a332abdf3285f00365390e24c040d4d1a2f50f997f47ea3586a4b02ed70" + }, + { + "path": "unit05/fixtures/OUTER-PLAN-BILL-v2.json", + "bytes": 1383, + "sha256": "50c20cf701bebffdb774b165455c1bdadaa28583a21f333e2c182bd1fbbc2b59" + }, + { + "path": "unit05/fixtures/POLICY-REQUIREMENTS-v2.json", + "bytes": 7780, + "sha256": "eab55574022638c58c89f7468d86ec8f3b1cda0efd66050250248b49e66ac892" + }, + { + "path": "unit05/fixtures/PROPOSAL-TESTS-v1-normal.txt", + "bytes": 1477, + "sha256": "488d38cf7147d94811dab07bc385f4339b999d2da1f0b0d18de7692f9dd417a8" + }, + { + "path": "unit05/fixtures/PROPOSAL-TESTS-v1-optimized.txt", + "bytes": 1477, + "sha256": "77ccaed42375657de3639d0b1cba77a8de25ac4ae8ab808013bab519b652d98b" + }, + { + "path": "unit05/fixtures/PROPOSAL-TESTS-v2-normal.txt", + "bytes": 1477, + "sha256": "b6987b739878fb854c97e959a08f291d0fd4f3a4b7d665b3c8b0340d68d74a7f" + }, + { + "path": "unit05/fixtures/PROPOSAL-TESTS-v2-optimized.txt", + "bytes": 1477, + "sha256": "488d38cf7147d94811dab07bc385f4339b999d2da1f0b0d18de7692f9dd417a8" + }, + { + "path": "unit05/fixtures/REPAIR-DELTA-v2.json", + "bytes": 1268, + "sha256": "1aec6f8bc41e8bb81f3d440d6b643f27e5a0aededa6fb406b2ab07fbddbe5703" + }, + { + "path": "unit05/fixtures/V1-REJECTION-v1.json", + "bytes": 1226, + "sha256": "e1978317502606bde5baa67698c2ed9227032192069e49c8b08ebee6eaec9a96" + }, + { + "path": "unit05/fixtures/run_proposal_pure_tests_v1.py", + "bytes": 3836, + "sha256": "2cd493991834294bc016510e11dbfd0f14049fd7915632970c28a10e3b51a790" + }, + { + "path": "unit05/fixtures/test_derivation_pure_v2.py", + "bytes": 5538, + "sha256": "37260fe75234e3b4565cea65fba6c4374cd0a30a407b5cfaa670f198df5b8a82" + }, + { + "path": "unit05/fixtures/test_new_orchestration_v2.py", + "bytes": 12170, + "sha256": "7193e4eadf500a1a1e630236dbbda73703e20cfc7cbc7ab174e18636a5d6362c" + }, + { + "path": "unit05/fixtures/v1-frozen/AUTHOR-RECEIPT-v1.json", + "bytes": 5666, + "sha256": "5cdaf0437a4453c0584859b15be288b7a0770e5a729a5eb364e2797e511028ff" + }, + { + "path": "unit05/fixtures/v1-frozen/fixtures/ASSEMBLY-v1.json", + "bytes": 6294, + "sha256": "fcb9d53fbb77583a12ace09ebec7edb9e9820d7eeb00e15b6b7410888738763b" + }, + { + "path": "unit05/fixtures/v1-frozen/fixtures/PROPOSAL-TESTS-v1-normal.txt", + "bytes": 1477, + "sha256": "488d38cf7147d94811dab07bc385f4339b999d2da1f0b0d18de7692f9dd417a8" + }, + { + "path": "unit05/fixtures/v1-frozen/fixtures/PROPOSAL-TESTS-v1-optimized.txt", + "bytes": 1477, + "sha256": "77ccaed42375657de3639d0b1cba77a8de25ac4ae8ab808013bab519b652d98b" + }, + { + "path": "unit05/fixtures/v1-frozen/fixtures/V1-REJECTION-v1.json", + "bytes": 1226, + "sha256": "e1978317502606bde5baa67698c2ed9227032192069e49c8b08ebee6eaec9a96" + }, + { + "path": "unit05/fixtures/v1-frozen/fixtures/run_proposal_pure_tests_v1.py", + "bytes": 3836, + "sha256": "2cd493991834294bc016510e11dbfd0f14049fd7915632970c28a10e3b51a790" + }, + { + "path": "unit05/fixtures/v1-frozen/implementation/epoch_copy_v5.py", + "bytes": 82957, + "sha256": "4f459d0336d59975df787c24373e18dad4044c3a24137392e890115f811b3211" + }, + { + "path": "unit05/fixtures/v1-frozen/implementation/epoch_schema_v5.py", + "bytes": 30668, + "sha256": "b89a789654be87bde40a47300f4d9702dce2b90e6ab3be9a2025f6d8041b3e9a" + }, + { + "path": "unit05/fixtures/v1-frozen/implementation/group01_evidence_v1.py", + "bytes": 15610, + "sha256": "05ec6a63c57340ba929aea1fab71b096efc143e099346640f6def41310bd3e25" + }, + { + "path": "unit05/fixtures/v1-frozen/implementation/h25_parent_supervisor.py", + "bytes": 23047, + "sha256": "cfb09a18dd10b597cc6d5a8139ee769bef679bc44ae029329755e3d97b055075" + }, + { + "path": "unit05/fixtures/v1-frozen/implementation/parent_closure_v1.py", + "bytes": 13463, + "sha256": "a15424f14baa3d484fe04bfbe7e449c32561c866dbaca2c1b5f646dfb377ed1f" + }, + { + "path": "unit05/fixtures/v1-frozen/implementation/parent_completion_v1.py", + "bytes": 54168, + "sha256": "d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5" + }, + { + "path": "unit05/fixtures/v1-frozen/implementation/parent_domain_v1.py", + "bytes": 23942, + "sha256": "a51264289803b4b17bb262f2460ddd4ed72500aaa21e5eb80fa2db4583689361" + }, + { + "path": "unit05/fixtures/v1-frozen/implementation/test_v03_prefix_supervisor_v1.py", + "bytes": 6381, + "sha256": "b5f8055da6f9a48e85a4eed0868f7076859adca317e0691e5b2336e0bdb58d52" + }, + { + "path": "unit05/fixtures/v1-frozen/implementation/v03_integrated_constructor_v1.py", + "bytes": 6087, + "sha256": "5e08ff84298fe1249be5e8790ea259e6179048f4736fb7eafdb6e170b8bc1cf9" + }, + { + "path": "unit05/fixtures/v1-frozen/implementation/v03_prefix_derivation_v1.py", + "bytes": 3830, + "sha256": "4591de196d008f0fdc094f4a74b19a84c095e2def5d28dbdaea7085e4630f8a7" + }, + { + "path": "unit05/fixtures/v1-frozen/implementation/v03_prefix_supervisor_v1.py", + "bytes": 35491, + "sha256": "75bef7834fe7278638010f79a8efca84b49b1e48320d3c8ac2d93cadea5a8262" + }, + { + "path": "unit05/fixtures/v1-frozen/implementation/v03_source_refusal_observer_v1.py", + "bytes": 14205, + "sha256": "abf25690d3bee4a9783ee504567c29f7fb47da670e0ec95f57cb5944bf57264f" + }, + { + "path": "unit05/fixtures/v2-pre-close-model/ORCHESTRATION-v2-normal.txt", + "bytes": 1483, + "sha256": "d663d2e3e1e24f6fa8a12b31f9a5e8ee72b33fe6b1adaef2b3d31ee620fcaadb" + }, + { + "path": "unit05/fixtures/v2-pre-close-model/ORCHESTRATION-v2-optimized.txt", + "bytes": 1483, + "sha256": "82f7307a61300a8a363c4b1ce3c1c478e8f0a9cfbefcd6d32192c31bbcedbc33" + }, + { + "path": "unit05/fixtures/v2-pre-close-model/test_new_orchestration_v2.py", + "bytes": 10338, + "sha256": "251bc23c4b7ad15526bdfe0bdb3b053848f2fffc0fe8210b386a898f1838c610" + }, + { + "path": "unit05/implementation/epoch_copy_v5.py", + "bytes": 82957, + "sha256": "4f459d0336d59975df787c24373e18dad4044c3a24137392e890115f811b3211" + }, + { + "path": "unit05/implementation/epoch_schema_v5.py", + "bytes": 30668, + "sha256": "b89a789654be87bde40a47300f4d9702dce2b90e6ab3be9a2025f6d8041b3e9a" + }, + { + "path": "unit05/implementation/group01_evidence_v1.py", + "bytes": 15610, + "sha256": "05ec6a63c57340ba929aea1fab71b096efc143e099346640f6def41310bd3e25" + }, + { + "path": "unit05/implementation/h25_parent_supervisor.py", + "bytes": 23047, + "sha256": "cfb09a18dd10b597cc6d5a8139ee769bef679bc44ae029329755e3d97b055075" + }, + { + "path": "unit05/implementation/parent_closure_v1.py", + "bytes": 13463, + "sha256": "a15424f14baa3d484fe04bfbe7e449c32561c866dbaca2c1b5f646dfb377ed1f" + }, + { + "path": "unit05/implementation/parent_completion_v1.py", + "bytes": 54168, + "sha256": "d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5" + }, + { + "path": "unit05/implementation/parent_domain_v1.py", + "bytes": 23942, + "sha256": "a51264289803b4b17bb262f2460ddd4ed72500aaa21e5eb80fa2db4583689361" + }, + { + "path": "unit05/implementation/test_v03_prefix_supervisor_v1.py", + "bytes": 6381, + "sha256": "b5f8055da6f9a48e85a4eed0868f7076859adca317e0691e5b2336e0bdb58d52" + }, + { + "path": "unit05/implementation/v03_integrated_constructor_v1.py", + "bytes": 6087, + "sha256": "5e08ff84298fe1249be5e8790ea259e6179048f4736fb7eafdb6e170b8bc1cf9" + }, + { + "path": "unit05/implementation/v03_integrated_constructor_v2.py", + "bytes": 6111, + "sha256": "a80a60b390bc60e9bc434b79cda5ae6db88e4f0c6c7436de9adfe1f48a2045b1" + }, + { + "path": "unit05/implementation/v03_prefix_derivation_v1.py", + "bytes": 3830, + "sha256": "1ed813148c10d5fbd3cd6781d51eca650a347eda7a6323f581d740e6ea9cb6e2" + }, + { + "path": "unit05/implementation/v03_prefix_supervisor_v1.py", + "bytes": 36954, + "sha256": "f97b07d4a5f461d4134a2bdf4cfcc28da12acc7e7144c18f6cc0a017cdee86f6" + }, + { + "path": "unit05/implementation/v03_source_refusal_observer_v1.py", + "bytes": 14205, + "sha256": "abf25690d3bee4a9783ee504567c29f7fb47da670e0ec95f57cb5944bf57264f" + }, + { + "path": "unit05/proposal/closure-allowance.py.fragment", + "bytes": 63, + "sha256": "c3b3aee32015105b5fe4fe1a41183e2a2ec2599b1f2dca2b73fb889f823f563c" + }, + { + "path": "unit05/proposal/domain-prefix-accessor.py.fragment", + "bytes": 3484, + "sha256": "5397f59e65cef18d03581afe1c2727a288506248aaabc0dd88c06811e810f6b1" + }, + { + "path": "unit05/proposal/test_v03_prefix_supervisor_v1.py", + "bytes": 6381, + "sha256": "b5f8055da6f9a48e85a4eed0868f7076859adca317e0691e5b2336e0bdb58d52" + }, + { + "path": "unit05/proposal/v03_prefix_derivation_v1.py", + "bytes": 3830, + "sha256": "4591de196d008f0fdc094f4a74b19a84c095e2def5d28dbdaea7085e4630f8a7" + }, + { + "path": "unit05/proposal/v03_prefix_supervisor_v1.py", + "bytes": 35491, + "sha256": "75bef7834fe7278638010f79a8efca84b49b1e48320d3c8ac2d93cadea5a8262" + }, + { + "path": "unit05/review-derivation-closure-input-gate-v1.json", + "bytes": 4504, + "sha256": "9063c6d4132df9564b382e153de71770350662a31c67cd7df93e3117546ef23d" + }, + { + "path": "unit05/review-derivation-closure-input-gate-v1.md", + "bytes": 5370, + "sha256": "da729f70f5a4198dacf9e8813943758a45d0f1035f061bd7d85dfc437b1dc9d8" + }, + { + "path": "unit05/review-derivation-closure-v1.json", + "bytes": 7654, + "sha256": "efe6101d6b2ca2a954fa97d039740f2c4e52aafe6ac5e3d9d2e61867ebe76ebf" + }, + { + "path": "unit05/review-derivation-closure-v1.md", + "bytes": 8222, + "sha256": "bc00b661c148552c1f46954df182b5e4a110a1e08522e789f36e2a250fa22f4a" + }, + { + "path": "unit05/review-supervision-domain-input-gate-RESTORATION-v1.json", + "bytes": 1387, + "sha256": "edc33f4f2f9d83ac79aced451f5b0edd49cb250bc920b9935667094238b7c84d" + }, + { + "path": "unit05/review-supervision-domain-input-gate-v1.json", + "bytes": 5449, + "sha256": "7367c65eadb755719696d72358b81a043e53626b978f3b523baaea3fcaa9d7fc" + }, + { + "path": "unit05/review-supervision-domain-input-gate-v1.md", + "bytes": 10242, + "sha256": "21c02459c76b114caffd77ff6310c3c9933f4d8c627dbc5b667001b1bb5b5153" + }, + { + "path": "unit05/review-supervision-domain-v1.json", + "bytes": 8686, + "sha256": "9ee2baceb9a3f70f465c433e6f00b9bf69d028f685c1161fddfa720c5c9ba0b1" + }, + { + "path": "unit05/review-supervision-domain-v1.md", + "bytes": 14835, + "sha256": "467e6aeb70d98f45a73489b2041477d1cc95d02f510b033cb91b3e84337baaa5" + }, + { + "path": "verify.py", + "bytes": 2682, + "sha256": "54ea85a47da4dd23791c70b88659a2c18a7287039f8c506b5bd31f79416cbeed" + } + ] +} diff --git a/research/h25-v03-prefix-supervision/EQUIVALENCE.json b/research/h25-v03-prefix-supervision/EQUIVALENCE.json new file mode 100644 index 0000000000..edf7062a0d --- /dev/null +++ b/research/h25-v03-prefix-supervision/EQUIVALENCE.json @@ -0,0 +1,47 @@ +{ + "schema": "prefix-supervision-export-equivalence-v1", + "frozen_author_receipt_sha256": "9563e2b533ce5b06bf72911c2ad66ee389ef14119b423a7cd3309b521c4db02e", + "supervisor_sha256": "f97b07d4a5f461d4134a2bdf4cfcc28da12acc7e7144c18f6cc0a017cdee86f6", + "all_copies_byte_exact": true, + "source_files_modified": false, + "domain_delta": "Exact original20456B + two LF + exact3484B new accessor fragment =23942B.", + "closure_delta": "Sole63-byte mutable-name dictionary insertion; original functions unchanged.", + "production_parent_byte_exact": true, + "production_function_preservation": [ + { + "module": "parent_domain_v1", + "original_function_class_count": 15, + "all_original_function_class_source_segments_exact": true + }, + { + "module": "parent_closure_v1", + "original_function_class_count": 10, + "all_original_function_class_source_segments_exact": true + }, + { + "module": "parent_completion_v1", + "original_function_class_count": 19, + "all_original_function_class_source_segments_exact": true + } + ], + "runtime_path_adaptations": [ + { + "module": "unit05/fixtures/run_proposal_pure_tests_v1.py", + "assignments": { + "BASE": "package/unit05", + "IMPL": "package/unit05/implementation" + } + }, + { + "module": "unit05/fixtures/test_new_orchestration_v2.py", + "assignments": { + "BASE": "package/unit05", + "IMPL": "package/unit05/implementation" + } + } + ], + "supplied_path_adapter": "The unchanged supplied proposal harness already binds the new fixture Path name to its allowlisted two source files. This export preserves that fixture behavior.", + "test_function_semantics_changed": false, + "original_modules_imported": false, + "original_functions_executed": false +} diff --git a/research/h25-v03-prefix-supervision/LICENSE b/research/h25-v03-prefix-supervision/LICENSE new file mode 100644 index 0000000000..261eeb9e9f --- /dev/null +++ b/research/h25-v03-prefix-supervision/LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/research/h25-v03-prefix-supervision/NOTICE.md b/research/h25-v03-prefix-supervision/NOTICE.md new file mode 100644 index 0000000000..3494b7e1d9 --- /dev/null +++ b/research/h25-v03-prefix-supervision/NOTICE.md @@ -0,0 +1,7 @@ +# License and attribution + +Chris R / Clear1nsight, with substantial ChatGPT Pro / OpenAI Codex / GPT-6.1 Sol Max construction, finite-test, independent source-review and archive assistance. Preserve original source authors, PR6321/6029/5864 lineage, unpaidmoon Cursor/Grok PR6339, and Douglas R. Colkitt's native/circuit/verification and research-package lineage. Agent review is conditional source/delta review, distinct from human, proof-kernel or original runtime qualification. + +New authored package glue is Apache-2.0 under LICENSE. Every retained source file, test, fragment and historical report keeps its original bytes and notices. Source-specific terms are preserved. The packet contains Python source/data and inert references, with no compiler binary, native payload, GCC header corpus or runtime image. + +No private Pro chat, prompt, response or assessment is exported. Consultation hashes and historical source paths in frozen review records remain external documentary context, not live replay inputs or a claim of full source-history availability. The initial12/repaired13file assembly is not complete deployable closure. POLICY-REQUIREMENTS-v2.json is an unauthenticated requirements table, not a genuine policy or fabricated runtime capability. diff --git a/research/h25-v03-prefix-supervision/README.md b/research/h25-v03-prefix-supervision/README.md new file mode 100644 index 0000000000..a8d975f756 --- /dev/null +++ b/research/h25-v03-prefix-supervision/README.md @@ -0,0 +1,48 @@ +# Conditional non-minting prefix supervision and exit1 cleanup data + +This frozen Unit05 source increment retains a conditional prefix supervisor, a new appended exit1 cleanup-data accessor, a sole63-byte closure allowance, bounded external-plan endpoint custody, and independently reviewed rejection/repair evidence. It registers only 10 supplied new accessor/static methods plus 13 new orchestration methods per profile. They execute only named new function AST bodies with explicit fake operational services. Original functions and the full supervisor are never imported or executed. + +The final supervisor is 36,954 bytes, SHA256 `f97b07d4a5f461d4134a2bdf4cfcc28da12acc7e7144c18f6cc0a017cdee86f6`. AUTHOR-RECEIPT-v2 SHA256 is `9563e2b533ce5b06bf72911c2ad66ee389ef14119b423a7cd3309b521c4db02e`. SOURCE-CLOSE records the closed Unit05 source clock and late parent bookkeeping. Every retained file is byte-exact; SOURCE-ORIGIN provides origin/hash mappings and EQUIVALENCE records preservation and the explicit path-only fixture adapter. + +## Exact source contribution + +`parent_domain_v1.py` is the exact 20,456-byte original plus two LF bytes and the exact 3,484-byte `prefix_exit1_terminal_facts` fragment. Every original function remains unchanged. The accessor exposes conditional original-owned exit1 cleanup DATA and grants no refusal, production-completion or runtime credential. `parent_closure_v1.py` differs only by the 63-byte mutable-name allowance for this new supervisor. The 54,168-byte production parent and original mint route remain byte-exact. Original basis files are under `basis/` and never loaded. + +The initial proposal required the outer plan pin within its own embedded inventory and had an unavailable self-hash construction. The initial constructor's byte-key environment dictionary also failed the original closure data predicate. Exact v1 assembly, sources, rejection and fixture outputs remain under unit05/fixtures/v1-frozen and adjacent records. One declared repair window produced the immutable environment successor and the supervisor's separately authenticated outer-plan treatment. No mathematical fixed-point impossibility claim is made. + +The repaired supervisor keeps one initial decoded raw plan plus three bounded endpoint raw slots, reads the actual separately pinned plan with existing bounded APIs, checks equality, rejects exact-path and actual-inode aliases with the inner inventory, and charges the separate plan row within the original parent 8192-row limit. Endpoint equality does not prove the C07 lifetime interval. OUTER-PLAN-BILL-v2 distinguishes explicit API calls from complete physical read/hash cost, retains all bounds and states that maximal fit is unproved. + +The orchestration fixtures distinguish primary identity from cleanup errors, uncertain acquisition, helper abort from ordinary per-FD close failure, both known-FD close attempts, single-use control, bounded plan snapshots/aliases and partial raw-copy retention. The earlier mislabeled close model and initial fixture errors remain retained. All process/domain/copy/filesystem/timer/native services are fakes. Raw plan retention covers only bytes returned by the helper; actual read_verified may reject changed bytes before returning them. These tests prove no actual process/descriptor/kernel ownership, complete original control family or current runtime authority. + +## Replay boundary and dependencies + +Base `7c49fe32c55de02c2c873655c804b16e4c3fef0a`; historical portable-replay card, explicitly changed publication scope, partial outcome. SOURCES.json pins only base/card/selected-record Git provenance. Every live replay input is package-local; VERIFY.inputs is empty. Retained source availability is not a complete original Git-history claim. Historical paths and consultation hashes are documentary, and no private consultation transcript/prompt/response is exported. + +From the repository root, with standard-library Python 3.12: + +```sh +python3.12 -B scripts/research_package.py --package research/h25-v03-prefix-supervision --check-only +python3.12 -B scripts/research_package.py --package research/h25-v03-prefix-supervision +``` + +The two registered commands use -I -B -S, normal and -O, with 60-second limits. New verify.py checks complete archive/hash identity plus exact production byte/AST preservation. New run.py loads only that checker and the two supplied NEW fixture modules, rebinds only their BASE/IMPL globals, and invokes the unchanged supplied 10-method harness and 13-method orchestration suite. The supplied harness already restricts its Path adapter to the two local source files. The appended accessor and three new supervisor functions are extracted as AST by the frozen fixtures and receive explicit fake globals; no original module, original function, full supervisor, actual Popen/domain/native/namespace/compiler or target runs. REPLAY-SCOPE.json documents the exact boundary. + +Validation outputs are saved OUTSIDE the final packet under the publication worktree's validation/ directory. This avoids changing the packet inventory after a passing cold copy. The separate export receipt records final manifest/file identities, actual commands, results and log hashes. No historical or full original suites are registered. + +## Incomplete deployment and adjacent contribution + +The initial 12/repaired 13-file assembly is retained for source review and is **not complete deployable closure**. Required transitive modules, including epoch_parent_v5, original_build_provenance_v5 and group01_original_predicates_v1 plus native/stdlib dependencies, are absent and never imported. Actual receiver policy, runtime module identities and 48-module/512-global fit remain unestablished. POLICY-REQUIREMENTS-v2.json explicitly has no actual module objects, no genuine schema blob policy and null runtime policy identities; it supplies requirements only. No capability is fabricated. + +Adjacent publication #1, **PR URL pending parent publication**, exports the new pure derivation verifier at SHA256 `1ed813148c10d5fbd3cd6781d51eca650a347eda7a6323f581d740e6ea9cb6e2` and immutable environment constructor_v2 at SHA256 `a80a60b390bc60e9bc434b79cda5ae6db88e4f0c6c7436de9adfe1f48a2045b1`. Their frozen bodies are retained here as inert assembly/source provenance, and their 8 pure derivation methods are not registered here. The adjacent package is not an external live dependency of this fake/AST-only replay. + +## Status and costs + +Conditional source contribution only. Authenticated pre-import enclosing-parent bootstrap, actual complete transitive receiver policy/census, C05 complete runtime determinant inventory/cap/cost/channel proof, C07 immutable lifetime interval, current source/native/stage/command/funding/execution admission and actual enclosing-parent exit remain absent. full_C05=false, full_V03=false, runtime_qualification=false and original activity credit added 0. Original 43.5% / 22 of 49, stage 2/10, milestones 1/10, 24 components and 52 helpers remain unchanged. Goal service separately remains paused and is not queried or changed. Costs, including preparation/review/publication and all omitted physical work, remain OPEN_NOT_ZERO. Unit05 is closed; this packet resets no timer and authorizes no new implementation or execution. + +## Open next questions + +TASK.json gives structured questions and blockers. The smallest distinct source task is an independently authenticated fresh enclosing-parent pre-import bootstrap and a complete actual transitive receiver policy/census satisfying unchanged bounds and original mint behavior. It must also bind C05/C07/native/current runtime/funding admissions and actual parent exit. A separate complete original baseline and all named V03 controls remain unexecuted; fake fixture success is no substitute for those gates. Source work and execution require their own authorized scope. + +## Credit and licenses + +Chris R / Clear1nsight; substantial Pro / Codex / Sol Max assistance and independent agent source review; original authors, PR6321/6029/5864, unpaidmoon Cursor/Grok PR6339 and Douglas R.Colkitt lineage. See NOTICE.md and LICENSE. No live overlap/public-state refresh is claimed by this offline export preparation. diff --git a/research/h25-v03-prefix-supervision/REPLAY-SCOPE.json b/research/h25-v03-prefix-supervision/REPLAY-SCOPE.json new file mode 100644 index 0000000000..ed1476f4e7 --- /dev/null +++ b/research/h25-v03-prefix-supervision/REPLAY-SCOPE.json @@ -0,0 +1,30 @@ +{ + "schema": "prefix-supervision-replay-boundary-v1", + "accessor_static_methods": 10, + "orchestration_methods": 13, + "methods_per_profile": 23, + "other_unit05_derivation_methods_inactive": 8, + "only_new_operational_AST_targets": [ + "prefix_exit1_terminal_facts", + "_supervise", + "_source_snapshot", + "_capture" + ], + "accessor_static_method_names": [ + "test_intact_exit1_predicate", + "test_other_exit_dispositions", + "test_unclosed_fd", + "test_late_owned_child", + "test_existing_primary_identity", + "test_local_primary_identity", + "test_invalid_early_call_keeps_cleanup_phase", + "test_supervisor_has_no_mint_call", + "test_complete_observer_selected", + "test_source_gates_remain_none" + ], + "original_module_imports": false, + "full_supervisor_import": false, + "operational_services": "All PID/FD/process/domain/copy/filesystem/timer/native objects are explicit supplied test fakes; no returned fixture state is genuine capability.", + "test_paths": "Only BASE/IMPL globals rebound in the two new fixture modules. Frozen code/tests/harness unchanged.", + "unexecuted": "Full assembled candidate modules, all original functions, original closure capture, domain/Popen/native/namespace/target/bootstrap,8adjacent derivation tests and preserved old fixtures." +} diff --git a/research/h25-v03-prefix-supervision/SOURCE-ORIGIN.json b/research/h25-v03-prefix-supervision/SOURCE-ORIGIN.json new file mode 100644 index 0000000000..41e420fc3a --- /dev/null +++ b/research/h25-v03-prefix-supervision/SOURCE-ORIGIN.json @@ -0,0 +1,631 @@ +{ + "schema": "prefix-supervision-export-origin-v1", + "base_commit": "7c49fe32c55de02c2c873655c804b16e4c3fef0a", + "copies": [ + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/epoch_copy_v5.py", + "path": "unit05/implementation/epoch_copy_v5.py", + "bytes": 82957, + "sha256": "4f459d0336d59975df787c24373e18dad4044c3a24137392e890115f811b3211", + "byte_exact": true, + "scope": "Frozen candidate source/data; never imported as a module by registered replay. Only new named function AST bodies are fixture targets." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/epoch_schema_v5.py", + "path": "unit05/implementation/epoch_schema_v5.py", + "bytes": 30668, + "sha256": "b89a789654be87bde40a47300f4d9702dce2b90e6ab3be9a2025f6d8041b3e9a", + "byte_exact": true, + "scope": "Frozen candidate source/data; never imported as a module by registered replay. Only new named function AST bodies are fixture targets." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/group01_evidence_v1.py", + "path": "unit05/implementation/group01_evidence_v1.py", + "bytes": 15610, + "sha256": "05ec6a63c57340ba929aea1fab71b096efc143e099346640f6def41310bd3e25", + "byte_exact": true, + "scope": "Frozen candidate source/data; never imported as a module by registered replay. Only new named function AST bodies are fixture targets." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/h25_parent_supervisor.py", + "path": "unit05/implementation/h25_parent_supervisor.py", + "bytes": 23047, + "sha256": "cfb09a18dd10b597cc6d5a8139ee769bef679bc44ae029329755e3d97b055075", + "byte_exact": true, + "scope": "Frozen candidate source/data; never imported as a module by registered replay. Only new named function AST bodies are fixture targets." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_closure_v1.py", + "path": "unit05/implementation/parent_closure_v1.py", + "bytes": 13463, + "sha256": "a15424f14baa3d484fe04bfbe7e449c32561c866dbaca2c1b5f646dfb377ed1f", + "byte_exact": true, + "scope": "Frozen candidate source/data; never imported as a module by registered replay. Only new named function AST bodies are fixture targets." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_completion_v1.py", + "path": "unit05/implementation/parent_completion_v1.py", + "bytes": 54168, + "sha256": "d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5", + "byte_exact": true, + "scope": "Frozen candidate source/data; never imported as a module by registered replay. Only new named function AST bodies are fixture targets." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_domain_v1.py", + "path": "unit05/implementation/parent_domain_v1.py", + "bytes": 23942, + "sha256": "a51264289803b4b17bb262f2460ddd4ed72500aaa21e5eb80fa2db4583689361", + "byte_exact": true, + "scope": "Frozen candidate source/data; never imported as a module by registered replay. Only new named function AST bodies are fixture targets." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/test_v03_prefix_supervisor_v1.py", + "path": "unit05/implementation/test_v03_prefix_supervisor_v1.py", + "bytes": 6381, + "sha256": "b5f8055da6f9a48e85a4eed0868f7076859adca317e0691e5b2336e0bdb58d52", + "byte_exact": true, + "scope": "Frozen candidate source/data; never imported as a module by registered replay. Only new named function AST bodies are fixture targets." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_integrated_constructor_v1.py", + "path": "unit05/implementation/v03_integrated_constructor_v1.py", + "bytes": 6087, + "sha256": "5e08ff84298fe1249be5e8790ea259e6179048f4736fb7eafdb6e170b8bc1cf9", + "byte_exact": true, + "scope": "Frozen candidate source/data; never imported as a module by registered replay. Only new named function AST bodies are fixture targets." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_integrated_constructor_v2.py", + "path": "unit05/implementation/v03_integrated_constructor_v2.py", + "bytes": 6111, + "sha256": "a80a60b390bc60e9bc434b79cda5ae6db88e4f0c6c7436de9adfe1f48a2045b1", + "byte_exact": true, + "scope": "Frozen candidate source/data; never imported as a module by registered replay. Only new named function AST bodies are fixture targets." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_prefix_derivation_v1.py", + "path": "unit05/implementation/v03_prefix_derivation_v1.py", + "bytes": 3830, + "sha256": "1ed813148c10d5fbd3cd6781d51eca650a347eda7a6323f581d740e6ea9cb6e2", + "byte_exact": true, + "scope": "Frozen candidate source/data; never imported as a module by registered replay. Only new named function AST bodies are fixture targets." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_prefix_supervisor_v1.py", + "path": "unit05/implementation/v03_prefix_supervisor_v1.py", + "bytes": 36954, + "sha256": "f97b07d4a5f461d4134a2bdf4cfcc28da12acc7e7144c18f6cc0a017cdee86f6", + "byte_exact": true, + "scope": "Frozen candidate source/data; never imported as a module by registered replay. Only new named function AST bodies are fixture targets." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_source_refusal_observer_v1.py", + "path": "unit05/implementation/v03_source_refusal_observer_v1.py", + "bytes": 14205, + "sha256": "abf25690d3bee4a9783ee504567c29f7fb47da670e0ec95f57cb5944bf57264f", + "byte_exact": true, + "scope": "Frozen candidate source/data; never imported as a module by registered replay. Only new named function AST bodies are fixture targets." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/ASSEMBLY-v1.json", + "path": "unit05/fixtures/ASSEMBLY-v1.json", + "bytes": 6294, + "sha256": "fcb9d53fbb77583a12ace09ebec7edb9e9820d7eeb00e15b6b7410888738763b", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/DERIVATION-v2-normal.txt", + "path": "unit05/fixtures/DERIVATION-v2-normal.txt", + "bytes": 984, + "sha256": "d1bf5239bc1f28c3d9c0335905cc68403962ead056c55f6d85ec70e96e9ebd44", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/DERIVATION-v2-optimized.txt", + "path": "unit05/fixtures/DERIVATION-v2-optimized.txt", + "bytes": 984, + "sha256": "5e1c3982013b93f186fe0b6264d838afa2ce4eb71235b1f166dd7f77dd97eaf9", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/ORCHESTRATION-v2-initial-fixture-errors-normal.txt", + "path": "unit05/fixtures/ORCHESTRATION-v2-initial-fixture-errors-normal.txt", + "bytes": 6574, + "sha256": "883b2e4d35155f2d57b31c7c6c7740121cac9a87f98de421c3c8b18e72048e4d", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/ORCHESTRATION-v2-initial-fixture-errors-optimized.txt", + "path": "unit05/fixtures/ORCHESTRATION-v2-initial-fixture-errors-optimized.txt", + "bytes": 6574, + "sha256": "1d9aa5d591af2337f41b4acc2b535d1e03d344ecb1dc707c19062f645df9670c", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/ORCHESTRATION-v2-normal.txt", + "path": "unit05/fixtures/ORCHESTRATION-v2-normal.txt", + "bytes": 1755, + "sha256": "8f8900c0604a2f63cb4234a16749915cdbe8d2a617b4f76dc88a9f256c10835f", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/ORCHESTRATION-v2-optimized.txt", + "path": "unit05/fixtures/ORCHESTRATION-v2-optimized.txt", + "bytes": 1755, + "sha256": "fb797a332abdf3285f00365390e24c040d4d1a2f50f997f47ea3586a4b02ed70", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/OUTER-PLAN-BILL-v2.json", + "path": "unit05/fixtures/OUTER-PLAN-BILL-v2.json", + "bytes": 1383, + "sha256": "50c20cf701bebffdb774b165455c1bdadaa28583a21f333e2c182bd1fbbc2b59", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/POLICY-REQUIREMENTS-v2.json", + "path": "unit05/fixtures/POLICY-REQUIREMENTS-v2.json", + "bytes": 7780, + "sha256": "eab55574022638c58c89f7468d86ec8f3b1cda0efd66050250248b49e66ac892", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/PROPOSAL-TESTS-v1-normal.txt", + "path": "unit05/fixtures/PROPOSAL-TESTS-v1-normal.txt", + "bytes": 1477, + "sha256": "488d38cf7147d94811dab07bc385f4339b999d2da1f0b0d18de7692f9dd417a8", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/PROPOSAL-TESTS-v1-optimized.txt", + "path": "unit05/fixtures/PROPOSAL-TESTS-v1-optimized.txt", + "bytes": 1477, + "sha256": "77ccaed42375657de3639d0b1cba77a8de25ac4ae8ab808013bab519b652d98b", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/PROPOSAL-TESTS-v2-normal.txt", + "path": "unit05/fixtures/PROPOSAL-TESTS-v2-normal.txt", + "bytes": 1477, + "sha256": "b6987b739878fb854c97e959a08f291d0fd4f3a4b7d665b3c8b0340d68d74a7f", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/PROPOSAL-TESTS-v2-optimized.txt", + "path": "unit05/fixtures/PROPOSAL-TESTS-v2-optimized.txt", + "bytes": 1477, + "sha256": "488d38cf7147d94811dab07bc385f4339b999d2da1f0b0d18de7692f9dd417a8", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/REPAIR-DELTA-v2.json", + "path": "unit05/fixtures/REPAIR-DELTA-v2.json", + "bytes": 1268, + "sha256": "1aec6f8bc41e8bb81f3d440d6b643f27e5a0aededa6fb406b2ab07fbddbe5703", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/V1-REJECTION-v1.json", + "path": "unit05/fixtures/V1-REJECTION-v1.json", + "bytes": 1226, + "sha256": "e1978317502606bde5baa67698c2ed9227032192069e49c8b08ebee6eaec9a96", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/run_proposal_pure_tests_v1.py", + "path": "unit05/fixtures/run_proposal_pure_tests_v1.py", + "bytes": 3836, + "sha256": "2cd493991834294bc016510e11dbfd0f14049fd7915632970c28a10e3b51a790", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/test_derivation_pure_v2.py", + "path": "unit05/fixtures/test_derivation_pure_v2.py", + "bytes": 5538, + "sha256": "37260fe75234e3b4565cea65fba6c4374cd0a30a407b5cfaa670f198df5b8a82", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/test_new_orchestration_v2.py", + "path": "unit05/fixtures/test_new_orchestration_v2.py", + "bytes": 12170, + "sha256": "7193e4eadf500a1a1e630236dbbda73703e20cfc7cbc7ab174e18636a5d6362c", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/v1-frozen/AUTHOR-RECEIPT-v1.json", + "path": "unit05/fixtures/v1-frozen/AUTHOR-RECEIPT-v1.json", + "bytes": 5666, + "sha256": "5cdaf0437a4453c0584859b15be288b7a0770e5a729a5eb364e2797e511028ff", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/v1-frozen/fixtures/ASSEMBLY-v1.json", + "path": "unit05/fixtures/v1-frozen/fixtures/ASSEMBLY-v1.json", + "bytes": 6294, + "sha256": "fcb9d53fbb77583a12ace09ebec7edb9e9820d7eeb00e15b6b7410888738763b", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/v1-frozen/fixtures/PROPOSAL-TESTS-v1-normal.txt", + "path": "unit05/fixtures/v1-frozen/fixtures/PROPOSAL-TESTS-v1-normal.txt", + "bytes": 1477, + "sha256": "488d38cf7147d94811dab07bc385f4339b999d2da1f0b0d18de7692f9dd417a8", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/v1-frozen/fixtures/PROPOSAL-TESTS-v1-optimized.txt", + "path": "unit05/fixtures/v1-frozen/fixtures/PROPOSAL-TESTS-v1-optimized.txt", + "bytes": 1477, + "sha256": "77ccaed42375657de3639d0b1cba77a8de25ac4ae8ab808013bab519b652d98b", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/v1-frozen/fixtures/V1-REJECTION-v1.json", + "path": "unit05/fixtures/v1-frozen/fixtures/V1-REJECTION-v1.json", + "bytes": 1226, + "sha256": "e1978317502606bde5baa67698c2ed9227032192069e49c8b08ebee6eaec9a96", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/v1-frozen/fixtures/run_proposal_pure_tests_v1.py", + "path": "unit05/fixtures/v1-frozen/fixtures/run_proposal_pure_tests_v1.py", + "bytes": 3836, + "sha256": "2cd493991834294bc016510e11dbfd0f14049fd7915632970c28a10e3b51a790", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/v1-frozen/implementation/epoch_copy_v5.py", + "path": "unit05/fixtures/v1-frozen/implementation/epoch_copy_v5.py", + "bytes": 82957, + "sha256": "4f459d0336d59975df787c24373e18dad4044c3a24137392e890115f811b3211", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/v1-frozen/implementation/epoch_schema_v5.py", + "path": "unit05/fixtures/v1-frozen/implementation/epoch_schema_v5.py", + "bytes": 30668, + "sha256": "b89a789654be87bde40a47300f4d9702dce2b90e6ab3be9a2025f6d8041b3e9a", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/v1-frozen/implementation/group01_evidence_v1.py", + "path": "unit05/fixtures/v1-frozen/implementation/group01_evidence_v1.py", + "bytes": 15610, + "sha256": "05ec6a63c57340ba929aea1fab71b096efc143e099346640f6def41310bd3e25", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/v1-frozen/implementation/h25_parent_supervisor.py", + "path": "unit05/fixtures/v1-frozen/implementation/h25_parent_supervisor.py", + "bytes": 23047, + "sha256": "cfb09a18dd10b597cc6d5a8139ee769bef679bc44ae029329755e3d97b055075", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/v1-frozen/implementation/parent_closure_v1.py", + "path": "unit05/fixtures/v1-frozen/implementation/parent_closure_v1.py", + "bytes": 13463, + "sha256": "a15424f14baa3d484fe04bfbe7e449c32561c866dbaca2c1b5f646dfb377ed1f", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/v1-frozen/implementation/parent_completion_v1.py", + "path": "unit05/fixtures/v1-frozen/implementation/parent_completion_v1.py", + "bytes": 54168, + "sha256": "d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/v1-frozen/implementation/parent_domain_v1.py", + "path": "unit05/fixtures/v1-frozen/implementation/parent_domain_v1.py", + "bytes": 23942, + "sha256": "a51264289803b4b17bb262f2460ddd4ed72500aaa21e5eb80fa2db4583689361", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/v1-frozen/implementation/test_v03_prefix_supervisor_v1.py", + "path": "unit05/fixtures/v1-frozen/implementation/test_v03_prefix_supervisor_v1.py", + "bytes": 6381, + "sha256": "b5f8055da6f9a48e85a4eed0868f7076859adca317e0691e5b2336e0bdb58d52", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/v1-frozen/implementation/v03_integrated_constructor_v1.py", + "path": "unit05/fixtures/v1-frozen/implementation/v03_integrated_constructor_v1.py", + "bytes": 6087, + "sha256": "5e08ff84298fe1249be5e8790ea259e6179048f4736fb7eafdb6e170b8bc1cf9", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/v1-frozen/implementation/v03_prefix_derivation_v1.py", + "path": "unit05/fixtures/v1-frozen/implementation/v03_prefix_derivation_v1.py", + "bytes": 3830, + "sha256": "4591de196d008f0fdc094f4a74b19a84c095e2def5d28dbdaea7085e4630f8a7", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/v1-frozen/implementation/v03_prefix_supervisor_v1.py", + "path": "unit05/fixtures/v1-frozen/implementation/v03_prefix_supervisor_v1.py", + "bytes": 35491, + "sha256": "75bef7834fe7278638010f79a8efca84b49b1e48320d3c8ac2d93cadea5a8262", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/v1-frozen/implementation/v03_source_refusal_observer_v1.py", + "path": "unit05/fixtures/v1-frozen/implementation/v03_source_refusal_observer_v1.py", + "bytes": 14205, + "sha256": "abf25690d3bee4a9783ee504567c29f7fb47da670e0ec95f57cb5944bf57264f", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/v2-pre-close-model/ORCHESTRATION-v2-normal.txt", + "path": "unit05/fixtures/v2-pre-close-model/ORCHESTRATION-v2-normal.txt", + "bytes": 1483, + "sha256": "d663d2e3e1e24f6fa8a12b31f9a5e8ee72b33fe6b1adaef2b3d31ee620fcaadb", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/v2-pre-close-model/ORCHESTRATION-v2-optimized.txt", + "path": "unit05/fixtures/v2-pre-close-model/ORCHESTRATION-v2-optimized.txt", + "bytes": 1483, + "sha256": "82f7307a61300a8a363c4b1ce3c1c478e8f0a9cfbefcd6d32192c31bbcedbc33", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/v2-pre-close-model/test_new_orchestration_v2.py", + "path": "unit05/fixtures/v2-pre-close-model/test_new_orchestration_v2.py", + "bytes": 10338, + "sha256": "251bc23c4b7ad15526bdfe0bdb3b053848f2fffc0fe8210b386a898f1838c610", + "byte_exact": true, + "scope": "Exact frozen new fixture/history bytes; replay runs only supplied accessor/static and orchestration fixtures. Preserved v1 and earlier fixture models are inert." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/proposal/closure-allowance.py.fragment", + "path": "unit05/proposal/closure-allowance.py.fragment", + "bytes": 63, + "sha256": "c3b3aee32015105b5fe4fe1a41183e2a2ec2599b1f2dca2b73fb889f823f563c", + "byte_exact": true, + "scope": "Frozen proposed fragments/source retained as inert byte/AST provenance; old supervisor proposal rejected." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/proposal/domain-prefix-accessor.py.fragment", + "path": "unit05/proposal/domain-prefix-accessor.py.fragment", + "bytes": 3484, + "sha256": "5397f59e65cef18d03581afe1c2727a288506248aaabc0dd88c06811e810f6b1", + "byte_exact": true, + "scope": "Frozen proposed fragments/source retained as inert byte/AST provenance; old supervisor proposal rejected." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/proposal/test_v03_prefix_supervisor_v1.py", + "path": "unit05/proposal/test_v03_prefix_supervisor_v1.py", + "bytes": 6381, + "sha256": "b5f8055da6f9a48e85a4eed0868f7076859adca317e0691e5b2336e0bdb58d52", + "byte_exact": true, + "scope": "Frozen proposed fragments/source retained as inert byte/AST provenance; old supervisor proposal rejected." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/proposal/v03_prefix_derivation_v1.py", + "path": "unit05/proposal/v03_prefix_derivation_v1.py", + "bytes": 3830, + "sha256": "4591de196d008f0fdc094f4a74b19a84c095e2def5d28dbdaea7085e4630f8a7", + "byte_exact": true, + "scope": "Frozen proposed fragments/source retained as inert byte/AST provenance; old supervisor proposal rejected." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/proposal/v03_prefix_supervisor_v1.py", + "path": "unit05/proposal/v03_prefix_supervisor_v1.py", + "bytes": 35491, + "sha256": "75bef7834fe7278638010f79a8efca84b49b1e48320d3c8ac2d93cadea5a8262", + "byte_exact": true, + "scope": "Frozen proposed fragments/source retained as inert byte/AST provenance; old supervisor proposal rejected." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/SOURCE-CLOSE-v1.json", + "path": "unit05/SOURCE-CLOSE-v1.json", + "bytes": 2797, + "sha256": "e551cf038bde7c4fc1aa8e7b29846f158632f2d1cc7bbe3981d3d35ff7831390", + "byte_exact": true, + "scope": "Exact source-freeze, rejection/repair/input-gate or independent source review record; private consultation path/hash references are documentary only." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/AUTHOR-RECEIPT-v1.json", + "path": "unit05/AUTHOR-RECEIPT-v1.json", + "bytes": 5666, + "sha256": "5cdaf0437a4453c0584859b15be288b7a0770e5a729a5eb364e2797e511028ff", + "byte_exact": true, + "scope": "Exact source-freeze, rejection/repair/input-gate or independent source review record; private consultation path/hash references are documentary only." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/AUTHOR-RECEIPT-v2.json", + "path": "unit05/AUTHOR-RECEIPT-v2.json", + "bytes": 10784, + "sha256": "9563e2b533ce5b06bf72911c2ad66ee389ef14119b423a7cd3309b521c4db02e", + "byte_exact": true, + "scope": "Exact source-freeze, rejection/repair/input-gate or independent source review record; private consultation path/hash references are documentary only." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/INPUT-GATE-v1.json", + "path": "unit05/INPUT-GATE-v1.json", + "bytes": 2166, + "sha256": "d768b3ea5f27c53e498b7ead16f89862dbe82258b017f11ada9e638d10acc3ad", + "byte_exact": true, + "scope": "Exact source-freeze, rejection/repair/input-gate or independent source review record; private consultation path/hash references are documentary only." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/INPUT-GATE-EVIDENCE-LINKAGE-v1.json", + "path": "unit05/INPUT-GATE-EVIDENCE-LINKAGE-v1.json", + "bytes": 1393, + "sha256": "1f2d33b65f1c765d1252dd34927c83c1f9d01b0477ea5c9ff209bab4f4556399", + "byte_exact": true, + "scope": "Exact source-freeze, rejection/repair/input-gate or independent source review record; private consultation path/hash references are documentary only." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/REPAIR-WINDOW-v1.json", + "path": "unit05/REPAIR-WINDOW-v1.json", + "bytes": 1057, + "sha256": "ca419a99d405063d11404f163935f0ad97399b8f5f19c5052da3a2d5254111af", + "byte_exact": true, + "scope": "Exact source-freeze, rejection/repair/input-gate or independent source review record; private consultation path/hash references are documentary only." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/PROPOSAL-SOURCE-MANIFEST-v1.json", + "path": "unit05/PROPOSAL-SOURCE-MANIFEST-v1.json", + "bytes": 1674, + "sha256": "627fd8b7c8439851b9afcde92cbc5110b72aa957c3663dabf377482c4ebf5f44", + "byte_exact": true, + "scope": "Exact source-freeze, rejection/repair/input-gate or independent source review record; private consultation path/hash references are documentary only." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/review-supervision-domain-input-gate-v1.md", + "path": "unit05/review-supervision-domain-input-gate-v1.md", + "bytes": 10242, + "sha256": "21c02459c76b114caffd77ff6310c3c9933f4d8c627dbc5b667001b1bb5b5153", + "byte_exact": true, + "scope": "Exact source-freeze, rejection/repair/input-gate or independent source review record; private consultation path/hash references are documentary only." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/review-supervision-domain-input-gate-v1.json", + "path": "unit05/review-supervision-domain-input-gate-v1.json", + "bytes": 5449, + "sha256": "7367c65eadb755719696d72358b81a043e53626b978f3b523baaea3fcaa9d7fc", + "byte_exact": true, + "scope": "Exact source-freeze, rejection/repair/input-gate or independent source review record; private consultation path/hash references are documentary only." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/review-supervision-domain-input-gate-RESTORATION-v1.json", + "path": "unit05/review-supervision-domain-input-gate-RESTORATION-v1.json", + "bytes": 1387, + "sha256": "edc33f4f2f9d83ac79aced451f5b0edd49cb250bc920b9935667094238b7c84d", + "byte_exact": true, + "scope": "Exact source-freeze, rejection/repair/input-gate or independent source review record; private consultation path/hash references are documentary only." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/review-supervision-domain-v1.md", + "path": "unit05/review-supervision-domain-v1.md", + "bytes": 14835, + "sha256": "467e6aeb70d98f45a73489b2041477d1cc95d02f510b033cb91b3e84337baaa5", + "byte_exact": true, + "scope": "Exact source-freeze, rejection/repair/input-gate or independent source review record; private consultation path/hash references are documentary only." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/review-supervision-domain-v1.json", + "path": "unit05/review-supervision-domain-v1.json", + "bytes": 8686, + "sha256": "9ee2baceb9a3f70f465c433e6f00b9bf69d028f685c1161fddfa720c5c9ba0b1", + "byte_exact": true, + "scope": "Exact source-freeze, rejection/repair/input-gate or independent source review record; private consultation path/hash references are documentary only." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/review-derivation-closure-input-gate-v1.md", + "path": "unit05/review-derivation-closure-input-gate-v1.md", + "bytes": 5370, + "sha256": "da729f70f5a4198dacf9e8813943758a45d0f1035f061bd7d85dfc437b1dc9d8", + "byte_exact": true, + "scope": "Exact source-freeze, rejection/repair/input-gate or independent source review record; private consultation path/hash references are documentary only." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/review-derivation-closure-input-gate-v1.json", + "path": "unit05/review-derivation-closure-input-gate-v1.json", + "bytes": 4504, + "sha256": "9063c6d4132df9564b382e153de71770350662a31c67cd7df93e3117546ef23d", + "byte_exact": true, + "scope": "Exact source-freeze, rejection/repair/input-gate or independent source review record; private consultation path/hash references are documentary only." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/review-derivation-closure-v1.md", + "path": "unit05/review-derivation-closure-v1.md", + "bytes": 8222, + "sha256": "bc00b661c148552c1f46954df182b5e4a110a1e08522e789f36e2a250fa22f4a", + "byte_exact": true, + "scope": "Exact source-freeze, rejection/repair/input-gate or independent source review record; private consultation path/hash references are documentary only." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit05/review-derivation-closure-v1.json", + "path": "unit05/review-derivation-closure-v1.json", + "bytes": 7654, + "sha256": "efe6101d6b2ca2a954fa97d039740f2c4e52aafe6ac5e3d9d2e61867ebe76ebf", + "byte_exact": true, + "scope": "Exact source-freeze, rejection/repair/input-gate or independent source review record; private consultation path/hash references are documentary only." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit02/prerequisite-source/field-parent-completion-v2--parent_domain_v1.py.txt", + "path": "basis/parent_domain_v1.py.txt", + "bytes": 20456, + "sha256": "9205e14d6661fb5df0597f0ad7b2206006f2d31f01f784805f64c13875663282", + "byte_exact": true, + "scope": "Exact inert original production basis; hash/byte/AST comparisons only, never imported or executed." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit02/prerequisite-source/field-parent-completion-v2--parent_closure_v1.py.txt", + "path": "basis/parent_closure_v1.py.txt", + "bytes": 13400, + "sha256": "2d831cff8bd444de2d6941645d571e07618ede404a1f45692b557f61494b334a", + "byte_exact": true, + "scope": "Exact inert original production basis; hash/byte/AST comparisons only, never imported or executed." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/unit02/prerequisite-source/field-parent-completion-v2--parent_completion_v1.py.txt", + "path": "basis/parent_completion_v1.py.txt", + "bytes": 54168, + "sha256": "d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5", + "byte_exact": true, + "scope": "Exact inert original production basis; hash/byte/AST comparisons only, never imported or executed." + }, + { + "from": "outputs/c05-v03-completion-20261102T055710Z/publication-prefix-supervision-v1/LICENSE", + "path": "LICENSE", + "bytes": 11357, + "sha256": "c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4", + "byte_exact": true, + "scope": "Repository Apache-2.0 license; source-specific notices remain intact." + } + ], + "scope": "Exact source/path/hash archive availability only; not original Git-history completeness, deployment closure or runtime admission.", + "private_context": "No private chat/prompt/response/assessment is exported or read by replay. Historical consultation hashes and omitted PLAN/STATE/local paths inside frozen records are external documentary provenance, not replay inputs.", + "assembly_disposition": "Initial12-file/repaired13-file assembly is incomplete as a transitive runtime deployment. Required original dependencies named by inert code, including epoch_parent_v5/original_build_provenance_v5/group01_original_predicates_v1 and native/stdlib transitive dependencies, are intentionally absent and never imported by replay.", + "adjacent_publication_1": { + "url_status": "PENDING_PARENT_PR_URL", + "scope": "New pure derivation verifier and constructor successor; not an external live replay input here.", + "derivation_sha256": "1ed813148c10d5fbd3cd6781d51eca650a347eda7a6323f581d740e6ea9cb6e2", + "constructor_v2_sha256": "a80a60b390bc60e9bc434b79cda5ae6db88e4f0c6c7436de9adfe1f48a2045b1" + } +} diff --git a/research/h25-v03-prefix-supervision/SOURCES.json b/research/h25-v03-prefix-supervision/SOURCES.json new file mode 100644 index 0000000000..594089b9c7 --- /dev/null +++ b/research/h25-v03-prefix-supervision/SOURCES.json @@ -0,0 +1,18 @@ +{ + "schema_version": 1, + "base_commit": "7c49fe32c55de02c2c873655c804b16e4c3fef0a", + "files": [ + { + "path": "certificates/selected-result.json", + "usage": "provenance", + "git_blob": "d59b5035e7b4cbaa9d688a1d32dd0d6eb79c466a", + "sha256": "9b8d0eea95b3bf0dfcb7938a732a6439b87a2685dec2a5ab9e525b3b34debbfa" + }, + { + "path": "docs/research/agent-task-catalog.json", + "usage": "provenance", + "git_blob": "3404fbdd5e7529a0674eef26114b5071e4586cec", + "sha256": "ead6cdc9d0af6d58e8a49744d8ec8c7c15e13d2ba93c276c434bcf9b51b93a81" + } + ] +} diff --git a/research/h25-v03-prefix-supervision/TASK.json b/research/h25-v03-prefix-supervision/TASK.json new file mode 100644 index 0000000000..53485a2f5b --- /dev/null +++ b/research/h25-v03-prefix-supervision/TASK.json @@ -0,0 +1,66 @@ +{ + "schema_version": 1, + "task_id": "portable-replay", + "priority_revision": 8, + "base_commit": "7c49fe32c55de02c2c873655c804b16e4c3fef0a", + "original_card": { + "id": "portable-replay", + "question": "Can one reproducible environment or artifact-comparison failure be repaired?", + "starting_points": [ + "research/gzip-container-reproducibility/README.md", + "docs/ci-verification.md" + ], + "methods": [ + "Reproduce one portability failure and add a minimal cross-environment fix.", + "Audit one canonical-payload comparison for omitted proof-relevant fields." + ], + "acceptance_gate": "Preserve immutable source hashes and proof-relevant content; a different compressed byte stream alone is not a mathematical mismatch.", + "first_step": { + "command": [ + "python3", + "-B", + "scripts/research_selected_baseline.py" + ], + "expected": "PASS_RESEARCH_BASELINE_BINDINGS_ONLY", + "inspect": "Resolve the current selected review, separate complex/ordinary BIT/admitted BIT/outer budgets, and compare the card against live handoffs before starting. Historical ceilings require exact source/model equivalence.", + "scope": "Source-binding orientation only; not a scientific replay or all-size proof. Materialize selected inputs if this checkout is sparse." + }, + "first_experiment": "Reproduce one specific mismatch or audit one canonical comparison for omitted proof-relevant fields.", + "bottleneck_link": "Portable exact checks prevent environment failures from blocking valid contributions.", + "allowed_variations": [ + "One interpreter/version mismatch or one payload field comparison." + ], + "scope_change_triggers": [ + "Removing immutable-source pins because generated compressed bytes differ." + ], + "overlap_terms": [ + "gzip container", + "reproducibility", + "canonical payload" + ] + }, + "scope_status": "changed", + "actual_scope": "Frozen conditional non-minting prefix supervisor, exact appended exit1 cleanup-data accessor and sole63B closure allowance, bounded outer-plan custody repair, and23 new AST-extracted/fake-service fixture methods per mode. Not a complete runtime/bootstrap or original C05/V03 admission.", + "scope_change_reason": "Explicit publication#2 of closed Unit05; the historical portable-replay card is provenance. New derivation/constructor scope is an adjacent publication, not an imported replay dependency.", + "bottleneck_link": "Source-bound verifier qualification prerequisites; no change to the multiplication supplier, selected result or framework assumptions.", + "budget_minutes": 20, + "stop_rule": "Unit05source CLOSED; no algorithm/test-semantic repair, source acquisition, timer reset, original/native/Popen/domain/namespace/target execution. Publication-only export aimed11:50UTC, hard11:55UTC.", + "outcome": "partial", + "evidence": "Frozen AUTHOR-RECEIPT-v2 and source close; exact source/test/basis copies; EQUIVALENCE/SOURCE-ORIGIN; independent final source reviews;23new accessor/static/orchestration methods/profile. External final validation receipts.", + "author": "Chris R / Clear1nsight", + "ai_assistance": "Substantial ChatGPT Pro consultation, OpenAI Codex and GPT-6.1 Sol Max source construction, finite controls, independent source review and publication assistance. Agent acceptance is conditional source review, not human/proof-kernel/runtime qualification.", + "open_questions": [ + { + "question": "Can a separately authenticated fresh enclosing-parent bootstrap and complete initialized receiver policy satisfy all unchanged runtime predicates?", + "why_it_matters": "The12/13file assembly and policy-requirements table are incomplete source artifacts and do not provide genuine current runtime capability or48module/512global fit.", + "first_step": "Independently review a concrete pre-import image-owner/bootstrap and complete transitive receiver/source policy with actual initialized module identities and global census, retaining the exact production mint route.", + "blocked_by": "Actual bootstrap, complete transitive runtime closure/policy identity, C05/C07/native/stage/command/funding/execution/currentness admissions and observed enclosing-parent exit remain absent." + }, + { + "question": "Can complete original baseline and named V03 controls be executed under independently admitted original budgets and ownership?", + "why_it_matters": "The23fake/AST-only fixture methods grant no original ownership, first-error delivery, runtime admission or activity credit.", + "first_step": "After separate source/runtime gates pass, specify the unchanged full original baseline/control family, custody/first-error/owner/parent-exit evidence and complete physical invoice before seeking execution authority.", + "blocked_by": "C05whole determinant inventory, actual cap/cost bill and lifetime channel mechanism; C07interval; native/runtime/funding approval; full original baseline/control closure." + } + ] +} diff --git a/research/h25-v03-prefix-supervision/VERIFY.json b/research/h25-v03-prefix-supervision/VERIFY.json new file mode 100644 index 0000000000..77715bfea6 --- /dev/null +++ b/research/h25-v03-prefix-supervision/VERIFY.json @@ -0,0 +1,32 @@ +{ + "schema_version": 1, + "status": "ready", + "python": "3.12", + "requirements": [], + "inputs": [], + "commands": [ + { + "argv": [ + "{python}", + "-I", + "-B", + "-S", + "{package}/run.py" + ], + "timeout_seconds": 60, + "checks": "Exact archived bytes/production AST preservation; only10new accessor/static +13new orchestration methods with explicit fake operational services." + }, + { + "argv": [ + "{python}", + "-I", + "-O", + "-B", + "-S", + "{package}/run.py" + ], + "timeout_seconds": 60, + "checks": "Same23new methods and archive/preservation checks with optimization; no original/full supervisor/Popen/domain/native/namespace/target execution." + } + ] +} diff --git a/research/h25-v03-prefix-supervision/basis/parent_closure_v1.py.txt b/research/h25-v03-prefix-supervision/basis/parent_closure_v1.py.txt new file mode 100644 index 0000000000..ca541e94ca --- /dev/null +++ b/research/h25-v03-prefix-supervision/basis/parent_closure_v1.py.txt @@ -0,0 +1,270 @@ +"""Finite concrete receiver admission inside the original trusted parent. + +This verifies pinned source, bytecode derived from those bytes without executing +them, concrete local import edges, and the current captured object graph. It is +not a new Python sandbox or proof of the initial OS/interpreter/native memory. +The original parent must load these exact modules through its admitted bootstrap +before adverse input. No user supplied arbitrary checker is accepted. +""" +import ast +import builtins +import __future__ +import copy +import dataclasses +import fcntl +import gc +import hashlib +import json +import marshal +import math +import os +import pathlib +import posix +import resource +import signal +import struct +import subprocess +import sys +import time +import types +import epoch_schema_v5 as schema +import epoch_copy_v5 as copying + +_TYPE, _LEN, _COMPILE = type, len, compile +_MODULE_DICT = types.ModuleType.__dict__['__dict__'].__get__ +_FUNCTION_GETTERS = tuple(types.FunctionType.__dict__[name].__get__ for name in + ('__code__', '__globals__', '__builtins__', '__defaults__', '__kwdefaults__', '__closure__', '__dict__')) +_CELL_GET = types.CellType.__dict__['cell_contents'].__get__ +_CLASS_DICT = type.__dict__['__dict__'].__get__ +_STATIC_FUNCTION = staticmethod.__dict__['__func__'].__get__ +_CLASS_FUNCTION = classmethod.__dict__['__func__'].__get__ +_SOURCE_RECEIVERS = [] +_STDLIB_MODULES = {name: module for name, module in tuple(sys.modules.items()) + if _TYPE(name) is str and _TYPE(module) is types.ModuleType} +MAX_MODULES = 48 +MAX_GLOBALS = 512 + +# These exact registries are intentionally mutated only by their original +# source. Their object identities are still checked. Private-state sabotage +# by code already running in this trusted parent remains outside the boundary. +_MUTABLE_NAMES = { + 'epoch_parent_v5': ('_RESERVED_EPOCHS', '_PARENT_OWNERS'), + 'epoch_schema_v5': ('_ERROR_OWNERS',), + 'epoch_stop_v5': ('_SINK_REGISTRY',), + 'parent_domain_v1': ('_DOMAINS',), + 'parent_completion_v1': ('_PARENTS', '_PROCESS'), + 'parent_closure_v1': ('_SOURCE_RECEIVERS',), +} +_GATE_SUFFIXES = ('CONFIGURATION', 'SOURCE_REVIEW', 'EXECUTION_APPROVAL', 'FUNDING', + 'STAGE_APPROVAL', 'COMMAND_APPROVAL', 'VALIDATION_EXECUTION') + + +def _namespace(module): + schema.need(_TYPE(module) is types.ModuleType, 'exact original module required') + namespace = _MODULE_DICT(module, types.ModuleType) + schema.need(_TYPE(namespace) is dict and _LEN(namespace) <= MAX_GLOBALS, + 'original module namespace bound differs') + for key in namespace: + schema.text(key, 256) + return namespace + + +def _function_record(function): + schema.need(_TYPE(function) is types.FunctionType, 'exact source function required') + values = tuple(getter(function, types.FunctionType) for getter in _FUNCTION_GETTERS) + closure = values[5] + cells = () if closure is None else tuple((cell, _CELL_GET(cell, types.CellType)) for cell in closure) + schema.need(_LEN(cells) <= 64, 'source function closure bound exceeded') + return function, values, cells + + +def _function_check(record): + function, values, cells = record + schema.need(_TYPE(function) is types.FunctionType, 'source function identity changed') + for getter, expected in zip(_FUNCTION_GETTERS, values): + schema.need(getter(function, types.FunctionType) is expected, + 'source function code/globals/builtins/defaults/closure/dict changed') + for cell, expected in cells: + schema.need(_CELL_GET(cell, types.CellType) is expected, 'source function closure contents changed') + + +def _codes(code, result): + result.setdefault(code.co_qualname, []).append(code) + for child in code.co_consts: + if _TYPE(child) is types.CodeType: + _codes(child, result) + + +def _data(value, depth=0): + """Snapshot literal data only; no foreign repr/hash/eq/iteration protocols.""" + schema.need(depth <= 32, 'literal snapshot depth exceeded') + kind = _TYPE(value) + if value is None or kind in (str, int, bool, bytes, float): + return (kind, value) + if kind in (list, tuple): + schema.need(_LEN(value) <= 65536, 'literal sequence bound exceeded') + return (kind, tuple(_data(item, depth + 1) for item in value)) + if kind is dict: + schema.need(_LEN(value) <= 8192, 'literal mapping bound exceeded') + for key in value: + schema.need(_TYPE(key) in (str, int), 'nonliteral mapping key') + return (kind, tuple((_data(key, depth + 1), _data(item, depth + 1)) + for key, item in value.items())) + if kind in (set, frozenset): + schema.need(_LEN(value) <= 8192 and all(_TYPE(item) in (str, int) for item in value), + 'nonliteral set value') + return (kind, frozenset(value)) + raise schema.EpochStop('not literal data') + + +def _validate_code(function, compiled_codes, namespace): + values = tuple(getter(function, types.FunctionType) for getter in _FUNCTION_GETTERS) + code = values[0] + schema.need(values[1] is namespace and values[2] is builtins.__dict__, + 'source function original namespace/builtins differs') + candidates = compiled_codes.get(code.co_qualname, ()) + encoded = marshal.dumps(code) + schema.need(any(marshal.dumps(expected) == encoded for expected in candidates), + 'receiving function bytecode differs from pinned source') + + +def bind_receivers(modules, source_policy, error_owner): + """Only the source-fixed original parent calls this before child launch. + + source_policy is a separately pinned, prelaunch source inventory, never a + report supplied by a child. The two producer-specific validators have fixed + names; unsupported or absent variant source cannot be substituted by a + callable argument. Every received module must be listed in the policy. + """ + schema.owner_state(error_owner) + schema.need(_TYPE(modules) is dict and 1 <= _LEN(modules) <= MAX_MODULES and + _TYPE(source_policy) is dict, 'finite receiver module map required') + for name in modules: + schema.text(name, 128) + for name in source_policy: + schema.text(name, 128) + schema.need(set(modules) == set(source_policy), 'exact receiver closure differs') + records = [] + for name in sorted(modules): + module = modules[name] + namespace = _namespace(module) + pin = source_policy[name] + schema.blob(pin) + raw = copying.read_verified(pin, schema.FILE_BYTES, error_owner=error_owner) + schema.need(namespace.get('__name__') == name and namespace.get('__file__') == pin['path'], + 'original receiving module origin differs') + tree = ast.parse(raw, filename=pin['path']) + compiled = _COMPILE(raw, pin['path'], 'exec', dont_inherit=True, optimize=sys.flags.optimize) + compiled_codes = {} + _codes(compiled, compiled_codes) + functions, classes, literals, imports = [], [], [], [] + for node in tree.body: + if _TYPE(node) is ast.FunctionDef: + function = namespace[node.name] + _validate_code(function, compiled_codes, namespace) + functions.append(_function_record(function)) + elif _TYPE(node) is ast.ClassDef: + cls = namespace[node.name] + schema.need(_TYPE(cls) is type, 'source class type differs') + class_namespace = _CLASS_DICT(cls, type) + for item in node.body: + if _TYPE(item) is ast.FunctionDef: + method = class_namespace[item.name] + # The currently selected explicit methods have no + # property/classmethod/staticmethod decorators. + schema.need(not item.decorator_list, 'unreviewed decorated receiver method') + # Python implicitly wraps __new__ and two class hooks. + # No arbitrary descriptor protocol is invoked. + if item.name == '__new__' and _TYPE(method) is staticmethod: + method = _STATIC_FUNCTION(method, staticmethod) + elif item.name in ('__init_subclass__', '__class_getitem__') and _TYPE(method) is classmethod: + method = _CLASS_FUNCTION(method, classmethod) + _validate_code(method, compiled_codes, namespace) + functions.append(_function_record(method)) + # Dataclass-generated methods are part of the inherited + # dataclasses/initial-parent trust, not compiled from this + # class body. Their actual original code/environment remains + # captured and checked; they cannot be changed after capture. + for method in class_namespace.values(): + if _TYPE(method) is types.FunctionType and not any(method is r[0] for r in functions): + functions.append(_function_record(method)) + classes.append((cls, tuple(class_namespace.items()))) + elif _TYPE(node) in (ast.Import, ast.ImportFrom): + for alias in node.names: + schema.need(alias.name != '*', 'star receiver import unsupported') + if _TYPE(node) is ast.Import: + source_name = alias.name + local_name = alias.asname or source_name.split('.')[0] + expected = modules.get(source_name, _STDLIB_MODULES.get(source_name)) + else: + source_name = node.module + schema.need(node.level == 0, 'relative receiver import unsupported') + local_name = alias.asname or alias.name + source_module = modules.get(source_name, _STDLIB_MODULES.get(source_name)) + schema.need(source_module is not None, 'receiver import dependency absent') + expected = _namespace(source_module).get(alias.name) + schema.need(expected is not None and namespace.get(local_name) is expected, + 'concrete receiving import identity differs') + imports.append((local_name, expected)) + elif _TYPE(node) is ast.Assign: + if _LEN(node.targets) != 1 or _TYPE(node.targets[0]) is not ast.Name: + continue + key = node.targets[0].id + if key in _MUTABLE_NAMES.get(name, ()) or key.endswith(_GATE_SUFFIXES): + continue + try: + literal = ast.literal_eval(node.value) + except (ValueError, TypeError, SyntaxError): + continue + schema.need(_data(namespace[key]) == _data(literal), 'receiver literal differs from source') + literals.append((key, _data(literal))) + for function in namespace.values(): + if _TYPE(function) is types.FunctionType and not any(function is r[0] for r in functions): + functions.append(_function_record(function)) + records.append((name, module, namespace, pin, tuple(namespace.items()), + tuple(functions), tuple(classes), tuple(literals), tuple(imports))) + capability = object() + packet = (capability, tuple(records), error_owner) + schema.need(_LEN(_SOURCE_RECEIVERS) < 2, 'receiver closure finite parent bound exceeded') + _SOURCE_RECEIVERS.append(packet) + check_receivers(capability) + return capability + + +def _packet(capability): + schema.need(_TYPE(capability) is object, 'exact receiver capability required') + for packet in _SOURCE_RECEIVERS: + if packet[0] is capability: + return packet + raise schema.EpochStop('unknown original receiver closure') + + +def check_receivers(capability): + packet = _packet(capability) + for name, module, namespace, pin, original_items, functions, classes, literals, imports in packet[1]: + schema.need(_namespace(module) is namespace and _LEN(namespace) == _LEN(original_items), + 'receiver namespace identity/census changed') + for key, expected in original_items: + schema.need(namespace.get(key) is expected, 'receiver namespace binding changed') + for record in functions: + _function_check(record) + for cls, items in classes: + current = _CLASS_DICT(cls, type) + schema.need(_LEN(current) == _LEN(items), 'receiver class census changed') + for key, expected in items: + schema.need(current.get(key) is expected, 'receiver class binding changed') + for key, expected in literals: + schema.need(_data(namespace[key]) == expected, 'receiver literal data changed') + copying.verify(pin, error_owner=packet[2]) + return None + + +def receiver(capability, module_name, name): + """Return only a specifically named original from the registered closure.""" + schema.text(module_name, 128) + schema.text(name, 128) + for row in _packet(capability)[1]: + if row[0] == module_name: + schema.need(name in row[2], 'fixed receiving entry missing') + return row[2][name] + raise schema.EpochStop('fixed receiving module missing') diff --git a/research/h25-v03-prefix-supervision/basis/parent_completion_v1.py.txt b/research/h25-v03-prefix-supervision/basis/parent_completion_v1.py.txt new file mode 100644 index 0000000000..3191be7570 --- /dev/null +++ b/research/h25-v03-prefix-supervision/basis/parent_completion_v1.py.txt @@ -0,0 +1,880 @@ +"""Source-only two-producer completion owner for one future guarded parent. + +No configuration or execution gate is installed. The original trusted parent +must authenticate this source, its exact receiver closure and initial OS/runtime +before importing it. Capabilities are process local. This component never +invokes run_guarded, a queue wrapper, a global ledger writer, or a child report +as authority. The enclosing single orchestrator pays this entire component +once, including all child, validation, retention, failure and final-exit costs. +""" +import fcntl +import os +import resource +import signal +import stat +import subprocess +import sys +import time +import epoch_schema_v5 as schema +import epoch_copy_v5 as copying +import epoch_parent_v5 as epoch +import parent_closure_v1 as closure +import parent_domain_v1 as domain +import group01_evidence_v1 as group01 + +CONFIGURATION = None +SOURCE_REVIEW = None +STAGE_APPROVAL = None +COMMAND_APPROVAL = None +FUNDING = None +EXECUTION_APPROVAL = None + +FLAGS = ('-S', '-s', '-P', '-B') +ENV = {'PATH': '/usr/bin:/bin', 'PYTHONHASHSEED': '0', 'LANG': 'C.UTF-8', + 'LC_ALL': 'C.UTF-8', 'TZ': 'UTC', 'PYTHONDONTWRITEBYTECODE': '1'} +_TYPE, _LEN = type, len +_OPEN, _CLOSE, _MKDIR, _STAT, _SCANDIR = os.open, os.close, os.mkdir, os.stat, os.scandir +_POPEN = subprocess.Popen +_CLOCK, _SLEEP = time.monotonic, time.sleep +_SETRLIMIT, _GETRLIMIT = resource.setrlimit, resource.getrlimit +_SETTIMER, _GETTIMER = signal.setitimer, signal.getitimer +_SIGNAL, _GETSIGNAL = signal.signal, signal.getsignal +_PARENTS = [] +_PROCESS = [None] +# Shared before the first constructor read, including failures before a parent +# capability can be published. No mode can replace or reset this owner. +_UNKNOWN_OWNER = {'quarantine': [False], 'pending': [False], + 'iterator_uncertain': [False], 'primary': [None], + 'native_errors': [None] * 4} +_EPOCH_ENTRY = epoch._entry_state +_EPOCH_RESERVE = epoch.ParentEpoch.reserve_producer +_EPOCH_ACCEPT = epoch.ParentEpoch.accept_completed_producer +_EPOCH_COMPLETION = epoch.ParentCompletion +_EPOCH_COMMIT = epoch.ParentEpoch.commit_exports +_EPOCH_CLOSE = epoch.ParentEpoch.close +MAX_SOURCE_FILES = 8192 +MAX_STAGE_ENTRIES = 16384 +MAX_RAW_VARIANT_FILES = 64 +VARIANT_MODULE = 'variant_validation_v1' +VARIANT_FUNCTION = 'validate_variant_producer' +MAX_VARIANT_RAW_BYTES = 32 * 1024 * 1024 +# Source-literal inventory copied from the separately pinned concrete interface. +VARIANT_FILES = ('initial-tcb.raw.json', 'initial-controls.raw.json', 'initial-restoration.raw.json', 'root-before.raw.json', 'preflight-before.raw.json', 'custody-before.raw.json', 'pyinit_failure/control.attempt.json', 'pyinit_failure/control.attempt.jsonl', 'pyinit_failure/control.stdout.raw', 'pyinit_failure/control.stderr.raw', 'pyinit_failure/helper-return.raw.json', 'pyinit_failure/build.json', 'pyinit_failure/_h25_dict_probe.cpython-312-x86_64-linux-gnu.so', 'pyinit_failure/elf.raw.json', 'exec_failure/control.attempt.json', 'exec_failure/control.attempt.jsonl', 'exec_failure/control.stdout.raw', 'exec_failure/control.stderr.raw', 'exec_failure/helper-return.raw.json', 'exec_failure/build.json', 'exec_failure/_h25_dict_probe.cpython-312-x86_64-linux-gnu.so', 'exec_failure/elf.raw.json', 'preflight-after.raw.json', 'custody-after.raw.json', 'root-after.raw.json', 'receipt.json') +VARIANT_GROUPS = ('initial-tcb.raw.json', 'initial-controls.raw.json', 'initial-restoration.raw.json', 'root-before.raw.json', 'preflight-before.raw.json', 'custody-before.raw.json', 'pyinit_failure/helper-return.raw.json', 'pyinit_failure/elf.raw.json', 'exec_failure/helper-return.raw.json', 'exec_failure/elf.raw.json', 'preflight-after.raw.json', 'custody-after.raw.json', 'root-after.raw.json') +REQUIRED_MODULES = ( + 'epoch_schema_v5', 'epoch_copy_v5', 'epoch_parent_v5', 'epoch_stop_v5', + 'original_build_provenance_v5', 'h25_parent_supervisor', 'parent_closure_v1', + 'parent_domain_v1', 'parent_completion_v1', 'group01_evidence_v1', + 'group01_original_predicates_v1', 'receipt_contract_v1', 'native_field_controls_v1', + 'transport_controls_v1', 'collector_controls_v1', 'elf_literal_fixture_v1', + 'elf_controls_v1', 'provider_controls_v1', 'run_pure_controls_v1', + 'elf_literal_fixture_v2', 'elf_extended_controls_v2', 'run_pure_controls_v2', + 'restoration_contract_v1', 'loader_model_controls_v1', 'driver_model_body_sources_v3', + 'root_model_body_sources_v3', 'loader_model_controls_v3', 'group_evidence_v5', + 'close_model_controls_v5', 'projection_model_controls_v5', 'run_controls_v5', + 'variant_validation_v1', 'sealed_elf_profile_v2') + + +class ParentDeadline(RuntimeError): + pass + + +def _alarm(signum, frame): + raise ParentDeadline('owned producer deadline including Popen/preexec') + + +def _gate(): + schema.exact(CONFIGURATION, ('plans', 'receiver_policy', 'checker_source')) + schema.exact(CONFIGURATION['plans'], ('normal', 'optimized')) + for pin in tuple(CONFIGURATION['plans'].values()) + (CONFIGURATION['receiver_policy'], CONFIGURATION['checker_source']): + schema.blob(pin, schema.RECORD_BYTES) + for record, key in ((SOURCE_REVIEW, 'review_sha256'), (STAGE_APPROVAL, 'stage_review_sha256'), + (COMMAND_APPROVAL, 'command_review_sha256'), (FUNDING, 'reservation_sha256'), + (EXECUTION_APPROVAL, 'external_launch_policy_sha256')): + schema.exact(record, (key,)) + schema.digest(record[key]) + + +def _state(capability): + schema.need(_TYPE(capability) is object, 'exact parent capability required') + for token, state in _PARENTS: + if token is capability: + return state + raise schema.EpochStop('unregistered parent completion owner') + + +def _receiver_gate_values(receivers): + # Fail before any producer if the concrete downstream parsers are still + # source-only. These stronger parent envelopes are installed by the + # independently authenticated original bootstrap; hashes alone grant none. + specifications = ( + ('original_build_provenance_v5', 'PARSER_CONFIGURATION', + ('leaf_policy_sha256', 'configuration_sha256', 'original_helper_sha256')), + ('original_build_provenance_v5', 'PARSER_EXECUTION_APPROVAL', ('external_launch_policy_sha256',)), + ('original_build_provenance_v5', 'PARSER_FUNDING', ('reservation_sha256',)), + ('variant_validation_v1', 'VALIDATION_CONFIGURATION', ('leaf_policy_sha256', 'configuration_sha256')), + ('variant_validation_v1', 'VALIDATION_SOURCE_REVIEW', ('review_sha256',)), + ('variant_validation_v1', 'VALIDATION_EXECUTION', ('external_launch_policy_sha256',)), + ('variant_validation_v1', 'VALIDATION_FUNDING', ('reservation_sha256',))) + result = {} + for module, name, keys in specifications: + value = closure.receiver(receivers, module, name) + schema.exact(value, keys) + for item in value.values(): + schema.digest(item) + result[module + '.' + name] = schema.plain_copy(value) + schema.need(result['original_build_provenance_v5.PARSER_CONFIGURATION']['original_helper_sha256'] == + 'aa0a315110e031e19291970c9611fe5e0f91465fa20eaec51e81186099563f78', + 'original helper source protocol differs before producer launch') + return result + + +def _guard(state): + _gate() + schema.need(state['phase'] not in ('STOP', 'CLOSED'), 'parent completion owner is terminal') + domain.refresh_unknown_owner(state['unknown_owner']) + schema.need(state['io_quarantine'][0] is False and state['unknown_owner']['pending'][0] is False and + state['unknown_owner']['iterator_uncertain'][0] is False and + state['unknown_owner']['primary'][0] is None, + 'parent I/O ownership requires kernel teardown') + schema.need(os.getpid() == state['pid'], 'parent capability cannot cross exec/process') + schema.need(_POPEN is subprocess.Popen and _OPEN is os.open and _CLOSE is os.close and + _SETRLIMIT is resource.setrlimit and _GETRLIMIT is resource.getrlimit and + _CLOCK is time.monotonic and _SETTIMER is signal.setitimer and + _GETTIMER is signal.getitimer and _SIGNAL is signal.signal and + _GETSIGNAL is signal.getsignal, + 'original parent runtime primitive binding changed') + schema.need(epoch._entry_state is _EPOCH_ENTRY and epoch.ParentEpoch.reserve_producer is _EPOCH_RESERVE and + epoch.ParentEpoch.accept_completed_producer is _EPOCH_ACCEPT and + epoch.ParentCompletion is _EPOCH_COMPLETION and epoch.ParentEpoch.commit_exports is _EPOCH_COMMIT and + epoch.ParentEpoch.close is _EPOCH_CLOSE, 'original epoch receiving entry changed') + closure.check_receivers(state['receivers']) + schema.need(_receiver_gate_values(state['receivers']) == state['receiver_gate_snapshot'], + 'independently installed receiver gates changed') + for key in ('plan', 'receiver_policy', 'checker_source'): + current = CONFIGURATION['plans'][state['plan']['mode']] if key == 'plan' else CONFIGURATION[key] + schema.need(current == state['configuration'][key], 'configured source binding changed') + copying.verify(state['configuration'][key], error_owner=state['errors']) + schema.need(_CLOCK() <= state['shared_deadline'], 'complete parent reservation deadline exceeded') + + +def _stop(state, operation, primary): + # No formatting or instance dispatch on an exception. Capture failure is + # separate, never a reason to replace the already delivered primary. + state['phase'] = 'STOP' + # The shared slot was stored inline at the first delivered local/domain + # failure, before any optional retention helper or cleanup call. + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = primary + elif state['unknown_owner']['primary'][0] is not primary: + if state['fallback'][4] is None: + state['fallback'][4] = primary + primary = state['unknown_owner']['primary'][0] + if state['stop'][0] is None: + state['stop'][0] = primary + state['stop'][1] = operation + try: + domain.refresh_unknown_owner(state['unknown_owner']) + except BaseException as error: + # Failure even to inspect retained ownership cannot permit a writer. + state['io_quarantine'][0] = True + if state['fallback'][5] is None: + state['fallback'][5] = error + try: + schema.retain_primary(state['errors'], primary, operation) + except BaseException as error: + state['fallback'][0] = error + # An uncertain native acquisition prevents further diagnostic I/O. The + # outer guard must retain memory state and observe kernel parent teardown. + if (state['directory_created'] and not state['stop_write_attempted'] and not state['io_quarantine'][0] and + not state['unknown_owner']['pending'][0] and not state['unknown_owner']['iterator_uncertain'][0] and + not (_PROCESS[0] is not None and _PROCESS[0]['acquisition_in_flight'])): + try: + state['stop_write_attempted'] = True + record = {'schema': 'h25-parent-completion-stop-v1', 'operation': operation, + 'epoch_id': state['plan']['epoch_id'], 'mode': state['plan']['mode'], + 'status': 'STOP', 'retry_or_restore_allowed': False, + 'error': schema.error_snapshot(state['errors']), + 'domain_obligations_may_be_incomplete': True, + 'enclosing_guard_must_observe_parent_exit': True} + state['stop_file'] = copying.write_once(state['plan']['session_directory'] + '/STOP.json', + schema.canonical(record), error_owner=state['errors']) + except BaseException as error: + state['fallback'][1] = error + + +def _snapshot_sources(plan, error_owner): + schema.need(_TYPE(plan['source_files']) is list and 1 <= _LEN(plan['source_files']) <= MAX_SOURCE_FILES, + 'complete prelaunch source inventory bound differs') + rows, paths, categories = [], set(), set() + for expected in plan['source_files']: + schema.exact(expected, ('category', 'path', 'sha256', 'bytes', 'mode')) + schema.choice(expected['category'], ('parent', 'root', 'provider', 'driver', 'project', + 'system_headers', 'compiler_link', 'oracle', 'stage')) + schema.path(expected['path']) + schema.digest(expected['sha256']) + schema.integer(expected['bytes'], 1, schema.FILE_BYTES) + schema.integer(expected['mode'], 0, 0o7777) + schema.need(expected['path'] not in paths, 'duplicate prelaunch source path') + paths.add(expected['path']) + categories.add(expected['category']) + actual = copying.inspect(expected['path'], schema.FILE_BYTES, error_owner=error_owner) + schema.need(actual['sha256'] == expected['sha256'] and actual['bytes'] == expected['bytes'] and + actual['identity']['mode'] & 0o7777 == expected['mode'], 'source/profile/closure changed') + rows.append(actual) + schema.need(categories == {'parent', 'root', 'provider', 'driver', 'project', 'system_headers', + 'compiler_link', 'oracle', 'stage'}, 'a mandatory source category is absent') + return rows + + +def _tree(root, state): + """Bounded exact stage census; all actual file contents are separately read.""" + schema.path(root) + pending, files, directories = [('', root)], [], [] + count = 0 + while pending: + schema.need(state['io_quarantine'][0] is False and state['unknown_owner']['pending'][0] is False and + state['unknown_owner']['iterator_uncertain'][0] is False, + 'stage census cannot acquire after uncertain ownership') + relative, current = pending.pop() + before = _STAT(current, follow_symlinks=False) + schema.need(stat.S_ISDIR(before.st_mode) and not before.st_mode & 0o222, + 'immutable stage directory kind/mode differs') + entries, primary = None, None + state['unknown_owner']['pending'][0] = True + try: + entries = _SCANDIR(current) + state['unknown_owner']['pending'][0] = False + for entry in entries: + count += 1 + schema.need(count <= MAX_STAGE_ENTRIES, 'stage census bound exceeded') + name = entry.name + schema.need(_TYPE(name) is str and name not in ('.', '..') and '/' not in name, + 'stage entry name differs') + child = name if not relative else relative + '/' + name + info = entry.stat(follow_symlinks=False) + if stat.S_ISREG(info.st_mode): + files.append(child) + elif stat.S_ISDIR(info.st_mode): + directories.append(child) + pending.append((child, current + '/' + name)) + else: + raise schema.EpochStop('stage has symlink or special file') + except BaseException as error: + primary = error + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['io_quarantine'][0] = True + state['unknown_owner']['iterator_uncertain'][0] = True + state['fallback'][2] = error + raise + finally: + if entries is not None: + owned = entries + entries = None + try: + owned.close() + except BaseException as error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['io_quarantine'][0] = True + state['unknown_owner']['iterator_uncertain'][0] = True + state['fallback'][3] = error + if primary is None: + raise + after = _STAT(current, follow_symlinks=False) + schema.need((before.st_dev, before.st_ino, before.st_mode, before.st_mtime_ns, before.st_ctime_ns) == + (after.st_dev, after.st_ino, after.st_mode, after.st_mtime_ns, after.st_ctime_ns), + 'stage directory changed during census') + return sorted(files), sorted(directories) + + +def _stage(plan, error_owner, state): + copying.verify(plan['stage_manifest'], error_owner=error_owner) + raw = copying.read_verified(plan['stage_manifest'], schema.RECORD_BYTES, error_owner=error_owner) + declared = group01.decode(raw) + schema.need(_TYPE(declared.get('files')) is dict and + plan['stage_manifest']['path'] == plan['stage_directory'] + '/STAGE.json', + 'independent stage manifest origin differs') + files, directories = _tree(plan['stage_directory'], state) + schema.need(files == sorted(list(declared['files']) + ['STAGE.json']) and + directories == plan['stage_directories'], 'complete immutable stage census differs') + source_by_path = {row['path']: row for row in plan['source_files']} + for relative, expected in declared['files'].items(): + schema.need(_TYPE(relative) is str and not relative.startswith('/') and + all(part not in ('', '.', '..') for part in relative.split('/')), + 'stage relative path differs') + path = plan['stage_directory'] + '/' + relative + schema.need(path in source_by_path and expected == + {'sha256': source_by_path[path]['sha256'], 'mode': source_by_path[path]['mode']}, + 'stage file absent from independently fixed current source closure') + return {'manifest': plan['stage_manifest'], 'file_count': len(files), 'directories': directories} + + +def _validate_plan(plan): + schema.exact(plan, ('schema', 'epoch_id', 'mode', 'round_root', 'session_directory', + 'session_seconds', 'source_closure_admission_sha256', 'source_files', 'producers')) + schema.need(plan['schema'] == 'h25-parent-completion-plan-v1', 'parent plan schema differs') + schema.label(plan['epoch_id']) + schema.choice(plan['mode'], ('normal', 'optimized')) + schema.path(plan['round_root']) + schema.path(plan['session_directory']) + schema.integer(plan['session_seconds'], 1, 600) + schema.digest(plan['source_closure_admission_sha256']) + schema.exact(plan['producers'], ('group01', 'failure_variants')) + for role in schema.PRODUCERS: + row = plan['producers'][role] + schema.exact(row, ('epoch_plan', 'command', 'cwd', 'output', 'evidence_directory', + 'stage_directory', 'stage_manifest', 'stage_directories', 'launch_binding', 'launch_nonce', + 'root_seconds', 'address_space_bytes', 'rss_bytes', 'evidence_plan', 'launch_artifacts')) + epoch._plan(row['epoch_plan'], role) + schema.launch(row['launch_binding']) + schema.text(row['launch_nonce'], 64) + schema.need(_LEN(row['launch_nonce']) == 64 and + all(c in '0123456789abcdef' for c in row['launch_nonce']), 'one-use launch nonce differs') + for key in ('cwd', 'output', 'evidence_directory', 'stage_directory'): + schema.path(row[key]) + schema.blob(row['stage_manifest'], schema.RECORD_BYTES) + schema.need(row['stage_manifest']['sha256'] == row['epoch_plan']['stage_sha256'] == + row['launch_binding']['stage_sha256'], 'independent producer stage pins differ') + schema.need(row['launch_binding']['root_sha256'] == row['epoch_plan']['root_sha256'], + 'independent producer root pins differ') + schema.integer(row['root_seconds'], 1, 180) + schema.integer(row['address_space_bytes'], 1, 1024 ** 3) + schema.integer(row['rss_bytes'], 1, 1024 ** 3) + command = row['command'] + schema.need(_TYPE(command) is list and 6 <= _LEN(command) <= 128, 'bounded original root argv required') + for argument in command: + schema.text(argument, 8192) + schema.need(bool(argument), 'empty root argument') + prefix = ['/usr/bin/python3.12', *FLAGS] + (['-O'] if plan['mode'] == 'optimized' else []) + schema.need(command[:len(prefix)] == prefix, 'original root interpreter/flags/mode differs') + entry = command[len(prefix)] + schema.path(entry) + schema.need(entry.startswith(row['stage_directory'] + '/') and + entry == row['stage_directory'] + '/integration/full_driver.py', + 'source-fixed genuine root entry differs') + schema.need(command.count('--output') == 1 and + command[command.index('--output') + 1] == row['output'], 'independent root output differs') + args = command[len(prefix) + 1:] + schema.need(len(args) >= 11 and args[0] == '--root-sha256' and args[2] == '--provider' and + args[5] == '--driver' and args[8] == '--integration' and args[10] == '--', + 'original bootstrap argv positions differ') + by_path = {item['path']: item for item in plan['source_files']} + integration = row['stage_directory'] + '/integration' + schema.need(args[1] == row['epoch_plan']['root_sha256'] and args[9] == integration and + args[3].rsplit('/', 1)[0] == args[6].rsplit('/', 1)[0] == integration, + 'actual root/provider/driver source origins differ') + for path, digest, category in ((entry, args[1], 'root'), (args[3], args[4], 'provider'), + (args[6], args[7], 'driver')): + schema.need(path in by_path and by_path[path]['sha256'] == digest and + by_path[path]['category'] == category, 'bootstrap hash not in independent source closure') + schema.exact(row['launch_artifacts'], ('configuration_sha256', 'startup_tcb_sha256', 'expected_history_sha256')) + for key, pin in row['launch_artifacts'].items(): + schema.blob(pin, schema.RECORD_BYTES) + schema.need(pin['sha256'] == row['launch_binding'][key] and pin['path'] in by_path and + by_path[pin['path']]['sha256'] == pin['sha256'] and + by_path[pin['path']]['bytes'] == pin['bytes'], 'launch data binding lacks actual source pin') + evidence = row['evidence_plan'] + if role == 'group01': + schema.need(command.count('--finite-only') == 1 and command.count('--lanes') == 1 and + command[command.index('--lanes') + 1] == 'candidate', 'Group01 must use original finite candidate route') + schema.need(evidence['mode'] == plan['mode'] and evidence['generation'] == row['epoch_plan']['generation'] and + evidence['stage_sha256'] == row['epoch_plan']['stage_sha256'] and + evidence['root_sha256'] == args[1] and evidence['driver_sha256'] == args[7], + 'Group01 evidence expectation not bound to actual independent launch') + else: + schema.need(args[11:] == ['--output', row['output'], '--generation', row['epoch_plan']['generation'], + '--launch-nonce', row['launch_nonce']], 'variant exact tail argv differs') + schema.need(args[1] == 'f5a2d33f2b4d3651f214156a0e7094c2bb516ce2d5ab7698d18c11f98f35dee0' and + args[3] == integration + '/probe_binding_v3.py' and + args[4] == '9cbb7368f89e71d1e6cc46db5dc77efed3e03ed2a801c98c88fe316e4d9f3ef2' and + args[6] == integration + '/variant_driver_v1.py', 'variant genuine original bootstrap differs') + schema.need(evidence['binding'] == {'mode': plan['mode'], 'generation': row['epoch_plan']['generation'], + 'launch_nonce': row['launch_nonce']} and evidence['output'] == row['output'] and + evidence['stage_root'] == row['stage_directory'] and evidence['raw_file_names'] == list(VARIANT_FILES), + 'variant expectation not bound to actual independent launch') + schema.need(schema.sha(schema.canonical({'argv': command})) == row['epoch_plan']['command_sha256'] == + row['launch_binding']['command_sha256'], 'independent exact root command digest differs') + schema.need(row['evidence_directory'] == plan['session_directory'] + '/' + role and + row['output'] == row['evidence_directory'] + '/producer-output', + 'source-fixed private producer origins differ') + schema.need(plan['producers']['group01']['launch_nonce'] != plan['producers']['failure_variants']['launch_nonce'], + 'producer exec launch nonce reused') + + +def make_parent(original_epoch, original_authority, original_receivers): + _gate() + schema.need(_LEN(_PARENTS) < 2, 'finite two-mode parent owner bound exceeded') + # A second mode shares the same process and therefore the same unknown + # resources. Check before the first configuration read can acquire an FD. + for unused, prior in _PARENTS: + owner = prior['unknown_owner'] + domain.refresh_unknown_owner(owner) + schema.need(prior['phase'] != 'STOP' and owner['primary'][0] is None and + owner['quarantine'][0] is False and owner['pending'][0] is False and + owner['iterator_uncertain'][0] is False, + 'prior parent failure forbids a new mode or configuration read') + schema.need(_PROCESS[0] is None or _PROCESS[0]['acquisition_in_flight'] is False, + 'uncertain process-owned lock acquisition requires kernel teardown') + owner = _UNKNOWN_OWNER + domain.refresh_unknown_owner(owner) + schema.need(owner['primary'][0] is None and owner['quarantine'][0] is False and + owner['pending'][0] is False and owner['iterator_uncertain'][0] is False, + 'earlier constructor failure prohibits configuration reads') + try: + errors = schema.make_error_owner() + native_index = 2 * len(_PARENTS) + owner['native_errors'][native_index] = schema.owner_state(errors) + original_state = _EPOCH_ENTRY(original_epoch, original_authority) + owner['native_errors'][native_index + 1] = schema.owner_state(original_state['_error_owner']) + domain.refresh_unknown_owner(owner) + schema.need(owner['quarantine'][0] is False, 'original V5 owner already requires teardown') + mode = original_state['_mode'] + schema.choice(mode, ('normal', 'optimized')) + schema.need(not any(item[1]['plan']['mode'] == mode for item in _PARENTS), 'mode parent already consumed') + configuration = schema.plain_copy({'plan': CONFIGURATION['plans'][mode], + 'receiver_policy': CONFIGURATION['receiver_policy'], 'checker_source': CONFIGURATION['checker_source']}) + plan = group01.decode(copying.read_verified(configuration['plan'], schema.RECORD_BYTES, error_owner=errors)) + _validate_plan(plan) + policy = group01.decode(copying.read_verified(configuration['receiver_policy'], schema.RECORD_BYTES, error_owner=errors)) + schema.need(set(policy) == set(REQUIRED_MODULES), 'exact fixed parent/producer receiving closure differs') + schema.need(policy['parent_completion_v1'] == configuration['checker_source'], + 'actual completion source differs from configured checker') + receivers = closure.bind_receivers(original_receivers, policy, errors) + receiver_gate_snapshot = _receiver_gate_values(receivers) + schema.need(closure.receiver(receivers, 'epoch_parent_v5', 'ParentEpoch') is epoch.ParentEpoch and + closure.receiver(receivers, 'epoch_schema_v5', 'need') is schema.need and + closure.receiver(receivers, 'epoch_copy_v5', 'inspect') is copying.inspect, + 'parent/checker epoch module identities differ') + source_guard = closure.receiver(receivers, 'h25_parent_supervisor', 'launch_contract') + source_guard() + closure.check_receivers(receivers) + original_state = _EPOCH_ENTRY(original_epoch, original_authority) + schema.need(original_state['_epoch_id'] == plan['epoch_id'] and original_state['_mode'] == plan['mode'] and + original_state['_state'] == 'PRODUCERS_PENDING' and + original_state['_plans'] == {role: row['epoch_plan'] for role, row in plan['producers'].items()} and + epoch.CONFIGURATION['parent_checker_sha256'] == configuration['checker_source']['sha256'], + 'original constructor registry is not this prelaunch epoch/plan/checker') + token = object() + state = {'pid': os.getpid(), 'phase': 'CONSTRUCTING', 'epoch': original_epoch, + 'authority': original_authority, 'errors': errors, 'plan': plan, 'configuration': configuration, + 'receivers': receivers, 'receiver_gate_snapshot': receiver_gate_snapshot, + 'runs': {}, 'next': 0, 'directory_created': False, + 'stop': [None, None], 'fallback': [None] * 8, 'stop_file': None, + 'stop_write_attempted': False, 'io_quarantine': owner['quarantine'], + 'unknown_owner': owner, + 'began': _CLOCK(), 'shared_deadline': _CLOCK() + plan['session_seconds'], + 'subreaper': None, 'native_keeper': None, 'lock_fds': [None, None], + 'lock_attempted': [False, False], 'initial_sources': None} + _PARENTS.append((token, state)) + except BaseException as error: + # Reserve the original error before another call or native cleanup. + # This also covers failures before _PARENTS receives a capability. + if owner['primary'][0] is None: + owner['primary'][0] = error + owner['quarantine'][0] = True + raise + try: + # Exclusive creation is the persistent no-restore marker. It is never + # deleted by this source; a crashed/partial same-plan session cannot run. + _MKDIR(plan['session_directory'], 0o700) + state['directory_created'] = True + if _PROCESS[0] is None: + process_record = {'pid': state['pid'], 'locks': [None, None], 'keeper': None, + 'subreaper': None, 'acquisition_in_flight': False} + _PROCESS[0] = process_record + for index, name in enumerate(('parent-queue.lock', 'science.lock')): + process_record['acquisition_in_flight'] = True + process_record['locks'][index] = _OPEN(plan['round_root'] + '/runtime/' + name, + os.O_RDWR | os.O_CREAT | os.O_CLOEXEC | os.O_NOFOLLOW, 0o600) + process_record['acquisition_in_flight'] = False + fcntl.flock(process_record['locks'][index], fcntl.LOCK_EX | fcntl.LOCK_NB) + installer = closure.receiver(receivers, 'h25_parent_supervisor', 'install_subreaper') + # Original installer has a concrete pinned source/TCB/native closure. + # Its path interface is the original pathlib.Path contract. + from pathlib import Path + subreaper, keeper = installer(Path(plan['round_root'])) + process_record['subreaper'], process_record['keeper'] = subreaper, keeper + process_record = _PROCESS[0] + schema.need(process_record['pid'] == state['pid'] and process_record['keeper'] is not None, + 'original same-process subreaper ownership missing') + state['subreaper'], state['native_keeper'] = process_record['subreaper'], process_record['keeper'] + closure.check_receivers(receivers) + state['initial_sources'] = _snapshot_sources(plan, errors) + copying.verify(configuration['checker_source'], error_owner=errors) + copying.write_once(plan['session_directory'] + '/PARENT-INTENT.json', + schema.canonical({'schema': 'h25-parent-completion-intent-v1', 'epoch_id': plan['epoch_id'], + 'mode': plan['mode'], 'configuration': configuration, 'parent_pid': state['pid'], + 'source_closure_admission_sha256': plan['source_closure_admission_sha256'], + 'retry_or_restore_allowed': False, 'accounting': 'nested non-additive; paid by one outer orchestrator'}), + error_owner=errors) + state['phase'] = 'READY' + _guard(state) + return token + except BaseException as primary: + _stop(state, 'make_parent', primary) + raise + + +def _close_logs(run, primary): + first = None + for index in range(2): + descriptor = run['log_fds'][index] + if descriptor is None or run['log_close_attempted'][index]: + continue + run['log_close_attempted'][index] = True + try: + _CLOSE(descriptor) + run['log_close_confirmed'][index] = True + except BaseException as error: + if run['unknown_owner']['primary'][0] is None: + run['unknown_owner']['primary'][0] = primary if primary is not None else error + run['unknown_owner']['quarantine'][0] = True + run['errors'][index] = error + if first is None: + first = error + if primary is None and first is not None: + raise first + + +def run_producer(owner_capability, producer_role): + state = _state(owner_capability) + try: + _guard(state) + schema.choice(producer_role, schema.PRODUCERS) + schema.need(state['phase'] == 'READY' and state['next'] < 2 and + producer_role == schema.PRODUCERS[state['next']] and producer_role not in state['runs'], + 'producer order, replay or prior completion differs') + except BaseException as primary: + _stop(state, 'run_producer_entry', primary) + raise + row = state['plan']['producers'][producer_role] + # Burn the actual epoch ticket before any later preparation or launch. + try: + ticket = _EPOCH_RESERVE(state['epoch'], state['authority'], producer_role) + run_token = object() + run = {'token': run_token, 'ticket': ticket, 'role': producer_role, 'phase': 'RESERVED', + 'unknown_owner': state['unknown_owner'], + 'plan': row, 'domain': None, 'process': None, 'root': None, 'terminal': None, + 'log_fds': [None, None], 'log_close_attempted': [False, False], + 'log_close_confirmed': [False, False], 'errors': [None] * 8, + 'primary': [None], 'acquisition_in_flight': False, 'spawn_entered': False, + 'spawn_returned': False, 'source_before': None, 'stage_before': None, + 'began': _CLOCK(), 'peak_rss': 0, 'file_limits': tuple(_GETRLIMIT(resource.RLIMIT_FSIZE))} + state['runs'][producer_role] = run + state['phase'] = 'PRODUCER_IN_FLIGHT' + except BaseException as primary: + _stop(state, 'run_producer_reservation', primary) + raise + primary = None + old_handler = None + alarm_installed = False + try: + _guard(state) + _MKDIR(row['evidence_directory'], 0o700) + # output remains absent; the genuine original Root creates it exclusively. + try: + _STAT(row['output'], follow_symlinks=False) + except FileNotFoundError: + pass + else: + raise schema.EpochStop('producer output already exists') + local_plan = dict(state['plan'], **row) + run['source_before'] = _snapshot_sources(state['plan'], state['errors']) + run['stage_before'] = _stage(local_plan, state['errors'], state) + # Reject oversized complete-custody records BEFORE any child launch. + run['source_bytes_before'] = _source_custody_bytes(state, run['source_before'], run['stage_before']) + for pin in row['launch_artifacts'].values(): + copying.verify(pin, schema.RECORD_BYTES, error_owner=state['errors']) + run['domain'] = domain.create_domain(state['unknown_owner']) + launch = {'schema': 'h25-owned-producer-launch-v1', 'epoch_id': state['plan']['epoch_id'], + 'mode': state['plan']['mode'], 'role': producer_role, + 'generation': row['epoch_plan']['generation'], 'launch_nonce': row['launch_nonce'], + 'parent_pid': state['pid'], 'command': row['command'], 'environment': ENV, 'cwd': row['cwd'], + 'launch_binding': row['launch_binding'], 'parent_file_limits': list(run['file_limits']), + 'new_session': True, 'close_fds': True, 'pass_fds': [], + 'root_seconds': row['root_seconds'], 'rss_bytes': row['rss_bytes'], + 'address_space_bytes': row['address_space_bytes']} + run['launch'] = copying.write_once(row['evidence_directory'] + '/LAUNCH.json', + schema.canonical(launch), error_owner=state['errors']) + for index, name in enumerate(('stdout.raw', 'stderr.raw')): + schema.need(state['io_quarantine'][0] is False and state['unknown_owner']['pending'][0] is False and + state['unknown_owner']['iterator_uncertain'][0] is False, + 'raw stream cannot acquire after uncertain ownership') + run['acquisition_in_flight'] = True + state['unknown_owner']['pending'][0] = True + run['log_fds'][index] = _OPEN(row['evidence_directory'] + '/' + name, + os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_CLOEXEC | os.O_NOFOLLOW, 0o600) + run['acquisition_in_flight'] = False + state['unknown_owner']['pending'][0] = False + setter, kind, limits = _SETRLIMIT, resource.RLIMIT_AS, (row['address_space_bytes'], row['address_space_bytes']) + def child_limit(): + setter(kind, limits) + schema.need(_GETTIMER(signal.ITIMER_REAL) == (0.0, 0.0), 'existing parent timer cannot be replaced') + old_handler = _GETSIGNAL(signal.SIGALRM) + _SIGNAL(signal.SIGALRM, _alarm) + alarm_installed = True + deadline = min(run['began'] + row['root_seconds'], state['shared_deadline'] - domain.CLEANUP_SECONDS) + schema.need(_CLOCK() < deadline, 'no funded root/cleanup interval remains') + _SETTIMER(signal.ITIMER_REAL, max(0.000001, deadline - _CLOCK())) + run['spawn_entered'] = True + run['process'] = _POPEN(row['command'], cwd=row['cwd'], env=dict(ENV), + stdout=run['log_fds'][0], stderr=run['log_fds'][1], stdin=subprocess.DEVNULL, + close_fds=True, pass_fds=(), start_new_session=True, preexec_fn=child_limit) + run['spawn_returned'] = True + run['root'] = domain.adopt_popen(run['domain'], run['process']) + while True: + unused, current = domain.observe(run['domain']) + run['peak_rss'] = max(run['peak_rss'], sum(item[6] for item in current)) + schema.need(run['peak_rss'] <= row['rss_bytes'], 'owned process RSS sum exceeded') + schema.need(max(_STAT(row['evidence_directory'] + '/' + name, follow_symlinks=False).st_size + for name in ('stdout.raw', 'stderr.raw')) <= schema.LOG_BYTES, 'root output bound exceeded') + if domain.poll_owned(run['domain']) is not None: + break + _SLEEP(0.01) + except BaseException as error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + primary = state['unknown_owner']['primary'][0] + run['primary'][0] = primary + if primary is not error: + run['errors'][4] = error + if (run['acquisition_in_flight'] or state['unknown_owner']['pending'][0] or + state['unknown_owner']['iterator_uncertain'][0] or _TYPE(error) is MemoryError): + state['io_quarantine'][0] = True + raise primary + finally: + # Preserve the first locally delivered primary through all cleanup. + first_cleanup = None + if alarm_installed: + try: + _SETTIMER(signal.ITIMER_REAL, 0) + _SIGNAL(signal.SIGALRM, old_handler) + except BaseException as error: + run['errors'][2] = error + first_cleanup = error + if run['domain'] is not None: + try: + domain.finish_domain(run['domain']) + except BaseException as error: + run['errors'][3] = error + state['io_quarantine'][0] = True + if first_cleanup is None: + first_cleanup = error + try: + _close_logs(run, primary if primary is not None else first_cleanup) + except BaseException as error: + if first_cleanup is None: + first_cleanup = error + for index in range(2): + if run['log_close_attempted'][index] and not run['log_close_confirmed'][index]: + state['io_quarantine'][0] = True + if primary is not None: + _stop(state, 'run_producer', primary) + elif first_cleanup is not None: + _stop(state, 'run_producer_cleanup', first_cleanup) + raise first_cleanup + try: + schema.need(run['spawn_entered'] is True and run['spawn_returned'] is True and + run['acquisition_in_flight'] is False and all(run['log_close_confirmed']), + 'root spawn or raw stream ownership incomplete') + run['terminal'] = domain.terminal_facts(run['domain']) + schema.need(tuple(_GETRLIMIT(resource.RLIMIT_FSIZE)) == run['file_limits'], 'parent file limit drift') + run['phase'] = 'JOINED' + state['phase'] = 'PRODUCER_JOINED' + _guard(state) + return run_token + except BaseException as primary: + _stop(state, 'postcleanup_terminal', primary) + raise + + +def _source_custody_bytes(state, files, stage): + raw = group01.encode({'schema': 'h25-parent-current-source-custody-v1', 'files': files, + 'stage': stage, 'source_closure_admission_sha256': state['plan']['source_closure_admission_sha256'], + 'historical_compiler_interval_proof_claimed_by_this_record': False}) + schema.need(len(raw) <= schema.RECORD_BYTES, 'complete source custody record exceeds admitted writer bound') + return raw + + +def _variant(state, run, stdout_raw): + """Dedicated concrete typed receiver; source remains external until frozen.""" + expected = group01.decode(group01.encode(run['plan']['evidence_plan'])) + expected['producer_process_id'] = run['root'][0] + expected['parent_file_limits'] = list(run['file_limits']) + files = expected['raw_file_names'] + schema.need(_TYPE(files) is list and files == list(VARIANT_FILES), + 'fixed variant raw file inventory missing') + raw_files, pins, total = {}, [], 0 + for relative in files: + schema.text(relative, 256) + schema.need(not relative.startswith('/') and all(part not in ('', '.', '..') for part in relative.split('/')), + 'variant raw origin differs') + path = run['plan']['output'] + '/' + relative + limit = 8388608 if relative.endswith('.so') else schema.LOG_BYTES if relative.endswith('.raw') else schema.RECORD_BYTES + pin = copying.inspect(path, limit, error_owner=state['errors']) + total += pin['bytes'] + schema.need(total <= MAX_VARIANT_RAW_BYTES, 'variant aggregate byte bound exceeded before allocation') + raw_files[relative] = copying.read_verified(pin, limit, error_owner=state['errors']) + pins.append(pin) + closure.check_receivers(state['receivers']) + validator = closure.receiver(state['receivers'], VARIANT_MODULE, VARIANT_FUNCTION) + result = validator(raw_files, expected) + closure.check_receivers(state['receivers']) + # Exact result schema is fixed with the separately frozen variant source. + # This branch cannot run before that complete source/interface is admitted. + schema.exact(result, ('schema', 'raw_result_relative', 'raw_group_relatives', 'builds', + 'zero_candidate_loads', 'not_runtime_authority')) + schema.need(result['schema'] == 'h25-negative-variant-data-authentication-v1' and + result['zero_candidate_loads'] is True and result['not_runtime_authority'] is True, + 'variant data-validation scope differs') + pin_by_relative = dict(zip(files, pins)) + schema.need(result['raw_result_relative'] == 'receipt.json' and + group01.same_json(group01.decode(stdout_raw), group01.decode(raw_files['receipt.json'])), + 'variant original stdout/final raw result differs') + builds = [] + schema.sequence(result['builds'], 2) + for role, row in zip(schema.ROLES[3:], result['builds']): + schema.exact(row, ('role', 'command_sha256', 'profile', 'files')) + schema.need(row['role'] == role, 'variant build role order differs') + schema.exact(row['files'], ('original_output', 'original_receipt', 'attempt', 'journal', 'stdout', 'stderr')) + build = {'role': role, 'producer_role': 'failure_variants', + 'producer_generation': run['plan']['epoch_plan']['generation'], + 'producer_stage_sha256': run['plan']['epoch_plan']['stage_sha256'], + 'command_sha256': row['command_sha256'], 'profile': row['profile']} + for key, relative in row['files'].items(): + schema.text(relative, 256) + schema.need(relative in pin_by_relative, 'variant validator returned unowned file') + build[key] = pin_by_relative[relative] + schema.build(build) + builds.append(build) + schema.need(result['raw_group_relatives'] == list(VARIANT_GROUPS), 'variant exact raw group census differs') + raw_groups = [] + for relative in result['raw_group_relatives']: + schema.text(relative, 256) + schema.need(relative in pin_by_relative, 'variant validator returned unowned raw group') + raw_groups.append({'file': relative, 'raw': pin_by_relative[relative]}) + return {'raw_result': pin_by_relative['receipt.json'], 'group_rows': raw_groups, + 'builds': builds, 'additional_raw': pins, + 'native_runtime_or_full_union_qualified': False} + + +def accept_producer(owner_capability, completed_run_capability): + state = _state(owner_capability) + try: + _guard(state) + schema.need(_TYPE(completed_run_capability) is object and state['phase'] == 'PRODUCER_JOINED', + 'joined original producer capability required') + matches = [run for run in state['runs'].values() if run['token'] is completed_run_capability] + schema.need(_LEN(matches) == 1 and matches[0]['phase'] == 'JOINED', 'unknown or replayed producer completion') + run = matches[0] + run['phase'] = 'COMPLETION_CONSUMED' + terminal = domain.terminal_facts(run['domain']) + schema.need(terminal == run['terminal'], 'owned terminal facts changed') + row, errors = run['plan'], state['errors'] + stdout = copying.inspect(row['evidence_directory'] + '/stdout.raw', schema.LOG_BYTES, error_owner=errors) + stderr = copying.inspect(row['evidence_directory'] + '/stderr.raw', schema.LOG_BYTES, error_owner=errors) + schema.need(stderr['bytes'] == 0, 'original producer stderr is not empty') + stdout_raw = copying.read_verified(stdout, schema.LOG_BYTES, error_owner=errors) + if run['role'] == 'group01': + actual = group01.authenticate_group01(row['output'], row['evidence_plan'], run['root'][0], + run['file_limits'], state['receivers'], errors, stdout_raw) + else: + actual = _variant(state, run, stdout_raw) + # These facts are parent-derived from current bytes and real owned + # cleanup, never child status flags or an imported ParentCompletion. + source_after = _snapshot_sources(state['plan'], errors) + schema.need(source_after == run['source_before'] == state['initial_sources'], 'complete current source identity changed') + stage_after = _stage(dict(state['plan'], **row), errors, state) + schema.need(stage_after == run['stage_before'], 'late complete stage custody changed') + closure.check_receivers(state['receivers']) + schema.need(domain.terminal_facts(run['domain']) == terminal, 'late parent-domain cleanup changed') + copying.verify(stdout, schema.LOG_BYTES, error_owner=errors) + copying.verify(stderr, schema.LOG_BYTES, error_owner=errors) + for build in actual['builds']: + for key, limit in (('original_output', schema.FILE_BYTES), ('original_receipt', 65536), + ('attempt', 65536), ('journal', schema.JOURNAL_BYTES), ('stdout', schema.LOG_BYTES), ('stderr', schema.LOG_BYTES)): + copying.verify(build[key], limit, error_owner=errors) + for pin in actual['additional_raw']: + copying.verify(pin, schema.FILE_BYTES, error_owner=errors) + copying.verify(actual['raw_result'], schema.RAW_RESULT_BYTES, error_owner=errors) + for pin in row['launch_artifacts'].values(): + copying.verify(pin, schema.RECORD_BYTES, error_owner=errors) + for group in actual['group_rows']: + copying.verify(group['raw'], schema.RECORD_BYTES, error_owner=errors) + if run['role'] == 'group01': + copying.verify(group['validation'], 8192, error_owner=errors) + directory = row['evidence_directory'] + terminal_pin = copying.write_once(directory + '/TERMINAL.json', schema.canonical({ + 'schema': 'h25-owned-producer-terminal-v1', 'launch': run['launch'], + 'generation': row['epoch_plan']['generation'], 'launch_nonce': row['launch_nonce'], + 'actual': terminal, 'stdout': stdout, 'stderr': stderr, + 'root_wall_before_completion_diagnostic_nanoseconds': int((_CLOCK() - run['began']) * 1000000000), + 'diagnostic_is_nested_not_additive': True}), error_owner=errors) + raw_groups = copying.write_once(directory + '/RAW-GROUPS.json', + group01.encode({'schema': 'h25-parent-retained-raw-groups-v1', 'rows': actual['group_rows'], + 'additional_raw': actual['additional_raw'], 'returned_groups_checked_before_mint': True}), error_owner=errors) + source_bytes_after = _source_custody_bytes(state, source_after, stage_after) + schema.need(source_bytes_after == run['source_bytes_before'], 'source custody changed after prelaunch size gate') + source_pin = copying.write_once(directory + '/FINAL-SOURCE-CUSTODY.json', source_bytes_after, error_owner=errors) + _guard(state) + schema.need(_CLOCK() - run['began'] <= row['root_seconds'], 'complete root including validation/custody exceeded bound') + observation = {'schema': 'h25-owned-parent-observation-v1', 'epoch_id': state['plan']['epoch_id'], + 'mode': state['plan']['mode'], 'producer_role': run['role'], 'generation': row['epoch_plan']['generation'], + 'launch_nonce': row['launch_nonce'], 'launch': run['launch'], 'terminal': terminal_pin, + 'raw_result': actual['raw_result'], 'raw_groups': raw_groups, 'final_source_custody': source_pin, + 'root_pid': run['root'][0], 'root_start_ticks': run['root'][4], + 'later_cross_root_aggregate_required_before_export': False, + 'native_full_or_gain_qualification': False} + observed_pin = copying.write_once(directory + '/PARENT-OBSERVATION.json', schema.canonical(observation), error_owner=errors) + record = {key: row['epoch_plan'][key] for key in ('role', 'generation', 'stage_sha256', 'command_sha256', 'root_sha256')} + record.update(terminal=terminal_pin, raw_result=actual['raw_result'], raw_groups=raw_groups, + final_source_custody=source_pin, parent_observation=observed_pin, + completion_checker_sha256=state['configuration']['checker_source']['sha256'], builds=actual['builds']) + schema.producer(record) + # The only mint site is below every actual launch/domain/raw/source + # check. Neither ticket nor completion is ever returned to a caller. + _guard(state) + completion = _EPOCH_COMPLETION(run['ticket'], state['configuration']['checker_source']['sha256'], + observed_pin['sha256'], row['epoch_plan']['generation'], state['plan']['mode'], run['role'], + run['root'][0], run['root'][4], True, True, True, True, True, True) + _EPOCH_ACCEPT(state['epoch'], state['authority'], run['ticket'], completion, record) + _guard(state) + schema.need(_CLOCK() - run['began'] <= row['root_seconds'], + 'complete root plus acceptance tail exceeded bound') + run['phase'], run['record'] = 'ACCEPTED', record + state['next'] += 1 + state['phase'] = 'READY' if state['next'] < 2 else 'PRODUCERS_ACCEPTED' + return schema.plain_copy(record) + except BaseException as primary: + _stop(state, 'accept_producer', primary) + raise + + +def commit_exports(owner_capability): + state = _state(owner_capability) + try: + _guard(state) + schema.need(state['phase'] == 'PRODUCERS_ACCEPTED' and state['next'] == 2 and + all(run['phase'] == 'ACCEPTED' for run in state['runs'].values()), + 'only two genuinely accepted producer records may export') + result = _EPOCH_COMMIT(state['epoch'], state['authority']) + _guard(state) + state['phase'] = 'EXPORTED' + return result + except BaseException as primary: + _stop(state, 'commit_exports', primary) + raise + + +def stop_evidence(owner_capability): + state = _state(owner_capability) + summaries = [{'role': run['role'], 'phase': run['phase'], + 'spawn_entered': run['spawn_entered'], 'spawn_returned': run['spawn_returned'], + 'log_close_attempted': list(run['log_close_attempted']), + 'log_close_confirmed': list(run['log_close_confirmed'])} + for run in state['runs'].values()] + # Never expose the epoch ticket, Popen object, domain capability or private + # run sidecar through diagnostic return values. + return state['stop'], state['errors'], state['fallback'], summaries diff --git a/research/h25-v03-prefix-supervision/basis/parent_domain_v1.py.txt b/research/h25-v03-prefix-supervision/basis/parent_domain_v1.py.txt new file mode 100644 index 0000000000..55f0103208 --- /dev/null +++ b/research/h25-v03-prefix-supervision/basis/parent_domain_v1.py.txt @@ -0,0 +1,450 @@ +"""Owned Linux child domains for one trusted, single-threaded parent process. + +Source proposal only. No target was imported or run during authoring. The +external launcher must authenticate the OS, interpreter, system modules and +original subreaper installer before importing this module. This is the original +closed child-domain premise, not a sandbox against hostile forking or a hostile +host. Acquisition/unwind ambiguity quarantines the parent; it never authorizes +another launch or a completion. The enclosing guard must observe parent exit. +""" +import os +import signal +import subprocess +import time +import epoch_schema_v5 as schema + +_TYPE, _LEN = type, len +_OPEN, _READ, _CLOSE = os.open, os.read, os.close +_STAT = os.stat +_SCANDIR, _GETPID, _GETPGRP, _GETSID = os.scandir, os.getpid, os.getpgrp, os.getsid +_PIDFD_OPEN, _PIDFD_SIGNAL = os.pidfd_open, signal.pidfd_send_signal +_WAITPID, _CLOCK, _SLEEP = os.waitpid, time.monotonic, time.sleep +_POPEN, _POLL = subprocess.Popen, subprocess.Popen.poll +_PAGE_BYTES = os.sysconf('SC_PAGE_SIZE') +_DOMAINS = [] +MAX_GENERATIONS = 128 +MAX_PROC_ENTRIES = 131072 +MAX_PROC_BYTES = 8192 +CLEANUP_SECONDS = 2.0 + + +def _state(capability): + schema.need(_TYPE(capability) is object, 'exact owned domain capability required') + for token, state in _DOMAINS: + if token is capability: + return state + raise schema.EpochStop('unregistered owned domain') + + +def refresh_unknown_owner(owner): + # These are exact V5 ErrorOwner state references captured by the original + # parent before use. Read only the pinned private shape; no projection, + # callback, native I/O or interpretation of historical release slot9. + for native in owner['native_errors']: + if native is None: + continue + io = native[7] + if (io[0] or io[1] or io[2] or io[4] or io[6] or io[10] or io[11] or + io[5] is not None or native[5][1] or io[7][4] == 1): + owner['quarantine'][0] = True + if io[5] is not None: + owner['iterator_uncertain'][0] = True + + +def _fresh_acquisition(state): + # This shares the original parent's preallocated unknown-resource owner. + # Pending acquisition and delivered census failure are independent of a + # later Python close return. Neither flag is cleared by cleanup. + owner = state['unknown_owner'] + refresh_unknown_owner(owner) + schema.need(state['quarantine'] is False and state['acquisition_in_flight'] is False and + state['io_uncertain'] is False and owner['quarantine'][0] is False and + owner['pending'][0] is False and owner['iterator_uncertain'][0] is False, + 'uncertain ownership prohibits a fresh native acquisition') + + +def _opaque(state, error, slot): + # Preallocated slots retain the actual delivered object, without formatting. + # A secondary never replaces the first primary. Slots are finite and an + # overflow means quarantine, not a successful evidence projection. + state['quarantine'] = True + if state['primary'][0] is None: + state['primary'][0] = error + elif state['secondary'][slot] is None: + state['secondary'][slot] = error + else: + state['overflow'][0] = error + + +def _proc(pid, state): + schema.integer(pid, 1, (1 << 31) - 1) + descriptor = None + primary = None + _fresh_acquisition(state) + # The uncertain acquisition flag is set before the native entry. If open + # raises after an undisclosed descriptor acquisition, parent exit is needed. + try: + try: + _STAT('/proc/' + str(pid) + '/stat', dir_fd=None, follow_symlinks=False) + except (FileNotFoundError, ProcessLookupError): + # Only the pinned metadata-only primitive establishes absence. + # An exception from a later acquisition never proves no FD existed. + return None + state['acquisition_in_flight'] = True + state['unknown_owner']['pending'][0] = True + descriptor = _OPEN('/proc/' + str(pid) + '/stat', + os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW | os.O_NONBLOCK) + state['acquisition_in_flight'] = False + state['unknown_owner']['pending'][0] = False + raw = _READ(descriptor, MAX_PROC_BYTES + 1) + schema.need(_TYPE(raw) is bytes and _LEN(raw) <= MAX_PROC_BYTES, + 'bounded proc stat read differs') + end = raw.rfind(b') ') + schema.need(end >= 0, 'malformed proc stat') + fields = raw[end + 2:].split() + schema.need(_LEN(fields) >= 22 and raw[:raw.find(b' ')] == str(pid).encode('ascii'), + 'proc stat identity or shape differs') + row = (pid, int(fields[1]), int(fields[2]), int(fields[3]), + int(fields[19]), fields[0].decode('ascii'), int(fields[21]) * _PAGE_BYTES) + schema.need(row[4] > 0 and row[6] >= 0, 'proc generation or RSS differs') + return row + except BaseException as error: + primary = error + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + _opaque(state, error, 0) + raise + finally: + if descriptor is not None: + # Burn before entry; a failed native close is not retried. + owned = descriptor + descriptor = None + try: + _CLOSE(owned) + except BaseException as close_error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = close_error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + state['io_uncertain'] = True + _opaque(state, close_error, 1) + if primary is None: + raise + + +def _census(state): + iterator = None + primary = None + rows = {} + _fresh_acquisition(state) + state['acquisition_in_flight'] = True + state['unknown_owner']['pending'][0] = True + try: + iterator = _SCANDIR('/proc') + state['acquisition_in_flight'] = False + state['unknown_owner']['pending'][0] = False + count = 0 + for entry in iterator: + count += 1 + schema.need(count <= MAX_PROC_ENTRIES, 'proc census entry bound exceeded') + name = entry.name + if name.isdecimal(): + row = _proc(int(name), state) + if row is not None: + rows[row[0]] = row + return rows + except BaseException as error: + primary = error + # All delivered iteration/body failures latch before optional helper + # entry. A no-op/successful close cannot establish release afterward. + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['quarantine'] = True + state['io_uncertain'] = True + state['unknown_owner']['quarantine'][0] = True + state['unknown_owner']['iterator_uncertain'][0] = True + _opaque(state, error, 2) + raise + finally: + if iterator is not None: + owned = iterator + iterator = None + try: + owned.close() + except BaseException as close_error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = close_error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + state['unknown_owner']['iterator_uncertain'][0] = True + state['io_uncertain'] = True + _opaque(state, close_error, 3) + if primary is None: + raise + + +def create_domain(unknown_owner): + """Called only after the original same-process subreaper was installed.""" + schema.need(_LEN(_DOMAINS) < 4, 'two modes by two producers domain bound exceeded') + schema.exact(unknown_owner, ('quarantine', 'pending', 'iterator_uncertain', 'primary', 'native_errors')) + for key in ('quarantine', 'pending', 'iterator_uncertain', 'primary'): + schema.need(_TYPE(unknown_owner[key]) is list and _LEN(unknown_owner[key]) == 1, + 'original parent unknown-resource slot differs') + schema.need(_TYPE(unknown_owner['native_errors']) is list and _LEN(unknown_owner['native_errors']) == 4, + 'exact two-mode V5 error-owner registry required') + for native in unknown_owner['native_errors']: + schema.need(native is None or (_TYPE(native) is list and _LEN(native) == 9 and + _TYPE(native[7]) is list and _LEN(native[7]) == 13), + 'original captured V5 error-owner shape differs') + refresh_unknown_owner(unknown_owner) + schema.need(all(unknown_owner[key][0] is False for key in + ('quarantine', 'pending', 'iterator_uncertain')) and unknown_owner['primary'][0] is None, + 'unknown-resource parent already requires teardown') + token = object() + state = {'rows': [None] * MAX_GENERATIONS, 'fds': [None] * MAX_GENERATIONS, + 'fd_attempted': [False] * MAX_GENERATIONS, + 'fd_closed': [False] * MAX_GENERATIONS, 'count': 0, + 'groups': set(), 'reaped': [], 'after_root': set(), + 'process': None, 'root': None, 'returncode': None, + 'parent_pid': _GETPID(), 'parent_group': _GETPGRP(), 'parent_session': _GETSID(0), + 'phase': 'CONSTRUCTING', 'quarantine': False, + 'acquisition_in_flight': False, 'io_uncertain': False, 'primary': [None], + 'unknown_owner': unknown_owner, + 'secondary': [None] * 16, 'overflow': [None], + 'final_rows': None, 'closure_confirmed': False} + _DOMAINS.append((token, state)) + try: + rows = _census(state) + schema.need(not any(row[1] == state['parent_pid'] for row in rows.values()), + 'parent has preexisting child processes') + state['phase'] = 'RESERVED' + return token + except BaseException as error: + if unknown_owner['primary'][0] is None: + unknown_owner['primary'][0] = error + unknown_owner['quarantine'][0] = True + state['quarantine'] = True + _opaque(state, error, 4) + state['phase'] = 'STOP' + raise + + +def _add(state, row): + _fresh_acquisition(state) + key = row[0], row[4] + schema.need(row[0] != state['parent_pid'], 'parent cannot enter own child domain') + for index in range(state['count']): + prior = state['rows'][index] + if prior is not None and (prior[0], prior[4]) == key: + if row[2] != state['parent_group']: + state['groups'].add((row[2], row[3])) + return True + index = state['count'] + schema.need(index < MAX_GENERATIONS, 'owned process generation bound exceeded') + # Reserve the slot before native acquisition. No role/generation slot is + # recycled after a failed or disappeared acquisition. + state['count'] = index + 1 + state['rows'][index] = row + state['acquisition_in_flight'] = True + state['unknown_owner']['pending'][0] = True + try: + state['fds'][index] = _PIDFD_OPEN(row[0], 0) + state['acquisition_in_flight'] = False + state['unknown_owner']['pending'][0] = False + current = _proc(row[0], state) + if current is None or (current[0], current[4]) != key: + return False # The actual FD stays owned for one terminal close. + if current[2] != state['parent_group']: + state['groups'].add((current[2], current[3])) + return True + except BaseException as error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + _opaque(state, error, 5) + raise + + +def observe(capability): + state = _state(capability) + all_rows = _census(state) + known = set() + for index in range(state['count']): + prior = state['rows'][index] + current = None if prior is None else all_rows.get(prior[0]) + if current is not None and current[4] == prior[4]: + known.add(current[0]) + _add(state, current) + for unused in range(MAX_GENERATIONS + 1): + changed = False + for pid, row in all_rows.items(): + if pid not in known and (row[1] == state['parent_pid'] or row[1] in known): + if _add(state, row): + known.add(pid) + changed = True + if not changed: + break + else: + raise schema.EpochStop('child-domain closure iteration bound exceeded') + return all_rows, tuple(all_rows[pid] for pid in sorted(known)) + + +def adopt_popen(capability, process): + state = _state(capability) + schema.need(state['phase'] == 'RESERVED' and state['process'] is None and + _TYPE(process) is _POPEN, 'Popen ownership or one-attempt state differs') + state['process'] = process # Exact original return, never a supplied proxy. + row = _proc(process.pid, state) + schema.need(row is not None and row[1] == state['parent_pid'] and + row[2] == row[3] == process.pid, + 'new child PID/session/generation missing before first poll') + state['root'] = row + schema.need(_add(state, row) is True, 'original child pidfd generation not owned') + state['phase'] = 'RUNNING' + return row + + +def poll_owned(capability): + state = _state(capability) + schema.need(state['phase'] == 'RUNNING' and _TYPE(state['process']) is _POPEN, + 'original running Popen required') + result = _POLL(state['process']) + if result is not None: + schema.integer(result, -128, 255) + state['returncode'] = result + return result + + +def _kill(state): + for index in range(state['count']): + fd, prior = state['fds'][index], state['rows'][index] + if fd is None or state['fd_attempted'][index]: + continue + current = _proc(prior[0], state) + if current is not None and current[4] == prior[4] and current[5] != 'Z': + try: + _PIDFD_SIGNAL(fd, signal.SIGKILL, None, 0) + except ProcessLookupError: + pass + + +def finish_domain(capability): + """Always attempted, including Popen exceptions; no caller closure claims.""" + state = _state(capability) + schema.need(state['phase'] in ('RESERVED', 'RUNNING'), 'domain cleanup replay') + state['phase'] = 'CLEANUP_CONSUMED' + started = _CLOCK() + primary = None + try: + _fresh_acquisition(state) + while True: + all_rows, current = observe(capability) + process = state['process'] + if process is not None and process.returncode is not None: + for row in current: + if row[0] != process.pid: + state['after_root'].add((row[0], row[4])) + _kill(state) + if process is not None: + result = _POLL(process) + if result is not None: + state['returncode'] = result + for index in range(state['count']): + prior = state['rows'][index] + row = _proc(prior[0], state) + if (row is None or row[4] != prior[4] or row[1] != state['parent_pid'] or + (process is not None and row[0] == process.pid)): + continue + try: + pid, status = _WAITPID(row[0], os.WNOHANG) + except ChildProcessError: + continue + if pid: + state['reaped'].append((pid, prior[4], status)) + all_rows, current = observe(capability) + remaining = tuple(row for row in all_rows.values() + if row[1] == state['parent_pid'] or (row[2], row[3]) in state['groups'] or + any(prior is not None and (row[0], row[4]) == (prior[0], prior[4]) + for prior in state['rows'][:state['count']])) + state['final_rows'] = remaining + if not current and not remaining: + state['closure_confirmed'] = True + break + if _CLOCK() - started >= CLEANUP_SECONDS: + break + _SLEEP(0.01) + except BaseException as error: + primary = error + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + _opaque(state, error, 6) + raise + finally: + # Every known FD gets one attempt even if a prior close failed. Native + # return/boxing, Python call-entry and final unwind still have no total + # recovery theorem; any such failure forbids minting and parent reuse. + first_close = None + for index in range(state['count']): + descriptor = state['fds'][index] + if descriptor is None or state['fd_attempted'][index]: + continue + state['fd_attempted'][index] = True + try: + _CLOSE(descriptor) + state['fd_closed'][index] = True + except BaseException as error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + state['io_uncertain'] = True + _opaque(state, error, 7) + if first_close is None: + first_close = error + state['phase'] = 'CLOSED' if primary is None and first_close is None else 'STOP' + if primary is None and first_close is not None: + raise first_close + + +def terminal_facts(capability): + state = _state(capability) + _fresh_acquisition(state) + schema.need(state['phase'] == 'CLOSED' and state['quarantine'] is False and + state['acquisition_in_flight'] is False and state['io_uncertain'] is False and state['root'] is not None and + state['returncode'] == 0 and state['closure_confirmed'] is True and + state['final_rows'] == () and not state['after_root'] and not state['reaped'] and + all(fd is None or (state['fd_attempted'][index] and state['fd_closed'][index]) + for index, fd in enumerate(state['fds'])), + 'owned terminal domain is incomplete, failed, orphaned or quarantined') + # Fresh census after FD cleanup. This is independent of receipt booleans. + rows = _census(state) + schema.need(not any(row[1] == state['parent_pid'] or + (row[2], row[3]) in state['groups'] for row in rows.values()), + 'postcleanup owned child/group still present') + return {'root': list(state['root']), 'returncode': state['returncode'], + 'owned_generations': [list(row) for row in state['rows'][:state['count']]], + 'groups': [list(pair) for pair in sorted(state['groups'])], + 'remaining': [], 'adopted_reaps': [], 'observed_after_root_exit': [], + 'pidfd_close_attempted': list(state['fd_attempted'][:state['count']]), + 'pidfd_close_confirmed': list(state['fd_closed'][:state['count']]), + 'source': 'original in-process Popen and owned generation registry', + 'hostile_fork_or_privileged_host_resistance_claimed': False} + + +def stop_slots(capability): + state = _state(capability) + return state['primary'], state['secondary'], state['overflow'], { + 'phase': state['phase'], 'quarantine': state['quarantine'], + 'acquisition_in_flight': state['acquisition_in_flight'], + 'io_uncertain': state['io_uncertain'], + 'shared_pending': state['unknown_owner']['pending'][0], + 'shared_iterator_uncertain': state['unknown_owner']['iterator_uncertain'][0], + 'shared_quarantine': state['unknown_owner']['quarantine'][0], + 'closure_confirmed': state['closure_confirmed'], + 'pidfd_close_attempted': list(state['fd_attempted'][:state['count']]), + 'pidfd_close_confirmed': list(state['fd_closed'][:state['count']])} diff --git a/research/h25-v03-prefix-supervision/run.py b/research/h25-v03-prefix-supervision/run.py new file mode 100644 index 0000000000..d8c095fd5d --- /dev/null +++ b/research/h25-v03-prefix-supervision/run.py @@ -0,0 +1,45 @@ +# SPDX-License-Identifier: Apache-2.0 +"""Only new AST-extracted fixture functions; all operations remain fake.""" +from pathlib import Path +import importlib.util +import sys +import unittest +ROOT = Path(__file__).resolve().parent +BLOCKED = {'epoch_schema_v5','epoch_copy_v5','parent_domain_v1','parent_closure_v1','parent_completion_v1','h25_parent_supervisor','group01_evidence_v1','v03_prefix_supervisor_v1','v03_prefix_derivation_v1','v03_integrated_constructor_v1','v03_integrated_constructor_v2'} + +def load(name, path): + spec = importlib.util.spec_from_file_location(name, path) + module = importlib.util.module_from_spec(spec) + sys.modules[name] = module + spec.loader.exec_module(module) + return module + +def main(): + if BLOCKED & set(sys.modules): + raise RuntimeError('archived module already imported') + load('prefix_export_archive_checker', ROOT / 'verify.py').check() + base = ROOT / 'unit05' + proposal = load('prefix_new_supplied_fixture_runner', base / 'fixtures/run_proposal_pure_tests_v1.py') + proposal.BASE = base + proposal.IMPL = base / 'implementation' + try: + proposal.main() + except SystemExit as result: + if result.code != 0: + raise + orchestration = load('prefix_new_orchestration_fixture', base / 'fixtures/test_new_orchestration_v2.py') + orchestration.BASE = base + orchestration.IMPL = base / 'implementation' + suite = unittest.defaultTestLoader.loadTestsFromModule(orchestration) + if suite.countTestCases() != 13: + raise RuntimeError('expected13new orchestration methods') + result = unittest.TextTestRunner(verbosity=2).run(suite) + if result.testsRun != 13 or not result.wasSuccessful(): + return 1 + if BLOCKED & set(sys.modules): + raise RuntimeError('archived runtime import boundary violated') + print('PASS_PREFIX_SUPERVISION_NEW_FIXTURES methods=23 optimized=' + str(sys.flags.optimize), flush=True) + return 0 + +if __name__ == '__main__': + raise SystemExit(main()) diff --git a/research/h25-v03-prefix-supervision/unit05/AUTHOR-RECEIPT-v1.json b/research/h25-v03-prefix-supervision/unit05/AUTHOR-RECEIPT-v1.json new file mode 100644 index 0000000000..d729443a8e --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/AUTHOR-RECEIPT-v1.json @@ -0,0 +1,124 @@ +{ + "artifacts": [ + { + "bytes": 82957, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/epoch_copy_v5.py", + "sha256": "4f459d0336d59975df787c24373e18dad4044c3a24137392e890115f811b3211" + }, + { + "bytes": 30668, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/epoch_schema_v5.py", + "sha256": "b89a789654be87bde40a47300f4d9702dce2b90e6ab3be9a2025f6d8041b3e9a" + }, + { + "bytes": 15610, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/group01_evidence_v1.py", + "sha256": "05ec6a63c57340ba929aea1fab71b096efc143e099346640f6def41310bd3e25" + }, + { + "bytes": 23047, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/h25_parent_supervisor.py", + "sha256": "cfb09a18dd10b597cc6d5a8139ee769bef679bc44ae029329755e3d97b055075" + }, + { + "bytes": 13463, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_closure_v1.py", + "sha256": "a15424f14baa3d484fe04bfbe7e449c32561c866dbaca2c1b5f646dfb377ed1f" + }, + { + "bytes": 54168, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_completion_v1.py", + "sha256": "d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5" + }, + { + "bytes": 23942, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_domain_v1.py", + "sha256": "a51264289803b4b17bb262f2460ddd4ed72500aaa21e5eb80fa2db4583689361" + }, + { + "bytes": 6381, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/test_v03_prefix_supervisor_v1.py", + "sha256": "b5f8055da6f9a48e85a4eed0868f7076859adca317e0691e5b2336e0bdb58d52" + }, + { + "bytes": 6087, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_integrated_constructor_v1.py", + "sha256": "5e08ff84298fe1249be5e8790ea259e6179048f4736fb7eafdb6e170b8bc1cf9" + }, + { + "bytes": 3830, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_prefix_derivation_v1.py", + "sha256": "4591de196d008f0fdc094f4a74b19a84c095e2def5d28dbdaea7085e4630f8a7" + }, + { + "bytes": 35491, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_prefix_supervisor_v1.py", + "sha256": "75bef7834fe7278638010f79a8efca84b49b1e48320d3c8ac2d93cadea5a8262" + }, + { + "bytes": 14205, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_source_refusal_observer_v1.py", + "sha256": "abf25690d3bee4a9783ee504567c29f7fb47da670e0ec95f57cb5944bf57264f" + }, + { + "bytes": 6294, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/ASSEMBLY-v1.json", + "sha256": "fcb9d53fbb77583a12ace09ebec7edb9e9820d7eeb00e15b6b7410888738763b" + }, + { + "bytes": 1477, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/PROPOSAL-TESTS-v1-normal.txt", + "sha256": "488d38cf7147d94811dab07bc385f4339b999d2da1f0b0d18de7692f9dd417a8" + }, + { + "bytes": 1477, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/PROPOSAL-TESTS-v1-optimized.txt", + "sha256": "77ccaed42375657de3639d0b1cba77a8de25ac4ae8ab808013bab519b652d98b" + }, + { + "bytes": 1226, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/V1-REJECTION-v1.json", + "sha256": "e1978317502606bde5baa67698c2ed9227032192069e49c8b08ebee6eaec9a96" + }, + { + "bytes": 3836, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/run_proposal_pure_tests_v1.py", + "sha256": "2cd493991834294bc016510e11dbfd0f14049fd7915632970c28a10e3b51a790" + } + ], + "bootstrap_C07_actual_stage_native_funding_runtime_admissions": "MISSING_SEPARATE_PREMISES", + "full_C05": false, + "full_V03": false, + "independent_source_acceptance": false, + "isolation": "only exact new test module and appended new accessor function AST with explicit fake globals; no full supervisor/original module import", + "normal_and_optimized_test_status": "PASS", + "original_activity_credit": false, + "outside_costs": "OPEN_NOT_ZERO", + "proposal_source_manifest_sha256": "627fd8b7c8439851b9afcde92cbc5110b72aa957c3663dabf377482c4ebf5f44", + "response_sha256": "d1b15e2a92c6cbf137319ef2c165e2d920202d5f2d7509d7a8d572d90b4ffa13", + "retained_findings": [ + { + "finding": "Unit01 constructor NATIVE_ENV is dict with bytes keys; original closure _data rejects dict keys not exact str/int, so proposed receiver capture cannot succeed", + "id": "U05-R01", + "original_function_executed_to_prove": false, + "reviewer": "c05_component_review", + "source_anchors": [ + "v03_integrated_constructor_v1.py:13-17", + "parent_closure_v1.py original _data:98-116 and capture:209-220" + ] + }, + { + "finding": "make_prefix_owner requires outer configuration.plan blob among decoded plan.source_files with identical hash/size/mode; this demands plan ownhash construction not supplied", + "id": "U05-R02", + "original_function_executed_to_prove": false, + "reviewer": "v03_source_route_review", + "source_anchors": [ + "v03_prefix_supervisor_v1.py original proposal:363-373" + ] + } + ], + "schema": "unit05-author-initial-v1", + "source_assembly": "exact proposal copied; originaldomain append only; originalclosure sole63B insertion; productionparent unchanged", + "source_assembly_ready_utc": "2026-11-02T11:03:27Z", + "supplied_new_pure_tests": 10 +} diff --git a/research/h25-v03-prefix-supervision/unit05/AUTHOR-RECEIPT-v2.json b/research/h25-v03-prefix-supervision/unit05/AUTHOR-RECEIPT-v2.json new file mode 100644 index 0000000000..019f45fa05 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/AUTHOR-RECEIPT-v2.json @@ -0,0 +1,245 @@ +{ + "artifacts": [ + { + "bytes": 82957, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/epoch_copy_v5.py", + "sha256": "4f459d0336d59975df787c24373e18dad4044c3a24137392e890115f811b3211" + }, + { + "bytes": 30668, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/epoch_schema_v5.py", + "sha256": "b89a789654be87bde40a47300f4d9702dce2b90e6ab3be9a2025f6d8041b3e9a" + }, + { + "bytes": 15610, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/group01_evidence_v1.py", + "sha256": "05ec6a63c57340ba929aea1fab71b096efc143e099346640f6def41310bd3e25" + }, + { + "bytes": 23047, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/h25_parent_supervisor.py", + "sha256": "cfb09a18dd10b597cc6d5a8139ee769bef679bc44ae029329755e3d97b055075" + }, + { + "bytes": 13463, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_closure_v1.py", + "sha256": "a15424f14baa3d484fe04bfbe7e449c32561c866dbaca2c1b5f646dfb377ed1f" + }, + { + "bytes": 54168, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_completion_v1.py", + "sha256": "d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5" + }, + { + "bytes": 23942, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_domain_v1.py", + "sha256": "a51264289803b4b17bb262f2460ddd4ed72500aaa21e5eb80fa2db4583689361" + }, + { + "bytes": 6381, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/test_v03_prefix_supervisor_v1.py", + "sha256": "b5f8055da6f9a48e85a4eed0868f7076859adca317e0691e5b2336e0bdb58d52" + }, + { + "bytes": 6087, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_integrated_constructor_v1.py", + "sha256": "5e08ff84298fe1249be5e8790ea259e6179048f4736fb7eafdb6e170b8bc1cf9" + }, + { + "bytes": 6111, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_integrated_constructor_v2.py", + "sha256": "a80a60b390bc60e9bc434b79cda5ae6db88e4f0c6c7436de9adfe1f48a2045b1" + }, + { + "bytes": 3830, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_prefix_derivation_v1.py", + "sha256": "1ed813148c10d5fbd3cd6781d51eca650a347eda7a6323f581d740e6ea9cb6e2" + }, + { + "bytes": 36954, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_prefix_supervisor_v1.py", + "sha256": "f97b07d4a5f461d4134a2bdf4cfcc28da12acc7e7144c18f6cc0a017cdee86f6" + }, + { + "bytes": 14205, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_source_refusal_observer_v1.py", + "sha256": "abf25690d3bee4a9783ee504567c29f7fb47da670e0ec95f57cb5944bf57264f" + }, + { + "bytes": 6294, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/ASSEMBLY-v1.json", + "sha256": "fcb9d53fbb77583a12ace09ebec7edb9e9820d7eeb00e15b6b7410888738763b" + }, + { + "bytes": 984, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/DERIVATION-v2-normal.txt", + "sha256": "d1bf5239bc1f28c3d9c0335905cc68403962ead056c55f6d85ec70e96e9ebd44" + }, + { + "bytes": 984, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/DERIVATION-v2-optimized.txt", + "sha256": "5e1c3982013b93f186fe0b6264d838afa2ce4eb71235b1f166dd7f77dd97eaf9" + }, + { + "bytes": 6574, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/ORCHESTRATION-v2-initial-fixture-errors-normal.txt", + "sha256": "883b2e4d35155f2d57b31c7c6c7740121cac9a87f98de421c3c8b18e72048e4d" + }, + { + "bytes": 6574, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/ORCHESTRATION-v2-initial-fixture-errors-optimized.txt", + "sha256": "1d9aa5d591af2337f41b4acc2b535d1e03d344ecb1dc707c19062f645df9670c" + }, + { + "bytes": 1755, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/ORCHESTRATION-v2-normal.txt", + "sha256": "8f8900c0604a2f63cb4234a16749915cdbe8d2a617b4f76dc88a9f256c10835f" + }, + { + "bytes": 1755, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/ORCHESTRATION-v2-optimized.txt", + "sha256": "fb797a332abdf3285f00365390e24c040d4d1a2f50f997f47ea3586a4b02ed70" + }, + { + "bytes": 1383, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/OUTER-PLAN-BILL-v2.json", + "sha256": "50c20cf701bebffdb774b165455c1bdadaa28583a21f333e2c182bd1fbbc2b59" + }, + { + "bytes": 7780, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/POLICY-REQUIREMENTS-v2.json", + "sha256": "eab55574022638c58c89f7468d86ec8f3b1cda0efd66050250248b49e66ac892" + }, + { + "bytes": 1477, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/PROPOSAL-TESTS-v1-normal.txt", + "sha256": "488d38cf7147d94811dab07bc385f4339b999d2da1f0b0d18de7692f9dd417a8" + }, + { + "bytes": 1477, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/PROPOSAL-TESTS-v1-optimized.txt", + "sha256": "77ccaed42375657de3639d0b1cba77a8de25ac4ae8ab808013bab519b652d98b" + }, + { + "bytes": 1477, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/PROPOSAL-TESTS-v2-normal.txt", + "sha256": "b6987b739878fb854c97e959a08f291d0fd4f3a4b7d665b3c8b0340d68d74a7f" + }, + { + "bytes": 1477, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/PROPOSAL-TESTS-v2-optimized.txt", + "sha256": "488d38cf7147d94811dab07bc385f4339b999d2da1f0b0d18de7692f9dd417a8" + }, + { + "bytes": 1268, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/REPAIR-DELTA-v2.json", + "sha256": "1aec6f8bc41e8bb81f3d440d6b643f27e5a0aededa6fb406b2ab07fbddbe5703" + }, + { + "bytes": 1226, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/V1-REJECTION-v1.json", + "sha256": "e1978317502606bde5baa67698c2ed9227032192069e49c8b08ebee6eaec9a96" + }, + { + "bytes": 3836, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/run_proposal_pure_tests_v1.py", + "sha256": "2cd493991834294bc016510e11dbfd0f14049fd7915632970c28a10e3b51a790" + }, + { + "bytes": 5538, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/test_derivation_pure_v2.py", + "sha256": "37260fe75234e3b4565cea65fba6c4374cd0a30a407b5cfaa670f198df5b8a82" + }, + { + "bytes": 12170, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/test_new_orchestration_v2.py", + "sha256": "7193e4eadf500a1a1e630236dbbda73703e20cfc7cbc7ab174e18636a5d6362c" + } + ], + "full_C05": false, + "full_V03": false, + "new_pure_test_logs": [ + { + "bytes": 1477, + "methods": 10, + "mode": "normal", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/PROPOSAL-TESTS-v2-normal.txt", + "sha256": "b6987b739878fb854c97e959a08f291d0fd4f3a4b7d665b3c8b0340d68d74a7f", + "status": "PASS" + }, + { + "bytes": 1477, + "methods": 10, + "mode": "optimized", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/PROPOSAL-TESTS-v2-optimized.txt", + "sha256": "488d38cf7147d94811dab07bc385f4339b999d2da1f0b0d18de7692f9dd417a8", + "status": "PASS" + }, + { + "bytes": 1755, + "methods": 13, + "mode": "normal", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/ORCHESTRATION-v2-normal.txt", + "sha256": "8f8900c0604a2f63cb4234a16749915cdbe8d2a617b4f76dc88a9f256c10835f", + "status": "PASS" + }, + { + "bytes": 1755, + "methods": 13, + "mode": "optimized", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/ORCHESTRATION-v2-optimized.txt", + "sha256": "fb797a332abdf3285f00365390e24c040d4d1a2f50f997f47ea3586a4b02ed70", + "status": "PASS" + }, + { + "bytes": 984, + "methods": 8, + "mode": "normal", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/DERIVATION-v2-normal.txt", + "sha256": "d1bf5239bc1f28c3d9c0335905cc68403962ead056c55f6d85ec70e96e9ebd44", + "status": "PASS" + }, + { + "bytes": 984, + "methods": 8, + "mode": "optimized", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/DERIVATION-v2-optimized.txt", + "sha256": "5e1c3982013b93f186fe0b6264d838afa2ce4eb71235b1f166dd7f77dd97eaf9", + "status": "PASS" + } + ], + "original_activity_credit": false, + "original_code_executed": false, + "original_modules_imported": false, + "original_sources_modified": false, + "outer_plan_bill": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/OUTER-PLAN-BILL-v2.json", + "outside_costs": "OPEN_NOT_ZERO", + "policy_requirements": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/POLICY-REQUIREMENTS-v2.json", + "preserved_v1_directory": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/v1-frozen", + "preserved_v1_receipt_sha256": "5cdaf0437a4453c0584859b15be288b7a0770e5a729a5eb364e2797e511028ff", + "production_parent_mint_route_modified": false, + "pure_test_methods_per_mode": 31, + "repair_delta": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/REPAIR-DELTA-v2.json", + "repair_window": [ + "2026-11-02T11:07:10.897421Z", + "2026-11-02T11:22:10.897421Z" + ], + "repair_windows": 1, + "retained_fixture_failures": [ + "ORCHESTRATION-v2-initial-fixture-errors-normal.txt", + "ORCHESTRATION-v2-initial-fixture-errors-optimized.txt" + ], + "retained_fixture_scope_correction": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/v2-pre-close-model", + "runtime_qualified": false, + "schema": "unit05-author-repaired-v2", + "source_acceptance": "independent delta review pending final hashes; no runtime acceptance inferred", + "source_frozen_before_repair_deadline": true, + "test_isolation": "supplied new accessor/static tests; AST-extracted NEW supervisor functions with all fake services; exact new pure constructor/verifier only; no archived import or full supervisor execution", + "tests_not_executed": [ + "actual original closure receiver capture", + "actual parent/domain/subreaper/Popen or namespace operations", + "genuine parent bootstrap/token construction", + "complete missing/extra raw/native-receipt replay/source-tamper family", + "full original V03 controls or compiler workloads" + ] +} diff --git a/research/h25-v03-prefix-supervision/unit05/INPUT-GATE-EVIDENCE-LINKAGE-v1.json b/research/h25-v03-prefix-supervision/unit05/INPUT-GATE-EVIDENCE-LINKAGE-v1.json new file mode 100644 index 0000000000..1234141e2d --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/INPUT-GATE-EVIDENCE-LINKAGE-v1.json @@ -0,0 +1,34 @@ +{ + "recorded_utc": "2026-11-02T11:29:43.187147+00:00", + "scope": "Initial reports extended by final reviews; exact known original bytes separately restored and hash verified, not silently relabelled", + "rows": [ + { + "original_path": "review-derivation-closure-v1.md", + "frozen_initial_path": "review-derivation-closure-input-gate-v1.md", + "bytes": 5370, + "sha256": "da729f70f5a4198dacf9e8813943758a45d0f1035f061bd7d85dfc437b1dc9d8", + "restored_exact_known_hash": true + }, + { + "original_path": "review-derivation-closure-v1.json", + "frozen_initial_path": "review-derivation-closure-input-gate-v1.json", + "bytes": 4504, + "sha256": "9063c6d4132df9564b382e153de71770350662a31c67cd7df93e3117546ef23d", + "restored_exact_known_hash": true + }, + { + "original_path": "review-supervision-domain-v1.md", + "frozen_initial_path": "review-supervision-domain-input-gate-v1.md", + "bytes": 10242, + "sha256": "21c02459c76b114caffd77ff6310c3c9933f4d8c627dbc5b667001b1bb5b5153", + "restored_exact_known_hash": true + }, + { + "original_path": "review-supervision-domain-v1.json", + "frozen_initial_path": "review-supervision-domain-input-gate-v1.json", + "bytes": 5449, + "sha256": "7367c65eadb755719696d72358b81a043e53626b978f3b523baaea3fcaa9d7fc", + "restored_exact_known_hash": true + } + ] +} diff --git a/research/h25-v03-prefix-supervision/unit05/INPUT-GATE-v1.json b/research/h25-v03-prefix-supervision/unit05/INPUT-GATE-v1.json new file mode 100644 index 0000000000..a276d01d80 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/INPUT-GATE-v1.json @@ -0,0 +1,47 @@ +{ + "recorded_utc": "2026-11-02T11:18:21.258576+00:00", + "input_gate_utc": "2026-11-02T11:15:20.190742+00:00", + "independent_gate_reports_completed_by_utc": "2026-11-02T11:13:33+00:00", + "late_root_bookkeeping_preserved": true, + "verdict": "PASS_FOR_CONDITIONAL_SOURCE_REVIEW_INPUTS_AND_NEW_PURE_FIXTURE_ISOLATION_ONLY", + "evidence": [ + { + "path": "review-derivation-closure-v1.md", + "bytes": 5370, + "sha256": "da729f70f5a4198dacf9e8813943758a45d0f1035f061bd7d85dfc437b1dc9d8" + }, + { + "path": "review-derivation-closure-v1.json", + "bytes": 4504, + "sha256": "9063c6d4132df9564b382e153de71770350662a31c67cd7df93e3117546ef23d" + }, + { + "path": "review-supervision-domain-v1.md", + "bytes": 10242, + "sha256": "21c02459c76b114caffd77ff6310c3c9933f4d8c627dbc5b667001b1bb5b5153" + }, + { + "path": "review-supervision-domain-v1.json", + "bytes": 5449, + "sha256": "7367c65eadb755719696d72358b81a043e53626b978f3b523baaea3fcaa9d7fc" + } + ], + "v1_integrated_supervisor": "REJECTED_two_independent_constructibility_defects_preserved", + "repair_window": "REPAIR-WINDOW-v1.json; no extension", + "narrow_v1_source_findings": [ + "Pure configured-prefix derivation proof passed; complete closure still needed immutable environment successor", + "Separate exit1 terminal DATA accessor and unchanged production function preservation passed", + "Supplied tests isolate only new extracted functions with synthetic state; no actual owner/runtime proof" + ], + "withheld_gates": [ + "Complete deployable transitive receiverpolicy/module count and actual module bindings", + "Authentic enclosing parent pre-import bootstrap", + "C05/C07 immutable admitted instance and actual current native/source/stage/command/funding/execution approvals", + "Full original V03 intact baseline, negative/positive controls, first-error and raw-capture qualification" + ], + "no_original_or_native_execution": true, + "original_activity_credit": 0, + "independently_accepted_current_complete_unit_milestones": 0, + "counts_wait_for_repaired_frozen_exact_source": true, + "outside_costs": "OPEN_NOT_ZERO" +} diff --git a/research/h25-v03-prefix-supervision/unit05/PROPOSAL-SOURCE-MANIFEST-v1.json b/research/h25-v03-prefix-supervision/unit05/PROPOSAL-SOURCE-MANIFEST-v1.json new file mode 100644 index 0000000000..8a9c55e90a --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/PROPOSAL-SOURCE-MANIFEST-v1.json @@ -0,0 +1,41 @@ +{ + "raw_response": "../consultation/RESPONSE-v6.txt", + "raw_sha256": "d1b15e2a92c6cbf137319ef2c165e2d920202d5f2d7509d7a8d572d90b4ffa13", + "rows": [ + { + "block": 0, + "path": "proposal/closure-allowance.py.fragment", + "bytes": 63, + "sha256": "c3b3aee32015105b5fe4fe1a41183e2a2ec2599b1f2dca2b73fb889f823f563c", + "policy": "Exact captured DOM code text after language label, one finalLF when missing; rawDOM retained" + }, + { + "block": 1, + "path": "proposal/domain-prefix-accessor.py.fragment", + "bytes": 3484, + "sha256": "5397f59e65cef18d03581afe1c2727a288506248aaabc0dd88c06811e810f6b1", + "policy": "Exact captured DOM code text after language label, one finalLF when missing; rawDOM retained" + }, + { + "block": 2, + "path": "proposal/v03_prefix_derivation_v1.py", + "bytes": 3830, + "sha256": "4591de196d008f0fdc094f4a74b19a84c095e2def5d28dbdaea7085e4630f8a7", + "policy": "Exact captured DOM code text after language label, one finalLF when missing; rawDOM retained" + }, + { + "block": 5, + "path": "proposal/v03_prefix_supervisor_v1.py", + "bytes": 35491, + "sha256": "75bef7834fe7278638010f79a8efca84b49b1e48320d3c8ac2d93cadea5a8262", + "policy": "Exact captured DOM code text after language label, one finalLF when missing; rawDOM retained" + }, + { + "block": 6, + "path": "proposal/test_v03_prefix_supervisor_v1.py", + "bytes": 6381, + "sha256": "b5f8055da6f9a48e85a4eed0868f7076859adca317e0691e5b2336e0bdb58d52", + "policy": "Exact captured DOM code text after language label, one finalLF when missing; rawDOM retained" + } + ] +} diff --git a/research/h25-v03-prefix-supervision/unit05/REPAIR-WINDOW-v1.json b/research/h25-v03-prefix-supervision/unit05/REPAIR-WINDOW-v1.json new file mode 100644 index 0000000000..c987bf9b87 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/REPAIR-WINDOW-v1.json @@ -0,0 +1,14 @@ +{ + "window": 1, + "start_utc": "2026-11-02T11:07:10.897421+00:00", + "deadline_utc": "2026-11-02T11:22:10.897421+00:00", + "within_original_hard_deadline": "2026-11-02T12:00:20.190742+00:00", + "scope": [ + "New constructor dependency successor using capture-compatible immutable environment representation; preserve closed Unit01 original", + "Remove mandatory self-hash of plan from its own inventory; separately retain/recheck outer-pinned plan custody with all original parent bounds and explicit interval gap", + "Other directly consequential review findings only if disclosed and repaired inside this single window" + ], + "requirements": "Freeze exact v1 and failures before semantic edits; no mutable exemption, source-gate weakening, new runtime/native policy or production mint change. Independent delta review required; no second repair window.", + "source_inputs": "All exact original/source proposal bytes available; authentic bootstrap/C07 instance intentionally absent and remains a runtime blocker", + "original_activity_credit": 0 +} diff --git a/research/h25-v03-prefix-supervision/unit05/SOURCE-CLOSE-v1.json b/research/h25-v03-prefix-supervision/unit05/SOURCE-CLOSE-v1.json new file mode 100644 index 0000000000..92da44de09 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/SOURCE-CLOSE-v1.json @@ -0,0 +1,60 @@ +{ + "unit": "05", + "phase": "source_closed_repaired_conditional_increment_publication_next", + "recorded_utc": "2026-11-02T11:29:43.187427+00:00", + "author_source_frozen_utc": "2026-11-02T11:20:27+00:00", + "repair_cutoff_utc": "2026-11-02T11:22:10.897421+00:00", + "source_hard_deadline_utc": "2026-11-02T12:00:20.190742+00:00", + "source_edits_and_tests_stopped_inside_repair_window": true, + "late_parent_close_bookkeeping_preserved": true, + "author_receipt_sha256": "9563e2b533ce5b06bf72911c2ad66ee389ef14119b423a7cd3309b521c4db02e", + "source_scopes_independently_reviewed": [ + "configured-prefix verifier and immutable environment successor; exact new pure source/data scope", + "new exit1 domain cleanup DATA accessor and sole closure allowance; original production/mint source unchanged", + "conditional non-minting supervisor and bounded external-plan endpoint custody; genuine runtime ownership/admission not established" + ], + "reviews": [ + { + "path": "review-derivation-closure-v1.md", + "bytes": 8222, + "sha256": "bc00b661c148552c1f46954df182b5e4a110a1e08522e789f36e2a250fa22f4a" + }, + { + "path": "review-derivation-closure-v1.json", + "bytes": 7654, + "sha256": "efe6101d6b2ca2a954fa97d039740f2c4e52aafe6ac5e3d9d2e61867ebe76ebf" + }, + { + "path": "review-supervision-domain-v1.md", + "bytes": 14835, + "sha256": "467e6aeb70d98f45a73489b2041477d1cc95d02f510b033cb91b3e84337baaa5" + }, + { + "path": "review-supervision-domain-v1.json", + "bytes": 8686, + "sha256": "9ee2baceb9a3f70f465c433e6f00b9bf69d028f685c1161fddfa720c5c9ba0b1" + } + ], + "new_pure_methods_per_mode": 31, + "profiles": [ + "normal", + "optimized" + ], + "complete_original_control_families_executed": 0, + "current_genuine_runtime_capability_obtained": false, + "source_reviewed_scopes_are_not_original_activity_credit": true, + "remaining": [ + "Authenticated fresh enclosing-parent pre-import bootstrap", + "Actual complete transitive receiverpolicy/module identity and48module/512global fit", + "C05 complete runtime determinant inventory, actual cap/cost bill and concrete channel/lifetime mechanism", + "Current independent source/native/stage/command/funding/execution admission", + "Actual original full intact baseline plus all named V03 controls and complete raw/first-error/owner/parent-exit evidence" + ], + "full_C05": false, + "full_V03": false, + "original_execution": false, + "original_activity_credit_added": 0, + "publication": "pending_two_scoped_exports", + "outside_costs": "OPEN_NOT_ZERO", + "no_progress_timer_disposition": "Closed source round; no further source edit/test dispatch or repeated pause. Publication adapters are separate and must preserve frozen algorithms and test semantics." +} diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/ASSEMBLY-v1.json b/research/h25-v03-prefix-supervision/unit05/fixtures/ASSEMBLY-v1.json new file mode 100644 index 0000000000..32a38c5fa8 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/ASSEMBLY-v1.json @@ -0,0 +1,110 @@ +{ + "full_C05": false, + "full_V03": false, + "original_code_executed": false, + "original_modules_imported": false, + "outside_costs": "OPEN_NOT_ZERO", + "proposal_manifest_sha256": "627fd8b7c8439851b9afcde92cbc5110b72aa957c3663dabf377482c4ebf5f44", + "proposal_semantics_changed": false, + "raw_response_sha256": "d1b15e2a92c6cbf137319ef2c165e2d920202d5f2d7509d7a8d572d90b4ffa13", + "rows": [ + { + "bytes": 54168, + "original_bytes": 54168, + "original_path": "outputs/c05-v03-completion-20261102T055710Z/unit02/prerequisite-source/field-parent-completion-v2--parent_completion_v1.py.txt", + "original_sha256": "d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_completion_v1.py", + "sha256": "d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5", + "transformation": "exact inert candidate copy; never imported" + }, + { + "bytes": 23942, + "original_bytes": 20456, + "original_path": "outputs/c05-v03-completion-20261102T055710Z/unit02/prerequisite-source/field-parent-completion-v2--parent_domain_v1.py.txt", + "original_sha256": "9205e14d6661fb5df0597f0ad7b2206006f2d31f01f784805f64c13875663282", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_domain_v1.py", + "sha256": "a51264289803b4b17bb262f2460ddd4ed72500aaa21e5eb80fa2db4583689361", + "transformation": "exact original byte prefix plus two LF separator and exact new accessor fragment" + }, + { + "bytes": 13463, + "original_bytes": 13400, + "original_path": "outputs/c05-v03-completion-20261102T055710Z/unit02/prerequisite-source/field-parent-completion-v2--parent_closure_v1.py.txt", + "original_sha256": "2d831cff8bd444de2d6941645d571e07618ede404a1f45692b557f61494b334a", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_closure_v1.py", + "sha256": "a15424f14baa3d484fe04bfbe7e449c32561c866dbaca2c1b5f646dfb377ed1f", + "transformation": "exact original with sole63byte mutable-name dictionary insertion" + }, + { + "bytes": 23047, + "original_bytes": 23047, + "original_path": "outputs/c05-v03-completion-20261102T055710Z/unit02/prerequisite-source/h25_parent_supervisor.py.txt", + "original_sha256": "cfb09a18dd10b597cc6d5a8139ee769bef679bc44ae029329755e3d97b055075", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/h25_parent_supervisor.py", + "sha256": "cfb09a18dd10b597cc6d5a8139ee769bef679bc44ae029329755e3d97b055075", + "transformation": "exact inert candidate copy; never imported" + }, + { + "bytes": 30668, + "original_bytes": 30668, + "original_path": "outputs/c05-v03-completion-20261102T055710Z/unit02/prerequisite-source/field-negative-epoch-v5--epoch_schema_v5.py.txt", + "original_sha256": "b89a789654be87bde40a47300f4d9702dce2b90e6ab3be9a2025f6d8041b3e9a", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/epoch_schema_v5.py", + "sha256": "b89a789654be87bde40a47300f4d9702dce2b90e6ab3be9a2025f6d8041b3e9a", + "transformation": "exact inert candidate copy; never imported" + }, + { + "bytes": 82957, + "original_bytes": 82957, + "original_path": "outputs/c05-v03-completion-20261102T055710Z/unit02/prerequisite-source/field-negative-epoch-v5--epoch_copy_v5.py.txt", + "original_sha256": "4f459d0336d59975df787c24373e18dad4044c3a24137392e890115f811b3211", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/epoch_copy_v5.py", + "sha256": "4f459d0336d59975df787c24373e18dad4044c3a24137392e890115f811b3211", + "transformation": "exact inert candidate copy; never imported" + }, + { + "bytes": 15610, + "original_bytes": 15610, + "original_path": "outputs/c05-v03-completion-20261102T055710Z/unit02/prerequisite-source/field-parent-completion-v2--group01_evidence_v1.py.txt", + "original_sha256": "05ec6a63c57340ba929aea1fab71b096efc143e099346640f6def41310bd3e25", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/group01_evidence_v1.py", + "sha256": "05ec6a63c57340ba929aea1fab71b096efc143e099346640f6def41310bd3e25", + "transformation": "exact inert candidate copy; never imported" + }, + { + "bytes": 3830, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_prefix_derivation_v1.py", + "sha256": "4591de196d008f0fdc094f4a74b19a84c095e2def5d28dbdaea7085e4630f8a7", + "transformation": "exact proposal bytes copied without semantic changes" + }, + { + "bytes": 35491, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_prefix_supervisor_v1.py", + "sha256": "75bef7834fe7278638010f79a8efca84b49b1e48320d3c8ac2d93cadea5a8262", + "transformation": "exact proposal bytes copied without semantic changes" + }, + { + "bytes": 6381, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/test_v03_prefix_supervisor_v1.py", + "sha256": "b5f8055da6f9a48e85a4eed0868f7076859adca317e0691e5b2336e0bdb58d52", + "transformation": "exact proposal bytes copied without semantic changes" + }, + { + "bytes": 6087, + "original_path": "outputs/c05-v03-completion-20261102T055710Z/implementation/v03_integrated_constructor_v1.py", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_integrated_constructor_v1.py", + "sha256": "5e08ff84298fe1249be5e8790ea259e6179048f4736fb7eafdb6e170b8bc1cf9", + "transformation": "exact final reviewed Unit01 new pure component copy" + }, + { + "bytes": 14205, + "original_path": "outputs/c05-v03-completion-20261102T055710Z/implementation/v03_source_refusal_observer_v1.py", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_source_refusal_observer_v1.py", + "sha256": "abf25690d3bee4a9783ee504567c29f7fb47da670e0ec95f57cb5944bf57264f", + "transformation": "exact final reviewed Unit01 new pure component copy" + } + ], + "runtime_qualified": false, + "schema": "unit05-exact-initial-assembly-v1", + "tests_executed_yet": false +} diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/DERIVATION-v2-normal.txt b/research/h25-v03-prefix-supervision/unit05/fixtures/DERIVATION-v2-normal.txt new file mode 100644 index 0000000000..a1f4531afc --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/DERIVATION-v2-normal.txt @@ -0,0 +1,13 @@ +test_bool_is_not_integer_gate_data (__main__.DerivationTests.test_bool_is_not_integer_gate_data) ... ok +test_duplicate_gate_rejects (__main__.DerivationTests.test_duplicate_gate_rejects) ... ok +test_non_gate_byte_change_rejects (__main__.DerivationTests.test_non_gate_byte_change_rejects) ... ok +test_nonliteral_call_never_executes (__main__.DerivationTests.test_nonliteral_call_never_executes) ... ok +test_plain_text_container_and_depth_exhaustion (__main__.DerivationTests.test_plain_text_container_and_depth_exhaustion) ... ok +test_tuple_environment_preserves_all_six_native_pairs (__main__.DerivationTests.test_tuple_environment_preserves_all_six_native_pairs) ... ok +test_unconfigured_exact_rendering (__main__.DerivationTests.test_unconfigured_exact_rendering) ... ok +test_unicode_gate_literal_byte_offsets (__main__.DerivationTests.test_unicode_gate_literal_byte_offsets) ... ok + +---------------------------------------------------------------------- +Ran 8 tests in 0.246s + +OK diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/DERIVATION-v2-optimized.txt b/research/h25-v03-prefix-supervision/unit05/fixtures/DERIVATION-v2-optimized.txt new file mode 100644 index 0000000000..09f1a2a671 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/DERIVATION-v2-optimized.txt @@ -0,0 +1,13 @@ +test_bool_is_not_integer_gate_data (__main__.DerivationTests.test_bool_is_not_integer_gate_data) ... ok +test_duplicate_gate_rejects (__main__.DerivationTests.test_duplicate_gate_rejects) ... ok +test_non_gate_byte_change_rejects (__main__.DerivationTests.test_non_gate_byte_change_rejects) ... ok +test_nonliteral_call_never_executes (__main__.DerivationTests.test_nonliteral_call_never_executes) ... ok +test_plain_text_container_and_depth_exhaustion (__main__.DerivationTests.test_plain_text_container_and_depth_exhaustion) ... ok +test_tuple_environment_preserves_all_six_native_pairs (__main__.DerivationTests.test_tuple_environment_preserves_all_six_native_pairs) ... ok +test_unconfigured_exact_rendering (__main__.DerivationTests.test_unconfigured_exact_rendering) ... ok +test_unicode_gate_literal_byte_offsets (__main__.DerivationTests.test_unicode_gate_literal_byte_offsets) ... ok + +---------------------------------------------------------------------- +Ran 8 tests in 0.235s + +OK diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/ORCHESTRATION-v2-initial-fixture-errors-normal.txt b/research/h25-v03-prefix-supervision/unit05/fixtures/ORCHESTRATION-v2-initial-fixture-errors-normal.txt new file mode 100644 index 0000000000..5f9d1f2c5b --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/ORCHESTRATION-v2-initial-fixture-errors-normal.txt @@ -0,0 +1,83 @@ +test_changed_plan_raw_is_retained_before_rejection (__main__.OuterPlanTests.test_changed_plan_raw_is_retained_before_rejection) ... ok +test_outer_plan_row_is_counted (__main__.OuterPlanTests.test_outer_plan_row_is_counted) ... ok +test_plan_inode_cannot_alias_an_inner_row (__main__.OuterPlanTests.test_plan_inode_cannot_alias_an_inner_row) ... ok +test_plan_path_cannot_be_an_inner_row (__main__.OuterPlanTests.test_plan_path_cannot_be_an_inner_row) ... ok +test_three_actual_fixture_reads_retained_and_equal (__main__.OuterPlanTests.test_three_actual_fixture_reads_retained_and_equal) ... ok +test_partial_copy_failure_retains_already_captured_sources (__main__.RawRetentionTests.test_partial_copy_failure_retains_already_captured_sources) ... ok +test_adoption_and_observe_primary_survive_cleanup (__main__.SuperviseTests.test_adoption_and_observe_primary_survive_cleanup) ... + test_adoption_and_observe_primary_survive_cleanup (__main__.SuperviseTests.test_adoption_and_observe_primary_survive_cleanup) (phase='adopt') ... ERROR + test_adoption_and_observe_primary_survive_cleanup (__main__.SuperviseTests.test_adoption_and_observe_primary_survive_cleanup) (phase='observe') ... ERROR +test_consumed_control_does_not_spawn_again (__main__.SuperviseTests.test_consumed_control_does_not_spawn_again) ... ERROR +test_failed_raw_close_is_not_retried_or_terminal (__main__.SuperviseTests.test_failed_raw_close_is_not_retried_or_terminal) ... ERROR +test_popen_primary_survives_cleanup_secondary (__main__.SuperviseTests.test_popen_primary_survives_cleanup_secondary) ... ERROR +test_uncertain_raw_open_stops_later_acquisitions (__main__.SuperviseTests.test_uncertain_raw_open_stops_later_acquisitions) ... ERROR + +====================================================================== +ERROR: test_adoption_and_observe_primary_survive_cleanup (__main__.SuperviseTests.test_adoption_and_observe_primary_survive_cleanup) (phase='adopt') +---------------------------------------------------------------------- +Traceback (most recent call last): + File "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/test_new_orchestration_v2.py", line 103, in test_adoption_and_observe_primary_survive_cleanup + with self.assertRaises(RuntimeError) as caught:fn(s) + ^^^^^ + File "", line 601, in _supervise + File "", line 499, in _supervise +KeyError: 'errors' + +====================================================================== +ERROR: test_adoption_and_observe_primary_survive_cleanup (__main__.SuperviseTests.test_adoption_and_observe_primary_survive_cleanup) (phase='observe') +---------------------------------------------------------------------- +Traceback (most recent call last): + File "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/test_new_orchestration_v2.py", line 103, in test_adoption_and_observe_primary_survive_cleanup + with self.assertRaises(RuntimeError) as caught:fn(s) + ^^^^^ + File "", line 601, in _supervise + File "", line 499, in _supervise +KeyError: 'errors' + +====================================================================== +ERROR: test_consumed_control_does_not_spawn_again (__main__.SuperviseTests.test_consumed_control_does_not_spawn_again) +---------------------------------------------------------------------- +Traceback (most recent call last): + File "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/test_new_orchestration_v2.py", line 130, in test_consumed_control_does_not_spawn_again + fn(s) + File "", line 601, in _supervise + File "", line 499, in _supervise +KeyError: 'errors' + +====================================================================== +ERROR: test_failed_raw_close_is_not_retried_or_terminal (__main__.SuperviseTests.test_failed_raw_close_is_not_retried_or_terminal) +---------------------------------------------------------------------- +Traceback (most recent call last): + File "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/test_new_orchestration_v2.py", line 121, in test_failed_raw_close_is_not_retried_or_terminal + with self.assertRaises(RuntimeError) as caught:fn(s) + ^^^^^ + File "", line 601, in _supervise + File "", line 499, in _supervise +KeyError: 'errors' + +====================================================================== +ERROR: test_popen_primary_survives_cleanup_secondary (__main__.SuperviseTests.test_popen_primary_survives_cleanup_secondary) +---------------------------------------------------------------------- +Traceback (most recent call last): + File "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/test_new_orchestration_v2.py", line 93, in test_popen_primary_survives_cleanup_secondary + with self.assertRaises(RuntimeError) as caught:fn(s) + ^^^^^ + File "", line 601, in _supervise + File "", line 499, in _supervise +KeyError: 'errors' + +====================================================================== +ERROR: test_uncertain_raw_open_stops_later_acquisitions (__main__.SuperviseTests.test_uncertain_raw_open_stops_later_acquisitions) +---------------------------------------------------------------------- +Traceback (most recent call last): + File "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/test_new_orchestration_v2.py", line 111, in test_uncertain_raw_open_stops_later_acquisitions + with self.assertRaises(RuntimeError) as caught:fn(s) + ^^^^^ + File "", line 601, in _supervise + File "", line 499, in _supervise +KeyError: 'errors' + +---------------------------------------------------------------------- +Ran 11 tests in 0.108s + +FAILED (errors=6) diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/ORCHESTRATION-v2-initial-fixture-errors-optimized.txt b/research/h25-v03-prefix-supervision/unit05/fixtures/ORCHESTRATION-v2-initial-fixture-errors-optimized.txt new file mode 100644 index 0000000000..6b76a6488b --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/ORCHESTRATION-v2-initial-fixture-errors-optimized.txt @@ -0,0 +1,83 @@ +test_changed_plan_raw_is_retained_before_rejection (__main__.OuterPlanTests.test_changed_plan_raw_is_retained_before_rejection) ... ok +test_outer_plan_row_is_counted (__main__.OuterPlanTests.test_outer_plan_row_is_counted) ... ok +test_plan_inode_cannot_alias_an_inner_row (__main__.OuterPlanTests.test_plan_inode_cannot_alias_an_inner_row) ... ok +test_plan_path_cannot_be_an_inner_row (__main__.OuterPlanTests.test_plan_path_cannot_be_an_inner_row) ... ok +test_three_actual_fixture_reads_retained_and_equal (__main__.OuterPlanTests.test_three_actual_fixture_reads_retained_and_equal) ... ok +test_partial_copy_failure_retains_already_captured_sources (__main__.RawRetentionTests.test_partial_copy_failure_retains_already_captured_sources) ... ok +test_adoption_and_observe_primary_survive_cleanup (__main__.SuperviseTests.test_adoption_and_observe_primary_survive_cleanup) ... + test_adoption_and_observe_primary_survive_cleanup (__main__.SuperviseTests.test_adoption_and_observe_primary_survive_cleanup) (phase='adopt') ... ERROR + test_adoption_and_observe_primary_survive_cleanup (__main__.SuperviseTests.test_adoption_and_observe_primary_survive_cleanup) (phase='observe') ... ERROR +test_consumed_control_does_not_spawn_again (__main__.SuperviseTests.test_consumed_control_does_not_spawn_again) ... ERROR +test_failed_raw_close_is_not_retried_or_terminal (__main__.SuperviseTests.test_failed_raw_close_is_not_retried_or_terminal) ... ERROR +test_popen_primary_survives_cleanup_secondary (__main__.SuperviseTests.test_popen_primary_survives_cleanup_secondary) ... ERROR +test_uncertain_raw_open_stops_later_acquisitions (__main__.SuperviseTests.test_uncertain_raw_open_stops_later_acquisitions) ... ERROR + +====================================================================== +ERROR: test_adoption_and_observe_primary_survive_cleanup (__main__.SuperviseTests.test_adoption_and_observe_primary_survive_cleanup) (phase='adopt') +---------------------------------------------------------------------- +Traceback (most recent call last): + File "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/test_new_orchestration_v2.py", line 103, in test_adoption_and_observe_primary_survive_cleanup + with self.assertRaises(RuntimeError) as caught:fn(s) + ^^^^^ + File "", line 601, in _supervise + File "", line 499, in _supervise +KeyError: 'errors' + +====================================================================== +ERROR: test_adoption_and_observe_primary_survive_cleanup (__main__.SuperviseTests.test_adoption_and_observe_primary_survive_cleanup) (phase='observe') +---------------------------------------------------------------------- +Traceback (most recent call last): + File "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/test_new_orchestration_v2.py", line 103, in test_adoption_and_observe_primary_survive_cleanup + with self.assertRaises(RuntimeError) as caught:fn(s) + ^^^^^ + File "", line 601, in _supervise + File "", line 499, in _supervise +KeyError: 'errors' + +====================================================================== +ERROR: test_consumed_control_does_not_spawn_again (__main__.SuperviseTests.test_consumed_control_does_not_spawn_again) +---------------------------------------------------------------------- +Traceback (most recent call last): + File "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/test_new_orchestration_v2.py", line 130, in test_consumed_control_does_not_spawn_again + fn(s) + File "", line 601, in _supervise + File "", line 499, in _supervise +KeyError: 'errors' + +====================================================================== +ERROR: test_failed_raw_close_is_not_retried_or_terminal (__main__.SuperviseTests.test_failed_raw_close_is_not_retried_or_terminal) +---------------------------------------------------------------------- +Traceback (most recent call last): + File "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/test_new_orchestration_v2.py", line 121, in test_failed_raw_close_is_not_retried_or_terminal + with self.assertRaises(RuntimeError) as caught:fn(s) + ^^^^^ + File "", line 601, in _supervise + File "", line 499, in _supervise +KeyError: 'errors' + +====================================================================== +ERROR: test_popen_primary_survives_cleanup_secondary (__main__.SuperviseTests.test_popen_primary_survives_cleanup_secondary) +---------------------------------------------------------------------- +Traceback (most recent call last): + File "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/test_new_orchestration_v2.py", line 93, in test_popen_primary_survives_cleanup_secondary + with self.assertRaises(RuntimeError) as caught:fn(s) + ^^^^^ + File "", line 601, in _supervise + File "", line 499, in _supervise +KeyError: 'errors' + +====================================================================== +ERROR: test_uncertain_raw_open_stops_later_acquisitions (__main__.SuperviseTests.test_uncertain_raw_open_stops_later_acquisitions) +---------------------------------------------------------------------- +Traceback (most recent call last): + File "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/test_new_orchestration_v2.py", line 111, in test_uncertain_raw_open_stops_later_acquisitions + with self.assertRaises(RuntimeError) as caught:fn(s) + ^^^^^ + File "", line 601, in _supervise + File "", line 499, in _supervise +KeyError: 'errors' + +---------------------------------------------------------------------- +Ran 11 tests in 0.095s + +FAILED (errors=6) diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/ORCHESTRATION-v2-normal.txt b/research/h25-v03-prefix-supervision/unit05/fixtures/ORCHESTRATION-v2-normal.txt new file mode 100644 index 0000000000..45e967383e --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/ORCHESTRATION-v2-normal.txt @@ -0,0 +1,18 @@ +test_changed_plan_raw_is_retained_before_rejection (__main__.OuterPlanTests.test_changed_plan_raw_is_retained_before_rejection) ... ok +test_outer_plan_row_is_counted (__main__.OuterPlanTests.test_outer_plan_row_is_counted) ... ok +test_plan_inode_cannot_alias_an_inner_row (__main__.OuterPlanTests.test_plan_inode_cannot_alias_an_inner_row) ... ok +test_plan_path_cannot_be_an_inner_row (__main__.OuterPlanTests.test_plan_path_cannot_be_an_inner_row) ... ok +test_three_actual_fixture_reads_retained_and_equal (__main__.OuterPlanTests.test_three_actual_fixture_reads_retained_and_equal) ... ok +test_partial_copy_failure_retains_already_captured_sources (__main__.RawRetentionTests.test_partial_copy_failure_retains_already_captured_sources) ... ok +test_adoption_and_observe_primary_survive_cleanup (__main__.SuperviseTests.test_adoption_and_observe_primary_survive_cleanup) ... ok +test_close_helper_abort_is_not_retried_or_terminal (__main__.SuperviseTests.test_close_helper_abort_is_not_retried_or_terminal) ... ok +test_consumed_control_does_not_spawn_again (__main__.SuperviseTests.test_consumed_control_does_not_spawn_again) ... ok +test_ordinary_first_close_failure_still_attempts_other_fd (__main__.SuperviseTests.test_ordinary_first_close_failure_still_attempts_other_fd) ... ok +test_popen_primary_survives_cleanup_secondary (__main__.SuperviseTests.test_popen_primary_survives_cleanup_secondary) ... ok +test_primary_survives_per_fd_close_failure (__main__.SuperviseTests.test_primary_survives_per_fd_close_failure) ... ok +test_uncertain_raw_open_stops_later_acquisitions (__main__.SuperviseTests.test_uncertain_raw_open_stops_later_acquisitions) ... ok + +---------------------------------------------------------------------- +Ran 13 tests in 0.121s + +OK diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/ORCHESTRATION-v2-optimized.txt b/research/h25-v03-prefix-supervision/unit05/fixtures/ORCHESTRATION-v2-optimized.txt new file mode 100644 index 0000000000..f83c7dcfe8 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/ORCHESTRATION-v2-optimized.txt @@ -0,0 +1,18 @@ +test_changed_plan_raw_is_retained_before_rejection (__main__.OuterPlanTests.test_changed_plan_raw_is_retained_before_rejection) ... ok +test_outer_plan_row_is_counted (__main__.OuterPlanTests.test_outer_plan_row_is_counted) ... ok +test_plan_inode_cannot_alias_an_inner_row (__main__.OuterPlanTests.test_plan_inode_cannot_alias_an_inner_row) ... ok +test_plan_path_cannot_be_an_inner_row (__main__.OuterPlanTests.test_plan_path_cannot_be_an_inner_row) ... ok +test_three_actual_fixture_reads_retained_and_equal (__main__.OuterPlanTests.test_three_actual_fixture_reads_retained_and_equal) ... ok +test_partial_copy_failure_retains_already_captured_sources (__main__.RawRetentionTests.test_partial_copy_failure_retains_already_captured_sources) ... ok +test_adoption_and_observe_primary_survive_cleanup (__main__.SuperviseTests.test_adoption_and_observe_primary_survive_cleanup) ... ok +test_close_helper_abort_is_not_retried_or_terminal (__main__.SuperviseTests.test_close_helper_abort_is_not_retried_or_terminal) ... ok +test_consumed_control_does_not_spawn_again (__main__.SuperviseTests.test_consumed_control_does_not_spawn_again) ... ok +test_ordinary_first_close_failure_still_attempts_other_fd (__main__.SuperviseTests.test_ordinary_first_close_failure_still_attempts_other_fd) ... ok +test_popen_primary_survives_cleanup_secondary (__main__.SuperviseTests.test_popen_primary_survives_cleanup_secondary) ... ok +test_primary_survives_per_fd_close_failure (__main__.SuperviseTests.test_primary_survives_per_fd_close_failure) ... ok +test_uncertain_raw_open_stops_later_acquisitions (__main__.SuperviseTests.test_uncertain_raw_open_stops_later_acquisitions) ... ok + +---------------------------------------------------------------------- +Ran 13 tests in 0.114s + +OK diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/OUTER-PLAN-BILL-v2.json b/research/h25-v03-prefix-supervision/unit05/fixtures/OUTER-PLAN-BILL-v2.json new file mode 100644 index 0000000000..f94c5c8c5f --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/OUTER-PLAN-BILL-v2.json @@ -0,0 +1,37 @@ +{ + "C07_interval_proven": false, + "aliases": "exact outer plan path and independently verified actual inode pair cannot appear in inner inventory", + "child_caps_unchanged": { + "capture_bytes": 268435456, + "file_bytes": 67108864, + "rows": 512 + }, + "explicit_reads": { + "api_call_counts_are_not_complete_physical_read_or_hash_costs": true, + "existing_guard_verify_calls_additional": "unchanged configuration verification at every _guard; actual finite count follows reached route", + "initial_constructor_decode": 1, + "source_snapshot_constructor": 1, + "source_snapshot_postcapture": 1, + "source_snapshot_prelaunch": 1, + "total_explicit_read_verified_calls": 4 + }, + "outer_plan_is_not_an_inner_selfhash_row": true, + "outside_costs": "OPEN_NOT_ZERO", + "representation": { + "maximal_inventory_fit_claimed": false, + "outer_plan_rows": 1, + "parent_inner_rows_max": 8191, + "parent_total_rows_max": 8192, + "record_includes_outer_pin_hash_bytes_and_rowcount": true, + "source_custody_record_max": 1048576 + }, + "retention": { + "actual_returned_bytes_stored_before_comparison": true, + "endpoint_raw_slots": 3, + "endpoint_slot_consumed_before_read": true, + "initial_plan_raw_slots": 1, + "max_combined_four_raw_slots_bytes": 4194304, + "max_each_read_bytes": 1048576 + }, + "schema": "unit05-outer-plan-custody-bill-v2" +} diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/POLICY-REQUIREMENTS-v2.json b/research/h25-v03-prefix-supervision/unit05/fixtures/POLICY-REQUIREMENTS-v2.json new file mode 100644 index 0000000000..1b95c656e5 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/POLICY-REQUIREMENTS-v2.json @@ -0,0 +1,249 @@ +{ + "active_constructor": "v03_integrated_constructor_v2", + "actual_module_objects_supplied": false, + "genuine_schema_blob_policy": false, + "inactive_reference_constructor": "v03_integrated_constructor_v1", + "missing": [ + "independently authenticated actual source policy with observed identities", + "complete actual transitive native/stdlib/source module graph and fit", + "authenticated fresh enclosing-parent pre-import bootstrap", + "C07 actual immutable source/ancestor/lifetime instance", + "actual source/native/funding/current execution admissions" + ], + "modules": [ + { + "bytes": 82957, + "direct_imports": [ + "hashlib", + "os", + "stat", + "epoch_schema_v5" + ], + "module": "epoch_copy_v5", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/epoch_copy_v5.py", + "reference_only_not_selected": false, + "runtime_policy_identity": null, + "sha256": "4f459d0336d59975df787c24373e18dad4044c3a24137392e890115f811b3211" + }, + { + "bytes": 30668, + "direct_imports": [ + "hashlib", + "json", + "types" + ], + "module": "epoch_schema_v5", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/epoch_schema_v5.py", + "reference_only_not_selected": false, + "runtime_policy_identity": null, + "sha256": "b89a789654be87bde40a47300f4d9702dce2b90e6ab3be9a2025f6d8041b3e9a" + }, + { + "bytes": 15610, + "direct_imports": [ + "json", + "math", + "epoch_schema_v5", + "epoch_copy_v5", + "original_build_provenance_v5", + "parent_closure_v1", + "group01_original_predicates_v1" + ], + "module": "group01_evidence_v1", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/group01_evidence_v1.py", + "reference_only_not_selected": false, + "runtime_policy_identity": null, + "sha256": "05ec6a63c57340ba929aea1fab71b096efc143e099346640f6def41310bd3e25" + }, + { + "bytes": 23047, + "direct_imports": [ + "fcntl", + "hashlib", + "json", + "os", + "pathlib", + "resource", + "signal", + "stat", + "subprocess", + "sys", + "time" + ], + "module": "h25_parent_supervisor", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/h25_parent_supervisor.py", + "reference_only_not_selected": false, + "runtime_policy_identity": null, + "sha256": "cfb09a18dd10b597cc6d5a8139ee769bef679bc44ae029329755e3d97b055075" + }, + { + "bytes": 13463, + "direct_imports": [ + "ast", + "builtins", + "__future__", + "copy", + "dataclasses", + "fcntl", + "gc", + "hashlib", + "json", + "marshal", + "math", + "os", + "pathlib", + "posix", + "resource", + "signal", + "struct", + "subprocess", + "sys", + "time", + "types", + "epoch_schema_v5", + "epoch_copy_v5" + ], + "module": "parent_closure_v1", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_closure_v1.py", + "reference_only_not_selected": false, + "runtime_policy_identity": null, + "sha256": "a15424f14baa3d484fe04bfbe7e449c32561c866dbaca2c1b5f646dfb377ed1f" + }, + { + "bytes": 54168, + "direct_imports": [ + "fcntl", + "os", + "resource", + "signal", + "stat", + "subprocess", + "sys", + "time", + "epoch_schema_v5", + "epoch_copy_v5", + "epoch_parent_v5", + "parent_closure_v1", + "parent_domain_v1", + "group01_evidence_v1" + ], + "module": "parent_completion_v1", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_completion_v1.py", + "reference_only_not_selected": false, + "runtime_policy_identity": null, + "sha256": "d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5" + }, + { + "bytes": 23942, + "direct_imports": [ + "os", + "signal", + "subprocess", + "time", + "epoch_schema_v5" + ], + "module": "parent_domain_v1", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_domain_v1.py", + "reference_only_not_selected": false, + "runtime_policy_identity": null, + "sha256": "a51264289803b4b17bb262f2460ddd4ed72500aaa21e5eb80fa2db4583689361" + }, + { + "bytes": 6381, + "direct_imports": [ + "ast", + "copy", + "pathlib", + "types", + "unittest" + ], + "module": "test_v03_prefix_supervisor_v1", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/test_v03_prefix_supervisor_v1.py", + "reference_only_not_selected": true, + "runtime_policy_identity": null, + "sha256": "b5f8055da6f9a48e85a4eed0868f7076859adca317e0691e5b2336e0bdb58d52" + }, + { + "bytes": 6087, + "direct_imports": [ + "ast", + "hashlib" + ], + "module": "v03_integrated_constructor_v1", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_integrated_constructor_v1.py", + "reference_only_not_selected": true, + "runtime_policy_identity": null, + "sha256": "5e08ff84298fe1249be5e8790ea259e6179048f4736fb7eafdb6e170b8bc1cf9" + }, + { + "bytes": 6111, + "direct_imports": [ + "ast", + "hashlib" + ], + "module": "v03_integrated_constructor_v2", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_integrated_constructor_v2.py", + "reference_only_not_selected": false, + "runtime_policy_identity": null, + "sha256": "a80a60b390bc60e9bc434b79cda5ae6db88e4f0c6c7436de9adfe1f48a2045b1" + }, + { + "bytes": 3830, + "direct_imports": [ + "ast", + "v03_integrated_constructor_v2" + ], + "module": "v03_prefix_derivation_v1", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_prefix_derivation_v1.py", + "reference_only_not_selected": false, + "runtime_policy_identity": null, + "sha256": "1ed813148c10d5fbd3cd6781d51eca650a347eda7a6323f581d740e6ea9cb6e2" + }, + { + "bytes": 36954, + "direct_imports": [ + "fcntl", + "os", + "pathlib", + "resource", + "signal", + "stat", + "subprocess", + "time", + "epoch_schema_v5", + "epoch_copy_v5", + "parent_domain_v1", + "parent_closure_v1", + "parent_completion_v1", + "group01_evidence_v1", + "v03_prefix_derivation_v1" + ], + "module": "v03_prefix_supervisor_v1", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_prefix_supervisor_v1.py", + "reference_only_not_selected": false, + "runtime_policy_identity": null, + "sha256": "f97b07d4a5f461d4134a2bdf4cfcc28da12acc7e7144c18f6cc0a017cdee86f6" + }, + { + "bytes": 14205, + "direct_imports": [ + "ast", + "hashlib", + "json" + ], + "module": "v03_source_refusal_observer_v1", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_source_refusal_observer_v1.py", + "reference_only_not_selected": false, + "runtime_policy_identity": null, + "sha256": "abf25690d3bee4a9783ee504567c29f7fb47da670e0ec95f57cb5944bf57264f" + } + ], + "no_mutable_exemption_for_NATIVE_ENV": true, + "original_limits_unchanged": { + "captures": 2, + "domains": 4, + "globals": 512, + "modules": 48 + }, + "schema": "unit05-source-only-policy-requirements-v2" +} diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/PROPOSAL-TESTS-v1-normal.txt b/research/h25-v03-prefix-supervision/unit05/fixtures/PROPOSAL-TESTS-v1-normal.txt new file mode 100644 index 0000000000..8672dfe50c --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/PROPOSAL-TESTS-v1-normal.txt @@ -0,0 +1,18 @@ +test_existing_primary_identity (unit05_exact_new_proposal_tests.AccessorTests.test_existing_primary_identity) ... ok +test_intact_exit1_predicate (unit05_exact_new_proposal_tests.AccessorTests.test_intact_exit1_predicate) ... ok +test_invalid_early_call_keeps_cleanup_phase (unit05_exact_new_proposal_tests.AccessorTests.test_invalid_early_call_keeps_cleanup_phase) ... ok +test_late_owned_child (unit05_exact_new_proposal_tests.AccessorTests.test_late_owned_child) ... ok +test_local_primary_identity (unit05_exact_new_proposal_tests.AccessorTests.test_local_primary_identity) ... ok +test_other_exit_dispositions (unit05_exact_new_proposal_tests.AccessorTests.test_other_exit_dispositions) ... ok +test_unclosed_fd (unit05_exact_new_proposal_tests.AccessorTests.test_unclosed_fd) ... ok +test_complete_observer_selected (unit05_exact_new_proposal_tests.SourceStructureTests.test_complete_observer_selected) ... ok +test_source_gates_remain_none (unit05_exact_new_proposal_tests.SourceStructureTests.test_source_gates_remain_none) ... ok +test_supervisor_has_no_mint_call (unit05_exact_new_proposal_tests.SourceStructureTests.test_supervisor_has_no_mint_call) ... ok + +---------------------------------------------------------------------- +Ran 10 tests in 0.088s + +OK +ISOLATION: exact new tests; only new accessor AST executed; synthetic state/functions; no original runtime imports +FIXTURE_IMPORTS: ast,copy,pathlib,types,unittest +ACTUAL_OWNERSHIP_OR_NATIVE_OR_RUNTIME_ADMISSION: false diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/PROPOSAL-TESTS-v1-optimized.txt b/research/h25-v03-prefix-supervision/unit05/fixtures/PROPOSAL-TESTS-v1-optimized.txt new file mode 100644 index 0000000000..02a2b800d6 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/PROPOSAL-TESTS-v1-optimized.txt @@ -0,0 +1,18 @@ +test_existing_primary_identity (unit05_exact_new_proposal_tests.AccessorTests.test_existing_primary_identity) ... ok +test_intact_exit1_predicate (unit05_exact_new_proposal_tests.AccessorTests.test_intact_exit1_predicate) ... ok +test_invalid_early_call_keeps_cleanup_phase (unit05_exact_new_proposal_tests.AccessorTests.test_invalid_early_call_keeps_cleanup_phase) ... ok +test_late_owned_child (unit05_exact_new_proposal_tests.AccessorTests.test_late_owned_child) ... ok +test_local_primary_identity (unit05_exact_new_proposal_tests.AccessorTests.test_local_primary_identity) ... ok +test_other_exit_dispositions (unit05_exact_new_proposal_tests.AccessorTests.test_other_exit_dispositions) ... ok +test_unclosed_fd (unit05_exact_new_proposal_tests.AccessorTests.test_unclosed_fd) ... ok +test_complete_observer_selected (unit05_exact_new_proposal_tests.SourceStructureTests.test_complete_observer_selected) ... ok +test_source_gates_remain_none (unit05_exact_new_proposal_tests.SourceStructureTests.test_source_gates_remain_none) ... ok +test_supervisor_has_no_mint_call (unit05_exact_new_proposal_tests.SourceStructureTests.test_supervisor_has_no_mint_call) ... ok + +---------------------------------------------------------------------- +Ran 10 tests in 0.083s + +OK +ISOLATION: exact new tests; only new accessor AST executed; synthetic state/functions; no original runtime imports +FIXTURE_IMPORTS: ast,copy,pathlib,types,unittest +ACTUAL_OWNERSHIP_OR_NATIVE_OR_RUNTIME_ADMISSION: false diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/PROPOSAL-TESTS-v2-normal.txt b/research/h25-v03-prefix-supervision/unit05/fixtures/PROPOSAL-TESTS-v2-normal.txt new file mode 100644 index 0000000000..679a978c4a --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/PROPOSAL-TESTS-v2-normal.txt @@ -0,0 +1,18 @@ +test_existing_primary_identity (unit05_exact_new_proposal_tests.AccessorTests.test_existing_primary_identity) ... ok +test_intact_exit1_predicate (unit05_exact_new_proposal_tests.AccessorTests.test_intact_exit1_predicate) ... ok +test_invalid_early_call_keeps_cleanup_phase (unit05_exact_new_proposal_tests.AccessorTests.test_invalid_early_call_keeps_cleanup_phase) ... ok +test_late_owned_child (unit05_exact_new_proposal_tests.AccessorTests.test_late_owned_child) ... ok +test_local_primary_identity (unit05_exact_new_proposal_tests.AccessorTests.test_local_primary_identity) ... ok +test_other_exit_dispositions (unit05_exact_new_proposal_tests.AccessorTests.test_other_exit_dispositions) ... ok +test_unclosed_fd (unit05_exact_new_proposal_tests.AccessorTests.test_unclosed_fd) ... ok +test_complete_observer_selected (unit05_exact_new_proposal_tests.SourceStructureTests.test_complete_observer_selected) ... ok +test_source_gates_remain_none (unit05_exact_new_proposal_tests.SourceStructureTests.test_source_gates_remain_none) ... ok +test_supervisor_has_no_mint_call (unit05_exact_new_proposal_tests.SourceStructureTests.test_supervisor_has_no_mint_call) ... ok + +---------------------------------------------------------------------- +Ran 10 tests in 0.104s + +OK +ISOLATION: exact new tests; only new accessor AST executed; synthetic state/functions; no original runtime imports +FIXTURE_IMPORTS: ast,copy,pathlib,types,unittest +ACTUAL_OWNERSHIP_OR_NATIVE_OR_RUNTIME_ADMISSION: false diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/PROPOSAL-TESTS-v2-optimized.txt b/research/h25-v03-prefix-supervision/unit05/fixtures/PROPOSAL-TESTS-v2-optimized.txt new file mode 100644 index 0000000000..8672dfe50c --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/PROPOSAL-TESTS-v2-optimized.txt @@ -0,0 +1,18 @@ +test_existing_primary_identity (unit05_exact_new_proposal_tests.AccessorTests.test_existing_primary_identity) ... ok +test_intact_exit1_predicate (unit05_exact_new_proposal_tests.AccessorTests.test_intact_exit1_predicate) ... ok +test_invalid_early_call_keeps_cleanup_phase (unit05_exact_new_proposal_tests.AccessorTests.test_invalid_early_call_keeps_cleanup_phase) ... ok +test_late_owned_child (unit05_exact_new_proposal_tests.AccessorTests.test_late_owned_child) ... ok +test_local_primary_identity (unit05_exact_new_proposal_tests.AccessorTests.test_local_primary_identity) ... ok +test_other_exit_dispositions (unit05_exact_new_proposal_tests.AccessorTests.test_other_exit_dispositions) ... ok +test_unclosed_fd (unit05_exact_new_proposal_tests.AccessorTests.test_unclosed_fd) ... ok +test_complete_observer_selected (unit05_exact_new_proposal_tests.SourceStructureTests.test_complete_observer_selected) ... ok +test_source_gates_remain_none (unit05_exact_new_proposal_tests.SourceStructureTests.test_source_gates_remain_none) ... ok +test_supervisor_has_no_mint_call (unit05_exact_new_proposal_tests.SourceStructureTests.test_supervisor_has_no_mint_call) ... ok + +---------------------------------------------------------------------- +Ran 10 tests in 0.088s + +OK +ISOLATION: exact new tests; only new accessor AST executed; synthetic state/functions; no original runtime imports +FIXTURE_IMPORTS: ast,copy,pathlib,types,unittest +ACTUAL_OWNERSHIP_OR_NATIVE_OR_RUNTIME_ADMISSION: false diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/REPAIR-DELTA-v2.json b/research/h25-v03-prefix-supervision/unit05/fixtures/REPAIR-DELTA-v2.json new file mode 100644 index 0000000000..bef5719d61 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/REPAIR-DELTA-v2.json @@ -0,0 +1,27 @@ +{ + "constructor_successor": { + "all_function_source_segments_unchanged": true, + "bytes": 6111, + "dict_of_pairs_equals_original": true, + "only_assignment_value_changed": "NATIVE_ENV dict -> immutable tuple of six exact bytes pairs", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_integrated_constructor_v2.py", + "predecessor_sha256": "5e08ff84298fe1249be5e8790ea259e6179048f4736fb7eafdb6e170b8bc1cf9", + "sha256": "a80a60b390bc60e9bc434b79cda5ae6db88e4f0c6c7436de9adfe1f48a2045b1" + }, + "original_execution": false, + "original_files_modified": false, + "original_module_imports": false, + "schema": "unit05-authorized-repair-delta-v2", + "supervisor_repair": [ + "outer plan excluded only from inner source membership", + "independent plan pin read at construction/prelaunch/postcapture snapshots", + "initial decoded raw retained; every endpoint raw retained before comparison", + "exact plan path and actual inode aliases rejected", + "outer row counted in original parent8192; every plan read<=RECORD_BYTES; source-custody record including plan evidence<=RECORD_BYTES", + "C07 interval remains unproved" + ], + "window": [ + "2026-11-02T11:07:10.897421Z", + "2026-11-02T11:22:10.897421Z" + ] +} diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/V1-REJECTION-v1.json b/research/h25-v03-prefix-supervision/unit05/fixtures/V1-REJECTION-v1.json new file mode 100644 index 0000000000..39698074bc --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/V1-REJECTION-v1.json @@ -0,0 +1,31 @@ +{ + "findings": [ + { + "finding": "Unit01 constructor NATIVE_ENV is dict with bytes keys; original closure _data rejects dict keys not exact str/int, so proposed receiver capture cannot succeed", + "id": "U05-R01", + "original_function_executed_to_prove": false, + "reviewer": "c05_component_review", + "source_anchors": [ + "v03_integrated_constructor_v1.py:13-17", + "parent_closure_v1.py original _data:98-116 and capture:209-220" + ] + }, + { + "finding": "make_prefix_owner requires outer configuration.plan blob among decoded plan.source_files with identical hash/size/mode; this demands plan ownhash construction not supplied", + "id": "U05-R02", + "original_function_executed_to_prove": false, + "reviewer": "v03_source_route_review", + "source_anchors": [ + "v03_prefix_supervisor_v1.py original proposal:363-373" + ] + } + ], + "new_proposal_tests": "10PASS normal and-O; not sufficient for source acceptance", + "original_execution": false, + "repair_window": [ + "2026-11-02T11:07:10.897421Z", + "2026-11-02T11:22:10.897421Z" + ], + "schema": "unit05-v1-independent-source-rejections", + "semantic_repairs_applied_at_capture": false +} diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/run_proposal_pure_tests_v1.py b/research/h25-v03-prefix-supervision/unit05/fixtures/run_proposal_pure_tests_v1.py new file mode 100644 index 0000000000..9f273553e5 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/run_proposal_pure_tests_v1.py @@ -0,0 +1,70 @@ +"""Run the exact new proposal tests with path fixtures, never original imports. + +Only the appended accessor body is compiled by the supplied extractor. All of +its external functions/state are explicit synthetic fixtures in that test file. +No full supervisor, domain, closure, parent, installer or native call executes. +""" +import ast +import builtins +import hashlib +from pathlib import Path +import sys +import types +import unittest + +WORKSPACE=Path('/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453') +BASE=WORKSPACE/'outputs/c05-v03-completion-20261102T055710Z/unit05' +IMPL=BASE/'implementation' +EXPECTED='b5f8055da6f9a48e85a4eed0868f7076859adca317e0691e5b2336e0bdb58d52' +ALLOWED_IMPORTS={'ast','copy','pathlib','types','unittest'} +BLOCKED={'epoch_schema_v5','epoch_copy_v5','parent_domain_v1','parent_closure_v1', + 'parent_completion_v1','h25_parent_supervisor','group01_evidence_v1', + 'v03_prefix_supervisor_v1'} + + +def main(): + raw=(IMPL/'test_v03_prefix_supervisor_v1.py').read_bytes() + if hashlib.sha256(raw).hexdigest()!=EXPECTED:raise ValueError('exact proposal fixture pin differs') + tree=ast.parse(raw,feature_version=(3,12)) + for node in ast.walk(tree): + if isinstance(node,ast.Import): + if any(alias.name not in ALLOWED_IMPORTS for alias in node.names):raise ValueError('new fixture import boundary') + elif isinstance(node,ast.ImportFrom) and node.module not in ALLOWED_IMPORTS: + raise ValueError('new fixture from-import boundary') + domain=(IMPL/'parent_domain_v1.py').read_bytes() + parsed=ast.parse(domain,feature_version=(3,12)) + matches=[node for node in parsed.body if type(node) is ast.FunctionDef and node.name=='prefix_exit1_terminal_facts'] + if len(matches)!=1:raise ValueError('unique new accessor required') + fragment=(BASE/'proposal/domain-prefix-accessor.py.fragment').read_bytes() + proposed=ast.parse(fragment,feature_version=(3,12)).body + if len(proposed)!=1 or ast.dump(matches[0],include_attributes=False)!=ast.dump(proposed[0],include_attributes=False): + raise ValueError('only exact newly authored accessor may execute') + if any(isinstance(n,(ast.Import,ast.ImportFrom)) for n in ast.walk(matches[0])): + raise ValueError('accessor fixture unexpectedly imports') + if BLOCKED & set(sys.modules):raise ValueError('original runtime module already imported') + imported=[] + real_import=builtins.__import__ + def fixture_import(name,globals=None,locals=None,fromlist=(),level=0): + if level or name not in ALLOWED_IMPORTS:raise ValueError('fixture attempted disallowed import') + imported.append(name) + return real_import(name,globals,locals,fromlist,level) + module=types.ModuleType('unit05_exact_new_proposal_tests') + scope=dict(vars(builtins));scope['__import__']=fixture_import + module.__dict__['__builtins__']=scope + exec(compile(raw,'','exec'),module.__dict__) + # Explicit path fixture only; copied proposal bytes are not rewritten. + def fixture_path(value): + if value not in ('parent_domain_v1.py','v03_prefix_supervisor_v1.py'): + raise ValueError('unexpected fixture path') + return IMPL/value + module.Path=fixture_path + suite=unittest.defaultTestLoader.loadTestsFromModule(module) + result=unittest.TextTestRunner(verbosity=2).run(suite) + if BLOCKED & set(sys.modules):raise ValueError('original runtime import boundary violated') + print('ISOLATION: exact new tests; only new accessor AST executed; synthetic state/functions; no original runtime imports') + print('FIXTURE_IMPORTS: '+','.join(imported)) + print('ACTUAL_OWNERSHIP_OR_NATIVE_OR_RUNTIME_ADMISSION: false') + raise SystemExit(0 if result.wasSuccessful() else 1) + + +if __name__=='__main__':main() diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/test_derivation_pure_v2.py b/research/h25-v03-prefix-supervision/unit05/fixtures/test_derivation_pure_v2.py new file mode 100644 index 0000000000..ffe51c2a74 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/test_derivation_pure_v2.py @@ -0,0 +1,93 @@ +"""Execute only NEW pure constructor/verifier source; original driver is bytes.""" +import ast +import builtins +import hashlib +from pathlib import Path +from types import ModuleType +import unittest + +ROOT=Path('/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453') +BASE=ROOT/'outputs/c05-v03-completion-20261102T055710Z/unit05' +IMPL=BASE/'implementation' +ORIGINAL=ROOT/'outputs/resolved-questions-publication-20261102T025112Z/v03-publication/research/h25-v03-source-prerequisites/snapshot/areas/field-variant-producer-v2/variant_driver_v1.py.txt' + + +def load_new(name,pin,constructor=None): + raw=(IMPL/(name+'.py')).read_bytes() + if hashlib.sha256(raw).hexdigest()!=pin:raise ValueError('new pure component source pin differs') + tree=ast.parse(raw,feature_version=(3,12)) + allowed={'ast','hashlib'} if constructor is None else {'ast','v03_integrated_constructor_v2'} + for node in ast.walk(tree): + if isinstance(node,ast.Import) and any(x.name not in allowed for x in node.names):raise ValueError('pure import boundary') + if isinstance(node,ast.ImportFrom) and node.module not in allowed:raise ValueError('pure from-import boundary') + module=ModuleType(name) + def importing(module_name,globals=None,locals=None,fromlist=(),level=0): + if level or module_name not in allowed:raise ValueError('new component attempted unexpected import') + if module_name=='v03_integrated_constructor_v2':return constructor + return builtins.__import__(module_name,globals,locals,fromlist,level) + functions=dict(vars(builtins));functions['__import__']=importing + module.__dict__['__builtins__']=functions + exec(compile(raw,'','exec'),module.__dict__) + return module + + +class DerivationTests(unittest.TestCase): + @classmethod + def setUpClass(cls): + cls.constructor=load_new('v03_integrated_constructor_v2','a80a60b390bc60e9bc434b79cda5ae6db88e4f0c6c7436de9adfe1f48a2045b1') + cls.checker=load_new('v03_prefix_derivation_v1','1ed813148c10d5fbd3cd6781d51eca650a347eda7a6323f581d740e6ea9cb6e2',cls.constructor) + cls.original=ORIGINAL.read_bytes() + if hashlib.sha256(cls.original).hexdigest()!='cdb1479253358508088f8aa0e1e92e6c75ffcc127e54552698598a02de061254':raise ValueError('inert original pin') + cls.rendered=cls.constructor.build_control_driver(cls.original) + + def values(self):return {name:None for name in self.constructor.GATES} + + def render(self,values,expression=None): + raw=self.rendered;tree=ast.parse(raw,feature_version=(3,12));lines=raw.split(b'\n');spans=[] + for node in tree.body: + if type(node) is ast.Assign and len(node.targets)==1 and type(node.targets[0]) is ast.Name and node.targets[0].id in values: + value=node.value + start=sum(len(x)+1 for x in lines[:value.lineno-1])+value.col_offset + end=sum(len(x)+1 for x in lines[:value.end_lineno-1])+value.end_col_offset + payload=expression if expression is not None and node.targets[0].id==self.constructor.GATES[0] else repr(values[node.targets[0].id]).encode('utf8') + spans.append((start,end,payload)) + for start,end,payload in sorted(spans,reverse=True):raw=raw[:start]+payload+raw[end:] + return raw + + def test_unconfigured_exact_rendering(self): + self.assertIsNone(self.checker.verify_configured_prefix(self.original,self.rendered,self.values())) + + def test_unicode_gate_literal_byte_offsets(self): + values=self.values();values[self.constructor.GATES[0]]={'unicode':'π','nested':[1,True,None]} + self.assertIsNone(self.checker.verify_configured_prefix(self.original,self.render(values),values)) + + def test_non_gate_byte_change_rejects(self): + with self.assertRaises(ValueError):self.checker.verify_configured_prefix(self.original,self.rendered+b'\n#NONGATE\n',self.values()) + + def test_bool_is_not_integer_gate_data(self): + actual=self.values();actual[self.constructor.GATES[0]]=True + expected=self.values();expected[self.constructor.GATES[0]]=1 + with self.assertRaises(ValueError):self.checker.verify_configured_prefix(self.original,self.render(actual),expected) + + def test_nonliteral_call_never_executes(self): + calls=[];self.checker.touch=lambda:calls.append('BAD') + with self.assertRaises(ValueError):self.checker.verify_configured_prefix(self.original,self.render(self.values(),b'touch()'),self.values()) + self.assertEqual(calls,[]) + + def test_duplicate_gate_rejects(self): + extra=('\n'+self.constructor.GATES[0]+' = None\n').encode() + with self.assertRaises(ValueError):self.checker.verify_configured_prefix(self.original,self.rendered+extra,self.values()) + + def test_plain_text_container_and_depth_exhaustion(self): + nested=None + for n in range(26):nested=[nested] + for bad in ('x'*8193,[None]*1025,nested): + values=self.values();values[self.constructor.GATES[0]]=bad + with self.assertRaises(ValueError):self.checker.verify_configured_prefix(self.original,self.render(values),values) + + def test_tuple_environment_preserves_all_six_native_pairs(self): + self.assertIs(type(self.constructor.NATIVE_ENV),tuple) + self.assertEqual(dict(self.constructor.NATIVE_ENV),{b'PATH':b'/usr/bin:/bin',b'PYTHONHASHSEED':b'0',b'LANG':b'C.UTF-8',b'LC_ALL':b'C.UTF-8',b'TZ':b'UTC',b'PYTHONDONTWRITEBYTECODE':b'1'}) + + +if __name__=='__main__':unittest.main(verbosity=2) diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/test_new_orchestration_v2.py b/research/h25-v03-prefix-supervision/unit05/fixtures/test_new_orchestration_v2.py new file mode 100644 index 0000000000..d44121f8d6 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/test_new_orchestration_v2.py @@ -0,0 +1,234 @@ +"""NEW-body-only pure discriminators. Every service and PID/FD below is fake. + +No state/token returned here is an actual capability; no original function, +Popen, native call, kernel census, namespace or target process is executed. +""" +import ast +import hashlib +import json +from pathlib import Path +from types import SimpleNamespace as NS +import unittest + +BASE=Path('/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05') +IMPL=BASE/'implementation' + + +class FixtureStop(RuntimeError):pass + + +def need(value,message): + if value is not True:raise FixtureStop(message) + + +def extract(name,scope): + tree=ast.parse((IMPL/'v03_prefix_supervisor_v1.py').read_bytes(),feature_version=(3,12)) + functions=[n for n in tree.body if type(n) is ast.FunctionDef and n.name==name] + if len(functions)!=1:raise ValueError('unique NEW function required') + if name not in ('_supervise','_source_snapshot','_capture'):raise ValueError('not a newly authored test target') + if any(isinstance(n,(ast.Import,ast.ImportFrom)) for n in ast.walk(functions[0])):raise ValueError('unexpected function import') + data=dict(scope) + exec(compile(ast.Module(body=functions,type_ignores=[]),'','exec'),data) + return data[name] + + +def owner():return {'primary':[None],'pending':[False],'iterator_uncertain':[False],'quarantine':[False]} + + +class SuperviseTests(unittest.TestCase): + def fixture(self,fail=None,cleanup=None,close=None): + counts={'popen':0,'finish':0,'close_logs':0,'opens':0,'terminal':0,'adopt':0,'observe':0,'closed_fds':[]} + own=owner() + case={'output':'/FAKE/output','root_seconds':40,'address_space_bytes':1024,'rss_bytes':1024, + 'id':'FAKE','generation':'FAKE','launch_nonce':'0'*64,'stage_directory':'/FAKE/stage', + 'command':['FAKE-NO-EXEC'],'expectation':{'outcome':'FIXTURE-ONLY'}} + state={'unknown_owner':own,'plan':{'case':case,'session_directory':'/FAKE/session','mode':'normal'}, + 'phase':'READY','run':None,'errors':object(),'initial_sources':('FAKE-SNAPSHOT',),'pid':10,'shared_deadline':1000} + A=RuntimeError('A fake first');B=RuntimeError('B fake cleanup') + def stat(path,**kw): + if path==case['output']:raise FileNotFoundError('fake absent') + return NS(st_size=0) + def opening(*args): + counts['opens']+=1 + if fail=='open2' and counts['opens']==2:raise A + return 100+counts['opens'] + def popen(*args,**kw): + counts['popen']+=1 + if fail=='popen':raise A + return object() + def adopt(*args): + counts['adopt']+=1 + if fail=='adopt':raise A + return (11,10,11,11,123,'Z',0) + def observe(*args): + counts['observe']+=1 + if fail=='observe':raise A + return (),() + def finish(*args): + counts['finish']+=1 + if cleanup:raise B + def close_logs(run,primary): + counts['close_logs']+=1 + first=None + for n,fd in enumerate(run['log_fds']): + if fd is None or run['log_close_attempted'][n]:continue + run['log_close_attempted'][n]=True + counts['closed_fds'].append(fd) + if close=='faithful': + # Explicit NEW fake model of the reviewed helper ABI: + # per-FD failure is retained and the other known FD tried. + try: + if n==0:raise B + run['log_close_confirmed'][n]=True + except BaseException as error: + if own['primary'][0] is None:own['primary'][0]=primary if primary is not None else error + own['quarantine'][0]=True + run['errors'][n]=error + if first is None:first=error + else: + if close:raise B # narrower helper-abort injection + run['log_close_confirmed'][n]=True + if primary is None and first is not None:raise first + def terminal(*args):counts['terminal']+=1;return {'FAKE-NOT-OWNERSHIP':True} + parent=NS(_STAT=stat,_GETRLIMIT=lambda x:(100,100),_OPEN=opening,_SETRLIMIT=lambda *x:None, + _GETTIMER=lambda *x:(0.0,0.0),_GETSIGNAL=lambda *x:None,_SIGNAL=lambda *x:None, + _SETTIMER=lambda *x:None,_alarm=lambda *x:None,_POPEN=popen,_SLEEP=lambda *x:None,_close_logs=close_logs) + domain=NS(CLEANUP_SECONDS=2,create_domain=lambda x:object(),adopt_popen=adopt, + observe=observe,poll_owned=lambda *x:0,finish_domain=finish) + scope={'schema':NS(need=need,EpochStop=FixtureStop,LOG_BYTES=2097152),'parent':parent,'domain':domain, + '_guard':lambda x:None,'_source_snapshot':lambda x:('FAKE-SNAPSHOT',),'_CLOCK':lambda:1, + 'copying':NS(write_once=lambda *a,**k:{'FAKE-FILE-PIN':True}),'_record_bytes':lambda x:b'FAKE', + 'resource':NS(RLIMIT_FSIZE=1,RLIMIT_AS=9),'signal':NS(ITIMER_REAL=0,SIGALRM=14), + '_clean':lambda x:None,'os':NS(O_WRONLY=1,O_CREAT=2,O_EXCL=4,O_CLOEXEC=8,O_NOFOLLOW=16), + 'subprocess':NS(DEVNULL=-3),'ENV':{'FAKE':'NOT-A-NATIVE-ENV'},'_terminal':terminal} + return extract('_supervise',scope),state,counts,A,B + + def test_popen_primary_survives_cleanup_secondary(self): + fn,s,c,A,B=self.fixture('popen',True) + with self.assertRaises(RuntimeError) as caught:fn(s) + self.assertIs(caught.exception,A) + self.assertIs(s['unknown_owner']['primary'][0],A) + self.assertIs(s['run']['errors'][3],B) + self.assertEqual((c['popen'],c['finish'],c['close_logs'],c['terminal']),(1,1,1,0)) + + def test_adoption_and_observe_primary_survive_cleanup(self): + for phase in ('adopt','observe'): + with self.subTest(phase=phase): + fn,s,c,A,B=self.fixture(phase,True) + with self.assertRaises(RuntimeError) as caught:fn(s) + self.assertIs(caught.exception,A) + self.assertIs(s['run']['errors'][3],B) + self.assertEqual(c['finish'],1) + self.assertEqual(c['terminal'],0) + + def test_uncertain_raw_open_stops_later_acquisitions(self): + fn,s,c,A,B=self.fixture('open2') + with self.assertRaises(RuntimeError) as caught:fn(s) + self.assertIs(caught.exception,A) + self.assertTrue(s['unknown_owner']['pending'][0]) + self.assertTrue(s['unknown_owner']['quarantine'][0]) + self.assertEqual((c['opens'],c['popen'],c['finish'],c['close_logs']),(2,0,1,1)) + self.assertEqual(s['run']['log_close_attempted'],[True,False]) + self.assertEqual(c['terminal'],0) + + def test_close_helper_abort_is_not_retried_or_terminal(self): + fn,s,c,A,B=self.fixture(close=True) + with self.assertRaises(RuntimeError) as caught:fn(s) + self.assertIs(caught.exception,B) + self.assertEqual(c['close_logs'],1) + self.assertTrue(s['unknown_owner']['quarantine'][0]) + self.assertEqual(s['run']['log_close_attempted'],[True,False]) + self.assertEqual(c['terminal'],0) + + def test_ordinary_first_close_failure_still_attempts_other_fd(self): + fn,s,c,A,B=self.fixture(close='faithful') + with self.assertRaises(RuntimeError) as caught:fn(s) + self.assertIs(caught.exception,B) + self.assertEqual(c['close_logs'],1) + self.assertEqual(c['closed_fds'],[101,102]) + self.assertEqual(s['run']['log_close_attempted'],[True,True]) + self.assertEqual(s['run']['log_close_confirmed'],[False,True]) + self.assertIs(s['run']['errors'][0],B) + self.assertEqual(c['terminal'],0) + + def test_primary_survives_per_fd_close_failure(self): + fn,s,c,A,B=self.fixture('popen',close='faithful') + with self.assertRaises(RuntimeError) as caught:fn(s) + self.assertIs(caught.exception,A) + self.assertIs(s['run']['errors'][0],B) + self.assertEqual(c['closed_fds'],[101,102]) + self.assertEqual(s['run']['log_close_attempted'],[True,True]) + self.assertEqual(c['terminal'],0) + + def test_consumed_control_does_not_spawn_again(self): + fn,s,c,A,B=self.fixture() + fn(s) + with self.assertRaises(FixtureStop):fn(s) + self.assertEqual(c['popen'],1) + + +class OuterPlanTests(unittest.TestCase): + def fixture(self): + raw=b'{}';pin={'path':'/FAKE/outer-plan','identity':{'device':1,'inode':1}} + row={'path':'/FAKE/input','identity':{'device':1,'inode':2}} + state={'plan':{'source_files':[{'path':row['path']}],'case':{},'source_closure_admission_sha256':'0'*64}, + 'configuration':{'plan':pin},'errors':object(),'plan_raw':raw,'plan_endpoint_raw':[None]*3,'plan_endpoint_count':0} + calls=[];read=[raw];rows=[row] + def verified(pin,bound,**kw):calls.append((pin,bound));return read[0] + scope={'schema':NS(need=need,RECORD_BYTES=1048576,inode=lambda x:(x['identity']['device'],x['identity']['inode']),sha=lambda b:hashlib.sha256(b).hexdigest()), + 'copying':NS(read_verified=verified),'parent':NS(MAX_SOURCE_FILES=2,_snapshot_sources=lambda *a:rows,_stage=lambda *a:{}), + '_record_bytes':lambda obj:(json.dumps(obj,sort_keys=True)+'\n').encode()} + return extract('_source_snapshot',scope),state,calls,read,rows + + def test_three_actual_fixture_reads_retained_and_equal(self): + fn,s,c,r,rows=self.fixture();a=fn(s);b=fn(s);d=fn(s) + self.assertEqual(a,b);self.assertEqual(a,d) + self.assertEqual(len(c),3);self.assertEqual(s['plan_endpoint_raw'],[b'{}']*3) + self.assertEqual(s['plan_endpoint_count'],3) + with self.assertRaises(FixtureStop):fn(s) + self.assertEqual(len(c),3) + + def test_plan_path_cannot_be_an_inner_row(self): + fn,s,c,r,rows=self.fixture();s['plan']['source_files'][0]['path']=s['configuration']['plan']['path'] + with self.assertRaises(FixtureStop):fn(s) + self.assertEqual(c,[]) + + def test_plan_inode_cannot_alias_an_inner_row(self): + fn,s,c,r,rows=self.fixture();rows[0]['identity']['inode']=1 + with self.assertRaises(FixtureStop):fn(s) + self.assertEqual(len(c),1) + self.assertEqual(s['plan_endpoint_raw'][0],b'{}') + + def test_changed_plan_raw_is_retained_before_rejection(self): + fn,s,c,r,rows=self.fixture();r[0]=b'CHANGED-FAKE-RAW' + with self.assertRaises(FixtureStop):fn(s) + self.assertEqual(s['plan_endpoint_raw'][0],b'CHANGED-FAKE-RAW') + + def test_outer_plan_row_is_counted(self): + fn,s,c,r,rows=self.fixture();s['plan']['source_files'].append({'path':'/FAKE/extra'}) + with self.assertRaises(FixtureStop):fn(s) + self.assertEqual(c,[]) + + +class RawRetentionTests(unittest.TestCase): + def test_partial_copy_failure_retains_already_captured_sources(self): + class CopyFailure(RuntimeError):pass + B=CopyFailure('FAKE copy failure');own=owner();run={'retained':{}} + state={'unknown_owner':own,'errors':object(),'plan':{'session_directory':'/FAKE/session','case':{'output':'/FAKE/out','expectation':{}}}} + count=[0] + def inspect(path,bound,**kw):count[0]+=1;return {'path':path,'pair':(1,count[0])} + def copy(source,target,occupied,**kw): + if source['path'].endswith('stderr.raw'):raise B + return {'path':target,'pair':(2,1)} + scope={'schema':NS(LOG_BYTES=2097152,RECORD_BYTES=1048576,inode=lambda x:x['pair'],need=need), + '_expected_files':lambda e:(), '_guard':lambda s:None, + 'copying':NS(inspect=inspect,copy_once=copy,read_verified=lambda *a,**k:b'')} + fn=extract('_capture',scope) + with self.assertRaises(CopyFailure) as caught:fn(state,run) + self.assertIs(caught.exception,B) + self.assertIn('copy',run['retained']['stdout.raw']) + self.assertIn('source',run['retained']['stderr.raw']) + self.assertNotIn('copy',run['retained']['stderr.raw']) + + +if __name__=='__main__':unittest.main(verbosity=2) diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/AUTHOR-RECEIPT-v1.json b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/AUTHOR-RECEIPT-v1.json new file mode 100644 index 0000000000..d729443a8e --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/AUTHOR-RECEIPT-v1.json @@ -0,0 +1,124 @@ +{ + "artifacts": [ + { + "bytes": 82957, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/epoch_copy_v5.py", + "sha256": "4f459d0336d59975df787c24373e18dad4044c3a24137392e890115f811b3211" + }, + { + "bytes": 30668, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/epoch_schema_v5.py", + "sha256": "b89a789654be87bde40a47300f4d9702dce2b90e6ab3be9a2025f6d8041b3e9a" + }, + { + "bytes": 15610, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/group01_evidence_v1.py", + "sha256": "05ec6a63c57340ba929aea1fab71b096efc143e099346640f6def41310bd3e25" + }, + { + "bytes": 23047, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/h25_parent_supervisor.py", + "sha256": "cfb09a18dd10b597cc6d5a8139ee769bef679bc44ae029329755e3d97b055075" + }, + { + "bytes": 13463, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_closure_v1.py", + "sha256": "a15424f14baa3d484fe04bfbe7e449c32561c866dbaca2c1b5f646dfb377ed1f" + }, + { + "bytes": 54168, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_completion_v1.py", + "sha256": "d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5" + }, + { + "bytes": 23942, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_domain_v1.py", + "sha256": "a51264289803b4b17bb262f2460ddd4ed72500aaa21e5eb80fa2db4583689361" + }, + { + "bytes": 6381, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/test_v03_prefix_supervisor_v1.py", + "sha256": "b5f8055da6f9a48e85a4eed0868f7076859adca317e0691e5b2336e0bdb58d52" + }, + { + "bytes": 6087, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_integrated_constructor_v1.py", + "sha256": "5e08ff84298fe1249be5e8790ea259e6179048f4736fb7eafdb6e170b8bc1cf9" + }, + { + "bytes": 3830, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_prefix_derivation_v1.py", + "sha256": "4591de196d008f0fdc094f4a74b19a84c095e2def5d28dbdaea7085e4630f8a7" + }, + { + "bytes": 35491, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_prefix_supervisor_v1.py", + "sha256": "75bef7834fe7278638010f79a8efca84b49b1e48320d3c8ac2d93cadea5a8262" + }, + { + "bytes": 14205, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_source_refusal_observer_v1.py", + "sha256": "abf25690d3bee4a9783ee504567c29f7fb47da670e0ec95f57cb5944bf57264f" + }, + { + "bytes": 6294, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/ASSEMBLY-v1.json", + "sha256": "fcb9d53fbb77583a12ace09ebec7edb9e9820d7eeb00e15b6b7410888738763b" + }, + { + "bytes": 1477, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/PROPOSAL-TESTS-v1-normal.txt", + "sha256": "488d38cf7147d94811dab07bc385f4339b999d2da1f0b0d18de7692f9dd417a8" + }, + { + "bytes": 1477, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/PROPOSAL-TESTS-v1-optimized.txt", + "sha256": "77ccaed42375657de3639d0b1cba77a8de25ac4ae8ab808013bab519b652d98b" + }, + { + "bytes": 1226, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/V1-REJECTION-v1.json", + "sha256": "e1978317502606bde5baa67698c2ed9227032192069e49c8b08ebee6eaec9a96" + }, + { + "bytes": 3836, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/run_proposal_pure_tests_v1.py", + "sha256": "2cd493991834294bc016510e11dbfd0f14049fd7915632970c28a10e3b51a790" + } + ], + "bootstrap_C07_actual_stage_native_funding_runtime_admissions": "MISSING_SEPARATE_PREMISES", + "full_C05": false, + "full_V03": false, + "independent_source_acceptance": false, + "isolation": "only exact new test module and appended new accessor function AST with explicit fake globals; no full supervisor/original module import", + "normal_and_optimized_test_status": "PASS", + "original_activity_credit": false, + "outside_costs": "OPEN_NOT_ZERO", + "proposal_source_manifest_sha256": "627fd8b7c8439851b9afcde92cbc5110b72aa957c3663dabf377482c4ebf5f44", + "response_sha256": "d1b15e2a92c6cbf137319ef2c165e2d920202d5f2d7509d7a8d572d90b4ffa13", + "retained_findings": [ + { + "finding": "Unit01 constructor NATIVE_ENV is dict with bytes keys; original closure _data rejects dict keys not exact str/int, so proposed receiver capture cannot succeed", + "id": "U05-R01", + "original_function_executed_to_prove": false, + "reviewer": "c05_component_review", + "source_anchors": [ + "v03_integrated_constructor_v1.py:13-17", + "parent_closure_v1.py original _data:98-116 and capture:209-220" + ] + }, + { + "finding": "make_prefix_owner requires outer configuration.plan blob among decoded plan.source_files with identical hash/size/mode; this demands plan ownhash construction not supplied", + "id": "U05-R02", + "original_function_executed_to_prove": false, + "reviewer": "v03_source_route_review", + "source_anchors": [ + "v03_prefix_supervisor_v1.py original proposal:363-373" + ] + } + ], + "schema": "unit05-author-initial-v1", + "source_assembly": "exact proposal copied; originaldomain append only; originalclosure sole63B insertion; productionparent unchanged", + "source_assembly_ready_utc": "2026-11-02T11:03:27Z", + "supplied_new_pure_tests": 10 +} diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/fixtures/ASSEMBLY-v1.json b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/fixtures/ASSEMBLY-v1.json new file mode 100644 index 0000000000..32a38c5fa8 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/fixtures/ASSEMBLY-v1.json @@ -0,0 +1,110 @@ +{ + "full_C05": false, + "full_V03": false, + "original_code_executed": false, + "original_modules_imported": false, + "outside_costs": "OPEN_NOT_ZERO", + "proposal_manifest_sha256": "627fd8b7c8439851b9afcde92cbc5110b72aa957c3663dabf377482c4ebf5f44", + "proposal_semantics_changed": false, + "raw_response_sha256": "d1b15e2a92c6cbf137319ef2c165e2d920202d5f2d7509d7a8d572d90b4ffa13", + "rows": [ + { + "bytes": 54168, + "original_bytes": 54168, + "original_path": "outputs/c05-v03-completion-20261102T055710Z/unit02/prerequisite-source/field-parent-completion-v2--parent_completion_v1.py.txt", + "original_sha256": "d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_completion_v1.py", + "sha256": "d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5", + "transformation": "exact inert candidate copy; never imported" + }, + { + "bytes": 23942, + "original_bytes": 20456, + "original_path": "outputs/c05-v03-completion-20261102T055710Z/unit02/prerequisite-source/field-parent-completion-v2--parent_domain_v1.py.txt", + "original_sha256": "9205e14d6661fb5df0597f0ad7b2206006f2d31f01f784805f64c13875663282", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_domain_v1.py", + "sha256": "a51264289803b4b17bb262f2460ddd4ed72500aaa21e5eb80fa2db4583689361", + "transformation": "exact original byte prefix plus two LF separator and exact new accessor fragment" + }, + { + "bytes": 13463, + "original_bytes": 13400, + "original_path": "outputs/c05-v03-completion-20261102T055710Z/unit02/prerequisite-source/field-parent-completion-v2--parent_closure_v1.py.txt", + "original_sha256": "2d831cff8bd444de2d6941645d571e07618ede404a1f45692b557f61494b334a", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_closure_v1.py", + "sha256": "a15424f14baa3d484fe04bfbe7e449c32561c866dbaca2c1b5f646dfb377ed1f", + "transformation": "exact original with sole63byte mutable-name dictionary insertion" + }, + { + "bytes": 23047, + "original_bytes": 23047, + "original_path": "outputs/c05-v03-completion-20261102T055710Z/unit02/prerequisite-source/h25_parent_supervisor.py.txt", + "original_sha256": "cfb09a18dd10b597cc6d5a8139ee769bef679bc44ae029329755e3d97b055075", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/h25_parent_supervisor.py", + "sha256": "cfb09a18dd10b597cc6d5a8139ee769bef679bc44ae029329755e3d97b055075", + "transformation": "exact inert candidate copy; never imported" + }, + { + "bytes": 30668, + "original_bytes": 30668, + "original_path": "outputs/c05-v03-completion-20261102T055710Z/unit02/prerequisite-source/field-negative-epoch-v5--epoch_schema_v5.py.txt", + "original_sha256": "b89a789654be87bde40a47300f4d9702dce2b90e6ab3be9a2025f6d8041b3e9a", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/epoch_schema_v5.py", + "sha256": "b89a789654be87bde40a47300f4d9702dce2b90e6ab3be9a2025f6d8041b3e9a", + "transformation": "exact inert candidate copy; never imported" + }, + { + "bytes": 82957, + "original_bytes": 82957, + "original_path": "outputs/c05-v03-completion-20261102T055710Z/unit02/prerequisite-source/field-negative-epoch-v5--epoch_copy_v5.py.txt", + "original_sha256": "4f459d0336d59975df787c24373e18dad4044c3a24137392e890115f811b3211", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/epoch_copy_v5.py", + "sha256": "4f459d0336d59975df787c24373e18dad4044c3a24137392e890115f811b3211", + "transformation": "exact inert candidate copy; never imported" + }, + { + "bytes": 15610, + "original_bytes": 15610, + "original_path": "outputs/c05-v03-completion-20261102T055710Z/unit02/prerequisite-source/field-parent-completion-v2--group01_evidence_v1.py.txt", + "original_sha256": "05ec6a63c57340ba929aea1fab71b096efc143e099346640f6def41310bd3e25", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/group01_evidence_v1.py", + "sha256": "05ec6a63c57340ba929aea1fab71b096efc143e099346640f6def41310bd3e25", + "transformation": "exact inert candidate copy; never imported" + }, + { + "bytes": 3830, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_prefix_derivation_v1.py", + "sha256": "4591de196d008f0fdc094f4a74b19a84c095e2def5d28dbdaea7085e4630f8a7", + "transformation": "exact proposal bytes copied without semantic changes" + }, + { + "bytes": 35491, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_prefix_supervisor_v1.py", + "sha256": "75bef7834fe7278638010f79a8efca84b49b1e48320d3c8ac2d93cadea5a8262", + "transformation": "exact proposal bytes copied without semantic changes" + }, + { + "bytes": 6381, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/test_v03_prefix_supervisor_v1.py", + "sha256": "b5f8055da6f9a48e85a4eed0868f7076859adca317e0691e5b2336e0bdb58d52", + "transformation": "exact proposal bytes copied without semantic changes" + }, + { + "bytes": 6087, + "original_path": "outputs/c05-v03-completion-20261102T055710Z/implementation/v03_integrated_constructor_v1.py", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_integrated_constructor_v1.py", + "sha256": "5e08ff84298fe1249be5e8790ea259e6179048f4736fb7eafdb6e170b8bc1cf9", + "transformation": "exact final reviewed Unit01 new pure component copy" + }, + { + "bytes": 14205, + "original_path": "outputs/c05-v03-completion-20261102T055710Z/implementation/v03_source_refusal_observer_v1.py", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_source_refusal_observer_v1.py", + "sha256": "abf25690d3bee4a9783ee504567c29f7fb47da670e0ec95f57cb5944bf57264f", + "transformation": "exact final reviewed Unit01 new pure component copy" + } + ], + "runtime_qualified": false, + "schema": "unit05-exact-initial-assembly-v1", + "tests_executed_yet": false +} diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/fixtures/PROPOSAL-TESTS-v1-normal.txt b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/fixtures/PROPOSAL-TESTS-v1-normal.txt new file mode 100644 index 0000000000..8672dfe50c --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/fixtures/PROPOSAL-TESTS-v1-normal.txt @@ -0,0 +1,18 @@ +test_existing_primary_identity (unit05_exact_new_proposal_tests.AccessorTests.test_existing_primary_identity) ... ok +test_intact_exit1_predicate (unit05_exact_new_proposal_tests.AccessorTests.test_intact_exit1_predicate) ... ok +test_invalid_early_call_keeps_cleanup_phase (unit05_exact_new_proposal_tests.AccessorTests.test_invalid_early_call_keeps_cleanup_phase) ... ok +test_late_owned_child (unit05_exact_new_proposal_tests.AccessorTests.test_late_owned_child) ... ok +test_local_primary_identity (unit05_exact_new_proposal_tests.AccessorTests.test_local_primary_identity) ... ok +test_other_exit_dispositions (unit05_exact_new_proposal_tests.AccessorTests.test_other_exit_dispositions) ... ok +test_unclosed_fd (unit05_exact_new_proposal_tests.AccessorTests.test_unclosed_fd) ... ok +test_complete_observer_selected (unit05_exact_new_proposal_tests.SourceStructureTests.test_complete_observer_selected) ... ok +test_source_gates_remain_none (unit05_exact_new_proposal_tests.SourceStructureTests.test_source_gates_remain_none) ... ok +test_supervisor_has_no_mint_call (unit05_exact_new_proposal_tests.SourceStructureTests.test_supervisor_has_no_mint_call) ... ok + +---------------------------------------------------------------------- +Ran 10 tests in 0.088s + +OK +ISOLATION: exact new tests; only new accessor AST executed; synthetic state/functions; no original runtime imports +FIXTURE_IMPORTS: ast,copy,pathlib,types,unittest +ACTUAL_OWNERSHIP_OR_NATIVE_OR_RUNTIME_ADMISSION: false diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/fixtures/PROPOSAL-TESTS-v1-optimized.txt b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/fixtures/PROPOSAL-TESTS-v1-optimized.txt new file mode 100644 index 0000000000..02a2b800d6 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/fixtures/PROPOSAL-TESTS-v1-optimized.txt @@ -0,0 +1,18 @@ +test_existing_primary_identity (unit05_exact_new_proposal_tests.AccessorTests.test_existing_primary_identity) ... ok +test_intact_exit1_predicate (unit05_exact_new_proposal_tests.AccessorTests.test_intact_exit1_predicate) ... ok +test_invalid_early_call_keeps_cleanup_phase (unit05_exact_new_proposal_tests.AccessorTests.test_invalid_early_call_keeps_cleanup_phase) ... ok +test_late_owned_child (unit05_exact_new_proposal_tests.AccessorTests.test_late_owned_child) ... ok +test_local_primary_identity (unit05_exact_new_proposal_tests.AccessorTests.test_local_primary_identity) ... ok +test_other_exit_dispositions (unit05_exact_new_proposal_tests.AccessorTests.test_other_exit_dispositions) ... ok +test_unclosed_fd (unit05_exact_new_proposal_tests.AccessorTests.test_unclosed_fd) ... ok +test_complete_observer_selected (unit05_exact_new_proposal_tests.SourceStructureTests.test_complete_observer_selected) ... ok +test_source_gates_remain_none (unit05_exact_new_proposal_tests.SourceStructureTests.test_source_gates_remain_none) ... ok +test_supervisor_has_no_mint_call (unit05_exact_new_proposal_tests.SourceStructureTests.test_supervisor_has_no_mint_call) ... ok + +---------------------------------------------------------------------- +Ran 10 tests in 0.083s + +OK +ISOLATION: exact new tests; only new accessor AST executed; synthetic state/functions; no original runtime imports +FIXTURE_IMPORTS: ast,copy,pathlib,types,unittest +ACTUAL_OWNERSHIP_OR_NATIVE_OR_RUNTIME_ADMISSION: false diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/fixtures/V1-REJECTION-v1.json b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/fixtures/V1-REJECTION-v1.json new file mode 100644 index 0000000000..39698074bc --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/fixtures/V1-REJECTION-v1.json @@ -0,0 +1,31 @@ +{ + "findings": [ + { + "finding": "Unit01 constructor NATIVE_ENV is dict with bytes keys; original closure _data rejects dict keys not exact str/int, so proposed receiver capture cannot succeed", + "id": "U05-R01", + "original_function_executed_to_prove": false, + "reviewer": "c05_component_review", + "source_anchors": [ + "v03_integrated_constructor_v1.py:13-17", + "parent_closure_v1.py original _data:98-116 and capture:209-220" + ] + }, + { + "finding": "make_prefix_owner requires outer configuration.plan blob among decoded plan.source_files with identical hash/size/mode; this demands plan ownhash construction not supplied", + "id": "U05-R02", + "original_function_executed_to_prove": false, + "reviewer": "v03_source_route_review", + "source_anchors": [ + "v03_prefix_supervisor_v1.py original proposal:363-373" + ] + } + ], + "new_proposal_tests": "10PASS normal and-O; not sufficient for source acceptance", + "original_execution": false, + "repair_window": [ + "2026-11-02T11:07:10.897421Z", + "2026-11-02T11:22:10.897421Z" + ], + "schema": "unit05-v1-independent-source-rejections", + "semantic_repairs_applied_at_capture": false +} diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/fixtures/run_proposal_pure_tests_v1.py b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/fixtures/run_proposal_pure_tests_v1.py new file mode 100644 index 0000000000..9f273553e5 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/fixtures/run_proposal_pure_tests_v1.py @@ -0,0 +1,70 @@ +"""Run the exact new proposal tests with path fixtures, never original imports. + +Only the appended accessor body is compiled by the supplied extractor. All of +its external functions/state are explicit synthetic fixtures in that test file. +No full supervisor, domain, closure, parent, installer or native call executes. +""" +import ast +import builtins +import hashlib +from pathlib import Path +import sys +import types +import unittest + +WORKSPACE=Path('/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453') +BASE=WORKSPACE/'outputs/c05-v03-completion-20261102T055710Z/unit05' +IMPL=BASE/'implementation' +EXPECTED='b5f8055da6f9a48e85a4eed0868f7076859adca317e0691e5b2336e0bdb58d52' +ALLOWED_IMPORTS={'ast','copy','pathlib','types','unittest'} +BLOCKED={'epoch_schema_v5','epoch_copy_v5','parent_domain_v1','parent_closure_v1', + 'parent_completion_v1','h25_parent_supervisor','group01_evidence_v1', + 'v03_prefix_supervisor_v1'} + + +def main(): + raw=(IMPL/'test_v03_prefix_supervisor_v1.py').read_bytes() + if hashlib.sha256(raw).hexdigest()!=EXPECTED:raise ValueError('exact proposal fixture pin differs') + tree=ast.parse(raw,feature_version=(3,12)) + for node in ast.walk(tree): + if isinstance(node,ast.Import): + if any(alias.name not in ALLOWED_IMPORTS for alias in node.names):raise ValueError('new fixture import boundary') + elif isinstance(node,ast.ImportFrom) and node.module not in ALLOWED_IMPORTS: + raise ValueError('new fixture from-import boundary') + domain=(IMPL/'parent_domain_v1.py').read_bytes() + parsed=ast.parse(domain,feature_version=(3,12)) + matches=[node for node in parsed.body if type(node) is ast.FunctionDef and node.name=='prefix_exit1_terminal_facts'] + if len(matches)!=1:raise ValueError('unique new accessor required') + fragment=(BASE/'proposal/domain-prefix-accessor.py.fragment').read_bytes() + proposed=ast.parse(fragment,feature_version=(3,12)).body + if len(proposed)!=1 or ast.dump(matches[0],include_attributes=False)!=ast.dump(proposed[0],include_attributes=False): + raise ValueError('only exact newly authored accessor may execute') + if any(isinstance(n,(ast.Import,ast.ImportFrom)) for n in ast.walk(matches[0])): + raise ValueError('accessor fixture unexpectedly imports') + if BLOCKED & set(sys.modules):raise ValueError('original runtime module already imported') + imported=[] + real_import=builtins.__import__ + def fixture_import(name,globals=None,locals=None,fromlist=(),level=0): + if level or name not in ALLOWED_IMPORTS:raise ValueError('fixture attempted disallowed import') + imported.append(name) + return real_import(name,globals,locals,fromlist,level) + module=types.ModuleType('unit05_exact_new_proposal_tests') + scope=dict(vars(builtins));scope['__import__']=fixture_import + module.__dict__['__builtins__']=scope + exec(compile(raw,'','exec'),module.__dict__) + # Explicit path fixture only; copied proposal bytes are not rewritten. + def fixture_path(value): + if value not in ('parent_domain_v1.py','v03_prefix_supervisor_v1.py'): + raise ValueError('unexpected fixture path') + return IMPL/value + module.Path=fixture_path + suite=unittest.defaultTestLoader.loadTestsFromModule(module) + result=unittest.TextTestRunner(verbosity=2).run(suite) + if BLOCKED & set(sys.modules):raise ValueError('original runtime import boundary violated') + print('ISOLATION: exact new tests; only new accessor AST executed; synthetic state/functions; no original runtime imports') + print('FIXTURE_IMPORTS: '+','.join(imported)) + print('ACTUAL_OWNERSHIP_OR_NATIVE_OR_RUNTIME_ADMISSION: false') + raise SystemExit(0 if result.wasSuccessful() else 1) + + +if __name__=='__main__':main() diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/epoch_copy_v5.py b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/epoch_copy_v5.py new file mode 100644 index 0000000000..0573ab23a5 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/epoch_copy_v5.py @@ -0,0 +1,1897 @@ +"""Bounded exclusive copy source with opaque error ownership; never executed here.""" +import hashlib +import os +import stat +import epoch_schema_v5 as schema + +COPY_CONFIGURATION = None +COPY_EXECUTION_APPROVAL = None +COPY_FUNDING = None +_TYPE, _LEN = type, len +_OPEN, _CLOSE, _READ, _WRITE = os.open, os.close, os.read, os.write +_FSTAT, _STAT, _LSEEK, _FSYNC = os.fstat, os.stat, os.lseek, os.fsync +_SCANDIR, _STAT_RESULT = os.scandir, os.stat_result + + +def _gate() -> None: + schema.exact(COPY_CONFIGURATION, ('leaf_policy_sha256', 'configuration_sha256', 'scandir_release_premise_sha256')) + schema.exact(COPY_EXECUTION_APPROVAL, ('external_launch_policy_sha256',)) + schema.exact(COPY_FUNDING, ('reservation_sha256',)) + for values in (COPY_CONFIGURATION, COPY_EXECUTION_APPROVAL, COPY_FUNDING): + for value in values.values(): + schema.digest(value) + + +def _fd(value) -> None: + schema.integer(value, 0, (1 << 31) - 1) + + +def _identity(info) -> dict: + schema.need(_TYPE(info) is _STAT_RESULT, 'exact native stat result required') + row = dict(zip(schema.IDENTITY_KEYS, (info.st_dev, info.st_ino, info.st_mode, info.st_nlink, + info.st_uid, info.st_gid, info.st_size, info.st_mtime_ns, info.st_ctime_ns))) + for value in row.values(): + schema.integer(value, 0, (1 << 127) - 1) + return row + + + + + +def _parent(path: str, owner, fd_slots: list, destination: int) -> str: + """Fill the caller-owned slot; caller's finally owns all five slots. + + No descriptor tuple crosses the helper return boundary. The fifth slot + owns the next ancestor until its transfer; any helper-entry/body failure + leaves all known descriptors reachable to the caller's inline cleanup. + """ + schema.path(path) + _state = schema.owner_state(owner) + _primary, _secondary, _phases, _uncertain = _state[0], _state[1], _state[2], _state[3] + _counts, _overflow, _io = _state[4], _state[5], _state[7] + _attempt_digits, _confirmed_digits = _io[7], _io[8] + _successors = schema.CUSTODY_SUCCESSORS + _quarantine_error = schema.IO_QUARANTINE_ERROR + _base_error, _close_native = BaseException, _CLOSE + _error_index = _digit = 0 + _owned_fd = _close_error = _acquisition_error = None + cleanup_primary = operation_primary = None + schema.need(_TYPE(fd_slots) is list and _LEN(fd_slots) == 5, 'internal FD slots differ') + schema.integer(destination, 0, 3) + schema.need(fd_slots[destination] is None and fd_slots[4] is None, 'parent slots already owned') + parts = path.split('/') + name = parts[-1] + flags = os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW | os.O_DIRECTORY + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + fd_slots[destination] = _OPEN('/', flags) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + _fd(fd_slots[destination]) + for part in parts[1:-1]: + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + fd_slots[4] = _OPEN(part, flags, dir_fd=fd_slots[destination]) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + _fd(fd_slots[4]) + previous = fd_slots[destination] + fd_slots[destination] = fd_slots[4] + fd_slots[4] = None + _owned_fd = previous + previous = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + if cleanup_primary is not None: + raise cleanup_primary + return name + +def _hash_fd(descriptor: int, limit: int) -> tuple[str, int]: + _fd(descriptor) + schema.integer(limit, 0, schema.FILE_BYTES) + digest, total, read_calls = hashlib.sha256(), 0, 0 + position = _LSEEK(descriptor, 0, os.SEEK_SET) + schema.integer(position, 0, 0) + while True: + read_calls += 1 + schema.need(read_calls <= schema.MAX_READ_CALLS, 'hash read-call bound exceeded') + raw = _READ(descriptor, min(schema.CHUNK_BYTES, limit + 1 - total)) + schema.need(_TYPE(raw) is bytes, 'native read returned foreign data') + if _LEN(raw) == 0: + break + total += _LEN(raw) + schema.need(total <= limit, 'file exceeds copy/hash bound') + digest.update(raw) + return digest.hexdigest(), total + + +def inspect(path: str, limit: int = schema.FILE_BYTES, *, error_owner) -> dict: + schema.owner_state(error_owner) + schema.path(path) + schema.integer(limit, 0, schema.FILE_BYTES) + _gate() + _state = schema.owner_state(error_owner) + _primary, _secondary, _phases, _uncertain = _state[0], _state[1], _state[2], _state[3] + _counts, _overflow, _io = _state[4], _state[5], _state[7] + _attempt_digits, _confirmed_digits = _io[7], _io[8] + _successors = schema.CUSTODY_SUCCESSORS + _quarantine_error = schema.IO_QUARANTINE_ERROR + _base_error, _close_native = BaseException, _CLOSE + _error_index = _digit = 0 + _owned_fd = _close_error = _acquisition_error = None + cleanup_primary = operation_primary = None + _fd_slots = [None] * 5 + _iterator = _owned_iterator = None + try: + name = _parent(path, error_owner, _fd_slots, 1) + parent = _fd_slots[1] + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + _fd_slots[0] = _OPEN(name, os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=parent) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + descriptor = _fd_slots[0] + _fd(descriptor) + before = _identity(_FSTAT(descriptor)) + schema.need(stat.S_ISREG(before['mode']) and before['links'] == 1 and before['size'] <= limit, + 'file kind/link/size differs') + digest, count = _hash_fd(descriptor, limit) + after = _identity(_FSTAT(descriptor)) + named = _identity(_STAT(name, dir_fd=parent, follow_symlinks=False)) + schema.need(before == after == named and count == before['size'], 'file changed during bounded snapshot') + result = {'path': path, 'sha256': digest, 'bytes': count, 'identity': after} + schema.blob(result, limit) + return result + except _base_error as operation_error: + operation_primary = operation_error + if _primary[0] is None: + _primary[0] = operation_error + _primary[1] = 'inspect' + _primary[2] = None + elif _primary[0] is not operation_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = operation_error + _phases[_error_index] = 'inspect' + _uncertain[_error_index] = None + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = operation_error + raise + finally: + _owned_fd = _fd_slots[0] + _fd_slots[0] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[1] + _fd_slots[1] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[2] + _fd_slots[2] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[3] + _fd_slots[3] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[4] + _fd_slots[4] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + if operation_primary is None and cleanup_primary is not None: + raise cleanup_primary + +def verify(expected: dict, limit: int = schema.FILE_BYTES, *, error_owner) -> None: + schema.owner_state(error_owner) + schema.blob(expected, limit) + schema.need(inspect(expected['path'], limit, error_owner=error_owner) == expected, + 'current source/store custody differs') + + +def copy_once(source: dict, destination: str, occupied_inodes: tuple, *, error_owner) -> dict: + schema.owner_state(error_owner) + schema.blob(source) + schema.path(destination) + schema.need(_TYPE(occupied_inodes) is tuple and _LEN(occupied_inodes) <= 51, 'inode collection differs') + for pair in occupied_inodes: + schema.need(_TYPE(pair) is tuple and _LEN(pair) == 2, 'inode pair differs') + schema.integer(pair[0], 0, (1 << 127) - 1) + schema.integer(pair[1], 1, (1 << 127) - 1) + schema.need(source['path'] != destination, 'copy path aliases source') + _gate() + verify(source, error_owner=error_owner) + _state = schema.owner_state(error_owner) + _primary, _secondary, _phases, _uncertain = _state[0], _state[1], _state[2], _state[3] + _counts, _overflow, _io = _state[4], _state[5], _state[7] + _attempt_digits, _confirmed_digits = _io[7], _io[8] + _successors = schema.CUSTODY_SUCCESSORS + _quarantine_error = schema.IO_QUARANTINE_ERROR + _base_error, _close_native = BaseException, _CLOSE + _error_index = _digit = 0 + _owned_fd = _close_error = _acquisition_error = None + cleanup_primary = operation_primary = None + _fd_slots = [None] * 5 + _iterator = _owned_iterator = None + try: + source_name = _parent(source['path'], error_owner, _fd_slots, 3) + source_parent = _fd_slots[3] + target_name = _parent(destination, error_owner, _fd_slots, 2) + target_parent = _fd_slots[2] + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + _fd_slots[1] = _OPEN(source_name, os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=source_parent) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + source_fd = _fd_slots[1] + _fd(source_fd) + before = _identity(_FSTAT(source_fd)) + schema.need(before == source['identity'], 'source changed before copy') + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + _fd_slots[0] = _OPEN(target_name, os.O_RDWR | os.O_CREAT | os.O_EXCL | os.O_CLOEXEC | os.O_NOFOLLOW, 0o600, dir_fd=target_parent) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + target_fd = _fd_slots[0] + _fd(target_fd) + initial = _identity(_FSTAT(target_fd)) + schema.need(stat.S_ISREG(initial['mode']) and initial['links'] == 1 and initial['size'] == 0 and + stat.S_IMODE(initial['mode']) == 0o600 and + (initial['device'], initial['inode']) not in occupied_inodes and + (initial['device'], initial['inode']) != schema.inode(source), 'exclusive destination alias') + digest, count, write_calls, read_calls = hashlib.sha256(), 0, 0, 0 + while True: + read_calls += 1 + schema.need(read_calls <= schema.MAX_READ_CALLS, 'copy read-call bound exceeded') + raw = _READ(source_fd, min(schema.CHUNK_BYTES, source['bytes'] + 1 - count)) + schema.need(_TYPE(raw) is bytes, 'native copy read returned foreign data') + if _LEN(raw) == 0: + break + count += _LEN(raw) + schema.need(count <= source['bytes'], 'source grew during copy') + digest.update(raw) + offset = 0 + while offset < _LEN(raw): + write_calls += 1 + schema.need(write_calls <= schema.MAX_WRITE_CALLS, 'copy write-call bound exceeded') + written = _WRITE(target_fd, raw[offset:]) + schema.integer(written, 1, _LEN(raw) - offset) + offset += written + schema.need(count == source['bytes'] and digest.hexdigest() == source['sha256'] and + _identity(_FSTAT(source_fd)) == source['identity'] and + _identity(_STAT(source_name, dir_fd=source_parent, follow_symlinks=False)) == source['identity'], + 'copy source custody/bytes differ') + _FSYNC(target_fd) + _FSYNC(target_parent) + before_readback = _identity(_FSTAT(target_fd)) + read_sha, read_size = _hash_fd(target_fd, schema.FILE_BYTES) + after = _identity(_FSTAT(target_fd)) + named = _identity(_STAT(target_name, dir_fd=target_parent, follow_symlinks=False)) + schema.need(read_sha == source['sha256'] and read_size == source['bytes'] and after['links'] == 1 and + (after['device'], after['inode']) == (initial['device'], initial['inode']) and + before_readback == after == named, 'destination readback/custody differs') + result = {'path': destination, 'sha256': read_sha, 'bytes': read_size, 'identity': after} + schema.blob(result) + verify(source, error_owner=error_owner) + schema.need(inspect(destination, error_owner=error_owner) == result, 'destination path changed after copy') + return result + except _base_error as operation_error: + operation_primary = operation_error + if _primary[0] is None: + _primary[0] = operation_error + _primary[1] = 'copy_once' + _primary[2] = None + elif _primary[0] is not operation_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = operation_error + _phases[_error_index] = 'copy_once' + _uncertain[_error_index] = None + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = operation_error + raise + finally: + _owned_fd = _fd_slots[0] + _fd_slots[0] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[1] + _fd_slots[1] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[2] + _fd_slots[2] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[3] + _fd_slots[3] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[4] + _fd_slots[4] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + if operation_primary is None and cleanup_primary is not None: + raise cleanup_primary + +def write_once(path: str, raw: bytes, *, error_owner) -> dict: + schema.owner_state(error_owner) + schema.path(path) + schema.need(_TYPE(raw) is bytes, 'exact record bytes required') + schema.need(0 < _LEN(raw) <= schema.RECORD_BYTES, 'record bound differs') + _gate() + _state = schema.owner_state(error_owner) + _primary, _secondary, _phases, _uncertain = _state[0], _state[1], _state[2], _state[3] + _counts, _overflow, _io = _state[4], _state[5], _state[7] + _attempt_digits, _confirmed_digits = _io[7], _io[8] + _successors = schema.CUSTODY_SUCCESSORS + _quarantine_error = schema.IO_QUARANTINE_ERROR + _base_error, _close_native = BaseException, _CLOSE + _error_index = _digit = 0 + _owned_fd = _close_error = _acquisition_error = None + cleanup_primary = operation_primary = None + _fd_slots = [None] * 5 + _iterator = _owned_iterator = None + try: + name = _parent(path, error_owner, _fd_slots, 1) + parent = _fd_slots[1] + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + _fd_slots[0] = _OPEN(name, os.O_RDWR | os.O_CREAT | os.O_EXCL | os.O_CLOEXEC | os.O_NOFOLLOW, 0o600, dir_fd=parent) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + descriptor = _fd_slots[0] + _fd(descriptor) + initial = _identity(_FSTAT(descriptor)) + schema.need(stat.S_ISREG(initial['mode']) and initial['links'] == 1 and initial['size'] == 0 and + stat.S_IMODE(initial['mode']) == 0o600, 'exclusive record file differs') + offset, calls = 0, 0 + while offset < _LEN(raw): + calls += 1 + schema.need(calls <= schema.MAX_RECORD_WRITE_CALLS, 'record write-call bound exceeded') + written = _WRITE(descriptor, raw[offset:offset + schema.CHUNK_BYTES]) + schema.integer(written, 1, min(schema.CHUNK_BYTES, _LEN(raw) - offset)) + offset += written + _FSYNC(descriptor) + _FSYNC(parent) + owned = _identity(_FSTAT(descriptor)) + result = inspect(path, schema.RECORD_BYTES, error_owner=error_owner) + schema.need(result['identity'] == owned and + (owned['device'], owned['inode']) == (initial['device'], initial['inode']) and + result['sha256'] == schema.sha(raw) and result['bytes'] == _LEN(raw), 'record readback differs') + return result + except _base_error as operation_error: + operation_primary = operation_error + if _primary[0] is None: + _primary[0] = operation_error + _primary[1] = 'write_once' + _primary[2] = None + elif _primary[0] is not operation_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = operation_error + _phases[_error_index] = 'write_once' + _uncertain[_error_index] = None + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = operation_error + raise + finally: + _owned_fd = _fd_slots[0] + _fd_slots[0] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[1] + _fd_slots[1] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[2] + _fd_slots[2] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[3] + _fd_slots[3] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[4] + _fd_slots[4] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + if operation_primary is None and cleanup_primary is not None: + raise cleanup_primary + +def read_verified(expected: dict, limit: int = schema.RECORD_BYTES, *, error_owner) -> bytes: + schema.owner_state(error_owner) + schema.integer(limit, 1, schema.RAW_RESULT_BYTES) + schema.blob(expected, limit) + _gate() + verify(expected, limit, error_owner=error_owner) + _state = schema.owner_state(error_owner) + _primary, _secondary, _phases, _uncertain = _state[0], _state[1], _state[2], _state[3] + _counts, _overflow, _io = _state[4], _state[5], _state[7] + _attempt_digits, _confirmed_digits = _io[7], _io[8] + _successors = schema.CUSTODY_SUCCESSORS + _quarantine_error = schema.IO_QUARANTINE_ERROR + _base_error, _close_native = BaseException, _CLOSE + _error_index = _digit = 0 + _owned_fd = _close_error = _acquisition_error = None + cleanup_primary = operation_primary = None + _fd_slots = [None] * 5 + _iterator = _owned_iterator = None + try: + name = _parent(expected['path'], error_owner, _fd_slots, 1) + parent = _fd_slots[1] + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + _fd_slots[0] = _OPEN(name, os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=parent) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + descriptor = _fd_slots[0] + _fd(descriptor) + schema.need(_identity(_FSTAT(descriptor)) == expected['identity'], 'evidence changed before read') + chunks, count, calls = [], 0, 0 + while True: + calls += 1 + schema.need(calls <= schema.MAX_READ_CALLS, 'evidence read-call bound exceeded') + raw = _READ(descriptor, min(schema.CHUNK_BYTES, limit + 1 - count)) + schema.need(_TYPE(raw) is bytes, 'native evidence read returned foreign data') + if _LEN(raw) == 0: + break + count += _LEN(raw) + schema.need(count <= limit, 'evidence byte bound exceeded') + chunks.append(raw) + result = b''.join(chunks) + schema.need(count == expected['bytes'] and schema.sha(result) == expected['sha256'] and + _identity(_FSTAT(descriptor)) == expected['identity'] and + _identity(_STAT(name, dir_fd=parent, follow_symlinks=False)) == expected['identity'], + 'retained evidence bytes/custody differ') + verify(expected, limit, error_owner=error_owner) + return result + except _base_error as operation_error: + operation_primary = operation_error + if _primary[0] is None: + _primary[0] = operation_error + _primary[1] = 'read_verified' + _primary[2] = None + elif _primary[0] is not operation_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = operation_error + _phases[_error_index] = 'read_verified' + _uncertain[_error_index] = None + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = operation_error + raise + finally: + _owned_fd = _fd_slots[0] + _fd_slots[0] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[1] + _fd_slots[1] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[2] + _fd_slots[2] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[3] + _fd_slots[3] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[4] + _fd_slots[4] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + if operation_primary is None and cleanup_primary is not None: + raise cleanup_primary + +def require_entries(directory: str, expected_names: tuple[str, ...], *, error_owner) -> None: + schema.owner_state(error_owner) + schema.path(directory) + schema.need(_TYPE(expected_names) is tuple and _LEN(expected_names) <= 7, 'census tuple differs') + # Validate all names before hashing, equality, membership, or set creation. + for name in expected_names: + schema.text(name, 256) + schema.need(0 < _LEN(name) and '/' not in name and name not in ('.', '..'), 'census name differs') + schema.need(_LEN(set(expected_names)) == _LEN(expected_names), 'duplicate census name') + _gate() + _state = schema.owner_state(error_owner) + _primary, _secondary, _phases, _uncertain = _state[0], _state[1], _state[2], _state[3] + _counts, _overflow, _io = _state[4], _state[5], _state[7] + _attempt_digits, _confirmed_digits = _io[7], _io[8] + _successors = schema.CUSTODY_SUCCESSORS + _quarantine_error = schema.IO_QUARANTINE_ERROR + _base_error, _close_native = BaseException, _CLOSE + _error_index = _digit = 0 + _owned_fd = _close_error = _acquisition_error = None + cleanup_primary = operation_primary = None + _fd_slots = [None] * 5 + _iterator = _owned_iterator = None + try: + name = _parent(directory, error_owner, _fd_slots, 1) + parent = _fd_slots[1] + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + _fd_slots[0] = _OPEN(name, os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW | os.O_DIRECTORY, dir_fd=parent) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + descriptor = _fd_slots[0] + _fd(descriptor) + before = _identity(_FSTAT(descriptor)) + schema.need(stat.S_ISDIR(before['mode']), 'copy root is not a directory') + names = [] + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + _iterator = _SCANDIR(descriptor) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + for entry in _iterator: + # Exact native entry guard remains before its attribute access. + schema.need(_TYPE(entry) is os.DirEntry, 'native directory entry type differs') + entry_name = entry.name + schema.text(entry_name, 256) + names.append(entry_name) + schema.need(_LEN(names) <= 7, 'copy root entry bound exceeded') + _owned_iterator = _iterator + _iterator = None + if _owned_iterator is not None: + try: + _owned_iterator.close() + except _base_error as _close_error: + if _io[5] is None: + _io[5] = _owned_iterator + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'scandir-close' + _primary[2] = None + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'scandir-close' + _uncertain[_error_index] = None + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + # A normal/no-op return after a delivered body error cannot + # invoke the selected release premise or clear uncertainty. + if operation_primary is None and not _io[0] and _io[5] is None: + _io[9] = True + _io[4] = True + if cleanup_primary is not None: + raise cleanup_primary + schema.need(set(names) == set(expected_names) and before == _identity(_FSTAT(descriptor)) == + _identity(_STAT(name, dir_fd=parent, follow_symlinks=False)), 'copy root entries/custody differ') + except _base_error as operation_error: + operation_primary = operation_error + # Any body failure may follow an ignored closedir result, including + # iterator OSError/MemoryError before an explicit close becomes a no-op. + # Root the exact error first; quarantine and retain stream uncertainty + # before cleanup or any optional helper/reporting can run. + _io[0] = True + _io[4] = True + if _io[5] is None: + if _iterator is not None: + _io[5] = _iterator + elif _owned_iterator is not None: + _io[5] = _owned_iterator + if _primary[0] is None: + _primary[0] = operation_error + _primary[1] = 'require_entries' + _primary[2] = None + elif _primary[0] is not operation_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = operation_error + _phases[_error_index] = 'require_entries' + _uncertain[_error_index] = None + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = operation_error + raise + finally: + _owned_iterator = _iterator + _iterator = None + if _owned_iterator is not None: + try: + _owned_iterator.close() + except _base_error as _close_error: + if _io[5] is None: + _io[5] = _owned_iterator + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'scandir-close' + _primary[2] = None + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'scandir-close' + _uncertain[_error_index] = None + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + # A normal/no-op return after a delivered body error cannot + # invoke the selected release premise or clear uncertainty. + if operation_primary is None and not _io[0] and _io[5] is None: + _io[9] = True + _io[4] = True + _owned_fd = _fd_slots[0] + _fd_slots[0] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[1] + _fd_slots[1] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[2] + _fd_slots[2] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[3] + _fd_slots[3] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[4] + _fd_slots[4] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + if operation_primary is None and cleanup_primary is not None: + raise cleanup_primary \ No newline at end of file diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/epoch_schema_v5.py b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/epoch_schema_v5.py new file mode 100644 index 0000000000..b95c2385a9 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/epoch_schema_v5.py @@ -0,0 +1,676 @@ +"""Finite negative-only data records. No import/load/compile/runtime authority. + +Source draft: no target execution has been authorized. These functions are not +run during source checks. Every caller must be a separately reviewed fixed +parent/child source; JSON never creates a parent capability. +""" +import hashlib +import json + +SCHEMA = 'h25-negative-build-epoch-v3' +CLAIM_SCHEMA = 'h25-negative-import-claim-v3' +ROLES = ('production', 'watcher', 'bounds', 'pyinit_failure', 'exec_failure') +PRODUCERS = ('group01', 'failure_variants') +GROUPS = ('02', '03', '04', '07', '08', '09', '10', '11', '12', '13', '14', '15', '16') +PROFILE_KEYS = ('source_manifest_sha256', 'project_headers_sha256', 'system_headers_sha256', + 'compiler_link_sha256', 'link_profile_sha256') +LAUNCH_KEYS = ('configuration_sha256', 'root_sha256', 'stage_sha256', 'command_sha256', + 'startup_tcb_sha256', 'expected_history_sha256') +FILE_BYTES = 64 * 1024 * 1024 +RECORD_BYTES = 1024 * 1024 +RAW_RESULT_BYTES = 4 * 1024 * 1024 +LOG_BYTES = 2 * 1024 * 1024 +JOURNAL_BYTES = 3 * 65536 +CHUNK_BYTES = 65536 +PATH_BYTES = 4096 +MAX_PATH_COMPONENTS = 64 +MAX_READ_CALLS = 8192 +MAX_WRITE_CALLS = 8192 +MAX_RECORD_WRITE_CALLS = 4096 +MAX_PRIVATE_COPIES = 41 +MAX_EXPORTS = 5 +MAX_EPOCH_FILE_BYTES = 46 * FILE_BYTES +IDENTITY_KEYS = ('device', 'inode', 'mode', 'links', 'uid', 'gid', 'size', 'mtime_ns', 'ctime_ns') + + +# Captured before any adverse input. Actual startup primitive/source admission +# is still required by the future caller; no module is imported in source work. +_TYPE, _LEN = type, len +_DICT, _LIST, _TUPLE, _STR, _INT, _BOOL, _BYTES = dict, list, tuple, str, int, bool, bytes +MAX_RECORD_KEYS = 256 +MAX_SEQUENCE = 256 +MAX_WIRE_NODES = 8192 +MAX_WIRE_DEPTH = 24 +MAX_WIRE_TEXT = 8192 +MAX_WIRE_TEXT_TOTAL = 512 * 1024 + + +class EpochStop(RuntimeError): + """Literal bounded source error; original foreign failures remain opaque.""" + + +def need(condition: bool, message: str) -> None: + # No truth testing or formatting of an unknown object. + if _TYPE(message) is not _STR or _LEN(message) > 256: + raise EpochStop('invalid internal error literal') + if condition is not True: + raise EpochStop(message) + + +def exact(value: dict, keys: tuple[str, ...]) -> None: + need(_TYPE(value) is _DICT, 'exact record type differs') + need(_LEN(value) <= MAX_RECORD_KEYS, 'record cardinality bound exceeded') + need(_TYPE(keys) is _TUPLE, 'exact expected key tuple differs') + need(_LEN(keys) <= MAX_RECORD_KEYS, 'expected key cardinality bound exceeded') + # Iteration over an exact dict does not hash its keys. Complete this walk + # before membership, set creation, or any value lookup in that dictionary. + for key in value: + need(_TYPE(key) is _STR, 'foreign record key rejected') + need(_LEN(key) <= MAX_WIRE_TEXT, 'record key length bound exceeded') + for key in keys: + need(_TYPE(key) is _STR, 'foreign expected key rejected') + need(_LEN(key) <= MAX_WIRE_TEXT, 'expected key length bound exceeded') + need(_LEN(value) == _LEN(keys), 'exact record keys differ') + seen = set() + for key in keys: + need(key not in seen, 'duplicate expected key') + seen.add(key) + for key in value: + need(key in seen, 'exact record keys differ') + + +def integer(value: int, lower: int, upper: int) -> None: + need(_TYPE(value) is _INT and _TYPE(lower) is _INT and _TYPE(upper) is _INT, + 'exact integer type differs') + need(lower <= value <= upper, 'bounded exact integer differs') + + +def boolean(value: bool) -> None: + need(_TYPE(value) is _BOOL, 'exact boolean type differs') + + +def text(value: str, limit: int = MAX_WIRE_TEXT) -> None: + need(_TYPE(value) is _STR and _TYPE(limit) is _INT, 'exact text/limit type differs') + need(0 <= limit <= MAX_WIRE_TEXT and _LEN(value) <= limit, 'text bound exceeded') + + +def choice(value: str, choices: tuple[str, ...]) -> None: + text(value) + need(_TYPE(choices) is _TUPLE and _LEN(choices) <= MAX_SEQUENCE, 'choice tuple differs') + for item in choices: + text(item) + need(value in choices, 'literal choice differs') + + +def sequence(value: list, count: int) -> None: + need(_TYPE(value) is _LIST and _TYPE(count) is _INT, 'exact sequence type differs') + need(0 <= count <= MAX_SEQUENCE and _LEN(value) == count, 'exact sequence count differs') + + +def digest(value: str) -> None: + text(value, 64) + need(_LEN(value) == 64 and all(c in '0123456789abcdef' for c in value), 'sha256 differs') + + +def label(value: str) -> None: + text(value, 96) + need(1 <= _LEN(value) <= 96 and + all(c in 'abcdefghijklmnopqrstuvwxyz0123456789-' for c in value), 'label differs') + + +def path(value: str) -> None: + text(value, PATH_BYTES) + need(1 < _LEN(value) <= PATH_BYTES and value.isascii() and value.startswith('/'), + 'canonical absolute path differs') + parts = value.split('/')[1:] + need(_LEN(parts) <= MAX_PATH_COMPONENTS and + all(p not in ('', '.', '..') for p in parts) and + all(32 <= ord(c) <= 126 for c in value), 'canonical absolute path differs') + + +def _plain(value, depth: int, budget: list): + # depth and budget are newly created private native values, never inputs. + budget[0] += 1 + need(budget[0] <= MAX_WIRE_NODES and depth <= MAX_WIRE_DEPTH, 'plain record node/depth bound') + kind = _TYPE(value) + if value is None or kind is _BOOL: + return value + if kind is _STR: + need(_LEN(value) <= MAX_WIRE_TEXT, 'plain text bound') + budget[1] += _LEN(value) + need(budget[1] <= MAX_WIRE_TEXT_TOTAL, 'plain total text bound') + return value + if kind is _INT: + need(-(1 << 127) <= value < (1 << 127), 'plain integer bound') + return value + if kind is _DICT: + need(_LEN(value) <= MAX_RECORD_KEYS, 'plain dictionary bound') + for key in value: + need(_TYPE(key) is _STR, 'plain foreign dictionary key') + need(_LEN(key) <= MAX_WIRE_TEXT, 'plain dictionary key bound') + result = {} + for key, item in value.items(): + budget[1] += _LEN(key) + need(budget[1] <= MAX_WIRE_TEXT_TOTAL, 'plain total key text bound') + result[key] = _plain(item, depth + 1, budget) + return result + if kind is _LIST or kind is _TUPLE: + need(_LEN(value) <= MAX_SEQUENCE, 'plain sequence bound') + return [_plain(item, depth + 1, budget) for item in value] + raise EpochStop('foreign plain-record value rejected') + + +def plain_copy(value): + """Bounded callback-free native copy before any codec/equality use.""" + return _plain(value, 0, [0, 0]) + + +def required_roles(group: str) -> tuple[str, ...]: + text(group, 2) + need(group in GROUPS, 'positive/non-native/unknown group cannot import') + return ROLES[:3] + (('pyinit_failure',) if group == '13' else + ('exec_failure',) if group == '14' else ()) + + +def profile(value: dict) -> None: + exact(value, PROFILE_KEYS) + for key in PROFILE_KEYS: + digest(value[key]) + + +def launch(value: dict) -> None: + exact(value, LAUNCH_KEYS) + for key in LAUNCH_KEYS: + digest(value[key]) + + +def blob(value: dict, limit: int = FILE_BYTES) -> None: + integer(limit, 0, FILE_BYTES) + exact(value, ('path', 'sha256', 'bytes', 'identity')) + path(value['path']) + digest(value['sha256']) + integer(value['bytes'], 0, limit) + identity = value['identity'] + exact(identity, IDENTITY_KEYS) + for key in IDENTITY_KEYS: + integer(identity[key], 0, (1 << 127) - 1) + need(identity['inode'] > 0 and identity['size'] == value['bytes'] and + identity['mode'] & 0o170000 == 0o100000 and identity['links'] == 1, + 'regular single-link file custody differs') + + +def inode(value: dict) -> tuple[int, int]: + blob(value) + return value['identity']['device'], value['identity']['inode'] + + +def canonical(value: dict) -> bytes: + need(_TYPE(value) is _DICT, 'canonical top-level exact dictionary required') + safe = plain_copy(value) + raw = json.dumps(safe, sort_keys=True, separators=(',', ':'), ensure_ascii=True, + allow_nan=False).encode('ascii') + b'\n' + need(_LEN(raw) <= RECORD_BYTES, 'record byte bound exceeded') + return raw + + +def sha(raw: bytes) -> str: + need(_TYPE(raw) is _BYTES, 'exact byte buffer required') + return hashlib.sha256(raw).hexdigest() + + +def _pairs(pairs: list) -> dict: + need(_TYPE(pairs) is _LIST and _LEN(pairs) <= MAX_RECORD_KEYS, 'decoded key count differs') + result = {} + for pair in pairs: + need(_TYPE(pair) is _TUPLE and _LEN(pair) == 2, 'decoded pair differs') + key, value = pair + text(key) + need(key not in result, 'duplicate JSON key') + result[key] = value + return result + + +def _reject_constant(value): + raise EpochStop('nonfinite JSON constant rejected') + + +def decode(raw: bytes) -> dict: + need(_TYPE(raw) is _BYTES, 'exact raw bytes required') + need(0 < _LEN(raw) <= RECORD_BYTES, 'raw record bound differs') + result = json.loads(raw.decode('ascii'), object_pairs_hook=_pairs, parse_constant=_reject_constant) + need(_TYPE(result) is _DICT, 'decoded top-level record differs') + safe = plain_copy(result) + need(canonical(safe) == raw, 'noncanonical record bytes') + return safe + + +def build(value: dict) -> None: + exact(value, ('role', 'producer_role', 'producer_generation', 'producer_stage_sha256', + 'command_sha256', 'profile', 'original_output', 'original_receipt', + 'attempt', 'journal', 'stdout', 'stderr')) + choice(value['role'], ROLES) + choice(value['producer_role'], PRODUCERS) + need((value['role'] in ROLES[:3]) == (value['producer_role'] == 'group01'), 'producer role swap') + label(value['producer_generation']) + digest(value['producer_stage_sha256']) + digest(value['command_sha256']) + profile(value['profile']) + blob(value['original_output']) + need(value['original_output']['bytes'] > 0, 'empty compiled artifact') + for key, bound in (('original_receipt', 65536), ('attempt', 65536), + ('journal', JOURNAL_BYTES), ('stdout', LOG_BYTES), ('stderr', LOG_BYTES)): + blob(value[key], bound) + + +def producer(value: dict) -> None: + exact(value, ('role', 'generation', 'stage_sha256', 'command_sha256', 'root_sha256', + 'terminal', 'raw_result', 'raw_groups', 'final_source_custody', + 'parent_observation', 'completion_checker_sha256', 'builds')) + choice(value['role'], PRODUCERS) + label(value['generation']) + for key in ('stage_sha256', 'command_sha256', 'root_sha256', 'completion_checker_sha256'): + digest(value[key]) + for key in ('terminal', 'raw_result', 'raw_groups', 'final_source_custody', 'parent_observation'): + blob(value[key], RAW_RESULT_BYTES) + roles = ROLES[:3] if value['role'] == 'group01' else ROLES[3:] + sequence(value['builds'], len(roles)) + for role, row in zip(roles, value['builds']): + build(row) + need(row['role'] == role and row['producer_role'] == value['role'] and + row['producer_generation'] == value['generation'] and + row['producer_stage_sha256'] == value['stage_sha256'], 'producer build binding differs') + + +def epoch(value: dict) -> None: + exact(value, ('schema', 'epoch_id', 'mode', 'publication_state', 'intent', 'producers', 'exports', + 'not_runtime_authority')) + text(value['schema']) + text(value['publication_state']) + boolean(value['not_runtime_authority']) + need(value['schema'] == SCHEMA and value['publication_state'] == 'COMMITTED' and + value['not_runtime_authority'] is True, 'epoch publication/schema/authority differs') + label(value['epoch_id']) + blob(value['intent'], RECORD_BYTES) + choice(value['mode'], ('normal', 'optimized')) + sequence(value['producers'], 2) + builds = [] + for role, row in zip(PRODUCERS, value['producers']): + producer(row) + need(row['role'] == role, 'producer order differs') + builds.extend(row['builds']) + need(value['producers'][0]['generation'] != value['producers'][1]['generation'], 'producer generation reused') + sequence(value['exports'], MAX_EXPORTS) + seen_paths, seen_inodes = set(), set() + for role, source, row in zip(ROLES, builds, value['exports']): + exact(row, ('role', 'build_sha256', 'file')) + digest(row['build_sha256']) + choice(row['role'], ROLES) + need(row['role'] == role and row['build_sha256'] == sha(canonical(source)), 'export build binding differs') + blob(row['file']) + need((row['file']['sha256'], row['file']['bytes']) == + (source['original_output']['sha256'], source['original_output']['bytes']), 'export bytes differ') + for record in (source['original_output'], row['file']): + need(record['path'] not in seen_paths and inode(record) not in seen_inodes, 'artifact/link alias') + seen_paths.add(record['path']) + seen_inodes.add(inode(record)) + + +def claim(value: dict, manifest: dict, expected_launch: dict, + expected_group: str, expected_generation: str, expected_private_directory: str) -> None: + epoch(manifest) + launch(expected_launch) + label(expected_generation) + path(expected_private_directory) + roles = required_roles(expected_group) + exact(value, ('schema', 'epoch_id', 'mode', 'group', 'generation', 'manifest_sha256', + 'launch', 'copies', 'local_compilations', 'not_runtime_authority', 'admission')) + text(value['schema']) + label(value['epoch_id']) + choice(value['mode'], ('normal', 'optimized')) + text(value['group'], 2) + label(value['generation']) + digest(value['manifest_sha256']) + integer(value['local_compilations'], 0, 0) + boolean(value['not_runtime_authority']) + text(value['admission']) + need(value['schema'] == CLAIM_SCHEMA and value['epoch_id'] == manifest['epoch_id'] and + value['mode'] == manifest['mode'] and value['group'] == expected_group and + value['generation'] == expected_generation and value['manifest_sha256'] == sha(canonical(manifest)), + 'claim independent epoch/mode/group/generation/manifest differs') + launch(value['launch']) + need(value['launch'] == expected_launch and type(value['local_compilations']) is int and + value['local_compilations'] == 0 and value['not_runtime_authority'] is True and + value['admission'] == 'CURRENT_CHILD_CHECKS_REQUIRED', 'claim authority/launch differs') + sequence(value['copies'], len(roles)) + export_by_role = {row['role']: row for row in manifest['exports']} + builds = [row for parent in manifest['producers'] for row in parent['builds']] + occupied_paths = {row['original_output']['path'] for row in builds} + occupied_inodes = {inode(row['original_output']) for row in builds} + occupied_paths.update(row['file']['path'] for row in manifest['exports']) + occupied_inodes.update(inode(row['file']) for row in manifest['exports']) + for role, row in zip(roles, value['copies']): + exact(row, ('role', 'build_sha256', 'source', 'destination')) + choice(row['role'], ROLES) + digest(row['build_sha256']) + blob(row['source']) + blob(row['destination']) + expected = export_by_role[role] + need(row['role'] == role and row['build_sha256'] == expected['build_sha256'] and + row['source'] == expected['file'], 'copy original source provenance differs') + dest = row['destination'] + need(dest['path'] == expected_private_directory + '/' + role + '.artifact', + 'private origin differs from independent launch') + need((dest['sha256'], dest['bytes']) == (row['source']['sha256'], row['source']['bytes']), + 'private copy bytes differ') + need(dest['path'] not in occupied_paths and inode(dest) not in occupied_inodes, 'private copy alias') + occupied_paths.add(dest['path']) + occupied_inodes.add(inode(dest)) + + +def imported_inputs(raw_manifest: bytes, raw_claim: bytes, expected_manifest_sha256: str, + expected_launch: dict, expected_group: str, expected_generation: str, + expected_private_directory: str) -> tuple: + """Validate data binding only. Child must still perform all original checks. + + Expected values must be supplied by independently pinned fresh launch source, + never from either JSON argument. This helper has no runtime admission state. + The negative Root must consume its one-attempt guard BEFORE invoking it. + """ + digest(expected_manifest_sha256) + need(sha(raw_manifest) == expected_manifest_sha256, 'independent parent manifest pin differs') + manifest, receipt = decode(raw_manifest), decode(raw_claim) + claim(receipt, manifest, expected_launch, expected_group, expected_generation, expected_private_directory) + return manifest, receipt + +# Opaque error/result custody. The owner never invokes a foreign object's +# string, equality, hash, attribute, metaclass, or formatting protocol. +ERROR_SLOTS = 64 +CASE_SLOTS = 64 +MAX_ERROR_ARGS = 2 +MAX_ERROR_ARG_CHARS = 256 +MAX_SECONDARY_PROJECTIONS = 6 +_BASE_ARGS_GET = BaseException.args.__get__ +_NATIVE_ERROR_LABELS = ( + (EpochStop, 'EPOCH_STOP'), (RuntimeError, 'RUNTIME_ERROR'), + (ValueError, 'VALUE_ERROR'), (TypeError, 'TYPE_ERROR'), + (OSError, 'OS_ERROR'), (FileNotFoundError, 'FILE_NOT_FOUND'), + (PermissionError, 'PERMISSION_ERROR'), (InterruptedError, 'INTERRUPTED_ERROR'), + (BlockingIOError, 'BLOCKING_IO_ERROR'), (MemoryError, 'MEMORY_ERROR'), + (KeyboardInterrupt, 'KEYBOARD_INTERRUPT'), (SystemExit, 'SYSTEM_EXIT'), + (OverflowError, 'OVERFLOW_ERROR'), (RecursionError, 'RECURSION_ERROR'), + (UnicodeDecodeError, 'UNICODE_DECODE_ERROR')) + + +CUSTODY_SUCCESSORS = tuple(range(1, 257)) +IO_QUARANTINE_ERROR = EpochStop('epoch IO quarantined; parent teardown required') + + +class ErrorOwner: + __slots__ = ('_state',) + + +_OWNER_GET = ErrorOwner._state.__get__ +_OWNER_SET = ErrorOwner._state.__set__ +_OBJECT_NEW = object.__new__ + + +def make_error_owner() -> ErrorOwner: + owner = _OBJECT_NEW(ErrorOwner) + # 0 primary [opaque,phase]; 1 errors; 2 phases; 3 uncertain FD; + # 4 counts [secondary,close_attempts,close_confirmed,cases]; + # 5 overflow [first opaque, incomplete flag]; + # 6 cases [name,opaque,is_error,capture_state,raw_sink_return,validated]. + state = [[None, None, None], [None] * ERROR_SLOTS, [None] * ERROR_SLOTS, + [None] * ERROR_SLOTS, [0, 0, 0, 0], [None, False], + [[None, None, False, 'NOT_RETURNED', None, False, None, None] for _ in range(CASE_SLOTS)], + [False, False, False, None, False, None, False, [0] * 5, [0] * 5, False, False, False, None], + [[None, False, 'NOT_RETURNED', None] for _ in range(CASE_SLOTS)]] + _OWNER_SET(owner, state) + return owner + + +def owner_state(owner: ErrorOwner) -> list: + need(_TYPE(owner) is ErrorOwner, 'exact trusted error owner required') + state = _OWNER_GET(owner, ErrorOwner) + need(_TYPE(state) is _LIST and _LEN(state) == 9, 'trusted owner state shape differs') + for index, count in ((0, 3), (1, ERROR_SLOTS), (2, ERROR_SLOTS), (3, ERROR_SLOTS), + (4, 4), (5, 2), (6, CASE_SLOTS), (7, 13), (8, CASE_SLOTS)): + need(_TYPE(state[index]) is _LIST and _LEN(state[index]) == count, 'trusted owner slot shape differs') + integer(state[4][0], 0, ERROR_SLOTS) + integer(state[4][1], 0, 1 << 32) + integer(state[4][2], 0, state[4][1]) + integer(state[4][3], 0, CASE_SLOTS) + boolean(state[5][1]) + io = state[7] + for index in (0, 1, 2, 4, 6, 9, 10, 11): + boolean(io[index]) + for index in (7, 8): + need(_TYPE(io[index]) is _LIST and _LEN(io[index]) == 5, 'close counter digits differ') + for digit in io[index][:4]: + integer(digit, 0, 255) + integer(io[index][4], 0, 1) + need(io[index][4] == 0 or io[index][:4] == [0, 0, 0, 0], 'close counter exceeds inherited bound') + # Fallible scalar projection occurs only at API entry/snapshot, never in + # the inline cleanup path. The five native digits are authoritative. + attempts = io[7][0] + (io[7][1] << 8) + (io[7][2] << 16) + (io[7][3] << 24) + (io[7][4] << 32) + confirmed = io[8][0] + (io[8][1] << 8) + (io[8][2] << 16) + (io[8][3] << 24) + (io[8][4] << 32) + need(confirmed <= attempts, 'native close confirmation exceeds attempt') + state[4][1], state[4][2] = attempts, confirmed + return state + + +def retain_primary(owner: ErrorOwner, opaque, phase: str, uncertain_fd=None) -> None: + state = owner_state(owner) + text(phase, 96) + if uncertain_fd is not None: + integer(uncertain_fd, 0, (1 << 31) - 1) + if state[0][0] is None: + state[0][0], state[0][1], state[0][2] = opaque, phase, uncertain_fd + elif state[0][0] is not opaque: + retain_secondary(owner, opaque, phase, uncertain_fd) + + +def retain_secondary(owner: ErrorOwner, opaque, phase: str, uncertain_fd) -> None: + state = owner_state(owner) + text(phase, 96) + if uncertain_fd is not None: + integer(uncertain_fd, 0, (1 << 31) - 1) + index = state[4][0] + if index < ERROR_SLOTS: + # Preallocated native slots: no error formatting/attributes, no append. + state[1][index], state[2][index], state[3][index] = opaque, phase, uncertain_fd + state[4][0] = index + 1 + else: + state[5][1] = True + if state[5][0] is None: + state[5][0] = opaque + + +def close_attempt(owner: ErrorOwner) -> None: + state = owner_state(owner) + need(state[4][1] < 1 << 32, 'close attempt counter bound') + digits = state[7][7] + index = 0 + while index < 4 and digits[index] == 255: + digits[index] = 0 + index = CUSTODY_SUCCESSORS[index] + digits[index] = CUSTODY_SUCCESSORS[digits[index]] + + +def close_confirmed(owner: ErrorOwner) -> None: + state = owner_state(owner) + need(state[4][2] < state[4][1], 'close confirmation lacks attempt') + digits = state[7][8] + index = 0 + while index < 4 and digits[index] == 255: + digits[index] = 0 + index = CUSTODY_SUCCESSORS[index] + digits[index] = CUSTODY_SUCCESSORS[digits[index]] + + +def project_error(opaque) -> dict: + kind = _TYPE(opaque) + label_value, admitted = 'FOREIGN_OPAQUE_EXCEPTION', False + for expected_kind, literal_label in _NATIVE_ERROR_LABELS: + if kind is expected_kind: + label_value, admitted = literal_label, True + break + strings, omitted = [], False + if admitted: + # Native BaseException descriptor, only after exact whitelisted type. + # No normal error.args/__dict__/cause/context/name/str access exists. + arguments = _BASE_ARGS_GET(opaque, BaseException) + if _TYPE(arguments) is _TUPLE: + omitted = _LEN(arguments) > MAX_ERROR_ARGS + for argument in arguments[:MAX_ERROR_ARGS]: + if _TYPE(argument) is _STR: + if _LEN(argument) <= MAX_ERROR_ARG_CHARS: + strings.append(argument) + else: + strings.append(argument[:MAX_ERROR_ARG_CHARS]) + omitted = True + else: + omitted = True + else: + omitted = True + return {'literal_type_label': label_value, 'exact_string_args': strings, + 'foreign_or_excess_args_omitted': omitted or not admitted, + 'original_object_retained_opaquely': True} + + +def error_snapshot(owner: ErrorOwner) -> dict: + state = owner_state(owner) + secondary = [] + for index in range(min(state[4][0], MAX_SECONDARY_PROJECTIONS)): + text(state[2][index], 96) + if state[3][index] is not None: + integer(state[3][index], 0, (1 << 31) - 1) + secondary.append({'slot': index, 'phase': state[2][index], + 'uncertain_close_fd': state[3][index], + 'error': project_error(state[1][index])}) + primary = None + if state[0][0] is not None: + text(state[0][1], 96) + if state[0][2] is not None: + integer(state[0][2], 0, (1 << 31) - 1) + primary = {'phase': state[0][1], 'uncertain_close_fd': state[0][2], + 'error': project_error(state[0][0])} + # Projection happens only after operation cleanup. At most six recorder + # errors are projected; a scan of all 64 slots counts omitted projections. + recording_failures = [] + recording_failure_count = 0 + for index, row in enumerate(state[8]): + if row[3] is not None: + recording_failure_count += 1 + if len(recording_failures) < MAX_SECONDARY_PROJECTIONS: + recording_failures.append({'slot': index, 'state': row[2], + 'target_is_error': row[1], 'recording_error': project_error(row[3]), + 'target_retained_opaquely': row[2] != 'NOT_RETURNED'}) + return {'primary': primary, 'secondary': secondary, + 'secondary_capture_incomplete': state[5][1], + 'secondary_projection_omitted': max(0, state[4][0] - MAX_SECONDARY_PROJECTIONS), + 'close_attempts': state[4][1], 'close_confirmed': state[4][2], + 'close_counter_incomplete': state[7][6], + 'io_quarantined': state[7][0], 'native_acquisition_pending': state[7][1], + 'possible_unreturned_native_fd': state[7][2], + 'parent_kernel_teardown_required': state[7][4], + 'uncertain_scandir_owner_retained': state[7][5] is not None, + 'scandir_close_returned_result_unobserved': state[7][9], + # An earlier normal close observation never overrides a later + # delivered failure or retained stream uncertainty. + 'scandir_release_uses_external_premise': (state[7][9] and not state[7][0] + and state[7][5] is None), + 'external_guard_acquisition_pending': state[7][10], + 'external_guard_fd_count_unavailable': state[7][11], + 'native_acquisition_error': None if state[7][3] is None else project_error(state[7][3]), + 'external_guard_error': None if state[7][12] is None else project_error(state[7][12]), + 'recording_failures': recording_failures, + 'recording_projection_omitted': max(0, recording_failure_count - MAX_SECONDARY_PROJECTIONS)} + + + +def record_case(owner: ErrorOwner, name: str, opaque, is_error: bool) -> int: + state = owner_state(owner) + text(name, 16) + boolean(is_error) + count = state[4][3] + need(count < CASE_SLOTS, 'case capacity exceeded') + for index in range(count): + row = state[6][index] + need(_TYPE(row) is _LIST and _LEN(row) == 8, 'case slot shape differs') + text(row[0], 16) + need(row[0] != name, 'case identity replay') + row = state[6][count] + need(_TYPE(row) is _LIST and _LEN(row) == 8, 'case slot shape differs') + text(row[3], 32) + need(row[3] == 'NOT_RETURNED', 'case slot already used') + row[0], row[1], row[2] = name, opaque, is_error + row[3] = 'RETURNED_NOT_CAPTURED' + state[4][3] = count + 1 + return count + + +def case_slot(owner: ErrorOwner, index: int) -> list: + state = owner_state(owner) + integer(index, 0, CASE_SLOTS - 1) + need(index < state[4][3], 'case not recorded') + row = state[6][index] + need(_TYPE(row) is _LIST and _LEN(row) == 8, 'case slot shape differs') + text(row[0], 16) + boolean(row[2]) + choice(row[3], ('NOT_RETURNED', 'RETURNED_NOT_CAPTURED', 'RAW_CAPTURED', 'VALIDATED')) + boolean(row[5]) + return row + +# Original-function record checks use native descriptors only after exact +# FunctionType/CellType gates. Provenance must come from the authenticated Root +# factory call, never a record recaptured after adverse input. +from types import FunctionType as _FUNCTION_TYPE, CellType as _CELL_TYPE +_FUNCTION_GETTERS = tuple(_FUNCTION_TYPE.__dict__[name].__get__ for name in + ('__code__', '__globals__', '__defaults__', '__kwdefaults__', '__closure__', '__annotations__', '__dict__')) +_CELL_GET = _CELL_TYPE.cell_contents.__get__ + + +def capture_original_function(function) -> tuple: + need(_TYPE(function) is _FUNCTION_TYPE, 'exact original function required') + values = tuple(getter(function, _FUNCTION_TYPE) for getter in _FUNCTION_GETTERS) + need(values[2] is None and values[3] is None, 'original callback defaults differ') + closure = values[4] + cells = [] + if closure is not None: + need(_TYPE(closure) is _TUPLE and _LEN(closure) <= 64, 'original closure bound differs') + for cell in closure: + need(_TYPE(cell) is _CELL_TYPE, 'original closure cell differs') + cells.append((cell, _CELL_GET(cell, _CELL_TYPE))) + return function, values, tuple(cells) + + +def check_original_function(function, record) -> None: + need(_TYPE(function) is _FUNCTION_TYPE, 'foreign callable rejected') + need(_TYPE(record) is _TUPLE and _LEN(record) == 3, 'original callback record differs') + need(function is record[0], 'original callback identity differs') + values, cells = record[1], record[2] + need(_TYPE(values) is _TUPLE and _LEN(values) == 7, 'original callback value record differs') + need(_TYPE(cells) is _TUPLE and _LEN(cells) <= 64, 'original callback cell record differs') + for getter, expected in zip(_FUNCTION_GETTERS, values): + need(getter(function, _FUNCTION_TYPE) is expected, 'original callback environment differs') + need(values[2] is None and values[3] is None, 'original callback defaults differ') + closure = values[4] + if closure is None: + need(_LEN(cells) == 0, 'unexpected original closure records') + return + need(_TYPE(closure) is _TUPLE and _LEN(closure) == _LEN(cells), 'original closure record count differs') + for actual_cell, pair in zip(closure, cells): + need(_TYPE(pair) is _TUPLE and _LEN(pair) == 2, 'original cell pair differs') + need(_TYPE(actual_cell) is _CELL_TYPE and actual_cell is pair[0], 'original cell identity differs') + need(_CELL_GET(actual_cell, _CELL_TYPE) is pair[1], 'original closure content identity differs') + + +def prepare_case_shadow(owner: ErrorOwner) -> tuple: + state = owner_state(owner) + count = state[4][3] + need(count < CASE_SLOTS, 'case shadow capacity exceeded') + row = state[8][count] + need(_TYPE(row) is _LIST and _LEN(row) == 4 and row[0] is None and row[3] is None and row[2] == 'NOT_RETURNED', + 'case shadow was already consumed') + return state, count, row diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/group01_evidence_v1.py b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/group01_evidence_v1.py new file mode 100644 index 0000000000..bde3f97232 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/group01_evidence_v1.py @@ -0,0 +1,256 @@ +"""Parent data replay of the exact unchanged Group01 finite producer route. + +All arguments come from the owning parent registry and independently frozen +prelaunch plan. A parsed status never establishes process ownership, native +correctness or historical source continuity. Those are separate original +source/runtime and owned-domain obligations. No function was executed here. +""" +import json +import math +import epoch_schema_v5 as schema +import epoch_copy_v5 as copying +import original_build_provenance_v5 as original_build +import parent_closure_v1 as closure +import group01_original_predicates_v1 as original_predicates + +_TYPE, _LEN = type, len +GROUP_ORDER = ('native', 'transport', 'collector', 'pure_initial', 'pure_extended', + 'pure_combined', 'root_model', 'sink_close_model', 'projection_model', 'aggregate') +GROUP_KEYS = ('native', 'transport', 'collector', 'elf', 'providers', 'elf_extended') +MAX_JSON_NODES = 200000 +MAX_JSON_BYTES = 4 * 1024 * 1024 +FINITE_KEYS = ('status', 'lanes', 'data_handling', 'data_source_custody', 'optimized', + 'original_controls', 'new_controls', 'new_source_custody', 'driver_sha256', + 'initial_native_tcb', 'initial_native_tcb_restoration', 'native_packet', + 'reference_driver_sha256', 'phases') + + +def _pairs(pairs): + schema.need(_TYPE(pairs) is list and _LEN(pairs) <= 8192, 'receipt JSON object bound') + result = {} + for key, value in pairs: + schema.need(_TYPE(key) is str and _LEN(key) <= 65536 and key not in result, + 'receipt duplicate/foreign/oversize key') + result[key] = value + return result + + +def _reject(value): + raise schema.EpochStop('nonfinite receipt JSON constant') + + +def _plain(value, budget, depth=0): + schema.need(depth <= 40 and budget[0] > 0, 'receipt JSON node/depth bound') + budget[0] -= 1 + kind = _TYPE(value) + if value is None or kind is bool: + return + if kind is int: + schema.need(value.bit_length() <= 4096, 'receipt integer bound') + return + if kind is float: + schema.need(math.isfinite(value), 'nonfinite receipt number') + return + if kind is str: + schema.need(_LEN(value) <= 65536, 'receipt string bound') + budget[1] += _LEN(value) + schema.need(budget[1] <= MAX_JSON_BYTES, 'receipt text budget') + return + schema.need(kind in (list, dict) and _LEN(value) <= 8192, 'receipt exact collection bound') + if kind is dict: + for key, item in value.items(): + schema.need(_TYPE(key) is str, 'receipt exact key required') + _plain(key, budget, depth + 1) + _plain(item, budget, depth + 1) + else: + for item in value: + _plain(item, budget, depth + 1) + + +def decode(raw): + schema.need(_TYPE(raw) is bytes and 0 < _LEN(raw) <= MAX_JSON_BYTES, 'receipt raw byte bound') + value = json.loads(raw.decode('ascii'), object_pairs_hook=_pairs, parse_constant=_reject) + schema.need(_TYPE(value) is dict, 'receipt top-level exact object required') + _plain(value, [MAX_JSON_NODES, 0]) + return value + + +def encode(value): + _plain(value, [MAX_JSON_NODES, 0]) + raw = json.dumps(value, sort_keys=True, separators=(',', ':'), ensure_ascii=True, + allow_nan=False).encode('ascii') + b'\n' + schema.need(_LEN(raw) <= MAX_JSON_BYTES, 'receipt canonical byte bound') + return raw + + +def same_json(left, right): + # Both operands are exact bounded JSON-native data. Canonical bytes retain + # bool/int/float distinctions that Python nested equality otherwise loses. + return encode(left) == encode(right) + + +def _read(path, bound, error_owner): + pin = copying.inspect(path, bound, error_owner=error_owner) + raw = copying.read_verified(pin, bound, error_owner=error_owner) + return pin, raw + + +def _captured_call(receiver_capability, module, name, *args): + # Exact module/function names below are source literals, not caller-selected + # callbacks. Current source/identity checks surround every receiving call. + closure.check_receivers(receiver_capability) + function = closure.receiver(receiver_capability, module, name) + result = function(*args) + closure.check_receivers(receiver_capability) + return result + + +def _legacy_controls(result, expected): + schema.exact(expected, ('original_counts', 'original_fixture_sha256', + 'original_v2_counts', 'original_v2_stream', 'new_controls')) + schema.digest(expected['original_fixture_sha256']) + native = result['original_controls'] + schema.need(_TYPE(native) is dict and native.get('status') == 'FINITE_NATIVE_GF2_CONTROLS_PASS' and + same_json(native.get('counts'), expected['original_counts']) and + native.get('fixture_sha256') == expected['original_fixture_sha256'] and + _TYPE(native.get('micro_repetitions')) is int and native['micro_repetitions'] == 128 and + native.get('independent_oracle') == + 'Dense binary lists, descending pivots, addition modulo 2; no packed/source/native helpers', + 'original native independent outcome projection differs') + schema.need(_TYPE(native.get('micro_fixtures')) is int and native['micro_fixtures'] > 0 and + _TYPE(native.get('native_and_fallback_calls')) is dict and + all(_TYPE(value) is int and value > 0 for value in native['native_and_fallback_calls'].values()), + 'original native and fallback paths not represented') + v2 = native.get('v2_controls') + schema.need(_TYPE(v2) is dict and v2.get('status') == 'V2_RUNTIME_AND_COMPLEMENT_STREAM_PASS' and + same_json(v2.get('counts'), expected['original_v2_counts']) and + same_json(v2.get('complement_fixture_stream'), expected['original_v2_stream']) and + _TYPE(v2.get('modified_helper_invocations')) is int and v2['modified_helper_invocations'] == 0, + 'original runtime/ordered-complement independent projection differs') + # The expected complete new-control tree is an independently approved input + # before launch. It is never learned from this result or an earlier PASS. + schema.need(same_json(result['new_controls'], expected['new_controls']), + 'complete original bookkeeping control return differs') + + +def authenticate_group01(output, expected, process_id, parent_file_limits, + receiver_capability, error_owner, stdout_raw): + """Return actual evidence data; only the owning launcher can mint authority.""" + schema.path(output) + schema.integer(process_id, 1, (1 << 31) - 1) + schema.exact(expected, ('mode', 'generation', 'stage_sha256', 'root_sha256', + 'driver_sha256', 'reference_driver_sha256', 'builds', 'legacy_outcomes', + 'source_receipts', 'tcb_files', 'hashlib_origin')) + schema.choice(expected['mode'], ('normal', 'optimized')) + schema.label(expected['generation']) + for key in ('stage_sha256', 'root_sha256', 'driver_sha256', 'reference_driver_sha256'): + schema.digest(expected[key]) + schema.path(expected['hashlib_origin']) + optimize = 0 if expected['mode'] == 'normal' else 1 + result_pin, result_raw = _read(output + '/receipt.json', MAX_JSON_BYTES, error_owner) + result = decode(result_raw) + schema.exact(result, FINITE_KEYS) + schema.need(result['status'] == 'H25_DATA_HANDLING_FINITE_PASS' and + result['lanes'] == 'all' and _TYPE(result['optimized']) is int and + result['optimized'] == optimize and + result['driver_sha256'] == expected['driver_sha256'] and + result['reference_driver_sha256'] == expected['reference_driver_sha256'], + 'original finite producer route/mode/source differs') + schema.need(same_json(decode(stdout_raw), result), 'original stdout and terminal finite receipt differ') + _legacy_controls(result, expected['legacy_outcomes']) + finite_pin, finite_raw = _read(output + '/finite-controls.json', MAX_JSON_BYTES, error_owner) + schema.need(same_json(decode(finite_raw), result['original_controls']), 'original finite raw result differs') + data, packet = result['data_handling'], result['native_packet'] + schema.need(_TYPE(data) is dict and data.get('schema') == 'h25-data-handling-v2' and + data.get('full_caller_run') is False and data.get('full_candidate_admission') is False and + data.get('cache_teardown_stops') == [] and same_json(data.get('native_packet'), packet), + 'original finite data or cleanup boundary differs') + original_predicates.check_original_control_union( + {'controls': data['controls'], 'native_packet': packet}, optimize, include_late=True) + schema.need(packet['late_started'] is True and packet['late_completed'] is True and + packet['field_service_closed'] is True and packet['direct_close_stop'] is None and + packet['field_group_stop'] is None and packet['field_restoration_receipt_checked'] is True and + packet['field_runtime_qualification'] is False, + 'original late/group/field cleanup or qualification boundary differs') + schema.exact(expected['source_receipts'], ('data_source_custody', 'new_source_custody', + 'compiler_dependencies')) + for key in ('data_source_custody', 'new_source_custody'): + schema.need(same_json(result[key], expected['source_receipts'][key]), 'source-derived receipt custody differs') + schema.need(same_json(packet['compiler_dependencies'], expected['source_receipts']['compiler_dependencies']), + 'original compiler/link/header receipt closure differs') + # Original placement is authenticated by exact launched source. This call + # replays its fixed data contract; it does not rerun initial native checks. + tcb_files = tuple(tuple(row) for row in expected['tcb_files']) + _captured_call(receiver_capability, 'restoration_contract_v1', 'validate_restoration', + result['initial_native_tcb'], data['controls']['native_initial_tcb'], + result['initial_native_tcb_restoration'], tcb_files, expected['hashlib_origin'], + expected['root_sha256'], len(tcb_files)) + schema.integer(result['initial_native_tcb']['pid'], 1, (1 << 31) - 1) + schema.integer(result['initial_native_tcb_restoration']['pid'], 1, (1 << 31) - 1) + schema.need(result['initial_native_tcb']['pid'] == process_id and + result['initial_native_tcb_restoration']['pid'] == process_id, + 'initial/restoration receipt belongs to another process') + initial_pin, initial_raw = _read(output + '/initial-native-tcb.json', MAX_JSON_BYTES, error_owner) + restored_pin, restored_raw = _read(output + '/initial-native-tcb-restoration.json', MAX_JSON_BYTES, error_owner) + schema.need(same_json(decode(initial_raw), result['initial_native_tcb']) and + same_json(decode(restored_raw), result['initial_native_tcb_restoration']), + 'initial/restoration retained raw differs') + controls_pin, controls_raw = _read(output + '/initial-tcb-controls/receipt.json', MAX_JSON_BYTES, error_owner) + schema.need(same_json(decode(controls_raw), data['controls']['native_initial_tcb']), 'original initial five-control raw differs') + delivery = packet['field_group_delivery'] + aggregate = delivery['aggregate'] + schema.need(same_json(data['controls']['native_fields'], aggregate), 'field aggregate projections differ') + # JSON object order is not the original insertion-order observation. Restore + # only this explicit source-fixed mapping order for the existing validator; + # no value/case/sequence/order or unknown-key repair is permitted. + schema.exact(aggregate['groups'], GROUP_KEYS) + aggregate['groups'] = {key: aggregate['groups'][key] for key in GROUP_KEYS} + _captured_call(receiver_capability, 'run_controls_v5', 'validate_all', delivery, expected['mode']) + values = (aggregate['groups']['native'], aggregate['groups']['transport'], + aggregate['groups']['collector'], aggregate['pure_v2']['initial'], + aggregate['pure_v2']['extended'], aggregate['pure_v2'], aggregate['root_model'], + aggregate['sink_close_model'], aggregate['projection_model'], aggregate) + group_rows = [] + for index, (group, value) in enumerate(zip(GROUP_ORDER, values)): + raw_ref = delivery['group_evidence']['raw_pins'][index][1] + validation_ref = delivery['group_evidence']['validation_pins'][index][1] + raw_pin, raw = _read(output + '/' + raw_ref['file'], 1048576, error_owner) + validation_pin, validation_raw = _read(output + '/' + validation_ref['file'], 8192, error_owner) + schema.need(raw_pin['sha256'] == raw_ref['sha256'] and raw_pin['bytes'] == raw_ref['bytes'] and + validation_pin['sha256'] == validation_ref['sha256'] and validation_pin['bytes'] == validation_ref['bytes'], + 'durable group pin differs from actual retained bytes') + schema.need(raw == encode(value), 'complete raw group differs from original aggregate projection') + note = {'schema': 'h25-full-group-evidence-sink-v5', 'mode': expected['mode'], 'group': group, + 'state': 'RETURNED_RAW_OUTER_VALIDATED', 'raw': raw_ref} + schema.need(validation_raw == encode(note), 'complete validation note differs') + group_rows.append({'group': group, 'raw': raw_pin, 'validation': validation_pin}) + builds = [] + schema.sequence(expected['builds'], 3) + for role, build_plan in zip(schema.ROLES[:3], expected['builds']): + schema.exact(build_plan, ('role', 'profile', 'command_sha256', 'original_output_path', 'expected_original')) + schema.need(build_plan['role'] == role, 'original build role order differs') + base = output + '/cold-native-metadata/' + role + original_record_pin, raw_receipt = _read(base + '-build.json', 65536, error_owner) + original_record = decode(raw_receipt) + schema.need(same_json(original_record, packet['builds'][role]), 'original build raw/terminal projection differs') + row = {'role': role, 'producer_role': 'group01', 'producer_generation': expected['generation'], + 'producer_stage_sha256': expected['stage_sha256'], 'command_sha256': build_plan['command_sha256'], + 'profile': build_plan['profile'], + 'original_output': copying.inspect(build_plan['original_output_path'], error_owner=error_owner), + 'original_receipt': original_record_pin, + 'attempt': copying.inspect(base + '.attempt.json', 65536, error_owner=error_owner), + 'journal': copying.inspect(base + '.attempt.jsonl', schema.JOURNAL_BYTES, error_owner=error_owner), + 'stdout': copying.inspect(base + '.stdout.raw', schema.LOG_BYTES, error_owner=error_owner), + 'stderr': copying.inspect(base + '.stderr.raw', schema.LOG_BYTES, error_owner=error_owner)} + independent = schema.plain_copy(build_plan['expected_original']) + independent['producer_process_id'] = process_id + independent['parent_file_limits'] = list(parent_file_limits) + closure.check_receivers(receiver_capability) + original_build.authenticate_original_build(row, independent, error_owner=error_owner) + closure.check_receivers(receiver_capability) + builds.append(row) + return {'raw_result': result_pin, 'group_rows': group_rows, 'builds': builds, + 'additional_raw': [finite_pin, initial_pin, restored_pin, controls_pin], + 'own_group01_source_and_result_contract_checked': True, + 'later_cross_root_aggregate_required_before_export': False, + 'native_runtime_or_full_union_qualified': False} diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/h25_parent_supervisor.py b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/h25_parent_supervisor.py new file mode 100644 index 0000000000..73ed60fe21 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/h25_parent_supervisor.py @@ -0,0 +1,475 @@ +"""Parent-only bounded process supervision; imports no candidate implementation. + +The runtime caller must establish the trusted clean launcher before calling us. +This source was prepared without loading ctypes or running any control. The +closed single-threaded child domain is an explicit premise, not a hostile-fork +sandbox. Numeric process IDs are never used as signal destinations. +""" +import fcntl +import hashlib +import json +import os +from pathlib import Path +import resource +import signal +import stat +import subprocess +import sys +import time + +FLAGS = ('-S', '-s', '-P', '-B') +ENV = {'PATH': '/usr/bin:/bin', 'PYTHONHASHSEED': '0', 'LANG': 'C.UTF-8', + 'LC_ALL': 'C.UTF-8', 'TZ': 'UTC', 'PYTHONDONTWRITEBYTECODE': '1'} +RUNNER_SHA = 'bd882e3dadb1b6aeaa63ee824f1a1c58f8ef2546b6840a2bffa46885a184d3eb' +QUEUE_SHA = '1348a7b4d7cc1f9fef556f5e0abdaf04411a998afdcd574d7812c76ab37dcf68' +TCB_SHA = '610492b3fc06baa0560175edc3ba27057de00d00b8fd3d58dbe55e5a371c042a' +LIBC = '/usr/lib/x86_64-linux-gnu/libc.so.6' +NATIVE_PINS = { + LIBC: '3a15d66867d83762c7f2f1e37359cb8f6c5743edb369c65285cb0b1c4f7498bf', + '/usr/lib/python3.12/lib-dynload/_ctypes.cpython-312-x86_64-linux-gnu.so': 'aad3e24f186e6c0a1c7efa8f16004f951f527db86f6451d30118657384a456c1', + '/usr/lib/x86_64-linux-gnu/libffi.so.8.1.4': '00f593fe192f2851b8ce23b25cec2488d769beb5a8f63e8c9e563071e1075153', + '/usr/lib/python3.12/ctypes/__init__.py': '0782592567ad71097198a3afe985ac3e2ea0b9b5e75452402c9460c89a86318a', + '/usr/lib/python3.12/ctypes/_endian.py': 'c5d692bdce10dfee242752620061bab684633bc72445a3def484961ef1bdbf3a', +} +CHUNK = 65536 +LOG_CAP = 2 * 1024 * 1024 +META_CAP = 256 * 1024 +CLEANUP_SECONDS = 2.0 + + +def need(condition, message): + if not condition: + raise RuntimeError(message) + + +def launch_contract(): + need(sys.executable == '/usr/bin/python3.12', 'Pinned interpreter required') + need(sys.flags.no_site == sys.flags.no_user_site == sys.flags.dont_write_bytecode == 1 and + sys.flags.safe_path and sys.flags.ignore_environment == sys.flags.isolated == + sys.flags.hash_randomization == 0, 'Trusted no-site safe-path fixed-seed flags required') + need(dict(os.environ) == ENV, 'Exact clean environment required') + need(tuple(sys.path) == ('/usr/lib/python312.zip', '/usr/lib/python3.12', + '/usr/lib/python3.12/lib-dynload'), 'Initial system stdlib path changed') + need(list(Path('/proc/self/task').iterdir()) == [Path('/proc/self/task') / str(os.getpid())], + 'Exactly one parent task required') + + +def identity(info): + return (info.st_dev, info.st_ino, info.st_mode, info.st_size, info.st_mtime_ns, info.st_ctime_ns) + + +def stable_file(path, limit, keep=False): + """Complete bounded snapshot; no file read can extend a growing snapshot.""" + path = Path(path) + before = path.stat(follow_symlinks=False) + need(stat.S_ISREG(before.st_mode) and before.st_size <= limit, 'File type/size bound: ' + str(path)) + fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK | os.O_CLOEXEC) + h, count, blocks = hashlib.sha256(), 0, [] + try: + opened = os.fstat(fd) + need(identity(before) == identity(opened), 'File changed while opening') + while count < opened.st_size: + block = os.read(fd, min(CHUNK, opened.st_size - count)) + need(bool(block), 'Short retained-file read') + count += len(block) + h.update(block) + if keep: + blocks.append(block) + after_fd = os.fstat(fd) + finally: + os.close(fd) + after = path.stat(follow_symlinks=False) + need(identity(before) == identity(after_fd) == identity(after), 'File drift during retained snapshot') + row = {'path': str(path), 'sha256': h.hexdigest(), 'bytes': count, + 'identity': list(identity(after)), 'stable': True, 'read_chunk_bytes': CHUNK} + return (row, b''.join(blocks)) if keep else row + + +def read_json(path, limit=META_CAP): + row, raw = stable_file(path, limit, True) + return json.loads(raw), row + + +def write_new(path, row): + raw = json.dumps(row, sort_keys=True, indent=2).encode('ascii') + b'\n' + need(len(raw) <= META_CAP, 'Bounded metadata record exceeded') + fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_CLOEXEC | os.O_NOFOLLOW, 0o600) + try: + view = memoryview(raw) + while view: + written = os.write(fd, view) + need(written > 0, 'Metadata write made no progress') + view = view[written:] + os.fsync(fd) + finally: + os.close(fd) + + +def proc(pid): + try: + with open('/proc/' + str(pid) + '/stat', 'rb') as stream: + raw = stream.read(8193) + need(len(raw) <= 8192, 'Unexpected process-stat size') + end = raw.rfind(b') ') + need(end >= 0, 'Malformed process stat') + fields = raw[end + 2:].split() + return {'pid': int(pid), 'ppid': int(fields[1]), 'pgid': int(fields[2]), + 'sid': int(fields[3]), 'start_ticks': int(fields[19]), + 'state': fields[0].decode('ascii'), + 'rss_bytes': int(fields[21]) * os.sysconf('SC_PAGE_SIZE')} + except (FileNotFoundError, ProcessLookupError, PermissionError): + return None + + +def census(): + found = {} + with os.scandir('/proc') as entries: + for entry in entries: + if entry.name.isdecimal(): + row = proc(int(entry.name)) + if row is not None: + found[row['pid']] = row + return found + + +def generation(row): + return row['pid'], row['start_ticks'] + + +def children_now(): + return [row for row in census().values() if row['ppid'] == os.getpid()] + + +def install_subreaper(root): + """Called only by the future parent, before any controlled root exists.""" + launch_contract() + need(not children_now(), 'Parent must own no preexisting child processes') + tcb, tcb_row = read_json(root / 'control/NATIVE-INITIAL-TCB-v1.json') + need(tcb_row['sha256'] == TCB_SHA, 'Accepted initial TCB changed') + need(any(row['path'] == LIBC and row['sha256'] == NATIVE_PINS[LIBC] + for row in tcb['files']), 'Pinned libc absent from accepted TCB') + evidence = {path: stable_file(path, 16 * 1024 * 1024) for path in NATIVE_PINS} + need(all(evidence[path]['sha256'] == expected for path, expected in NATIVE_PINS.items()), + 'Subreaper native/stdlib source supplement changed') + # This import and native call have NOT been performed during source authoring. + need(Path('/usr/lib/x86_64-linux-gnu/libffi.so.8').resolve() == + Path('/usr/lib/x86_64-linux-gnu/libffi.so.8.1.4'), 'Foreign libffi SONAME resolution') + import ctypes + need(sys.modules['_ctypes'].__file__ == + '/usr/lib/python3.12/lib-dynload/_ctypes.cpython-312-x86_64-linux-gnu.so', 'Foreign _ctypes owner') + need(ctypes.__file__ == '/usr/lib/python3.12/ctypes/__init__.py', 'Foreign ctypes owner') + library = ctypes.CDLL(LIBC, use_errno=True) + call = library.prctl + call.argtypes = [ctypes.c_int, ctypes.c_ulong, ctypes.c_ulong, ctypes.c_ulong, ctypes.c_ulong] + call.restype = ctypes.c_int + prior, actual = ctypes.c_int(), ctypes.c_int() + need(call(37, ctypes.addressof(prior), 0, 0, 0) == 0, 'PR_GET_CHILD_SUBREAPER failed') + need(call(36, 1, 0, 0, 0) == 0, 'PR_SET_CHILD_SUBREAPER failed') + need(call(37, ctypes.addressof(actual), 0, 0, 0) == 0 and actual.value == 1, + 'Same-process subreaper readback failed') + for path, expected in NATIVE_PINS.items(): + need(stable_file(path, 16 * 1024 * 1024)['sha256'] == expected, 'TCB bytes changed across load') + # Retain the CDLL and typed function in the owning parent for its whole queue. + return {'pid': os.getpid(), 'prior': prior.value, 'actual': actual.value, + 'tcb_sha256': TCB_SHA, 'native_source_evidence': evidence, + 'trust': 'Trusted OS/loader/initial system stdlib; file pins do not authenticate native memory'}, (library, call) + + +def ledger(root, allow_unclosed=False): + result = {} + runs = root / 'runtime/runs' + for folder in sorted(runs.iterdir()): + need(folder.is_dir() and not folder.is_symlink(), 'Unexpected round run entry') + if allow_unclosed and not (folder / 'receipt.json').exists(): + continue + receipt, _ = read_json(folder / 'receipt.json', 4 * 1024 * 1024) + amount = receipt.get('runner_wall_seconds', receipt.get('wall_seconds')) + need(type(amount) in (int, float) and amount >= 0, 'Invalid ledger amount') + result[folder.name] = float(amount) + return result + + +def budget(root): + phase, _ = read_json(root / 'control/EXECUTION-PHASE.json') + cap = phase['aggregate_cap_seconds'] + need(type(cap) is int and cap in (600, 2400), 'Unrecognized budget phase') + current = ledger(root) + need(sum(current.values()) < cap, 'Round budget consumed') + return cap, current + + +def parent_lock(root): + lock = (root / 'runtime/parent-queue.lock').open('a') + try: + fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB) + except BaseException: + lock.close() + raise + return lock + + +class ExecutionDeadline(RuntimeError): + pass + + +def deadline_handler(signum, frame): + raise ExecutionDeadline('Outer execution deadline reached, including Popen/preexec') + + +class OwnedDomain: + """Only our new children and their observed descendants enter this domain.""" + def __init__(self): + need(not children_now(), 'Owned child domain was not initially empty') + self.rows, self.fds, self.groups, self.reaped = {}, {}, set(), [] + self.root = None + self.parent_group = os.getpgrp() + self.parent_session = os.getsid(0) + + def add(self, row): + key = generation(row) + if key in self.rows: + if row['pgid'] != self.parent_group: + self.groups.add((row['pgid'], row['sid'])) + return + need(len(self.rows) < 128, 'Owned process observation limit exceeded') + need(row['pid'] != os.getpid(), 'Parent cannot enter its own child domain') + try: + fd = os.pidfd_open(row['pid'], 0) + except ProcessLookupError: + return + current = proc(row['pid']) + if current is None or generation(current) != key: + os.close(fd) + return + self.rows[key], self.fds[key] = dict(current), fd + # During interrupted Popen a child can briefly precede setsid. Its + # individual pidfd is owned; the queue parent group never is. + if current['pgid'] != self.parent_group: + self.groups.add((current['pgid'], current['sid'])) + + def observe(self): + all_rows = census() + known = {pid for pid, start in self.rows if pid in all_rows and + all_rows[pid]['start_ticks'] == start} + for pid in known: + self.add(all_rows[pid]) + changed = True + while changed: + changed = False + for pid, row in all_rows.items(): + if pid not in known and (row['ppid'] == os.getpid() or row['ppid'] in known): + self.add(row) + if generation(row) in self.rows: + known.add(pid) + changed = True + return all_rows, [all_rows[pid] for pid in known] + + def kill_owned(self): + self.observe() + for key, fd in self.fds.items(): + current = proc(key[0]) + if current is not None and generation(current) == key and current['state'] != 'Z': + try: + signal.pidfd_send_signal(fd, signal.SIGKILL, None, 0) + except ProcessLookupError: + pass + + def cleanup(self, process): + start = time.monotonic() + seen_after_root = [] + completed = False + while True: + _, current = self.observe() + if process is not None and process.returncode is not None: + seen_after_root.extend(generation(row) for row in current if row['pid'] != process.pid) + self.kill_owned() + if process is not None: + process.poll() + for key in list(self.rows): + row = proc(key[0]) + if row is None or generation(row) != key or row['ppid'] != os.getpid(): + continue + if process is not None and row['pid'] == process.pid: + continue + try: + pid, status = os.waitpid(row['pid'], os.WNOHANG) + except ChildProcessError: + continue + if pid: + self.reaped.append({'pid': pid, 'start_ticks': key[1], 'wait_status': status}) + all_rows, current = self.observe() + occupied = [row for row in all_rows.values() if (row['pgid'], row['sid']) in self.groups] + if not current and not occupied and not children_now(): + completed = True + break + if time.monotonic() - start >= CLEANUP_SECONDS: + break + time.sleep(0.01) + final_rows = census() + remaining = [row for row in final_rows.values() if + generation(row) in self.rows or (row['pgid'], row['sid']) in self.groups or + row['ppid'] == os.getpid()] + for fd in self.fds.values(): + os.close(fd) + self.fds.clear() + return {'complete': completed and not remaining, + 'owned_generations': list(self.rows.values()), + 'groups': [{'pgid': g, 'sid': s} for g, s in sorted(self.groups)], + 'reaped_adopted': self.reaped, + 'observed_after_root_exit': [list(key) for key in sorted(set(seen_after_root))], + 'remaining': remaining, 'cleanup_seconds': time.monotonic() - start, + 'cleanup_tail_limit_seconds': CLEANUP_SECONDS, + 'group_empty_proved': completed and not remaining, + 'signal_method': 'SIGKILL via generation-checked pidfd only; never killpg'} + + +def reconcile_missing_receipt(root, label, began, cause, cleanup): + folder = root / 'runtime/runs' / label + folder.mkdir(exist_ok=True) + if not cleanup['complete'] and not (folder / 'receipt.json').exists(): + # A surviving root must never race a replacement canonical receipt. + # Leave its attempt unclosed, blocking the unchanged runner, and add a + # distinct charged STOP record for the parent to reconcile manually. + folder = root / 'runtime/runs' / (label + '-outer-unclosed-stop') + folder.mkdir() + path = folder / 'receipt.json' + if path.exists(): + return None + start = {} + if (folder / 'START.json').exists(): + start, _ = read_json(folder / 'START.json') + row = dict(start, schema='h25-outer-reconciled-stop-v1', status='STOP', label=label, + kind='outer_reconciled_incomplete_root', termination=cause, attempt_label=label, + wall_seconds=time.monotonic() - began, original_root_receipt_absent=True, + original_root_completion_claimed=False, cleanup_complete=cleanup['complete'], + all_prior_files_preserved=True) + row['label'] = folder.name + row['runner_wall_seconds'] = row['wall_seconds'] + if not (folder / 'START.json').exists(): + write_new(folder / 'START.json', {'kind': row['kind'], 'label': label}) + write_new(path, row) + return row + + +def run_root(root, case, evidence, seconds, shared_deadline, as_bytes=201326592, + rss_bytes=201326592): + """One root. Cleanup and stable custody finish before returning to a queue.""" + launch_contract() + need(stable_file(root / 'run_guarded_v3.py', META_CAP)['sha256'] == RUNNER_SHA, + 'Actual root runner changed') + need(time.monotonic() + CLEANUP_SECONDS < shared_deadline, 'No reserved cleanup tail remains') + command = ['/usr/bin/python3.12', *FLAGS, str(root / 'run_guarded_v3.py'), + case['stage'], case['job'], case['label']] + for value in (case['stage'], case['job'], case['label']): + need(type(value) is str and value and all(c in 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_' for c in value), + 'Unsafe case identity') + evidence.mkdir() + need(type(seconds) in (int, float) and 0 < seconds <= 190, 'Unadmitted root deadline') + need(type(as_bytes) is int and 0 < as_bytes <= 1024 ** 3, 'Unadmitted root address-space bound') + need(type(rss_bytes) is int and 0 < rss_bytes <= 1024 ** 3, 'Unadmitted aggregate RSS bound') + began = time.monotonic() + deadline = min(began + seconds, shared_deadline - CLEANUP_SECONDS) + domain = OwnedDomain() + process, failure, cleanup = None, None, None + peak, spawn_entered, captured = 0, False, None + setter, limit_kind, limits = resource.setrlimit, resource.RLIMIT_AS, (as_bytes, as_bytes) + need(list(Path('/proc/self/task').iterdir()) == [Path('/proc/self/task') / str(os.getpid())], + 'Root preexec requires exactly one task') + def child_limit(): + setter(limit_kind, limits) + old_handler = signal.getsignal(signal.SIGALRM) + need(signal.getitimer(signal.ITIMER_REAL) == (0.0, 0.0), 'Parent already has an execution alarm') + write_new(evidence / 'LAUNCH.json', {'command': command, 'parent_pid': os.getpid(), + 'parent_pgid': os.getpgrp(), 'parent_sid': os.getsid(0), + 'root_execution_seconds': seconds, 'address_space_bytes': as_bytes, + 'rss_sum_bytes': rss_bytes, 'new_session': True, 'cleanup_reserved_seconds': CLEANUP_SECONDS}) + try: + with (evidence / 'root.stdout.raw').open('xb') as out, (evidence / 'root.stderr.raw').open('xb') as err: + signal.signal(signal.SIGALRM, deadline_handler) + signal.setitimer(signal.ITIMER_REAL, max(0.000001, deadline - time.monotonic())) + try: + spawn_entered = True + process = subprocess.Popen(command, cwd=root, env=dict(ENV), stdout=out, + stderr=err, start_new_session=True, preexec_fn=child_limit) + # Popen leaves an exited root waitable; capture its generation BEFORE poll. + captured = proc(process.pid) + need(captured is not None and captured['pgid'] == captured['sid'] == process.pid, + 'New root process/session identity missing') + domain.root = generation(captured) + domain.add(captured) + write_new(evidence / 'ROOT-PROCESS.json', captured) + while True: + _, current = domain.observe() + peak = max(peak, sum(row['rss_bytes'] for row in current)) + need(peak <= rss_bytes, 'Owned process RSS sum exceeded') + need(max((evidence / name).stat().st_size for name in + ('root.stdout.raw', 'root.stderr.raw')) <= LOG_CAP, 'Outer raw log cap exceeded') + if process.poll() is not None: + break + time.sleep(0.01) + finally: + signal.setitimer(signal.ITIMER_REAL, 0) + signal.signal(signal.SIGALRM, old_handler) + except BaseException as error: + failure = {'type': type(error).__name__, 'message': str(error)[:2048]} + finally: + signal.setitimer(signal.ITIMER_REAL, 0) + signal.signal(signal.SIGALRM, old_handler) + # This is also required when Popen raised before returning an object. + try: + cleanup = domain.cleanup(process) + except BaseException as cleanup_error: + cleanup = {'complete': False, 'group_empty_proved': False, + 'owned_generations': list(domain.rows.values()), + 'groups': [{'pgid': g, 'sid': sid} for g, sid in sorted(domain.groups)], + 'reaped_adopted': domain.reaped, 'observed_after_root_exit': [], + 'remaining': 'UNKNOWN_AFTER_CLEANUP_ERROR', + 'error': {'type': type(cleanup_error).__name__, 'message': str(cleanup_error)[:2048]}} + for fd in domain.fds.values(): + os.close(fd) + domain.fds.clear() + if not cleanup['complete']: + failure = failure or {'type': 'CleanupIncomplete', 'message': 'Owned descendants/group remain after bounded cleanup tail'} + if time.monotonic() > shared_deadline: + failure = failure or {'type': 'SharedDeadline', 'message': 'Shared cap crossed; necessary cleanup charged'} + reconciled = reconcile_missing_receipt(root, case['label'], began, + failure or {'type': 'MissingRootReceipt', 'message': 'Root exited without receipt'}, cleanup) + if reconciled is not None: + failure = failure or {'type': 'MissingRootReceipt', 'message': 'New reconciled STOP receipt; no retry'} + logs = {} + for name in ('root.stdout.raw', 'root.stderr.raw'): + try: + logs[name] = stable_file(evidence / name, LOG_CAP) + except BaseException as error: + failure = failure or {'type': type(error).__name__, 'message': str(error)[:2048]} + logs[name] = {'path': str(evidence / name), 'complete_hash': None, 'stable': False} + result = {'schema': 'h25-parent-root-supervision-v1', 'label': case['label'], + 'status': 'STOP' if failure else 'ROOT_COMPLETED_AND_OWNED_DOMAIN_EMPTY', + 'failure': failure, 'spawn_entered': spawn_entered, + 'spawn_returned': process is not None, 'captured_root': captured, + 'returncode': None if process is None else process.returncode, + 'cleanup': cleanup, 'outer_logs': logs, 'sampled_owned_rss_bytes': peak, + 'execution_and_cleanup_seconds': time.monotonic() - began, + 'root_receipt_reconciled': reconciled is not None, + 'no_hostile_fork_or_concurrent_children_claim': True} + write_new(evidence / 'SUPERVISION.json', result) + return result + + +def stop_supplement(root, label, reason): + folder = root / 'runtime/runs' / (label + '-supervision-stop') + folder.mkdir() + row = {'status': 'STOP', 'label': folder.name, 'kind': 'supervision_failure_marker', + 'failure': reason, 'wall_seconds': 0.0, 'runner_wall_seconds': 0.0, + 'cost_accounted_by_enclosing_queue_overhead': True, 'original_receipts_preserved': True} + write_new(folder / 'START.json', {'kind': row['kind']}) + write_new(folder / 'receipt.json', row) + + +def packet_unchanged(directory, manifest): + for name, expected in manifest['files'].items(): + row = stable_file(directory / name, META_CAP) + need(row['sha256'] == expected['sha256'] and row['bytes'] == expected['bytes'], + 'Parent source packet changed: ' + name) + need(not (directory / name).stat().st_mode & 0o222, 'Parent source packet became writable') + return True diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/parent_closure_v1.py b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/parent_closure_v1.py new file mode 100644 index 0000000000..cd9b3758ac --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/parent_closure_v1.py @@ -0,0 +1,271 @@ +"""Finite concrete receiver admission inside the original trusted parent. + +This verifies pinned source, bytecode derived from those bytes without executing +them, concrete local import edges, and the current captured object graph. It is +not a new Python sandbox or proof of the initial OS/interpreter/native memory. +The original parent must load these exact modules through its admitted bootstrap +before adverse input. No user supplied arbitrary checker is accepted. +""" +import ast +import builtins +import __future__ +import copy +import dataclasses +import fcntl +import gc +import hashlib +import json +import marshal +import math +import os +import pathlib +import posix +import resource +import signal +import struct +import subprocess +import sys +import time +import types +import epoch_schema_v5 as schema +import epoch_copy_v5 as copying + +_TYPE, _LEN, _COMPILE = type, len, compile +_MODULE_DICT = types.ModuleType.__dict__['__dict__'].__get__ +_FUNCTION_GETTERS = tuple(types.FunctionType.__dict__[name].__get__ for name in + ('__code__', '__globals__', '__builtins__', '__defaults__', '__kwdefaults__', '__closure__', '__dict__')) +_CELL_GET = types.CellType.__dict__['cell_contents'].__get__ +_CLASS_DICT = type.__dict__['__dict__'].__get__ +_STATIC_FUNCTION = staticmethod.__dict__['__func__'].__get__ +_CLASS_FUNCTION = classmethod.__dict__['__func__'].__get__ +_SOURCE_RECEIVERS = [] +_STDLIB_MODULES = {name: module for name, module in tuple(sys.modules.items()) + if _TYPE(name) is str and _TYPE(module) is types.ModuleType} +MAX_MODULES = 48 +MAX_GLOBALS = 512 + +# These exact registries are intentionally mutated only by their original +# source. Their object identities are still checked. Private-state sabotage +# by code already running in this trusted parent remains outside the boundary. +_MUTABLE_NAMES = { + 'v03_prefix_supervisor_v1': ('_PREFIX', '_UNKNOWN_OWNER'), + 'epoch_parent_v5': ('_RESERVED_EPOCHS', '_PARENT_OWNERS'), + 'epoch_schema_v5': ('_ERROR_OWNERS',), + 'epoch_stop_v5': ('_SINK_REGISTRY',), + 'parent_domain_v1': ('_DOMAINS',), + 'parent_completion_v1': ('_PARENTS', '_PROCESS'), + 'parent_closure_v1': ('_SOURCE_RECEIVERS',), +} +_GATE_SUFFIXES = ('CONFIGURATION', 'SOURCE_REVIEW', 'EXECUTION_APPROVAL', 'FUNDING', + 'STAGE_APPROVAL', 'COMMAND_APPROVAL', 'VALIDATION_EXECUTION') + + +def _namespace(module): + schema.need(_TYPE(module) is types.ModuleType, 'exact original module required') + namespace = _MODULE_DICT(module, types.ModuleType) + schema.need(_TYPE(namespace) is dict and _LEN(namespace) <= MAX_GLOBALS, + 'original module namespace bound differs') + for key in namespace: + schema.text(key, 256) + return namespace + + +def _function_record(function): + schema.need(_TYPE(function) is types.FunctionType, 'exact source function required') + values = tuple(getter(function, types.FunctionType) for getter in _FUNCTION_GETTERS) + closure = values[5] + cells = () if closure is None else tuple((cell, _CELL_GET(cell, types.CellType)) for cell in closure) + schema.need(_LEN(cells) <= 64, 'source function closure bound exceeded') + return function, values, cells + + +def _function_check(record): + function, values, cells = record + schema.need(_TYPE(function) is types.FunctionType, 'source function identity changed') + for getter, expected in zip(_FUNCTION_GETTERS, values): + schema.need(getter(function, types.FunctionType) is expected, + 'source function code/globals/builtins/defaults/closure/dict changed') + for cell, expected in cells: + schema.need(_CELL_GET(cell, types.CellType) is expected, 'source function closure contents changed') + + +def _codes(code, result): + result.setdefault(code.co_qualname, []).append(code) + for child in code.co_consts: + if _TYPE(child) is types.CodeType: + _codes(child, result) + + +def _data(value, depth=0): + """Snapshot literal data only; no foreign repr/hash/eq/iteration protocols.""" + schema.need(depth <= 32, 'literal snapshot depth exceeded') + kind = _TYPE(value) + if value is None or kind in (str, int, bool, bytes, float): + return (kind, value) + if kind in (list, tuple): + schema.need(_LEN(value) <= 65536, 'literal sequence bound exceeded') + return (kind, tuple(_data(item, depth + 1) for item in value)) + if kind is dict: + schema.need(_LEN(value) <= 8192, 'literal mapping bound exceeded') + for key in value: + schema.need(_TYPE(key) in (str, int), 'nonliteral mapping key') + return (kind, tuple((_data(key, depth + 1), _data(item, depth + 1)) + for key, item in value.items())) + if kind in (set, frozenset): + schema.need(_LEN(value) <= 8192 and all(_TYPE(item) in (str, int) for item in value), + 'nonliteral set value') + return (kind, frozenset(value)) + raise schema.EpochStop('not literal data') + + +def _validate_code(function, compiled_codes, namespace): + values = tuple(getter(function, types.FunctionType) for getter in _FUNCTION_GETTERS) + code = values[0] + schema.need(values[1] is namespace and values[2] is builtins.__dict__, + 'source function original namespace/builtins differs') + candidates = compiled_codes.get(code.co_qualname, ()) + encoded = marshal.dumps(code) + schema.need(any(marshal.dumps(expected) == encoded for expected in candidates), + 'receiving function bytecode differs from pinned source') + + +def bind_receivers(modules, source_policy, error_owner): + """Only the source-fixed original parent calls this before child launch. + + source_policy is a separately pinned, prelaunch source inventory, never a + report supplied by a child. The two producer-specific validators have fixed + names; unsupported or absent variant source cannot be substituted by a + callable argument. Every received module must be listed in the policy. + """ + schema.owner_state(error_owner) + schema.need(_TYPE(modules) is dict and 1 <= _LEN(modules) <= MAX_MODULES and + _TYPE(source_policy) is dict, 'finite receiver module map required') + for name in modules: + schema.text(name, 128) + for name in source_policy: + schema.text(name, 128) + schema.need(set(modules) == set(source_policy), 'exact receiver closure differs') + records = [] + for name in sorted(modules): + module = modules[name] + namespace = _namespace(module) + pin = source_policy[name] + schema.blob(pin) + raw = copying.read_verified(pin, schema.FILE_BYTES, error_owner=error_owner) + schema.need(namespace.get('__name__') == name and namespace.get('__file__') == pin['path'], + 'original receiving module origin differs') + tree = ast.parse(raw, filename=pin['path']) + compiled = _COMPILE(raw, pin['path'], 'exec', dont_inherit=True, optimize=sys.flags.optimize) + compiled_codes = {} + _codes(compiled, compiled_codes) + functions, classes, literals, imports = [], [], [], [] + for node in tree.body: + if _TYPE(node) is ast.FunctionDef: + function = namespace[node.name] + _validate_code(function, compiled_codes, namespace) + functions.append(_function_record(function)) + elif _TYPE(node) is ast.ClassDef: + cls = namespace[node.name] + schema.need(_TYPE(cls) is type, 'source class type differs') + class_namespace = _CLASS_DICT(cls, type) + for item in node.body: + if _TYPE(item) is ast.FunctionDef: + method = class_namespace[item.name] + # The currently selected explicit methods have no + # property/classmethod/staticmethod decorators. + schema.need(not item.decorator_list, 'unreviewed decorated receiver method') + # Python implicitly wraps __new__ and two class hooks. + # No arbitrary descriptor protocol is invoked. + if item.name == '__new__' and _TYPE(method) is staticmethod: + method = _STATIC_FUNCTION(method, staticmethod) + elif item.name in ('__init_subclass__', '__class_getitem__') and _TYPE(method) is classmethod: + method = _CLASS_FUNCTION(method, classmethod) + _validate_code(method, compiled_codes, namespace) + functions.append(_function_record(method)) + # Dataclass-generated methods are part of the inherited + # dataclasses/initial-parent trust, not compiled from this + # class body. Their actual original code/environment remains + # captured and checked; they cannot be changed after capture. + for method in class_namespace.values(): + if _TYPE(method) is types.FunctionType and not any(method is r[0] for r in functions): + functions.append(_function_record(method)) + classes.append((cls, tuple(class_namespace.items()))) + elif _TYPE(node) in (ast.Import, ast.ImportFrom): + for alias in node.names: + schema.need(alias.name != '*', 'star receiver import unsupported') + if _TYPE(node) is ast.Import: + source_name = alias.name + local_name = alias.asname or source_name.split('.')[0] + expected = modules.get(source_name, _STDLIB_MODULES.get(source_name)) + else: + source_name = node.module + schema.need(node.level == 0, 'relative receiver import unsupported') + local_name = alias.asname or alias.name + source_module = modules.get(source_name, _STDLIB_MODULES.get(source_name)) + schema.need(source_module is not None, 'receiver import dependency absent') + expected = _namespace(source_module).get(alias.name) + schema.need(expected is not None and namespace.get(local_name) is expected, + 'concrete receiving import identity differs') + imports.append((local_name, expected)) + elif _TYPE(node) is ast.Assign: + if _LEN(node.targets) != 1 or _TYPE(node.targets[0]) is not ast.Name: + continue + key = node.targets[0].id + if key in _MUTABLE_NAMES.get(name, ()) or key.endswith(_GATE_SUFFIXES): + continue + try: + literal = ast.literal_eval(node.value) + except (ValueError, TypeError, SyntaxError): + continue + schema.need(_data(namespace[key]) == _data(literal), 'receiver literal differs from source') + literals.append((key, _data(literal))) + for function in namespace.values(): + if _TYPE(function) is types.FunctionType and not any(function is r[0] for r in functions): + functions.append(_function_record(function)) + records.append((name, module, namespace, pin, tuple(namespace.items()), + tuple(functions), tuple(classes), tuple(literals), tuple(imports))) + capability = object() + packet = (capability, tuple(records), error_owner) + schema.need(_LEN(_SOURCE_RECEIVERS) < 2, 'receiver closure finite parent bound exceeded') + _SOURCE_RECEIVERS.append(packet) + check_receivers(capability) + return capability + + +def _packet(capability): + schema.need(_TYPE(capability) is object, 'exact receiver capability required') + for packet in _SOURCE_RECEIVERS: + if packet[0] is capability: + return packet + raise schema.EpochStop('unknown original receiver closure') + + +def check_receivers(capability): + packet = _packet(capability) + for name, module, namespace, pin, original_items, functions, classes, literals, imports in packet[1]: + schema.need(_namespace(module) is namespace and _LEN(namespace) == _LEN(original_items), + 'receiver namespace identity/census changed') + for key, expected in original_items: + schema.need(namespace.get(key) is expected, 'receiver namespace binding changed') + for record in functions: + _function_check(record) + for cls, items in classes: + current = _CLASS_DICT(cls, type) + schema.need(_LEN(current) == _LEN(items), 'receiver class census changed') + for key, expected in items: + schema.need(current.get(key) is expected, 'receiver class binding changed') + for key, expected in literals: + schema.need(_data(namespace[key]) == expected, 'receiver literal data changed') + copying.verify(pin, error_owner=packet[2]) + return None + + +def receiver(capability, module_name, name): + """Return only a specifically named original from the registered closure.""" + schema.text(module_name, 128) + schema.text(name, 128) + for row in _packet(capability)[1]: + if row[0] == module_name: + schema.need(name in row[2], 'fixed receiving entry missing') + return row[2][name] + raise schema.EpochStop('fixed receiving module missing') diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/parent_completion_v1.py b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/parent_completion_v1.py new file mode 100644 index 0000000000..3191be7570 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/parent_completion_v1.py @@ -0,0 +1,880 @@ +"""Source-only two-producer completion owner for one future guarded parent. + +No configuration or execution gate is installed. The original trusted parent +must authenticate this source, its exact receiver closure and initial OS/runtime +before importing it. Capabilities are process local. This component never +invokes run_guarded, a queue wrapper, a global ledger writer, or a child report +as authority. The enclosing single orchestrator pays this entire component +once, including all child, validation, retention, failure and final-exit costs. +""" +import fcntl +import os +import resource +import signal +import stat +import subprocess +import sys +import time +import epoch_schema_v5 as schema +import epoch_copy_v5 as copying +import epoch_parent_v5 as epoch +import parent_closure_v1 as closure +import parent_domain_v1 as domain +import group01_evidence_v1 as group01 + +CONFIGURATION = None +SOURCE_REVIEW = None +STAGE_APPROVAL = None +COMMAND_APPROVAL = None +FUNDING = None +EXECUTION_APPROVAL = None + +FLAGS = ('-S', '-s', '-P', '-B') +ENV = {'PATH': '/usr/bin:/bin', 'PYTHONHASHSEED': '0', 'LANG': 'C.UTF-8', + 'LC_ALL': 'C.UTF-8', 'TZ': 'UTC', 'PYTHONDONTWRITEBYTECODE': '1'} +_TYPE, _LEN = type, len +_OPEN, _CLOSE, _MKDIR, _STAT, _SCANDIR = os.open, os.close, os.mkdir, os.stat, os.scandir +_POPEN = subprocess.Popen +_CLOCK, _SLEEP = time.monotonic, time.sleep +_SETRLIMIT, _GETRLIMIT = resource.setrlimit, resource.getrlimit +_SETTIMER, _GETTIMER = signal.setitimer, signal.getitimer +_SIGNAL, _GETSIGNAL = signal.signal, signal.getsignal +_PARENTS = [] +_PROCESS = [None] +# Shared before the first constructor read, including failures before a parent +# capability can be published. No mode can replace or reset this owner. +_UNKNOWN_OWNER = {'quarantine': [False], 'pending': [False], + 'iterator_uncertain': [False], 'primary': [None], + 'native_errors': [None] * 4} +_EPOCH_ENTRY = epoch._entry_state +_EPOCH_RESERVE = epoch.ParentEpoch.reserve_producer +_EPOCH_ACCEPT = epoch.ParentEpoch.accept_completed_producer +_EPOCH_COMPLETION = epoch.ParentCompletion +_EPOCH_COMMIT = epoch.ParentEpoch.commit_exports +_EPOCH_CLOSE = epoch.ParentEpoch.close +MAX_SOURCE_FILES = 8192 +MAX_STAGE_ENTRIES = 16384 +MAX_RAW_VARIANT_FILES = 64 +VARIANT_MODULE = 'variant_validation_v1' +VARIANT_FUNCTION = 'validate_variant_producer' +MAX_VARIANT_RAW_BYTES = 32 * 1024 * 1024 +# Source-literal inventory copied from the separately pinned concrete interface. +VARIANT_FILES = ('initial-tcb.raw.json', 'initial-controls.raw.json', 'initial-restoration.raw.json', 'root-before.raw.json', 'preflight-before.raw.json', 'custody-before.raw.json', 'pyinit_failure/control.attempt.json', 'pyinit_failure/control.attempt.jsonl', 'pyinit_failure/control.stdout.raw', 'pyinit_failure/control.stderr.raw', 'pyinit_failure/helper-return.raw.json', 'pyinit_failure/build.json', 'pyinit_failure/_h25_dict_probe.cpython-312-x86_64-linux-gnu.so', 'pyinit_failure/elf.raw.json', 'exec_failure/control.attempt.json', 'exec_failure/control.attempt.jsonl', 'exec_failure/control.stdout.raw', 'exec_failure/control.stderr.raw', 'exec_failure/helper-return.raw.json', 'exec_failure/build.json', 'exec_failure/_h25_dict_probe.cpython-312-x86_64-linux-gnu.so', 'exec_failure/elf.raw.json', 'preflight-after.raw.json', 'custody-after.raw.json', 'root-after.raw.json', 'receipt.json') +VARIANT_GROUPS = ('initial-tcb.raw.json', 'initial-controls.raw.json', 'initial-restoration.raw.json', 'root-before.raw.json', 'preflight-before.raw.json', 'custody-before.raw.json', 'pyinit_failure/helper-return.raw.json', 'pyinit_failure/elf.raw.json', 'exec_failure/helper-return.raw.json', 'exec_failure/elf.raw.json', 'preflight-after.raw.json', 'custody-after.raw.json', 'root-after.raw.json') +REQUIRED_MODULES = ( + 'epoch_schema_v5', 'epoch_copy_v5', 'epoch_parent_v5', 'epoch_stop_v5', + 'original_build_provenance_v5', 'h25_parent_supervisor', 'parent_closure_v1', + 'parent_domain_v1', 'parent_completion_v1', 'group01_evidence_v1', + 'group01_original_predicates_v1', 'receipt_contract_v1', 'native_field_controls_v1', + 'transport_controls_v1', 'collector_controls_v1', 'elf_literal_fixture_v1', + 'elf_controls_v1', 'provider_controls_v1', 'run_pure_controls_v1', + 'elf_literal_fixture_v2', 'elf_extended_controls_v2', 'run_pure_controls_v2', + 'restoration_contract_v1', 'loader_model_controls_v1', 'driver_model_body_sources_v3', + 'root_model_body_sources_v3', 'loader_model_controls_v3', 'group_evidence_v5', + 'close_model_controls_v5', 'projection_model_controls_v5', 'run_controls_v5', + 'variant_validation_v1', 'sealed_elf_profile_v2') + + +class ParentDeadline(RuntimeError): + pass + + +def _alarm(signum, frame): + raise ParentDeadline('owned producer deadline including Popen/preexec') + + +def _gate(): + schema.exact(CONFIGURATION, ('plans', 'receiver_policy', 'checker_source')) + schema.exact(CONFIGURATION['plans'], ('normal', 'optimized')) + for pin in tuple(CONFIGURATION['plans'].values()) + (CONFIGURATION['receiver_policy'], CONFIGURATION['checker_source']): + schema.blob(pin, schema.RECORD_BYTES) + for record, key in ((SOURCE_REVIEW, 'review_sha256'), (STAGE_APPROVAL, 'stage_review_sha256'), + (COMMAND_APPROVAL, 'command_review_sha256'), (FUNDING, 'reservation_sha256'), + (EXECUTION_APPROVAL, 'external_launch_policy_sha256')): + schema.exact(record, (key,)) + schema.digest(record[key]) + + +def _state(capability): + schema.need(_TYPE(capability) is object, 'exact parent capability required') + for token, state in _PARENTS: + if token is capability: + return state + raise schema.EpochStop('unregistered parent completion owner') + + +def _receiver_gate_values(receivers): + # Fail before any producer if the concrete downstream parsers are still + # source-only. These stronger parent envelopes are installed by the + # independently authenticated original bootstrap; hashes alone grant none. + specifications = ( + ('original_build_provenance_v5', 'PARSER_CONFIGURATION', + ('leaf_policy_sha256', 'configuration_sha256', 'original_helper_sha256')), + ('original_build_provenance_v5', 'PARSER_EXECUTION_APPROVAL', ('external_launch_policy_sha256',)), + ('original_build_provenance_v5', 'PARSER_FUNDING', ('reservation_sha256',)), + ('variant_validation_v1', 'VALIDATION_CONFIGURATION', ('leaf_policy_sha256', 'configuration_sha256')), + ('variant_validation_v1', 'VALIDATION_SOURCE_REVIEW', ('review_sha256',)), + ('variant_validation_v1', 'VALIDATION_EXECUTION', ('external_launch_policy_sha256',)), + ('variant_validation_v1', 'VALIDATION_FUNDING', ('reservation_sha256',))) + result = {} + for module, name, keys in specifications: + value = closure.receiver(receivers, module, name) + schema.exact(value, keys) + for item in value.values(): + schema.digest(item) + result[module + '.' + name] = schema.plain_copy(value) + schema.need(result['original_build_provenance_v5.PARSER_CONFIGURATION']['original_helper_sha256'] == + 'aa0a315110e031e19291970c9611fe5e0f91465fa20eaec51e81186099563f78', + 'original helper source protocol differs before producer launch') + return result + + +def _guard(state): + _gate() + schema.need(state['phase'] not in ('STOP', 'CLOSED'), 'parent completion owner is terminal') + domain.refresh_unknown_owner(state['unknown_owner']) + schema.need(state['io_quarantine'][0] is False and state['unknown_owner']['pending'][0] is False and + state['unknown_owner']['iterator_uncertain'][0] is False and + state['unknown_owner']['primary'][0] is None, + 'parent I/O ownership requires kernel teardown') + schema.need(os.getpid() == state['pid'], 'parent capability cannot cross exec/process') + schema.need(_POPEN is subprocess.Popen and _OPEN is os.open and _CLOSE is os.close and + _SETRLIMIT is resource.setrlimit and _GETRLIMIT is resource.getrlimit and + _CLOCK is time.monotonic and _SETTIMER is signal.setitimer and + _GETTIMER is signal.getitimer and _SIGNAL is signal.signal and + _GETSIGNAL is signal.getsignal, + 'original parent runtime primitive binding changed') + schema.need(epoch._entry_state is _EPOCH_ENTRY and epoch.ParentEpoch.reserve_producer is _EPOCH_RESERVE and + epoch.ParentEpoch.accept_completed_producer is _EPOCH_ACCEPT and + epoch.ParentCompletion is _EPOCH_COMPLETION and epoch.ParentEpoch.commit_exports is _EPOCH_COMMIT and + epoch.ParentEpoch.close is _EPOCH_CLOSE, 'original epoch receiving entry changed') + closure.check_receivers(state['receivers']) + schema.need(_receiver_gate_values(state['receivers']) == state['receiver_gate_snapshot'], + 'independently installed receiver gates changed') + for key in ('plan', 'receiver_policy', 'checker_source'): + current = CONFIGURATION['plans'][state['plan']['mode']] if key == 'plan' else CONFIGURATION[key] + schema.need(current == state['configuration'][key], 'configured source binding changed') + copying.verify(state['configuration'][key], error_owner=state['errors']) + schema.need(_CLOCK() <= state['shared_deadline'], 'complete parent reservation deadline exceeded') + + +def _stop(state, operation, primary): + # No formatting or instance dispatch on an exception. Capture failure is + # separate, never a reason to replace the already delivered primary. + state['phase'] = 'STOP' + # The shared slot was stored inline at the first delivered local/domain + # failure, before any optional retention helper or cleanup call. + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = primary + elif state['unknown_owner']['primary'][0] is not primary: + if state['fallback'][4] is None: + state['fallback'][4] = primary + primary = state['unknown_owner']['primary'][0] + if state['stop'][0] is None: + state['stop'][0] = primary + state['stop'][1] = operation + try: + domain.refresh_unknown_owner(state['unknown_owner']) + except BaseException as error: + # Failure even to inspect retained ownership cannot permit a writer. + state['io_quarantine'][0] = True + if state['fallback'][5] is None: + state['fallback'][5] = error + try: + schema.retain_primary(state['errors'], primary, operation) + except BaseException as error: + state['fallback'][0] = error + # An uncertain native acquisition prevents further diagnostic I/O. The + # outer guard must retain memory state and observe kernel parent teardown. + if (state['directory_created'] and not state['stop_write_attempted'] and not state['io_quarantine'][0] and + not state['unknown_owner']['pending'][0] and not state['unknown_owner']['iterator_uncertain'][0] and + not (_PROCESS[0] is not None and _PROCESS[0]['acquisition_in_flight'])): + try: + state['stop_write_attempted'] = True + record = {'schema': 'h25-parent-completion-stop-v1', 'operation': operation, + 'epoch_id': state['plan']['epoch_id'], 'mode': state['plan']['mode'], + 'status': 'STOP', 'retry_or_restore_allowed': False, + 'error': schema.error_snapshot(state['errors']), + 'domain_obligations_may_be_incomplete': True, + 'enclosing_guard_must_observe_parent_exit': True} + state['stop_file'] = copying.write_once(state['plan']['session_directory'] + '/STOP.json', + schema.canonical(record), error_owner=state['errors']) + except BaseException as error: + state['fallback'][1] = error + + +def _snapshot_sources(plan, error_owner): + schema.need(_TYPE(plan['source_files']) is list and 1 <= _LEN(plan['source_files']) <= MAX_SOURCE_FILES, + 'complete prelaunch source inventory bound differs') + rows, paths, categories = [], set(), set() + for expected in plan['source_files']: + schema.exact(expected, ('category', 'path', 'sha256', 'bytes', 'mode')) + schema.choice(expected['category'], ('parent', 'root', 'provider', 'driver', 'project', + 'system_headers', 'compiler_link', 'oracle', 'stage')) + schema.path(expected['path']) + schema.digest(expected['sha256']) + schema.integer(expected['bytes'], 1, schema.FILE_BYTES) + schema.integer(expected['mode'], 0, 0o7777) + schema.need(expected['path'] not in paths, 'duplicate prelaunch source path') + paths.add(expected['path']) + categories.add(expected['category']) + actual = copying.inspect(expected['path'], schema.FILE_BYTES, error_owner=error_owner) + schema.need(actual['sha256'] == expected['sha256'] and actual['bytes'] == expected['bytes'] and + actual['identity']['mode'] & 0o7777 == expected['mode'], 'source/profile/closure changed') + rows.append(actual) + schema.need(categories == {'parent', 'root', 'provider', 'driver', 'project', 'system_headers', + 'compiler_link', 'oracle', 'stage'}, 'a mandatory source category is absent') + return rows + + +def _tree(root, state): + """Bounded exact stage census; all actual file contents are separately read.""" + schema.path(root) + pending, files, directories = [('', root)], [], [] + count = 0 + while pending: + schema.need(state['io_quarantine'][0] is False and state['unknown_owner']['pending'][0] is False and + state['unknown_owner']['iterator_uncertain'][0] is False, + 'stage census cannot acquire after uncertain ownership') + relative, current = pending.pop() + before = _STAT(current, follow_symlinks=False) + schema.need(stat.S_ISDIR(before.st_mode) and not before.st_mode & 0o222, + 'immutable stage directory kind/mode differs') + entries, primary = None, None + state['unknown_owner']['pending'][0] = True + try: + entries = _SCANDIR(current) + state['unknown_owner']['pending'][0] = False + for entry in entries: + count += 1 + schema.need(count <= MAX_STAGE_ENTRIES, 'stage census bound exceeded') + name = entry.name + schema.need(_TYPE(name) is str and name not in ('.', '..') and '/' not in name, + 'stage entry name differs') + child = name if not relative else relative + '/' + name + info = entry.stat(follow_symlinks=False) + if stat.S_ISREG(info.st_mode): + files.append(child) + elif stat.S_ISDIR(info.st_mode): + directories.append(child) + pending.append((child, current + '/' + name)) + else: + raise schema.EpochStop('stage has symlink or special file') + except BaseException as error: + primary = error + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['io_quarantine'][0] = True + state['unknown_owner']['iterator_uncertain'][0] = True + state['fallback'][2] = error + raise + finally: + if entries is not None: + owned = entries + entries = None + try: + owned.close() + except BaseException as error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['io_quarantine'][0] = True + state['unknown_owner']['iterator_uncertain'][0] = True + state['fallback'][3] = error + if primary is None: + raise + after = _STAT(current, follow_symlinks=False) + schema.need((before.st_dev, before.st_ino, before.st_mode, before.st_mtime_ns, before.st_ctime_ns) == + (after.st_dev, after.st_ino, after.st_mode, after.st_mtime_ns, after.st_ctime_ns), + 'stage directory changed during census') + return sorted(files), sorted(directories) + + +def _stage(plan, error_owner, state): + copying.verify(plan['stage_manifest'], error_owner=error_owner) + raw = copying.read_verified(plan['stage_manifest'], schema.RECORD_BYTES, error_owner=error_owner) + declared = group01.decode(raw) + schema.need(_TYPE(declared.get('files')) is dict and + plan['stage_manifest']['path'] == plan['stage_directory'] + '/STAGE.json', + 'independent stage manifest origin differs') + files, directories = _tree(plan['stage_directory'], state) + schema.need(files == sorted(list(declared['files']) + ['STAGE.json']) and + directories == plan['stage_directories'], 'complete immutable stage census differs') + source_by_path = {row['path']: row for row in plan['source_files']} + for relative, expected in declared['files'].items(): + schema.need(_TYPE(relative) is str and not relative.startswith('/') and + all(part not in ('', '.', '..') for part in relative.split('/')), + 'stage relative path differs') + path = plan['stage_directory'] + '/' + relative + schema.need(path in source_by_path and expected == + {'sha256': source_by_path[path]['sha256'], 'mode': source_by_path[path]['mode']}, + 'stage file absent from independently fixed current source closure') + return {'manifest': plan['stage_manifest'], 'file_count': len(files), 'directories': directories} + + +def _validate_plan(plan): + schema.exact(plan, ('schema', 'epoch_id', 'mode', 'round_root', 'session_directory', + 'session_seconds', 'source_closure_admission_sha256', 'source_files', 'producers')) + schema.need(plan['schema'] == 'h25-parent-completion-plan-v1', 'parent plan schema differs') + schema.label(plan['epoch_id']) + schema.choice(plan['mode'], ('normal', 'optimized')) + schema.path(plan['round_root']) + schema.path(plan['session_directory']) + schema.integer(plan['session_seconds'], 1, 600) + schema.digest(plan['source_closure_admission_sha256']) + schema.exact(plan['producers'], ('group01', 'failure_variants')) + for role in schema.PRODUCERS: + row = plan['producers'][role] + schema.exact(row, ('epoch_plan', 'command', 'cwd', 'output', 'evidence_directory', + 'stage_directory', 'stage_manifest', 'stage_directories', 'launch_binding', 'launch_nonce', + 'root_seconds', 'address_space_bytes', 'rss_bytes', 'evidence_plan', 'launch_artifacts')) + epoch._plan(row['epoch_plan'], role) + schema.launch(row['launch_binding']) + schema.text(row['launch_nonce'], 64) + schema.need(_LEN(row['launch_nonce']) == 64 and + all(c in '0123456789abcdef' for c in row['launch_nonce']), 'one-use launch nonce differs') + for key in ('cwd', 'output', 'evidence_directory', 'stage_directory'): + schema.path(row[key]) + schema.blob(row['stage_manifest'], schema.RECORD_BYTES) + schema.need(row['stage_manifest']['sha256'] == row['epoch_plan']['stage_sha256'] == + row['launch_binding']['stage_sha256'], 'independent producer stage pins differ') + schema.need(row['launch_binding']['root_sha256'] == row['epoch_plan']['root_sha256'], + 'independent producer root pins differ') + schema.integer(row['root_seconds'], 1, 180) + schema.integer(row['address_space_bytes'], 1, 1024 ** 3) + schema.integer(row['rss_bytes'], 1, 1024 ** 3) + command = row['command'] + schema.need(_TYPE(command) is list and 6 <= _LEN(command) <= 128, 'bounded original root argv required') + for argument in command: + schema.text(argument, 8192) + schema.need(bool(argument), 'empty root argument') + prefix = ['/usr/bin/python3.12', *FLAGS] + (['-O'] if plan['mode'] == 'optimized' else []) + schema.need(command[:len(prefix)] == prefix, 'original root interpreter/flags/mode differs') + entry = command[len(prefix)] + schema.path(entry) + schema.need(entry.startswith(row['stage_directory'] + '/') and + entry == row['stage_directory'] + '/integration/full_driver.py', + 'source-fixed genuine root entry differs') + schema.need(command.count('--output') == 1 and + command[command.index('--output') + 1] == row['output'], 'independent root output differs') + args = command[len(prefix) + 1:] + schema.need(len(args) >= 11 and args[0] == '--root-sha256' and args[2] == '--provider' and + args[5] == '--driver' and args[8] == '--integration' and args[10] == '--', + 'original bootstrap argv positions differ') + by_path = {item['path']: item for item in plan['source_files']} + integration = row['stage_directory'] + '/integration' + schema.need(args[1] == row['epoch_plan']['root_sha256'] and args[9] == integration and + args[3].rsplit('/', 1)[0] == args[6].rsplit('/', 1)[0] == integration, + 'actual root/provider/driver source origins differ') + for path, digest, category in ((entry, args[1], 'root'), (args[3], args[4], 'provider'), + (args[6], args[7], 'driver')): + schema.need(path in by_path and by_path[path]['sha256'] == digest and + by_path[path]['category'] == category, 'bootstrap hash not in independent source closure') + schema.exact(row['launch_artifacts'], ('configuration_sha256', 'startup_tcb_sha256', 'expected_history_sha256')) + for key, pin in row['launch_artifacts'].items(): + schema.blob(pin, schema.RECORD_BYTES) + schema.need(pin['sha256'] == row['launch_binding'][key] and pin['path'] in by_path and + by_path[pin['path']]['sha256'] == pin['sha256'] and + by_path[pin['path']]['bytes'] == pin['bytes'], 'launch data binding lacks actual source pin') + evidence = row['evidence_plan'] + if role == 'group01': + schema.need(command.count('--finite-only') == 1 and command.count('--lanes') == 1 and + command[command.index('--lanes') + 1] == 'candidate', 'Group01 must use original finite candidate route') + schema.need(evidence['mode'] == plan['mode'] and evidence['generation'] == row['epoch_plan']['generation'] and + evidence['stage_sha256'] == row['epoch_plan']['stage_sha256'] and + evidence['root_sha256'] == args[1] and evidence['driver_sha256'] == args[7], + 'Group01 evidence expectation not bound to actual independent launch') + else: + schema.need(args[11:] == ['--output', row['output'], '--generation', row['epoch_plan']['generation'], + '--launch-nonce', row['launch_nonce']], 'variant exact tail argv differs') + schema.need(args[1] == 'f5a2d33f2b4d3651f214156a0e7094c2bb516ce2d5ab7698d18c11f98f35dee0' and + args[3] == integration + '/probe_binding_v3.py' and + args[4] == '9cbb7368f89e71d1e6cc46db5dc77efed3e03ed2a801c98c88fe316e4d9f3ef2' and + args[6] == integration + '/variant_driver_v1.py', 'variant genuine original bootstrap differs') + schema.need(evidence['binding'] == {'mode': plan['mode'], 'generation': row['epoch_plan']['generation'], + 'launch_nonce': row['launch_nonce']} and evidence['output'] == row['output'] and + evidence['stage_root'] == row['stage_directory'] and evidence['raw_file_names'] == list(VARIANT_FILES), + 'variant expectation not bound to actual independent launch') + schema.need(schema.sha(schema.canonical({'argv': command})) == row['epoch_plan']['command_sha256'] == + row['launch_binding']['command_sha256'], 'independent exact root command digest differs') + schema.need(row['evidence_directory'] == plan['session_directory'] + '/' + role and + row['output'] == row['evidence_directory'] + '/producer-output', + 'source-fixed private producer origins differ') + schema.need(plan['producers']['group01']['launch_nonce'] != plan['producers']['failure_variants']['launch_nonce'], + 'producer exec launch nonce reused') + + +def make_parent(original_epoch, original_authority, original_receivers): + _gate() + schema.need(_LEN(_PARENTS) < 2, 'finite two-mode parent owner bound exceeded') + # A second mode shares the same process and therefore the same unknown + # resources. Check before the first configuration read can acquire an FD. + for unused, prior in _PARENTS: + owner = prior['unknown_owner'] + domain.refresh_unknown_owner(owner) + schema.need(prior['phase'] != 'STOP' and owner['primary'][0] is None and + owner['quarantine'][0] is False and owner['pending'][0] is False and + owner['iterator_uncertain'][0] is False, + 'prior parent failure forbids a new mode or configuration read') + schema.need(_PROCESS[0] is None or _PROCESS[0]['acquisition_in_flight'] is False, + 'uncertain process-owned lock acquisition requires kernel teardown') + owner = _UNKNOWN_OWNER + domain.refresh_unknown_owner(owner) + schema.need(owner['primary'][0] is None and owner['quarantine'][0] is False and + owner['pending'][0] is False and owner['iterator_uncertain'][0] is False, + 'earlier constructor failure prohibits configuration reads') + try: + errors = schema.make_error_owner() + native_index = 2 * len(_PARENTS) + owner['native_errors'][native_index] = schema.owner_state(errors) + original_state = _EPOCH_ENTRY(original_epoch, original_authority) + owner['native_errors'][native_index + 1] = schema.owner_state(original_state['_error_owner']) + domain.refresh_unknown_owner(owner) + schema.need(owner['quarantine'][0] is False, 'original V5 owner already requires teardown') + mode = original_state['_mode'] + schema.choice(mode, ('normal', 'optimized')) + schema.need(not any(item[1]['plan']['mode'] == mode for item in _PARENTS), 'mode parent already consumed') + configuration = schema.plain_copy({'plan': CONFIGURATION['plans'][mode], + 'receiver_policy': CONFIGURATION['receiver_policy'], 'checker_source': CONFIGURATION['checker_source']}) + plan = group01.decode(copying.read_verified(configuration['plan'], schema.RECORD_BYTES, error_owner=errors)) + _validate_plan(plan) + policy = group01.decode(copying.read_verified(configuration['receiver_policy'], schema.RECORD_BYTES, error_owner=errors)) + schema.need(set(policy) == set(REQUIRED_MODULES), 'exact fixed parent/producer receiving closure differs') + schema.need(policy['parent_completion_v1'] == configuration['checker_source'], + 'actual completion source differs from configured checker') + receivers = closure.bind_receivers(original_receivers, policy, errors) + receiver_gate_snapshot = _receiver_gate_values(receivers) + schema.need(closure.receiver(receivers, 'epoch_parent_v5', 'ParentEpoch') is epoch.ParentEpoch and + closure.receiver(receivers, 'epoch_schema_v5', 'need') is schema.need and + closure.receiver(receivers, 'epoch_copy_v5', 'inspect') is copying.inspect, + 'parent/checker epoch module identities differ') + source_guard = closure.receiver(receivers, 'h25_parent_supervisor', 'launch_contract') + source_guard() + closure.check_receivers(receivers) + original_state = _EPOCH_ENTRY(original_epoch, original_authority) + schema.need(original_state['_epoch_id'] == plan['epoch_id'] and original_state['_mode'] == plan['mode'] and + original_state['_state'] == 'PRODUCERS_PENDING' and + original_state['_plans'] == {role: row['epoch_plan'] for role, row in plan['producers'].items()} and + epoch.CONFIGURATION['parent_checker_sha256'] == configuration['checker_source']['sha256'], + 'original constructor registry is not this prelaunch epoch/plan/checker') + token = object() + state = {'pid': os.getpid(), 'phase': 'CONSTRUCTING', 'epoch': original_epoch, + 'authority': original_authority, 'errors': errors, 'plan': plan, 'configuration': configuration, + 'receivers': receivers, 'receiver_gate_snapshot': receiver_gate_snapshot, + 'runs': {}, 'next': 0, 'directory_created': False, + 'stop': [None, None], 'fallback': [None] * 8, 'stop_file': None, + 'stop_write_attempted': False, 'io_quarantine': owner['quarantine'], + 'unknown_owner': owner, + 'began': _CLOCK(), 'shared_deadline': _CLOCK() + plan['session_seconds'], + 'subreaper': None, 'native_keeper': None, 'lock_fds': [None, None], + 'lock_attempted': [False, False], 'initial_sources': None} + _PARENTS.append((token, state)) + except BaseException as error: + # Reserve the original error before another call or native cleanup. + # This also covers failures before _PARENTS receives a capability. + if owner['primary'][0] is None: + owner['primary'][0] = error + owner['quarantine'][0] = True + raise + try: + # Exclusive creation is the persistent no-restore marker. It is never + # deleted by this source; a crashed/partial same-plan session cannot run. + _MKDIR(plan['session_directory'], 0o700) + state['directory_created'] = True + if _PROCESS[0] is None: + process_record = {'pid': state['pid'], 'locks': [None, None], 'keeper': None, + 'subreaper': None, 'acquisition_in_flight': False} + _PROCESS[0] = process_record + for index, name in enumerate(('parent-queue.lock', 'science.lock')): + process_record['acquisition_in_flight'] = True + process_record['locks'][index] = _OPEN(plan['round_root'] + '/runtime/' + name, + os.O_RDWR | os.O_CREAT | os.O_CLOEXEC | os.O_NOFOLLOW, 0o600) + process_record['acquisition_in_flight'] = False + fcntl.flock(process_record['locks'][index], fcntl.LOCK_EX | fcntl.LOCK_NB) + installer = closure.receiver(receivers, 'h25_parent_supervisor', 'install_subreaper') + # Original installer has a concrete pinned source/TCB/native closure. + # Its path interface is the original pathlib.Path contract. + from pathlib import Path + subreaper, keeper = installer(Path(plan['round_root'])) + process_record['subreaper'], process_record['keeper'] = subreaper, keeper + process_record = _PROCESS[0] + schema.need(process_record['pid'] == state['pid'] and process_record['keeper'] is not None, + 'original same-process subreaper ownership missing') + state['subreaper'], state['native_keeper'] = process_record['subreaper'], process_record['keeper'] + closure.check_receivers(receivers) + state['initial_sources'] = _snapshot_sources(plan, errors) + copying.verify(configuration['checker_source'], error_owner=errors) + copying.write_once(plan['session_directory'] + '/PARENT-INTENT.json', + schema.canonical({'schema': 'h25-parent-completion-intent-v1', 'epoch_id': plan['epoch_id'], + 'mode': plan['mode'], 'configuration': configuration, 'parent_pid': state['pid'], + 'source_closure_admission_sha256': plan['source_closure_admission_sha256'], + 'retry_or_restore_allowed': False, 'accounting': 'nested non-additive; paid by one outer orchestrator'}), + error_owner=errors) + state['phase'] = 'READY' + _guard(state) + return token + except BaseException as primary: + _stop(state, 'make_parent', primary) + raise + + +def _close_logs(run, primary): + first = None + for index in range(2): + descriptor = run['log_fds'][index] + if descriptor is None or run['log_close_attempted'][index]: + continue + run['log_close_attempted'][index] = True + try: + _CLOSE(descriptor) + run['log_close_confirmed'][index] = True + except BaseException as error: + if run['unknown_owner']['primary'][0] is None: + run['unknown_owner']['primary'][0] = primary if primary is not None else error + run['unknown_owner']['quarantine'][0] = True + run['errors'][index] = error + if first is None: + first = error + if primary is None and first is not None: + raise first + + +def run_producer(owner_capability, producer_role): + state = _state(owner_capability) + try: + _guard(state) + schema.choice(producer_role, schema.PRODUCERS) + schema.need(state['phase'] == 'READY' and state['next'] < 2 and + producer_role == schema.PRODUCERS[state['next']] and producer_role not in state['runs'], + 'producer order, replay or prior completion differs') + except BaseException as primary: + _stop(state, 'run_producer_entry', primary) + raise + row = state['plan']['producers'][producer_role] + # Burn the actual epoch ticket before any later preparation or launch. + try: + ticket = _EPOCH_RESERVE(state['epoch'], state['authority'], producer_role) + run_token = object() + run = {'token': run_token, 'ticket': ticket, 'role': producer_role, 'phase': 'RESERVED', + 'unknown_owner': state['unknown_owner'], + 'plan': row, 'domain': None, 'process': None, 'root': None, 'terminal': None, + 'log_fds': [None, None], 'log_close_attempted': [False, False], + 'log_close_confirmed': [False, False], 'errors': [None] * 8, + 'primary': [None], 'acquisition_in_flight': False, 'spawn_entered': False, + 'spawn_returned': False, 'source_before': None, 'stage_before': None, + 'began': _CLOCK(), 'peak_rss': 0, 'file_limits': tuple(_GETRLIMIT(resource.RLIMIT_FSIZE))} + state['runs'][producer_role] = run + state['phase'] = 'PRODUCER_IN_FLIGHT' + except BaseException as primary: + _stop(state, 'run_producer_reservation', primary) + raise + primary = None + old_handler = None + alarm_installed = False + try: + _guard(state) + _MKDIR(row['evidence_directory'], 0o700) + # output remains absent; the genuine original Root creates it exclusively. + try: + _STAT(row['output'], follow_symlinks=False) + except FileNotFoundError: + pass + else: + raise schema.EpochStop('producer output already exists') + local_plan = dict(state['plan'], **row) + run['source_before'] = _snapshot_sources(state['plan'], state['errors']) + run['stage_before'] = _stage(local_plan, state['errors'], state) + # Reject oversized complete-custody records BEFORE any child launch. + run['source_bytes_before'] = _source_custody_bytes(state, run['source_before'], run['stage_before']) + for pin in row['launch_artifacts'].values(): + copying.verify(pin, schema.RECORD_BYTES, error_owner=state['errors']) + run['domain'] = domain.create_domain(state['unknown_owner']) + launch = {'schema': 'h25-owned-producer-launch-v1', 'epoch_id': state['plan']['epoch_id'], + 'mode': state['plan']['mode'], 'role': producer_role, + 'generation': row['epoch_plan']['generation'], 'launch_nonce': row['launch_nonce'], + 'parent_pid': state['pid'], 'command': row['command'], 'environment': ENV, 'cwd': row['cwd'], + 'launch_binding': row['launch_binding'], 'parent_file_limits': list(run['file_limits']), + 'new_session': True, 'close_fds': True, 'pass_fds': [], + 'root_seconds': row['root_seconds'], 'rss_bytes': row['rss_bytes'], + 'address_space_bytes': row['address_space_bytes']} + run['launch'] = copying.write_once(row['evidence_directory'] + '/LAUNCH.json', + schema.canonical(launch), error_owner=state['errors']) + for index, name in enumerate(('stdout.raw', 'stderr.raw')): + schema.need(state['io_quarantine'][0] is False and state['unknown_owner']['pending'][0] is False and + state['unknown_owner']['iterator_uncertain'][0] is False, + 'raw stream cannot acquire after uncertain ownership') + run['acquisition_in_flight'] = True + state['unknown_owner']['pending'][0] = True + run['log_fds'][index] = _OPEN(row['evidence_directory'] + '/' + name, + os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_CLOEXEC | os.O_NOFOLLOW, 0o600) + run['acquisition_in_flight'] = False + state['unknown_owner']['pending'][0] = False + setter, kind, limits = _SETRLIMIT, resource.RLIMIT_AS, (row['address_space_bytes'], row['address_space_bytes']) + def child_limit(): + setter(kind, limits) + schema.need(_GETTIMER(signal.ITIMER_REAL) == (0.0, 0.0), 'existing parent timer cannot be replaced') + old_handler = _GETSIGNAL(signal.SIGALRM) + _SIGNAL(signal.SIGALRM, _alarm) + alarm_installed = True + deadline = min(run['began'] + row['root_seconds'], state['shared_deadline'] - domain.CLEANUP_SECONDS) + schema.need(_CLOCK() < deadline, 'no funded root/cleanup interval remains') + _SETTIMER(signal.ITIMER_REAL, max(0.000001, deadline - _CLOCK())) + run['spawn_entered'] = True + run['process'] = _POPEN(row['command'], cwd=row['cwd'], env=dict(ENV), + stdout=run['log_fds'][0], stderr=run['log_fds'][1], stdin=subprocess.DEVNULL, + close_fds=True, pass_fds=(), start_new_session=True, preexec_fn=child_limit) + run['spawn_returned'] = True + run['root'] = domain.adopt_popen(run['domain'], run['process']) + while True: + unused, current = domain.observe(run['domain']) + run['peak_rss'] = max(run['peak_rss'], sum(item[6] for item in current)) + schema.need(run['peak_rss'] <= row['rss_bytes'], 'owned process RSS sum exceeded') + schema.need(max(_STAT(row['evidence_directory'] + '/' + name, follow_symlinks=False).st_size + for name in ('stdout.raw', 'stderr.raw')) <= schema.LOG_BYTES, 'root output bound exceeded') + if domain.poll_owned(run['domain']) is not None: + break + _SLEEP(0.01) + except BaseException as error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + primary = state['unknown_owner']['primary'][0] + run['primary'][0] = primary + if primary is not error: + run['errors'][4] = error + if (run['acquisition_in_flight'] or state['unknown_owner']['pending'][0] or + state['unknown_owner']['iterator_uncertain'][0] or _TYPE(error) is MemoryError): + state['io_quarantine'][0] = True + raise primary + finally: + # Preserve the first locally delivered primary through all cleanup. + first_cleanup = None + if alarm_installed: + try: + _SETTIMER(signal.ITIMER_REAL, 0) + _SIGNAL(signal.SIGALRM, old_handler) + except BaseException as error: + run['errors'][2] = error + first_cleanup = error + if run['domain'] is not None: + try: + domain.finish_domain(run['domain']) + except BaseException as error: + run['errors'][3] = error + state['io_quarantine'][0] = True + if first_cleanup is None: + first_cleanup = error + try: + _close_logs(run, primary if primary is not None else first_cleanup) + except BaseException as error: + if first_cleanup is None: + first_cleanup = error + for index in range(2): + if run['log_close_attempted'][index] and not run['log_close_confirmed'][index]: + state['io_quarantine'][0] = True + if primary is not None: + _stop(state, 'run_producer', primary) + elif first_cleanup is not None: + _stop(state, 'run_producer_cleanup', first_cleanup) + raise first_cleanup + try: + schema.need(run['spawn_entered'] is True and run['spawn_returned'] is True and + run['acquisition_in_flight'] is False and all(run['log_close_confirmed']), + 'root spawn or raw stream ownership incomplete') + run['terminal'] = domain.terminal_facts(run['domain']) + schema.need(tuple(_GETRLIMIT(resource.RLIMIT_FSIZE)) == run['file_limits'], 'parent file limit drift') + run['phase'] = 'JOINED' + state['phase'] = 'PRODUCER_JOINED' + _guard(state) + return run_token + except BaseException as primary: + _stop(state, 'postcleanup_terminal', primary) + raise + + +def _source_custody_bytes(state, files, stage): + raw = group01.encode({'schema': 'h25-parent-current-source-custody-v1', 'files': files, + 'stage': stage, 'source_closure_admission_sha256': state['plan']['source_closure_admission_sha256'], + 'historical_compiler_interval_proof_claimed_by_this_record': False}) + schema.need(len(raw) <= schema.RECORD_BYTES, 'complete source custody record exceeds admitted writer bound') + return raw + + +def _variant(state, run, stdout_raw): + """Dedicated concrete typed receiver; source remains external until frozen.""" + expected = group01.decode(group01.encode(run['plan']['evidence_plan'])) + expected['producer_process_id'] = run['root'][0] + expected['parent_file_limits'] = list(run['file_limits']) + files = expected['raw_file_names'] + schema.need(_TYPE(files) is list and files == list(VARIANT_FILES), + 'fixed variant raw file inventory missing') + raw_files, pins, total = {}, [], 0 + for relative in files: + schema.text(relative, 256) + schema.need(not relative.startswith('/') and all(part not in ('', '.', '..') for part in relative.split('/')), + 'variant raw origin differs') + path = run['plan']['output'] + '/' + relative + limit = 8388608 if relative.endswith('.so') else schema.LOG_BYTES if relative.endswith('.raw') else schema.RECORD_BYTES + pin = copying.inspect(path, limit, error_owner=state['errors']) + total += pin['bytes'] + schema.need(total <= MAX_VARIANT_RAW_BYTES, 'variant aggregate byte bound exceeded before allocation') + raw_files[relative] = copying.read_verified(pin, limit, error_owner=state['errors']) + pins.append(pin) + closure.check_receivers(state['receivers']) + validator = closure.receiver(state['receivers'], VARIANT_MODULE, VARIANT_FUNCTION) + result = validator(raw_files, expected) + closure.check_receivers(state['receivers']) + # Exact result schema is fixed with the separately frozen variant source. + # This branch cannot run before that complete source/interface is admitted. + schema.exact(result, ('schema', 'raw_result_relative', 'raw_group_relatives', 'builds', + 'zero_candidate_loads', 'not_runtime_authority')) + schema.need(result['schema'] == 'h25-negative-variant-data-authentication-v1' and + result['zero_candidate_loads'] is True and result['not_runtime_authority'] is True, + 'variant data-validation scope differs') + pin_by_relative = dict(zip(files, pins)) + schema.need(result['raw_result_relative'] == 'receipt.json' and + group01.same_json(group01.decode(stdout_raw), group01.decode(raw_files['receipt.json'])), + 'variant original stdout/final raw result differs') + builds = [] + schema.sequence(result['builds'], 2) + for role, row in zip(schema.ROLES[3:], result['builds']): + schema.exact(row, ('role', 'command_sha256', 'profile', 'files')) + schema.need(row['role'] == role, 'variant build role order differs') + schema.exact(row['files'], ('original_output', 'original_receipt', 'attempt', 'journal', 'stdout', 'stderr')) + build = {'role': role, 'producer_role': 'failure_variants', + 'producer_generation': run['plan']['epoch_plan']['generation'], + 'producer_stage_sha256': run['plan']['epoch_plan']['stage_sha256'], + 'command_sha256': row['command_sha256'], 'profile': row['profile']} + for key, relative in row['files'].items(): + schema.text(relative, 256) + schema.need(relative in pin_by_relative, 'variant validator returned unowned file') + build[key] = pin_by_relative[relative] + schema.build(build) + builds.append(build) + schema.need(result['raw_group_relatives'] == list(VARIANT_GROUPS), 'variant exact raw group census differs') + raw_groups = [] + for relative in result['raw_group_relatives']: + schema.text(relative, 256) + schema.need(relative in pin_by_relative, 'variant validator returned unowned raw group') + raw_groups.append({'file': relative, 'raw': pin_by_relative[relative]}) + return {'raw_result': pin_by_relative['receipt.json'], 'group_rows': raw_groups, + 'builds': builds, 'additional_raw': pins, + 'native_runtime_or_full_union_qualified': False} + + +def accept_producer(owner_capability, completed_run_capability): + state = _state(owner_capability) + try: + _guard(state) + schema.need(_TYPE(completed_run_capability) is object and state['phase'] == 'PRODUCER_JOINED', + 'joined original producer capability required') + matches = [run for run in state['runs'].values() if run['token'] is completed_run_capability] + schema.need(_LEN(matches) == 1 and matches[0]['phase'] == 'JOINED', 'unknown or replayed producer completion') + run = matches[0] + run['phase'] = 'COMPLETION_CONSUMED' + terminal = domain.terminal_facts(run['domain']) + schema.need(terminal == run['terminal'], 'owned terminal facts changed') + row, errors = run['plan'], state['errors'] + stdout = copying.inspect(row['evidence_directory'] + '/stdout.raw', schema.LOG_BYTES, error_owner=errors) + stderr = copying.inspect(row['evidence_directory'] + '/stderr.raw', schema.LOG_BYTES, error_owner=errors) + schema.need(stderr['bytes'] == 0, 'original producer stderr is not empty') + stdout_raw = copying.read_verified(stdout, schema.LOG_BYTES, error_owner=errors) + if run['role'] == 'group01': + actual = group01.authenticate_group01(row['output'], row['evidence_plan'], run['root'][0], + run['file_limits'], state['receivers'], errors, stdout_raw) + else: + actual = _variant(state, run, stdout_raw) + # These facts are parent-derived from current bytes and real owned + # cleanup, never child status flags or an imported ParentCompletion. + source_after = _snapshot_sources(state['plan'], errors) + schema.need(source_after == run['source_before'] == state['initial_sources'], 'complete current source identity changed') + stage_after = _stage(dict(state['plan'], **row), errors, state) + schema.need(stage_after == run['stage_before'], 'late complete stage custody changed') + closure.check_receivers(state['receivers']) + schema.need(domain.terminal_facts(run['domain']) == terminal, 'late parent-domain cleanup changed') + copying.verify(stdout, schema.LOG_BYTES, error_owner=errors) + copying.verify(stderr, schema.LOG_BYTES, error_owner=errors) + for build in actual['builds']: + for key, limit in (('original_output', schema.FILE_BYTES), ('original_receipt', 65536), + ('attempt', 65536), ('journal', schema.JOURNAL_BYTES), ('stdout', schema.LOG_BYTES), ('stderr', schema.LOG_BYTES)): + copying.verify(build[key], limit, error_owner=errors) + for pin in actual['additional_raw']: + copying.verify(pin, schema.FILE_BYTES, error_owner=errors) + copying.verify(actual['raw_result'], schema.RAW_RESULT_BYTES, error_owner=errors) + for pin in row['launch_artifacts'].values(): + copying.verify(pin, schema.RECORD_BYTES, error_owner=errors) + for group in actual['group_rows']: + copying.verify(group['raw'], schema.RECORD_BYTES, error_owner=errors) + if run['role'] == 'group01': + copying.verify(group['validation'], 8192, error_owner=errors) + directory = row['evidence_directory'] + terminal_pin = copying.write_once(directory + '/TERMINAL.json', schema.canonical({ + 'schema': 'h25-owned-producer-terminal-v1', 'launch': run['launch'], + 'generation': row['epoch_plan']['generation'], 'launch_nonce': row['launch_nonce'], + 'actual': terminal, 'stdout': stdout, 'stderr': stderr, + 'root_wall_before_completion_diagnostic_nanoseconds': int((_CLOCK() - run['began']) * 1000000000), + 'diagnostic_is_nested_not_additive': True}), error_owner=errors) + raw_groups = copying.write_once(directory + '/RAW-GROUPS.json', + group01.encode({'schema': 'h25-parent-retained-raw-groups-v1', 'rows': actual['group_rows'], + 'additional_raw': actual['additional_raw'], 'returned_groups_checked_before_mint': True}), error_owner=errors) + source_bytes_after = _source_custody_bytes(state, source_after, stage_after) + schema.need(source_bytes_after == run['source_bytes_before'], 'source custody changed after prelaunch size gate') + source_pin = copying.write_once(directory + '/FINAL-SOURCE-CUSTODY.json', source_bytes_after, error_owner=errors) + _guard(state) + schema.need(_CLOCK() - run['began'] <= row['root_seconds'], 'complete root including validation/custody exceeded bound') + observation = {'schema': 'h25-owned-parent-observation-v1', 'epoch_id': state['plan']['epoch_id'], + 'mode': state['plan']['mode'], 'producer_role': run['role'], 'generation': row['epoch_plan']['generation'], + 'launch_nonce': row['launch_nonce'], 'launch': run['launch'], 'terminal': terminal_pin, + 'raw_result': actual['raw_result'], 'raw_groups': raw_groups, 'final_source_custody': source_pin, + 'root_pid': run['root'][0], 'root_start_ticks': run['root'][4], + 'later_cross_root_aggregate_required_before_export': False, + 'native_full_or_gain_qualification': False} + observed_pin = copying.write_once(directory + '/PARENT-OBSERVATION.json', schema.canonical(observation), error_owner=errors) + record = {key: row['epoch_plan'][key] for key in ('role', 'generation', 'stage_sha256', 'command_sha256', 'root_sha256')} + record.update(terminal=terminal_pin, raw_result=actual['raw_result'], raw_groups=raw_groups, + final_source_custody=source_pin, parent_observation=observed_pin, + completion_checker_sha256=state['configuration']['checker_source']['sha256'], builds=actual['builds']) + schema.producer(record) + # The only mint site is below every actual launch/domain/raw/source + # check. Neither ticket nor completion is ever returned to a caller. + _guard(state) + completion = _EPOCH_COMPLETION(run['ticket'], state['configuration']['checker_source']['sha256'], + observed_pin['sha256'], row['epoch_plan']['generation'], state['plan']['mode'], run['role'], + run['root'][0], run['root'][4], True, True, True, True, True, True) + _EPOCH_ACCEPT(state['epoch'], state['authority'], run['ticket'], completion, record) + _guard(state) + schema.need(_CLOCK() - run['began'] <= row['root_seconds'], + 'complete root plus acceptance tail exceeded bound') + run['phase'], run['record'] = 'ACCEPTED', record + state['next'] += 1 + state['phase'] = 'READY' if state['next'] < 2 else 'PRODUCERS_ACCEPTED' + return schema.plain_copy(record) + except BaseException as primary: + _stop(state, 'accept_producer', primary) + raise + + +def commit_exports(owner_capability): + state = _state(owner_capability) + try: + _guard(state) + schema.need(state['phase'] == 'PRODUCERS_ACCEPTED' and state['next'] == 2 and + all(run['phase'] == 'ACCEPTED' for run in state['runs'].values()), + 'only two genuinely accepted producer records may export') + result = _EPOCH_COMMIT(state['epoch'], state['authority']) + _guard(state) + state['phase'] = 'EXPORTED' + return result + except BaseException as primary: + _stop(state, 'commit_exports', primary) + raise + + +def stop_evidence(owner_capability): + state = _state(owner_capability) + summaries = [{'role': run['role'], 'phase': run['phase'], + 'spawn_entered': run['spawn_entered'], 'spawn_returned': run['spawn_returned'], + 'log_close_attempted': list(run['log_close_attempted']), + 'log_close_confirmed': list(run['log_close_confirmed'])} + for run in state['runs'].values()] + # Never expose the epoch ticket, Popen object, domain capability or private + # run sidecar through diagnostic return values. + return state['stop'], state['errors'], state['fallback'], summaries diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/parent_domain_v1.py b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/parent_domain_v1.py new file mode 100644 index 0000000000..a0f242854a --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/parent_domain_v1.py @@ -0,0 +1,532 @@ +"""Owned Linux child domains for one trusted, single-threaded parent process. + +Source proposal only. No target was imported or run during authoring. The +external launcher must authenticate the OS, interpreter, system modules and +original subreaper installer before importing this module. This is the original +closed child-domain premise, not a sandbox against hostile forking or a hostile +host. Acquisition/unwind ambiguity quarantines the parent; it never authorizes +another launch or a completion. The enclosing guard must observe parent exit. +""" +import os +import signal +import subprocess +import time +import epoch_schema_v5 as schema + +_TYPE, _LEN = type, len +_OPEN, _READ, _CLOSE = os.open, os.read, os.close +_STAT = os.stat +_SCANDIR, _GETPID, _GETPGRP, _GETSID = os.scandir, os.getpid, os.getpgrp, os.getsid +_PIDFD_OPEN, _PIDFD_SIGNAL = os.pidfd_open, signal.pidfd_send_signal +_WAITPID, _CLOCK, _SLEEP = os.waitpid, time.monotonic, time.sleep +_POPEN, _POLL = subprocess.Popen, subprocess.Popen.poll +_PAGE_BYTES = os.sysconf('SC_PAGE_SIZE') +_DOMAINS = [] +MAX_GENERATIONS = 128 +MAX_PROC_ENTRIES = 131072 +MAX_PROC_BYTES = 8192 +CLEANUP_SECONDS = 2.0 + + +def _state(capability): + schema.need(_TYPE(capability) is object, 'exact owned domain capability required') + for token, state in _DOMAINS: + if token is capability: + return state + raise schema.EpochStop('unregistered owned domain') + + +def refresh_unknown_owner(owner): + # These are exact V5 ErrorOwner state references captured by the original + # parent before use. Read only the pinned private shape; no projection, + # callback, native I/O or interpretation of historical release slot9. + for native in owner['native_errors']: + if native is None: + continue + io = native[7] + if (io[0] or io[1] or io[2] or io[4] or io[6] or io[10] or io[11] or + io[5] is not None or native[5][1] or io[7][4] == 1): + owner['quarantine'][0] = True + if io[5] is not None: + owner['iterator_uncertain'][0] = True + + +def _fresh_acquisition(state): + # This shares the original parent's preallocated unknown-resource owner. + # Pending acquisition and delivered census failure are independent of a + # later Python close return. Neither flag is cleared by cleanup. + owner = state['unknown_owner'] + refresh_unknown_owner(owner) + schema.need(state['quarantine'] is False and state['acquisition_in_flight'] is False and + state['io_uncertain'] is False and owner['quarantine'][0] is False and + owner['pending'][0] is False and owner['iterator_uncertain'][0] is False, + 'uncertain ownership prohibits a fresh native acquisition') + + +def _opaque(state, error, slot): + # Preallocated slots retain the actual delivered object, without formatting. + # A secondary never replaces the first primary. Slots are finite and an + # overflow means quarantine, not a successful evidence projection. + state['quarantine'] = True + if state['primary'][0] is None: + state['primary'][0] = error + elif state['secondary'][slot] is None: + state['secondary'][slot] = error + else: + state['overflow'][0] = error + + +def _proc(pid, state): + schema.integer(pid, 1, (1 << 31) - 1) + descriptor = None + primary = None + _fresh_acquisition(state) + # The uncertain acquisition flag is set before the native entry. If open + # raises after an undisclosed descriptor acquisition, parent exit is needed. + try: + try: + _STAT('/proc/' + str(pid) + '/stat', dir_fd=None, follow_symlinks=False) + except (FileNotFoundError, ProcessLookupError): + # Only the pinned metadata-only primitive establishes absence. + # An exception from a later acquisition never proves no FD existed. + return None + state['acquisition_in_flight'] = True + state['unknown_owner']['pending'][0] = True + descriptor = _OPEN('/proc/' + str(pid) + '/stat', + os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW | os.O_NONBLOCK) + state['acquisition_in_flight'] = False + state['unknown_owner']['pending'][0] = False + raw = _READ(descriptor, MAX_PROC_BYTES + 1) + schema.need(_TYPE(raw) is bytes and _LEN(raw) <= MAX_PROC_BYTES, + 'bounded proc stat read differs') + end = raw.rfind(b') ') + schema.need(end >= 0, 'malformed proc stat') + fields = raw[end + 2:].split() + schema.need(_LEN(fields) >= 22 and raw[:raw.find(b' ')] == str(pid).encode('ascii'), + 'proc stat identity or shape differs') + row = (pid, int(fields[1]), int(fields[2]), int(fields[3]), + int(fields[19]), fields[0].decode('ascii'), int(fields[21]) * _PAGE_BYTES) + schema.need(row[4] > 0 and row[6] >= 0, 'proc generation or RSS differs') + return row + except BaseException as error: + primary = error + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + _opaque(state, error, 0) + raise + finally: + if descriptor is not None: + # Burn before entry; a failed native close is not retried. + owned = descriptor + descriptor = None + try: + _CLOSE(owned) + except BaseException as close_error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = close_error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + state['io_uncertain'] = True + _opaque(state, close_error, 1) + if primary is None: + raise + + +def _census(state): + iterator = None + primary = None + rows = {} + _fresh_acquisition(state) + state['acquisition_in_flight'] = True + state['unknown_owner']['pending'][0] = True + try: + iterator = _SCANDIR('/proc') + state['acquisition_in_flight'] = False + state['unknown_owner']['pending'][0] = False + count = 0 + for entry in iterator: + count += 1 + schema.need(count <= MAX_PROC_ENTRIES, 'proc census entry bound exceeded') + name = entry.name + if name.isdecimal(): + row = _proc(int(name), state) + if row is not None: + rows[row[0]] = row + return rows + except BaseException as error: + primary = error + # All delivered iteration/body failures latch before optional helper + # entry. A no-op/successful close cannot establish release afterward. + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['quarantine'] = True + state['io_uncertain'] = True + state['unknown_owner']['quarantine'][0] = True + state['unknown_owner']['iterator_uncertain'][0] = True + _opaque(state, error, 2) + raise + finally: + if iterator is not None: + owned = iterator + iterator = None + try: + owned.close() + except BaseException as close_error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = close_error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + state['unknown_owner']['iterator_uncertain'][0] = True + state['io_uncertain'] = True + _opaque(state, close_error, 3) + if primary is None: + raise + + +def create_domain(unknown_owner): + """Called only after the original same-process subreaper was installed.""" + schema.need(_LEN(_DOMAINS) < 4, 'two modes by two producers domain bound exceeded') + schema.exact(unknown_owner, ('quarantine', 'pending', 'iterator_uncertain', 'primary', 'native_errors')) + for key in ('quarantine', 'pending', 'iterator_uncertain', 'primary'): + schema.need(_TYPE(unknown_owner[key]) is list and _LEN(unknown_owner[key]) == 1, + 'original parent unknown-resource slot differs') + schema.need(_TYPE(unknown_owner['native_errors']) is list and _LEN(unknown_owner['native_errors']) == 4, + 'exact two-mode V5 error-owner registry required') + for native in unknown_owner['native_errors']: + schema.need(native is None or (_TYPE(native) is list and _LEN(native) == 9 and + _TYPE(native[7]) is list and _LEN(native[7]) == 13), + 'original captured V5 error-owner shape differs') + refresh_unknown_owner(unknown_owner) + schema.need(all(unknown_owner[key][0] is False for key in + ('quarantine', 'pending', 'iterator_uncertain')) and unknown_owner['primary'][0] is None, + 'unknown-resource parent already requires teardown') + token = object() + state = {'rows': [None] * MAX_GENERATIONS, 'fds': [None] * MAX_GENERATIONS, + 'fd_attempted': [False] * MAX_GENERATIONS, + 'fd_closed': [False] * MAX_GENERATIONS, 'count': 0, + 'groups': set(), 'reaped': [], 'after_root': set(), + 'process': None, 'root': None, 'returncode': None, + 'parent_pid': _GETPID(), 'parent_group': _GETPGRP(), 'parent_session': _GETSID(0), + 'phase': 'CONSTRUCTING', 'quarantine': False, + 'acquisition_in_flight': False, 'io_uncertain': False, 'primary': [None], + 'unknown_owner': unknown_owner, + 'secondary': [None] * 16, 'overflow': [None], + 'final_rows': None, 'closure_confirmed': False} + _DOMAINS.append((token, state)) + try: + rows = _census(state) + schema.need(not any(row[1] == state['parent_pid'] for row in rows.values()), + 'parent has preexisting child processes') + state['phase'] = 'RESERVED' + return token + except BaseException as error: + if unknown_owner['primary'][0] is None: + unknown_owner['primary'][0] = error + unknown_owner['quarantine'][0] = True + state['quarantine'] = True + _opaque(state, error, 4) + state['phase'] = 'STOP' + raise + + +def _add(state, row): + _fresh_acquisition(state) + key = row[0], row[4] + schema.need(row[0] != state['parent_pid'], 'parent cannot enter own child domain') + for index in range(state['count']): + prior = state['rows'][index] + if prior is not None and (prior[0], prior[4]) == key: + if row[2] != state['parent_group']: + state['groups'].add((row[2], row[3])) + return True + index = state['count'] + schema.need(index < MAX_GENERATIONS, 'owned process generation bound exceeded') + # Reserve the slot before native acquisition. No role/generation slot is + # recycled after a failed or disappeared acquisition. + state['count'] = index + 1 + state['rows'][index] = row + state['acquisition_in_flight'] = True + state['unknown_owner']['pending'][0] = True + try: + state['fds'][index] = _PIDFD_OPEN(row[0], 0) + state['acquisition_in_flight'] = False + state['unknown_owner']['pending'][0] = False + current = _proc(row[0], state) + if current is None or (current[0], current[4]) != key: + return False # The actual FD stays owned for one terminal close. + if current[2] != state['parent_group']: + state['groups'].add((current[2], current[3])) + return True + except BaseException as error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + _opaque(state, error, 5) + raise + + +def observe(capability): + state = _state(capability) + all_rows = _census(state) + known = set() + for index in range(state['count']): + prior = state['rows'][index] + current = None if prior is None else all_rows.get(prior[0]) + if current is not None and current[4] == prior[4]: + known.add(current[0]) + _add(state, current) + for unused in range(MAX_GENERATIONS + 1): + changed = False + for pid, row in all_rows.items(): + if pid not in known and (row[1] == state['parent_pid'] or row[1] in known): + if _add(state, row): + known.add(pid) + changed = True + if not changed: + break + else: + raise schema.EpochStop('child-domain closure iteration bound exceeded') + return all_rows, tuple(all_rows[pid] for pid in sorted(known)) + + +def adopt_popen(capability, process): + state = _state(capability) + schema.need(state['phase'] == 'RESERVED' and state['process'] is None and + _TYPE(process) is _POPEN, 'Popen ownership or one-attempt state differs') + state['process'] = process # Exact original return, never a supplied proxy. + row = _proc(process.pid, state) + schema.need(row is not None and row[1] == state['parent_pid'] and + row[2] == row[3] == process.pid, + 'new child PID/session/generation missing before first poll') + state['root'] = row + schema.need(_add(state, row) is True, 'original child pidfd generation not owned') + state['phase'] = 'RUNNING' + return row + + +def poll_owned(capability): + state = _state(capability) + schema.need(state['phase'] == 'RUNNING' and _TYPE(state['process']) is _POPEN, + 'original running Popen required') + result = _POLL(state['process']) + if result is not None: + schema.integer(result, -128, 255) + state['returncode'] = result + return result + + +def _kill(state): + for index in range(state['count']): + fd, prior = state['fds'][index], state['rows'][index] + if fd is None or state['fd_attempted'][index]: + continue + current = _proc(prior[0], state) + if current is not None and current[4] == prior[4] and current[5] != 'Z': + try: + _PIDFD_SIGNAL(fd, signal.SIGKILL, None, 0) + except ProcessLookupError: + pass + + +def finish_domain(capability): + """Always attempted, including Popen exceptions; no caller closure claims.""" + state = _state(capability) + schema.need(state['phase'] in ('RESERVED', 'RUNNING'), 'domain cleanup replay') + state['phase'] = 'CLEANUP_CONSUMED' + started = _CLOCK() + primary = None + try: + _fresh_acquisition(state) + while True: + all_rows, current = observe(capability) + process = state['process'] + if process is not None and process.returncode is not None: + for row in current: + if row[0] != process.pid: + state['after_root'].add((row[0], row[4])) + _kill(state) + if process is not None: + result = _POLL(process) + if result is not None: + state['returncode'] = result + for index in range(state['count']): + prior = state['rows'][index] + row = _proc(prior[0], state) + if (row is None or row[4] != prior[4] or row[1] != state['parent_pid'] or + (process is not None and row[0] == process.pid)): + continue + try: + pid, status = _WAITPID(row[0], os.WNOHANG) + except ChildProcessError: + continue + if pid: + state['reaped'].append((pid, prior[4], status)) + all_rows, current = observe(capability) + remaining = tuple(row for row in all_rows.values() + if row[1] == state['parent_pid'] or (row[2], row[3]) in state['groups'] or + any(prior is not None and (row[0], row[4]) == (prior[0], prior[4]) + for prior in state['rows'][:state['count']])) + state['final_rows'] = remaining + if not current and not remaining: + state['closure_confirmed'] = True + break + if _CLOCK() - started >= CLEANUP_SECONDS: + break + _SLEEP(0.01) + except BaseException as error: + primary = error + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + _opaque(state, error, 6) + raise + finally: + # Every known FD gets one attempt even if a prior close failed. Native + # return/boxing, Python call-entry and final unwind still have no total + # recovery theorem; any such failure forbids minting and parent reuse. + first_close = None + for index in range(state['count']): + descriptor = state['fds'][index] + if descriptor is None or state['fd_attempted'][index]: + continue + state['fd_attempted'][index] = True + try: + _CLOSE(descriptor) + state['fd_closed'][index] = True + except BaseException as error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + state['io_uncertain'] = True + _opaque(state, error, 7) + if first_close is None: + first_close = error + state['phase'] = 'CLOSED' if primary is None and first_close is None else 'STOP' + if primary is None and first_close is not None: + raise first_close + + +def terminal_facts(capability): + state = _state(capability) + _fresh_acquisition(state) + schema.need(state['phase'] == 'CLOSED' and state['quarantine'] is False and + state['acquisition_in_flight'] is False and state['io_uncertain'] is False and state['root'] is not None and + state['returncode'] == 0 and state['closure_confirmed'] is True and + state['final_rows'] == () and not state['after_root'] and not state['reaped'] and + all(fd is None or (state['fd_attempted'][index] and state['fd_closed'][index]) + for index, fd in enumerate(state['fds'])), + 'owned terminal domain is incomplete, failed, orphaned or quarantined') + # Fresh census after FD cleanup. This is independent of receipt booleans. + rows = _census(state) + schema.need(not any(row[1] == state['parent_pid'] or + (row[2], row[3]) in state['groups'] for row in rows.values()), + 'postcleanup owned child/group still present') + return {'root': list(state['root']), 'returncode': state['returncode'], + 'owned_generations': [list(row) for row in state['rows'][:state['count']]], + 'groups': [list(pair) for pair in sorted(state['groups'])], + 'remaining': [], 'adopted_reaps': [], 'observed_after_root_exit': [], + 'pidfd_close_attempted': list(state['fd_attempted'][:state['count']]), + 'pidfd_close_confirmed': list(state['fd_closed'][:state['count']]), + 'source': 'original in-process Popen and owned generation registry', + 'hostile_fork_or_privileged_host_resistance_claimed': False} + + +def stop_slots(capability): + state = _state(capability) + return state['primary'], state['secondary'], state['overflow'], { + 'phase': state['phase'], 'quarantine': state['quarantine'], + 'acquisition_in_flight': state['acquisition_in_flight'], + 'io_uncertain': state['io_uncertain'], + 'shared_pending': state['unknown_owner']['pending'][0], + 'shared_iterator_uncertain': state['unknown_owner']['iterator_uncertain'][0], + 'shared_quarantine': state['unknown_owner']['quarantine'][0], + 'closure_confirmed': state['closure_confirmed'], + 'pidfd_close_attempted': list(state['fd_attempted'][:state['count']]), + 'pidfd_close_confirmed': list(state['fd_closed'][:state['count']])} + + +def prefix_exit1_terminal_facts(capability): + """Return cleanup/exit DATA for an actual owned prefix child exiting 1. + + Separate from production terminal_facts. Never creates an epoch ticket, + ParentCompletion, source admission, or control-family acceptance. + """ + state = _state(capability) + owner = state['unknown_owner'] + try: + schema.need(_GETPID() == state['parent_pid'], + 'prefix terminal observer is not the owning parent') + _fresh_acquisition(state) + schema.need(owner['primary'][0] is None and + state['primary'][0] is None, + 'earlier error forbids prefix terminal observation') + schema.need( + state['phase'] == 'CLOSED' and + state['quarantine'] is False and + state['acquisition_in_flight'] is False and + state['io_uncertain'] is False and + state['root'] is not None and + _TYPE(state['returncode']) is int and + state['returncode'] == 1 and + state['closure_confirmed'] is True and + state['final_rows'] == () and + not state['after_root'] and + not state['reaped'] and + all(fd is None or + (state['fd_attempted'][index] and state['fd_closed'][index]) + for index, fd in enumerate(state['fds'])), + 'owned exit1 prefix domain is incomplete or quarantined', + ) + rows = _census(state) + schema.need( + not any(row[1] == state['parent_pid'] or + (row[2], row[3]) in state['groups'] + for row in rows.values()), + 'postcleanup owned prefix child/group still present', + ) + return { + 'schema': 'h25-prefix-exit1-terminal-facts-v1', + 'root': list(state['root']), + 'returncode': state['returncode'], + 'owned_generations': [ + list(row) for row in state['rows'][:state['count']] + ], + 'groups': [list(pair) for pair in sorted(state['groups'])], + 'remaining': [], + 'adopted_reaps': [], + 'observed_after_root_exit': [], + 'pidfd_close_attempted': list( + state['fd_attempted'][:state['count']] + ), + 'pidfd_close_confirmed': list( + state['fd_closed'][:state['count']] + ), + 'source': 'original in-process Popen and owned generation registry', + 'production_completion': False, + 'refusal_semantics_authenticated_by_this_function': False, + 'hostile_fork_or_privileged_host_resistance_claimed': False, + } + except BaseException as error: + if owner['primary'][0] is None: + prior = state['primary'][0] + owner['primary'][0] = error if prior is None else prior + primary = owner['primary'][0] + if state['primary'][0] is None: + state['primary'][0] = primary + if error is not primary: + if state['secondary'][8] is None: + state['secondary'][8] = error + elif state['overflow'][0] is None: + state['overflow'][0] = error + state['quarantine'] = True + owner['quarantine'][0] = True + # Do not change phase: an invalid early call must not prevent + # finish_domain from reaching its known-FD cleanup. + if primary is error: + raise + raise primary diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/test_v03_prefix_supervisor_v1.py b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/test_v03_prefix_supervisor_v1.py new file mode 100644 index 0000000000..02fbb90fc9 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/test_v03_prefix_supervisor_v1.py @@ -0,0 +1,173 @@ +"""Pure fixtures for newly authored functions; no archived module import. + +These tests establish local predicates and error retention only. Synthetic +states are never evidence of Popen, kernel cleanup, source admission or C05. +""" +import ast +import copy +from pathlib import Path +from types import SimpleNamespace +import unittest + + +def new_function(path, name, globals_map): + source = Path(path).read_text(encoding='utf-8') + tree = ast.parse(source, feature_version=(3, 12)) + matches = [node for node in tree.body + if type(node) is ast.FunctionDef and node.name == name] + if len(matches) != 1: + raise ValueError('unique newly authored function required') + module = ast.Module(body=matches, type_ignores=[]) + scope = dict(globals_map) + exec(compile(module, '', 'exec'), scope) + return scope[name] + + +class Stop(RuntimeError): + pass + + +def need(condition, message): + if condition is not True: + raise Stop(message) + + +class AccessorTests(unittest.TestCase): + def setUp(self): + self.owner = { + 'primary': [None], 'quarantine': [False], + 'pending': [False], 'iterator_uncertain': [False], + 'native_errors': [None] * 4, + } + self.state = { + 'parent_pid': 10, 'unknown_owner': self.owner, + 'primary': [None], 'secondary': [None] * 16, + 'overflow': [None], 'phase': 'CLOSED', + 'quarantine': False, 'acquisition_in_flight': False, + 'io_uncertain': False, + 'root': (11, 10, 11, 11, 123, 'Z', 0), + 'returncode': 1, 'closure_confirmed': True, + 'final_rows': (), 'after_root': set(), 'reaped': [], + 'fds': [7], 'fd_attempted': [True], 'fd_closed': [True], + 'rows': [(11, 10, 11, 11, 123, 'Z', 0)], + 'count': 1, 'groups': {(11, 11)}, + } + self.token = object() + self.rows = {} + self.census_calls = 0 + + def state(token): + need(token is self.token, 'synthetic token mismatch') + return self.state + + def fresh(value): + owner = value['unknown_owner'] + need(not owner['quarantine'][0] and + not owner['pending'][0] and + not owner['iterator_uncertain'][0], + 'synthetic uncertainty') + + def census(value): + self.census_calls += 1 + return self.rows + + self.call = new_function( + 'parent_domain_v1.py', 'prefix_exit1_terminal_facts', + {'_state': state, '_GETPID': lambda: 10, + '_fresh_acquisition': fresh, '_census': census, + '_TYPE': type, 'schema': SimpleNamespace(need=need)}) + + def test_intact_exit1_predicate(self): + result = self.call(self.token) + self.assertEqual(result['returncode'], 1) + self.assertIs(result['production_completion'], False) + self.assertIs( + result['refusal_semantics_authenticated_by_this_function'], False) + self.assertEqual(self.census_calls, 1) + + def test_other_exit_dispositions(self): + for value in (0, 2, -9, True, 1.0): + with self.subTest(value=repr(value)): + self.setUp() + self.state['returncode'] = value + with self.assertRaises(Stop): + self.call(self.token) + self.assertEqual(self.census_calls, 0) + + def test_unclosed_fd(self): + self.state['fd_closed'][0] = False + with self.assertRaises(Stop): + self.call(self.token) + + def test_late_owned_child(self): + self.rows = {12: (12, 10, 12, 12, 456, 'R', 1)} + with self.assertRaises(Stop): + self.call(self.token) + + def test_existing_primary_identity(self): + first = RuntimeError('first') + self.owner['primary'][0] = first + try: + self.call(self.token) + except BaseException as caught: + self.assertIs(caught, first) + else: + self.fail('earlier primary was accepted') + self.assertEqual(self.census_calls, 0) + + def test_local_primary_identity(self): + first = RuntimeError('local first') + self.state['primary'][0] = first + try: + self.call(self.token) + except BaseException as caught: + self.assertIs(caught, first) + self.assertIs(self.owner['primary'][0], first) + else: + self.fail('local primary was replaced') + + def test_invalid_early_call_keeps_cleanup_phase(self): + self.state['phase'] = 'RUNNING' + with self.assertRaises(Stop): + self.call(self.token) + self.assertEqual(self.state['phase'], 'RUNNING') + self.assertTrue(self.owner['quarantine'][0]) + + +class SourceStructureTests(unittest.TestCase): + def test_supervisor_has_no_mint_call(self): + source = Path('v03_prefix_supervisor_v1.py').read_text() + tree = ast.parse(source) + forbidden = { + 'ParentEpoch', 'ParentCompletion', 'reserve_producer', + 'accept_completed_producer', 'commit_exports', + '_EPOCH_COMPLETION', '_EPOCH_ACCEPT', + } + names = {node.id for node in ast.walk(tree) + if type(node) is ast.Name} + attributes = {node.attr for node in ast.walk(tree) + if type(node) is ast.Attribute} + self.assertFalse(forbidden & (names | attributes)) + + def test_complete_observer_selected(self): + source = Path('v03_prefix_supervisor_v1.py').read_text() + self.assertIn("'corroborate_complete_refusal'", source) + self.assertNotIn("'corroborate_raw_refusal'", source) + + def test_source_gates_remain_none(self): + tree = ast.parse(Path('v03_prefix_supervisor_v1.py').read_text()) + required = { + 'CONFIGURATION', 'SOURCE_REVIEW', 'STAGE_APPROVAL', + 'COMMAND_APPROVAL', 'FUNDING', 'EXECUTION_APPROVAL', + } + found = {} + for node in tree.body: + if type(node) is ast.Assign and len(node.targets) == 1: + target = node.targets[0] + if type(target) is ast.Name and target.id in required: + found[target.id] = ast.literal_eval(node.value) + self.assertEqual(found, {name: None for name in required}) + + +if __name__ == '__main__': + unittest.main() diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/v03_integrated_constructor_v1.py b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/v03_integrated_constructor_v1.py new file mode 100644 index 0000000000..15c56b7dd1 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/v03_integrated_constructor_v1.py @@ -0,0 +1,130 @@ +"""Pure authoring support for the proposed genuine-Root V03 prefix route. + +No original module is imported or executed. Output is a source draft with +all eight original admission/configuration literals still None. The selected +prefix requires independent review as V03 source-gate coverage, and is not V01. +""" +import ast +import hashlib + +ROOT_SHA = 'f5a2d33f2b4d3651f214156a0e7094c2bb516ce2d5ab7698d18c11f98f35dee0' +PROVIDER_SHA = '9cbb7368f89e71d1e6cc46db5dc77efed3e03ed2a801c98c88fe316e4d9f3ef2' +VARIANT_SHA = 'cdb1479253358508088f8aa0e1e92e6c75ffcc127e54552698598a02de061254' +NATIVE_ENV = { + b'PATH': b'/usr/bin:/bin', b'PYTHONHASHSEED': b'0', + b'LANG': b'C.UTF-8', b'LC_ALL': b'C.UTF-8', b'TZ': b'UTC', + b'PYTHONDONTWRITEBYTECODE': b'1', +} +GATES = ('VARIANT_CONFIGURATION', 'VARIANT_SOURCE_REVIEW', + 'VARIANT_STAGE_ADMISSION', 'VARIANT_NATIVE_PROFILE', + 'VARIANT_HEADER_ADMISSION', 'VARIANT_COMMAND_ADMISSION', + 'VARIANT_FUNDING', 'VARIANT_EXECUTION') +TAIL = b'''try: + _variant_main() +except BaseException as _variant_error: + _VARIANT_TERMINAL_ERROR[0] = _variant_error + raise +''' +CONTROL_TAIL = b'''_V03_RESULT = [None] +try: + _V03_RESULT[0] = _v03_original_input_prefix() + _vroot(_INITIAL_OUTPUT + '/v03-root-after.raw.json') + _vraw(_INITIAL_OUTPUT + '/v03-input-result.raw.json', { + 'schema': 'h25-v03-input-prefix-result-v1', + 'status': 'ORIGINAL_INPUT_PREFIX_RETURNED', + 'binding': _V03_RESULT[0], + 'whole_variant_producer_completed': False, + 'runtime_qualified': False}) +except BaseException as _v03_error: + _VARIANT_TERMINAL_ERROR[0] = _v03_error + # No diagnostic allocation or I/O after an inherited failure. The genuine + # parent retains its raw stderr stream and owned terminal facts; absent or + # incomplete evidence is STOP, never a successful negative control. + raise +''' + + +def need(condition, message): + if not condition: + raise ValueError(message) + + +def absolute(path): + need(type(path) is str and 1 < len(path) <= 4096 and + path.startswith('/') and all(32 <= ord(c) < 127 for c in path) and + all(part not in ('', '.', '..') for part in path.split('/')[1:]), + 'canonical bounded absolute ASCII path required') + return path + + +def build_control_driver(original): + """Construct an unconfigured driver by a checked source transformation.""" + need(type(original) is bytes and len(original) == 41337 and + hashlib.sha256(original).hexdigest() == VARIANT_SHA, + 'exact original variant source required') + tree = ast.parse(original, feature_version=(3, 12)) + functions = [node for node in tree.body if isinstance(node, ast.FunctionDef) + and node.name == '_variant_main'] + need(len(functions) == 1, 'unique original main required') + function = functions[0] + lines = original.splitlines(keepends=True) + body = b''.join(lines[function.lineno - 1:function.end_lineno]) + cut = b' builds = []\n' + need(body.count(cut) == 1 and body.startswith(b'def _variant_main():\n'), + 'original prebuild boundary differs') + prefix = body.split(cut, 1)[0] + prefix = prefix.replace(b'def _variant_main():\n', + b'def _v03_original_input_prefix():\n', 1) + prefix += b' return binding\n\n\n' + need(original.endswith(TAIL) and original.count(TAIL) == 1, + 'original terminal entry differs') + result = original[:-len(TAIL)] + prefix + CONTROL_TAIL + need(len(result) <= 262144, 'genuine Root driver limit exceeded') + result_tree = ast.parse(result, feature_version=(3, 12)) + found = {} + for node in result_tree.body: + if isinstance(node, ast.Assign) and len(node.targets) == 1: + target = node.targets[0] + if isinstance(target, ast.Name) and target.id in GATES: + need(isinstance(node.value, ast.Constant) and + node.value.value is None, 'original gate was configured') + found[target.id] = None + need(set(found) == set(GATES), 'original gate census differs') + return result + + +def genuine_launch(stage, output, generation, nonce, mode, driver_bytes): + """Return launch DATA only. It is not stage/source/funding admission. + + CWD=stage is an explicit choice of this launch instance, allowed by the + original Root. It becomes part of Gamma and must enter C05 rule derivation. + The future parent must authenticate and own that exact stage and output + ancestor before actually passing these values to its genuine Popen route. + """ + absolute(stage) + absolute(output) + need(output != stage and not output.startswith(stage + '/'), + 'output must be outside the immutable stage') + need(type(generation) is str and 1 <= len(generation) <= 96 and + all(c in 'abcdefghijklmnopqrstuvwxyz0123456789-' for c in generation), + 'generation differs') + need(type(nonce) is str and len(nonce) == 64 and + all(c in '0123456789abcdef' for c in nonce), 'nonce differs') + need(type(mode) is str and mode in ('normal', 'optimized'), 'mode differs') + need(type(driver_bytes) is bytes and 0 < len(driver_bytes) <= 262144, + 'bounded reviewed driver bytes required') + integration = stage + '/integration' + command = ['/usr/bin/python3.12', '-S', '-s', '-P', '-B'] + if mode == 'optimized': + command.append('-O') + command += [integration + '/full_driver.py', + '--root-sha256', ROOT_SHA, + '--provider', integration + '/probe_binding_v3.py', PROVIDER_SHA, + '--driver', integration + '/v03_control_driver_v1.py', + hashlib.sha256(driver_bytes).hexdigest(), + '--integration', integration, '--', + '--output', output, '--generation', generation, + '--launch-nonce', nonce] + return {'command': command, 'env': dict(NATIVE_ENV), 'cwd': stage, + 'mode': mode, 'generation': generation, 'launch_nonce': nonce, + 'source_admitted': False, 'execution_admitted': False} diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/v03_prefix_derivation_v1.py b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/v03_prefix_derivation_v1.py new file mode 100644 index 0000000000..25d0cdfbc9 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/v03_prefix_derivation_v1.py @@ -0,0 +1,99 @@ +"""Verify only eight literal replacements in the exact reviewed V03 prefix. + +Source proposal, Apache-2.0. Preserve original authors and derivation notices. +Pinned gate-value DATA does not confer source/native/funding/runtime admission. +""" +import ast +from v03_integrated_constructor_v1 import GATES, build_control_driver + + +def _plain(value): + budget = [0, 0] + + def walk(item, depth): + budget[0] += 1 + if depth > 24 or budget[0] > 65536: + raise ValueError('gate tree bound') + kind = type(item) + if item is None or kind is bool: + return + if kind is int: + if not -(1 << 64) <= item < (1 << 64): + raise ValueError('gate integer bound') + return + if kind is str: + budget[1] += len(item) + if len(item) > 8192 or budget[1] > 524288: + raise ValueError('gate text bound') + return + if kind not in (list, dict) or len(item) > 1024: + raise ValueError('gate exact JSON domain') + if kind is dict: + for key in item: + if type(key) is not str: + raise ValueError('gate exact string key required') + walk(key, depth + 1) + walk(item[key], depth + 1) + else: + for child in item: + walk(child, depth + 1) + + walk(value, 0) + + +def _same(left, right): + if type(left) is not type(right): + return False + if type(left) is dict: + return (set(left) == set(right) and + all(_same(left[k], right[k]) for k in left)) + if type(left) is list: + return (len(left) == len(right) and + all(_same(a, b) for a, b in zip(left, right))) + return left == right + + +def verify_configured_prefix(original_bytes, driver_bytes, frozen_gate_values): + expected = build_control_driver(original_bytes) + if type(driver_bytes) is not bytes or not 0 < len(driver_bytes) <= 262144: + raise ValueError('selected driver byte bound') + _plain(frozen_gate_values) + if type(frozen_gate_values) is not dict or set(frozen_gate_values) != set(GATES): + raise ValueError('exact eight frozen gates required') + + tree = ast.parse(driver_bytes, feature_version=(3, 12)) + offsets, position = [], 0 + for line in driver_bytes.splitlines(keepends=True): + offsets.append(position) + position += len(line) + + actual, spans = {}, [] + for node in tree.body: + if (type(node) is ast.Assign and len(node.targets) == 1 and + type(node.targets[0]) is ast.Name and + node.targets[0].id in GATES): + name, value = node.targets[0].id, node.value + if name in actual: + raise ValueError('duplicate configured gate') + pending, count = [(value, 0)], 0 + while pending: + child, depth = pending.pop() + count += 1 + if depth > 26 or count > 65536: + raise ValueError('literal AST bound') + pending.extend((part, depth + 1) + for part in ast.iter_child_nodes(child)) + actual[name] = ast.literal_eval(value) + spans.append(( + offsets[value.lineno - 1] + value.col_offset, + offsets[value.end_lineno - 1] + value.end_col_offset, + )) + + _plain(actual) + if set(actual) != set(GATES) or not _same(actual, frozen_gate_values): + raise ValueError('configured values differ from independently pinned data') + normalized = driver_bytes + for start, end in sorted(spans, reverse=True): + normalized = normalized[:start] + b'None' + normalized[end:] + if normalized != expected: + raise ValueError('selected source differs outside eight literal values') diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/v03_prefix_supervisor_v1.py b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/v03_prefix_supervisor_v1.py new file mode 100644 index 0000000000..e65414302f --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/v03_prefix_supervisor_v1.py @@ -0,0 +1,804 @@ +"""One non-minting genuine-Root V03 prefix observation per fresh parent. + +Conditional source proposal, Apache-2.0. Derived from the recovered original +parent/domain/closure/copy/supervisor sources. Preserve all original notices. + +The enclosing trusted bootstrap must authenticate this source, its imports, +configured selections and native/OS startup before import. C07 ancestor and +immutable-lifetime conditions remain actual external prerequisites. + +No epoch is created, reserved, accepted, committed or completed here. +""" +import fcntl +import os +from pathlib import Path +import resource +import signal +import stat +import subprocess +import time + +import epoch_schema_v5 as schema +import epoch_copy_v5 as copying +import parent_domain_v1 as domain +import parent_closure_v1 as closure +import parent_completion_v1 as parent +import group01_evidence_v1 as group01 +import v03_prefix_derivation_v1 as derivation + +CONFIGURATION = None +SOURCE_REVIEW = None +STAGE_APPROVAL = None +COMMAND_APPROVAL = None +FUNDING = None +EXECUTION_APPROVAL = None + +ROOT_SHA = 'f5a2d33f2b4d3651f214156a0e7094c2bb516ce2d5ab7698d18c11f98f35dee0' +PROVIDER_SHA = '9cbb7368f89e71d1e6cc46db5dc77efed3e03ed2a801c98c88fe316e4d9f3ef2' +VARIANT_SHA = 'cdb1479253358508088f8aa0e1e92e6c75ffcc127e54552698598a02de061254' +OBSERVER = 'v03_source_refusal_observer_v1' +ENV = {'PATH': '/usr/bin:/bin', 'PYTHONHASHSEED': '0', + 'LANG': 'C.UTF-8', 'LC_ALL': 'C.UTF-8', 'TZ': 'UTC', + 'PYTHONDONTWRITEBYTECODE': '1'} + +_PID, _CLOCK, _FLOCK = os.getpid, time.monotonic, fcntl.flock +_PREFIX = [False, None] +_UNKNOWN_OWNER = { + 'quarantine': [False], 'pending': [False], + 'iterator_uncertain': [False], 'primary': [None], + 'native_errors': [None] * 4, +} +_INITIAL = ( + 'initial-tcb.raw.json', 'initial-controls.raw.json', + 'initial-restoration.raw.json', +) +_PREFLIGHT = _INITIAL + ('root-before.raw.json', 'preflight-before.raw.json') +_CUSTODY = _PREFLIGHT + ('custody-before.raw.json',) +_RETURNED = _CUSTODY + ( + 'v03-root-after.raw.json', 'v03-input-result.raw.json', +) + + +def _gate_snapshot(): + schema.exact(CONFIGURATION, ( + 'plan', 'receiver_policy', 'checker_source', 'original_variant', + )) + for pin in CONFIGURATION.values(): + schema.blob(pin, schema.RECORD_BYTES) + records = ( + (SOURCE_REVIEW, 'review_sha256'), + (STAGE_APPROVAL, 'stage_review_sha256'), + (COMMAND_APPROVAL, 'command_review_sha256'), + (FUNDING, 'reservation_sha256'), + (EXECUTION_APPROVAL, 'external_launch_policy_sha256'), + ) + for record, key in records: + schema.exact(record, (key,)) + schema.digest(record[key]) + copying._gate() + return schema.plain_copy({ + 'configuration': CONFIGURATION, + 'source': SOURCE_REVIEW, 'stage': STAGE_APPROVAL, + 'command': COMMAND_APPROVAL, 'funding': FUNDING, + 'execution': EXECUTION_APPROVAL, + 'copy_configuration': copying.COPY_CONFIGURATION, + 'copy_execution': copying.COPY_EXECUTION_APPROVAL, + 'copy_funding': copying.COPY_FUNDING, + }) + + +def _state(token): + schema.need(type(token) is object and _PREFIX[1] is not None and + _PREFIX[1][0] is token, 'unknown prefix owner') + return _PREFIX[1][1] + + +def _clean(owner): + domain.refresh_unknown_owner(owner) + schema.need(owner['primary'][0] is None and + owner['quarantine'][0] is False and + owner['pending'][0] is False and + owner['iterator_uncertain'][0] is False, + 'prefix owner requires kernel teardown') + + +def _native_bindings(): + schema.need( + _PID is os.getpid and _CLOCK is time.monotonic and + _FLOCK is fcntl.flock and parent.ENV == ENV and + parent._OPEN is os.open and parent._CLOSE is os.close and + parent._MKDIR is os.mkdir and parent._STAT is os.stat and + parent._SCANDIR is os.scandir and + parent._POPEN is subprocess.Popen and + parent._CLOCK is time.monotonic and parent._SLEEP is time.sleep and + parent._SETRLIMIT is resource.setrlimit and + parent._GETRLIMIT is resource.getrlimit and + parent._SETTIMER is signal.setitimer and + parent._GETTIMER is signal.getitimer and + parent._SIGNAL is signal.signal and + parent._GETSIGNAL is signal.getsignal, + 'prefix native primitive binding changed', + ) + + +def _guard(state): + schema.need(state['phase'] not in ('STOP', 'CLOSED'), + 'prefix owner is terminal') + schema.need(_PID() == state['pid'], 'prefix owner crossed process') + _native_bindings() + _clean(state['unknown_owner']) + schema.need(_gate_snapshot() == state['admissions'], + 'prefix admission selections changed') + closure.check_receivers(state['receivers']) + for pin in state['configuration'].values(): + copying.verify(pin, error_owner=state['errors']) + schema.need(state['native_keeper'] is not None and + all(type(fd) is int and fd >= 0 for fd in state['lock_fds']), + 'prefix real keeper or lock ownership missing') + schema.need(_CLOCK() <= state['shared_deadline'], + 'complete prefix owner deadline exceeded') + + +def _expected_files(expected): + schema.exact(expected, ( + 'outcome', 'exception_type', 'message', 'terminal_function', + 'v03_discriminator', 'compiler_launches', 'candidate_image_loads', + 'complete_raw_and_owned_terminal_required', + )) + schema.boolean(expected['v03_discriminator']) + schema.need(type(expected['compiler_launches']) is int and + expected['compiler_launches'] == 0 and + type(expected['candidate_image_loads']) is int and + expected['candidate_image_loads'] == 0 and + expected['complete_raw_and_owned_terminal_required'] is True, + 'prefix expectation scope differs') + outcome = expected['outcome'] + function, message = expected['terminal_function'], expected['message'] + if outcome == 'PREFIX_RETURN': + schema.need(function is None and message is None and + expected['exception_type'] is None, + 'positive prefix expectation differs') + return _RETURNED + schema.need(outcome == 'EXACT_SOURCE_REFUSAL' and + expected['exception_type'] == 'RuntimeError', + 'prefix refusal expectation differs') + if function == '_vcheck_literal_sources': + schema.need(message in ( + 'Variant source role path differs', + 'Variant reviewed source/header differs', + 'Variant role file omitted from closure', + ), 'prefix literal refusal site differs') + return _INITIAL + if function == '_vcheck_custody': + schema.need(message == 'Variant current source closure differs', + 'prefix custody refusal site differs') + return _CUSTODY + schema.need(function == '_v03_original_input_prefix', + 'prefix refusal function differs') + if message == 'Variant literal configuration differs': + return _INITIAL + schema.need(message == 'Variant original preflight differs' and + expected['v03_discriminator'] is False, + 'earlier preflight refusal cannot receive V03 credit') + return _PREFLIGHT + + +def _validate_plan(plan): + schema.exact(plan, ( + 'schema', 'mode', 'round_root', 'session_directory', + 'session_seconds', 'source_closure_admission_sha256', + 'source_files', 'case', + )) + schema.need(plan['schema'] == 'h25-v03-prefix-parent-plan-v1', + 'prefix plan schema differs') + schema.choice(plan['mode'], ('normal', 'optimized')) + for key in ('round_root', 'session_directory'): + schema.path(plan[key]) + schema.integer(plan['session_seconds'], 1, 600) + schema.digest(plan['source_closure_admission_sha256']) + schema.need(type(plan['source_files']) is list and + 1 <= len(plan['source_files']) <= parent.MAX_SOURCE_FILES, + 'prefix parent source inventory bound differs') + case = plan['case'] + schema.exact(case, ( + 'id', 'generation', 'launch_nonce', 'stage_directory', + 'stage_manifest', 'stage_directories', 'output', 'command', + 'root_seconds', 'address_space_bytes', 'rss_bytes', + 'root_source', 'driver_source', 'gate_values', 'expectation', + )) + schema.label(case['id']) + schema.label(case['generation']) + schema.digest(case['launch_nonce']) + schema.path(case['stage_directory']) + schema.path(case['output']) + schema.need( + case['output'] == plan['session_directory'] + '/producer-output' and + case['output'] != case['stage_directory'] and + not case['output'].startswith(case['stage_directory'] + '/'), + 'prefix source/output origins differ', + ) + schema.integer(case['root_seconds'], 1, 180) + schema.integer(case['address_space_bytes'], 1, 1024 ** 3) + schema.integer(case['rss_bytes'], 1, 1024 ** 3) + for key in ('stage_manifest', 'root_source', 'driver_source', 'gate_values'): + schema.blob(case[key], schema.RECORD_BYTES) + schema.need(type(case['stage_directories']) is list and + len(case['stage_directories']) <= parent.MAX_STAGE_ENTRIES, + 'prefix stage directory declaration differs') + integration = case['stage_directory'] + '/integration' + schema.need( + case['root_source']['path'] == integration + '/full_driver.py' and + case['root_source']['sha256'] == ROOT_SHA and + case['root_source']['bytes'] == 38851 and + case['driver_source']['path'] == + integration + '/v03_control_driver_v1.py' and + 0 < case['driver_source']['bytes'] <= 262144, + 'prefix genuine Root/selected driver source differs', + ) + command = ['/usr/bin/python3.12', '-S', '-s', '-P', '-B'] + if plan['mode'] == 'optimized': + command.append('-O') + command += [ + integration + '/full_driver.py', '--root-sha256', ROOT_SHA, + '--provider', integration + '/probe_binding_v3.py', PROVIDER_SHA, + '--driver', case['driver_source']['path'], + case['driver_source']['sha256'], '--integration', integration, '--', + '--output', case['output'], '--generation', case['generation'], + '--launch-nonce', case['launch_nonce'], + ] + schema.need(type(case['command']) is list and + all(type(arg) is str for arg in case['command']) and + case['command'] == command, + 'prefix exact original Root command differs') + _expected_files(case['expectation']) + + +def _record_bytes(value): + raw = group01.encode(value) + schema.need(len(raw) <= schema.RECORD_BYTES, + 'prefix parent record exceeds original writer bound') + return raw + + +def _source_snapshot(state): + plan = state['plan'] + files = parent._snapshot_sources(plan, state['errors']) + stage = parent._stage(dict(plan, **plan['case']), state['errors'], state) + raw = _record_bytes({ + 'schema': 'h25-prefix-source-custody-v1', + 'files': files, 'stage': stage, + 'source_closure_admission_sha256': + plan['source_closure_admission_sha256'], + 'interval_proved_by_endpoint_equality': False, + }) + return files, stage, raw + + +def make_prefix_owner(original_receivers): + schema.need(_PREFIX[0] is False, 'one prefix owner per fresh process') + _PREFIX[0] = True + began = _CLOCK() + state = None + try: + admissions = _gate_snapshot() + _native_bindings() + _clean(_UNKNOWN_OWNER) + errors = schema.make_error_owner() + _UNKNOWN_OWNER['native_errors'][0] = schema.owner_state(errors) + configuration = schema.plain_copy(CONFIGURATION) + plan = group01.decode(copying.read_verified( + configuration['plan'], schema.RECORD_BYTES, error_owner=errors)) + _validate_plan(plan) + policy = group01.decode(copying.read_verified( + configuration['receiver_policy'], schema.RECORD_BYTES, + error_owner=errors)) + schema.need(type(policy) is dict and + policy.get('v03_prefix_supervisor_v1') == + configuration['checker_source'], + 'prefix checker absent from independent source policy') + receivers = closure.bind_receivers(original_receivers, policy, errors) + schema.need( + closure.receiver(receivers, 'v03_prefix_supervisor_v1', + 'make_prefix_owner') is make_prefix_owner and + closure.receiver(receivers, 'epoch_schema_v5', + 'make_error_owner') is schema.make_error_owner and + closure.receiver(receivers, 'epoch_copy_v5', + 'inspect') is copying.inspect and + closure.receiver(receivers, 'parent_domain_v1', + 'create_domain') is domain.create_domain and + closure.receiver(receivers, 'parent_completion_v1', + '_snapshot_sources') is parent._snapshot_sources and + closure.receiver(receivers, 'v03_prefix_derivation_v1', + 'verify_configured_prefix') is + derivation.verify_configured_prefix, + 'prefix actual receiver identities differ', + ) + schema.need(parent._PARENTS == [] and parent._PROCESS[0] is None and + domain._DOMAINS == [], + 'prefix requires a fresh parent/domain lifetime') + _clean(parent._UNKNOWN_OWNER) + launch_contract = closure.receiver( + receivers, 'h25_parent_supervisor', 'launch_contract') + installer = closure.receiver( + receivers, 'h25_parent_supervisor', 'install_subreaper') + launch_contract() + closure.check_receivers(receivers) + + case = plan['case'] + state = { + 'pid': _PID(), 'phase': 'CONSTRUCTING', 'errors': errors, + 'plan': plan, 'configuration': configuration, + 'admissions': admissions, 'receivers': receivers, + 'unknown_owner': _UNKNOWN_OWNER, + 'io_quarantine': _UNKNOWN_OWNER['quarantine'], + 'fallback': [None] * 8, + 'began': began, + 'shared_deadline': began + plan['session_seconds'], + 'lock_fds': [None, None], + 'native_keeper': None, 'subreaper': None, + 'initial_sources': None, 'run': None, + } + # Retain construction resources even if no capability is returned. + _PREFIX[1] = (None, state) + + parent._MKDIR(plan['session_directory'], 0o700) + parent._MKDIR(plan['session_directory'] + '/retained', 0o700) + for index, name in enumerate(('parent-queue.lock', 'science.lock')): + _clean(_UNKNOWN_OWNER) + _UNKNOWN_OWNER['pending'][0] = True + state['lock_fds'][index] = parent._OPEN( + plan['round_root'] + '/runtime/' + name, + os.O_RDWR | os.O_CREAT | os.O_CLOEXEC | os.O_NOFOLLOW, 0o600) + _UNKNOWN_OWNER['pending'][0] = False + _FLOCK(state['lock_fds'][index], fcntl.LOCK_EX | fcntl.LOCK_NB) + + _UNKNOWN_OWNER['pending'][0] = True + installed = installer(Path(plan['round_root'])) + state['subreaper'], state['native_keeper'] = installed + _UNKNOWN_OWNER['pending'][0] = False + closure.check_receivers(receivers) + _clean(_UNKNOWN_OWNER) + + state['initial_sources'] = _source_snapshot(state) + by_path = {row['path']: row for row in plan['source_files']} + pins = tuple(configuration.values()) + ( + case['root_source'], case['driver_source'], case['gate_values'], + ) + for pin in pins: + schema.need(pin['path'] in by_path and + by_path[pin['path']]['sha256'] == pin['sha256'] and + by_path[pin['path']]['bytes'] == pin['bytes'] and + by_path[pin['path']]['mode'] == + pin['identity']['mode'] & 0o7777, + 'prefix input absent from parent source custody') + state['root_bytes'] = copying.read_verified( + case['root_source'], 262144, error_owner=errors) + state['driver_bytes'] = copying.read_verified( + case['driver_source'], 262144, error_owner=errors) + original = copying.read_verified( + configuration['original_variant'], 262144, error_owner=errors) + schema.need(configuration['original_variant']['sha256'] == VARIANT_SHA, + 'original variant source pin differs') + gate_raw = copying.read_verified( + case['gate_values'], schema.RECORD_BYTES, error_owner=errors) + decode = closure.receiver(receivers, OBSERVER, '_decode') + values = decode(gate_raw, schema.RECORD_BYTES) + derivation.verify_configured_prefix( + original, state['driver_bytes'], values) + schema.need(all(value is not None for value in values.values()), + 'prefix remains unconfigured; launch withheld') + # The check above does not approve these values. Their genuine + # admission must already be established by the authenticated bootstrap. + state['before_pin'] = copying.write_once( + plan['session_directory'] + '/SOURCE-BEFORE.json', + state['initial_sources'][2], error_owner=errors) + state['phase'] = 'READY' + _guard(state) + token = object() + _PREFIX[1] = (token, state) + return token + except BaseException as error: + if _UNKNOWN_OWNER['primary'][0] is None: + _UNKNOWN_OWNER['primary'][0] = error + _UNKNOWN_OWNER['quarantine'][0] = True + if state is not None: + state['phase'] = 'STOP' + primary = _UNKNOWN_OWNER['primary'][0] + if primary is error: + raise + raise primary + + +def _terminal(state, run): + _guard(state) + schema.need(run['primary'][0] is None, + 'earlier run error forbids terminal observation') + if run['expectation']['outcome'] == 'PREFIX_RETURN': + return domain.terminal_facts(run['domain']) + return domain.prefix_exit1_terminal_facts(run['domain']) + + +def _supervise(state): + owner, plan = state['unknown_owner'], state['plan'] + case = plan['case'] + run = None + primary = first_cleanup = None + old_handler = None + alarm_installed = False + try: + _guard(state) + schema.need(state['phase'] == 'READY' and state['run'] is None, + 'prefix control already consumed') + state['phase'] = 'CONTROL_CONSUMED' + run = { + 'plan': case, 'unknown_owner': owner, + 'domain': None, 'process': None, 'root': None, 'terminal': None, + 'log_fds': [None, None], + 'log_close_attempted': [False, False], + 'log_close_confirmed': [False, False], + 'errors': [None] * 8, 'primary': [None], + 'acquisition_in_flight': False, + 'spawn_entered': False, 'spawn_returned': False, + 'finish_attempted': False, + 'began': _CLOCK(), 'peak_rss': 0, 'file_limits': None, + 'retained': {}, 'expectation': case['expectation'], + } + state['run'] = run + before = _source_snapshot(state) + schema.need(before == state['initial_sources'], + 'prefix source/stage changed before launch') + try: + parent._STAT(case['output'], follow_symlinks=False) + except FileNotFoundError: + pass + else: + raise schema.EpochStop('prefix output already exists') + + run['file_limits'] = tuple(parent._GETRLIMIT(resource.RLIMIT_FSIZE)) + run['domain'] = domain.create_domain(owner) + run['launch'] = copying.write_once( + plan['session_directory'] + '/LAUNCH.json', + _record_bytes({ + 'schema': 'h25-prefix-control-launch-v1', + 'case': case['id'], 'mode': plan['mode'], + 'generation': case['generation'], + 'launch_nonce': case['launch_nonce'], + 'parent_pid': state['pid'], 'command': case['command'], + 'cwd': case['stage_directory'], 'environment': ENV, + 'parent_file_limits': list(run['file_limits']), + 'root_seconds': case['root_seconds'], + 'address_space_bytes': case['address_space_bytes'], + 'rss_bytes': case['rss_bytes'], + 'new_session': True, 'close_fds': True, 'pass_fds': [], + 'production_completion': False, + }), error_owner=state['errors']) + + for index, name in enumerate(('stdout.raw', 'stderr.raw')): + _clean(owner) + run['acquisition_in_flight'] = True + owner['pending'][0] = True + run['log_fds'][index] = parent._OPEN( + plan['session_directory'] + '/' + name, + os.O_WRONLY | os.O_CREAT | os.O_EXCL | + os.O_CLOEXEC | os.O_NOFOLLOW, 0o600) + run['acquisition_in_flight'] = False + owner['pending'][0] = False + + setter, kind = parent._SETRLIMIT, resource.RLIMIT_AS + limits = (case['address_space_bytes'], case['address_space_bytes']) + + def child_limit(): + setter(kind, limits) + + schema.need(parent._GETTIMER(signal.ITIMER_REAL) == (0.0, 0.0), + 'existing timer cannot be replaced') + old_handler = parent._GETSIGNAL(signal.SIGALRM) + parent._SIGNAL(signal.SIGALRM, parent._alarm) + alarm_installed = True + deadline = min(run['began'] + case['root_seconds'], + state['shared_deadline'] - domain.CLEANUP_SECONDS) + schema.need(_CLOCK() < deadline, 'no funded root/cleanup interval') + parent._SETTIMER(signal.ITIMER_REAL, + max(0.000001, deadline - _CLOCK())) + _guard(state) + run['spawn_entered'] = True + run['process'] = parent._POPEN( + case['command'], cwd=case['stage_directory'], env=dict(ENV), + stdout=run['log_fds'][0], stderr=run['log_fds'][1], + stdin=subprocess.DEVNULL, close_fds=True, pass_fds=(), + start_new_session=True, preexec_fn=child_limit) + run['spawn_returned'] = True + run['root'] = domain.adopt_popen(run['domain'], run['process']) + while True: + unused, current = domain.observe(run['domain']) + run['peak_rss'] = max(run['peak_rss'], + sum(row[6] for row in current)) + schema.need(run['peak_rss'] <= case['rss_bytes'], + 'owned prefix RSS sum exceeded') + schema.need(max(parent._STAT( + plan['session_directory'] + '/' + name, + follow_symlinks=False).st_size + for name in ('stdout.raw', 'stderr.raw')) <= schema.LOG_BYTES, + 'prefix raw log bound exceeded') + if domain.poll_owned(run['domain']) is not None: + break + parent._SLEEP(0.01) + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + primary = owner['primary'][0] + if run is not None: + run['primary'][0] = primary + if error is not primary: + run['errors'][4] = error + if (owner['pending'][0] or owner['iterator_uncertain'][0] or + (run is not None and run['acquisition_in_flight']) or + type(error) is MemoryError): + owner['quarantine'][0] = True + finally: + if alarm_installed: + try: + parent._SETTIMER(signal.ITIMER_REAL, 0) + parent._SIGNAL(signal.SIGALRM, old_handler) + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + if run is not None: + run['errors'][2] = error + first_cleanup = error + if run is not None and run['domain'] is not None: + run['finish_attempted'] = True + try: + domain.finish_domain(run['domain']) + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + owner['quarantine'][0] = True + run['errors'][3] = error + if first_cleanup is None: + first_cleanup = error + if run is not None: + try: + parent._close_logs( + run, primary if primary is not None else first_cleanup) + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + if first_cleanup is None: + first_cleanup = error + for index in range(2): + if (run['log_close_attempted'][index] and + not run['log_close_confirmed'][index]): + owner['quarantine'][0] = True + + if owner['primary'][0] is not None: + state['phase'] = 'STOP' + raise owner['primary'][0] + schema.need(run is not None and run['spawn_entered'] is True and + run['spawn_returned'] is True and + run['finish_attempted'] is True and + run['acquisition_in_flight'] is False and + all(run['log_close_confirmed']), + 'prefix spawn/stream ownership incomplete') + schema.need(tuple(parent._GETRLIMIT(resource.RLIMIT_FSIZE)) == + run['file_limits'], 'parent file limit drift') + run['terminal'] = _terminal(state, run) + state['phase'] = 'CONTROL_JOINED' + return run + + +def _directory_identity(info): + return (info.st_dev, info.st_ino, info.st_mode, info.st_nlink, + info.st_uid, info.st_gid, info.st_size, + info.st_mtime_ns, info.st_ctime_ns) + + +def _census_output(state, directory, files, directories): + """Original path-census ownership pattern; C07 remains a prerequisite.""" + _clean(state['unknown_owner']) + schema.path(directory) + schema.need(len(files) + len(directories) <= 9, + 'prefix output declaration bound') + before = parent._STAT(directory, follow_symlinks=False) + schema.need(stat.S_ISDIR(before.st_mode), 'prefix directory kind differs') + owner = state['unknown_owner'] + iterator = None + primary = None + found_files, found_directories = [], [] + owner['pending'][0] = True + try: + iterator = parent._SCANDIR(directory) + owner['pending'][0] = False + for entry in iterator: + schema.need(type(entry) is os.DirEntry, + 'prefix native directory entry differs') + name = entry.name + schema.need(type(name) is str and 0 < len(name) <= 256 and + '/' not in name and name not in ('.', '..'), + 'prefix directory entry name differs') + schema.need(len(found_files) + len(found_directories) < 9, + 'prefix output entry bound exceeded') + info = entry.stat(follow_symlinks=False) + if stat.S_ISREG(info.st_mode): + found_files.append(name) + elif stat.S_ISDIR(info.st_mode): + found_directories.append(name) + else: + raise schema.EpochStop('prefix symlink/special output refused') + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + primary = owner['primary'][0] + owner['quarantine'][0] = True + owner['iterator_uncertain'][0] = True + if primary is error: + raise + raise primary + finally: + if iterator is not None: + owned = iterator + iterator = None + try: + owned.close() + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + owner['quarantine'][0] = True + owner['iterator_uncertain'][0] = True + if state['fallback'][3] is None: + state['fallback'][3] = error + if primary is None: + raise owner['primary'][0] + after = parent._STAT(directory, follow_symlinks=False) + schema.need(_directory_identity(before) == _directory_identity(after), + 'prefix directory changed during census') + schema.need(sorted(found_files) == sorted(files) and + sorted(found_directories) == sorted(directories), + 'prefix exact output census differs') + return _directory_identity(after) + + +def _capture(state, run): + plan, case = state['plan'], state['plan']['case'] + names = _expected_files(case['expectation']) + occupied, raw, pins = (), {}, {} + sources = ( + ('stdout.raw', plan['session_directory'] + '/stdout.raw', + schema.LOG_BYTES), + ('stderr.raw', plan['session_directory'] + '/stderr.raw', + schema.LOG_BYTES), + ) + tuple((name, case['output'] + '/' + name, schema.RECORD_BYTES) + for name in names) + + # Complete exclusive copies precede semantic interpretation. + for name, path, bound in sources: + _guard(state) + source = copying.inspect(path, bound, error_owner=state['errors']) + run['retained'][name] = {'source': source} + pair = schema.inode(source) + schema.need(pair not in occupied, 'prefix raw occurrences alias') + occupied += (pair,) + copied = copying.copy_once( + source, plan['session_directory'] + '/retained/' + name, + occupied, error_owner=state['errors']) + run['retained'][name]['copy'] = copied + occupied += (schema.inode(copied),) + raw[name] = copying.read_verified( + copied, bound, error_owner=state['errors']) + pins[name] = (source, copied, bound) + + output_identity = _census_output( + state, case['output'], names, ('initial-tcb-controls',)) + scratch_identity = _census_output( + state, case['output'] + '/initial-tcb-controls', (), ()) + decode = closure.receiver(state['receivers'], OBSERVER, '_decode') + values = {name: decode(raw[name], schema.RECORD_BYTES) for name in names} + closure.check_receivers(state['receivers']) + schema.need(raw['stdout.raw'] == b'', 'prefix stdout is not empty') + for name in ('initial-tcb.raw.json', 'initial-restoration.raw.json'): + receipt = values[name] + schema.need(type(receipt) is dict and + type(receipt.get('pid')) is int and + receipt['pid'] == run['root'][0], + 'prefix initial/restoration PID differs') + + expected = case['expectation'] + binding = {'mode': plan['mode'], 'generation': case['generation'], + 'launch_nonce': case['launch_nonce']} + if expected['outcome'] == 'PREFIX_RETURN': + schema.need(raw['stderr.raw'] == b'', + 'positive prefix stderr is not empty') + check = closure.receiver( + state['receivers'], OBSERVER, 'corroborate_positive') + ok = check(raw['v03-input-result.raw.json'], + raw['v03-root-after.raw.json'], + raw['preflight-before.raw.json'], + binding, schema.RECORD_BYTES) + else: + check = closure.receiver( + state['receivers'], OBSERVER, 'corroborate_complete_refusal') + ok = check(state['driver_bytes'], state['root_bytes'], + case['driver_source']['path'], case['root_source']['path'], + raw['stderr.raw'], expected['terminal_function'], + expected['message'], schema.LOG_BYTES) + schema.need(ok is True, 'complete prefix data corroboration differs') + closure.check_receivers(state['receivers']) + for source, copied, bound in pins.values(): + _clean(state['unknown_owner']) + copying.verify(source, bound, error_owner=state['errors']) + copying.verify(copied, bound, error_owner=state['errors']) + schema.need( + _census_output(state, case['output'], names, + ('initial-tcb-controls',)) == output_identity and + _census_output(state, case['output'] + '/initial-tcb-controls', + (), ()) == scratch_identity, + 'prefix output changed after capture', + ) + + +def run_prefix(token): + state = _state(token) + owner = state['unknown_owner'] + try: + run = _supervise(state) + _capture(state, run) + after = _source_snapshot(state) + schema.need(after == state['initial_sources'], + 'complete prefix source/stage custody changed') + schema.need(_terminal(state, run) == run['terminal'], + 'prefix owned terminal facts changed') + case = state['plan']['case'] + schema.need(_CLOCK() - run['began'] <= case['root_seconds'], + 'complete prefix root/capture tail exceeded bound') + _guard(state) + record = { + 'schema': 'h25-owned-v03-prefix-observation-v1', + 'case': case['id'], 'mode': state['plan']['mode'], + 'generation': case['generation'], + 'launch_nonce': case['launch_nonce'], + 'launch': run['launch'], 'terminal': run['terminal'], + 'source_before': state['before_pin'], + 'source_after_equals_before': True, + 'raw': run['retained'], + 'data_corroboration': 'COMPLETE_PREFIX_DATA_ONLY', + 'independent_native_receipt_replay_performed': False, + 'interval_proved_by_endpoint_equality': False, + 'parent_exit_observed_here': False, + 'enclosing_guard_must_observe_parent_exit': True, + 'production_completion': False, + 'full_c05': False, 'full_v03': False, + 'runtime_qualified': False, + } + result = copying.write_once( + state['plan']['session_directory'] + '/PREFIX-OBSERVATION.json', + _record_bytes(record), error_owner=state['errors']) + _guard(state) + schema.need(_CLOCK() - run['began'] <= case['root_seconds'], + 'complete prefix result-writing tail exceeded bound') + state['phase'] = 'CLOSED' + # Plain file pin DATA only. No owner/domain/Popen/epoch token escapes. + return schema.plain_copy(result) + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + state['phase'] = 'STOP' + if owner['pending'][0] or owner['iterator_uncertain'][0]: + owner['quarantine'][0] = True + primary = owner['primary'][0] + if primary is error: + raise + raise primary + + +def stop_evidence(token): + state = _state(token) + run = state['run'] + summary = None if run is None else { + 'spawn_entered': run['spawn_entered'], + 'spawn_returned': run['spawn_returned'], + 'finish_attempted': run['finish_attempted'], + 'log_close_attempted': list(run['log_close_attempted']), + 'log_close_confirmed': list(run['log_close_confirmed']), + } + return (state['unknown_owner']['primary'], state['errors'], + state['fallback'], summary) diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/v03_source_refusal_observer_v1.py b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/v03_source_refusal_observer_v1.py new file mode 100644 index 0000000000..d03b4e14bd --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/v1-frozen/implementation/v03_source_refusal_observer_v1.py @@ -0,0 +1,290 @@ +"""Pure source-location corroboration for parent-retained V03 stderr. + +This does not establish ownership, currentness, admission, or even that a child +ran. The genuine parent must supply its complete retained raw stderr after +actual owned termination, with independently authenticated driver/stage pins. +No result of this function by itself is a V03 PASS or a ParentCompletion. +""" +import ast +import hashlib +import json + +COMPONENT_LOG_BYTES = 2 * 1024 * 1024 +COMPONENT_RECORD_BYTES = 1048576 +ROOT_COUNTERS = ('load_calls', 'native_creations', 'native_execs', + 'activation_attempts', 'successful_bindings', + 'deactivation_attempts', 'cleanup_failures', + 'control_module_creations') + +MESSAGES = { + '_vcheck_literal_sources': ( + 'Variant source role path differs', + 'Variant reviewed source/header differs', + 'Variant role file omitted from closure'), + '_vcheck_custody': ('Variant current source closure differs',), + '_v03_original_input_prefix': ( + 'Variant literal configuration differs', + 'Variant original preflight differs'), +} + + +def source_site(driver_bytes, function, message): + """Derive the unique original logical-raise line without running code.""" + if (type(driver_bytes) is not bytes or not 0 < len(driver_bytes) <= 262144 or + type(function) is not str or type(message) is not str or + function not in MESSAGES or message not in MESSAGES[function]): + raise ValueError('bounded source and literal V03 refusal required') + tree = ast.parse(driver_bytes, feature_version=(3, 12)) + candidates = [node for node in tree.body + if isinstance(node, ast.FunctionDef) and node.name == function] + if len(candidates) != 1: + raise ValueError('unique actual control function required') + sites = [] + for node in ast.walk(candidates[0]): + if not isinstance(node, ast.Raise): + continue + value = node.exc + if (isinstance(value, ast.Call) and isinstance(value.func, ast.Name) and + value.func.id == 'RuntimeError' and len(value.args) == 1 and + not value.keywords and isinstance(value.args[0], ast.Constant) and + type(value.args[0].value) is str and value.args[0].value == message): + sites.append(node.lineno) + if len(sites) != 1: + raise ValueError('unique actual literal raise required') + return sites[0] + + +def corroborate_raw_refusal(driver_bytes, driver_path, stderr_raw, + function, message, original_log_bound): + """Recognize only the expected terminal logical source refusal. + + All exceptions from this checker mean incomplete verification. A False + return means different or insufficient raw evidence; never generic success. + The bound is the existing parent's independently fixed log limit, not a + newly increased allowance. This is terminal-site corroboration only: it + refuses conventional chaining but does not establish the middle frames or + complete traceback grammar. Use corroborate_complete_refusal as well before + accepting the proposed genuine-Root source-refusal route. + """ + if (type(driver_path) is not str or not 1 < len(driver_path) <= 4096 or + not driver_path.startswith('/') or + any(not 32 <= ord(c) < 127 for c in driver_path) or + type(original_log_bound) is not int or original_log_bound <= 0): + raise ValueError('actual source path and existing parent log limit required') + if (type(stderr_raw) is not bytes or + len(stderr_raw) > min(original_log_bound, COMPONENT_LOG_BYTES)): + return False + line_number = source_site(driver_bytes, function, message) + header = (' File "' + driver_path + '", line ' + str(line_number) + + ', in ' + function).encode('ascii') + ending = ('RuntimeError: ' + message + '\n').encode('ascii') + start = b'Traceback (most recent call last):\n' + if (not stderr_raw.startswith(start) or not stderr_raw.endswith(ending) or + stderr_raw.count(start) != 1 or + b'During handling of the above exception' in stderr_raw or + b'The above exception was the direct cause' in stderr_raw): + return False + frames = [line for line in stderr_raw.splitlines() if line.startswith(b' File "')] + return bool(frames) and frames[-1] == header + + +def _executed_calls(node, name): + """Find module/function-body calls without descending into new scopes.""" + result = [] + pending = list(ast.iter_child_nodes(node)) + while pending: + child = pending.pop() + if isinstance(child, (ast.FunctionDef, ast.AsyncFunctionDef, + ast.ClassDef, ast.Lambda)): + continue + if (isinstance(child, ast.Call) and isinstance(child.func, ast.Name) + and child.func.id == name): + result.append(child.lineno) + pending.extend(ast.iter_child_nodes(child)) + if len(result) != 1: + raise ValueError('unique actual source call required') + return result[0] + + +def corroborate_complete_refusal(driver_bytes, root_bytes, driver_path, + root_path, stderr_raw, function, message, + original_log_bound): + """Check the full standard traceback shape for the exact f5 Root route. + + This is a strict source-derived corroborator. It grants no ownership, + authenticity, currentness, error-delivery or admission credential. The parent + must separately authenticate the exact selected driver and complete streams. + Unavailable source lines, custom formatters, elision and nonstandard output + are refused, rather than silently accepted as complete original evidence. + """ + if not corroborate_raw_refusal(driver_bytes, driver_path, stderr_raw, + function, message, original_log_bound): + return False + if (type(root_bytes) is not bytes or len(root_bytes) != 38851 or + hashlib.sha256(root_bytes).hexdigest() != + 'f5a2d33f2b4d3651f214156a0e7094c2bb516ce2d5ab7698d18c11f98f35dee0' or + type(root_path) is not str or not 1 < len(root_path) <= 4096 or + not root_path.startswith('/') or root_path == driver_path or + any(not 32 <= ord(c) < 127 for c in root_path)): + raise ValueError('exact original Root bytes and distinct path required') + root_tree = ast.parse(root_bytes, feature_version=(3, 12)) + driver_tree = ast.parse(driver_bytes, feature_version=(3, 12)) + roots = [n for n in root_tree.body + if isinstance(n, ast.FunctionDef) and n.name == '_entry'] + prefixes = [n for n in driver_tree.body if isinstance(n, ast.FunctionDef) + and n.name == '_v03_original_input_prefix'] + if len(roots) != 1 or len(prefixes) != 1: + raise ValueError('unique actual Root entry and control prefix required') + terminal = source_site(driver_bytes, function, message) + expected = [(root_path, _executed_calls(root_tree, '_entry'), ''), + (root_path, _executed_calls(roots[0], '_EXEC'), '_entry'), + (driver_path, _executed_calls(driver_tree, + '_v03_original_input_prefix'), + '')] + if function != '_v03_original_input_prefix': + expected.append((driver_path, _executed_calls(prefixes[0], function), + '_v03_original_input_prefix')) + expected.append((driver_path, terminal, function)) + root_lines = root_bytes.decode('utf-8').splitlines() + driver_lines = driver_bytes.decode('utf-8').splitlines() + raw_lines = stderr_raw.splitlines(keepends=True) + position = 1 # The terminal corroborator already checked the initial header. + for path, line, frame in expected: + header = (' File "' + path + '", line ' + str(line) + ', in ' + + frame + '\n').encode('ascii') + source = root_lines if path == root_path else driver_lines + printed = (' ' + source[line - 1].strip() + '\n').encode('utf-8') + if (position + 1 >= len(raw_lines) or raw_lines[position] != header or + raw_lines[position + 1] != printed): + return False + position += 2 + # CPython may add a range indicator. It has no extra source authority. + if (position < len(raw_lines) and + raw_lines[position].startswith(b' ') and + raw_lines[position].strip(b' \n') and + all(c in b' ~^\n' for c in raw_lines[position]) and + b'^' in raw_lines[position]): + indicator = raw_lines[position].strip(b' \n') + # The standard formatter has one contiguous primary caret range. + first = indicator.find(b'^') + last = indicator.rfind(b'^') + if (any(c != 126 for c in indicator[:first]) or + any(c != 94 for c in indicator[first:last+1]) or + any(c != 126 for c in indicator[last+1:])): + return False + position += 1 + ending = ('RuntimeError: ' + message + '\n').encode('ascii') + return position == len(raw_lines) - 1 and raw_lines[position] == ending + + +def _no_noninteger(token): + raise ValueError('noninteger JSON number or constant') + + +def _integer(token): + if len(token) > 21: + raise ValueError('JSON integer length bound') + value = int(token) + if not -(1 << 64) <= value < (1 << 64): + raise ValueError('JSON integer domain') + return value + + +def _pairs(pairs): + if len(pairs) > 1024: + raise ValueError('JSON mapping bound') + result = {} + for key, value in pairs: + if key in result: + raise ValueError('duplicate JSON key') + result[key] = value + return result + + +def _tree(value, depth, budget): + budget[0] += 1 + if depth > 24 or budget[0] > 65536: + raise ValueError('JSON tree bound') + kind = type(value) + if value is None or kind is bool or kind is int: + return + if kind is str: + budget[1] += len(value) + if len(value) > 8192 or budget[1] > 524288: + raise ValueError('JSON text bound') + return + if kind is list: + if len(value) > 1024: + raise ValueError('JSON sequence bound') + for item in value: + _tree(item, depth + 1, budget) + return + if kind is dict: + for key in value: + _tree(key, depth + 1, budget) + _tree(value[key], depth + 1, budget) + return + raise ValueError('foreign JSON value') + + +def _decode(raw, original_record_bound): + if (type(original_record_bound) is not int or original_record_bound <= 0 or + type(raw) is not bytes or + not 0 < len(raw) <= min(original_record_bound, COMPONENT_RECORD_BYTES)): + raise ValueError('existing parent/raw component byte bound') + value = json.loads(raw.decode('ascii'), object_pairs_hook=_pairs, + parse_int=_integer, parse_float=_no_noninteger, + parse_constant=_no_noninteger) + _tree(value, 0, [0, 0]) + return value + + +def corroborate_positive(result_raw, root_after_raw, preflight_raw, + parent_binding, original_record_bound): + """Corroborate three complete raw records against independent launch data. + + A True result is ONLY these three checks. Original initial TCB/five-control/ + restoration records, custody-before, independent dependencies, parent source + continuity, domain ownership and terminal capture remain required elsewhere. + Limits here are additional component ceilings, never increased parent caps. + Decode resource/MemoryError failures propagate for parent first-error capture. + """ + if (type(parent_binding) is not dict or + any(type(k) is not str for k in parent_binding) or set(parent_binding) != { + 'mode', 'generation', 'launch_nonce'} or + any(type(v) is not str for v in parent_binding.values()) or + parent_binding['mode'] not in ('normal', 'optimized') or + not 1 <= len(parent_binding['generation']) <= 96 or + any(c not in 'abcdefghijklmnopqrstuvwxyz0123456789-' + for c in parent_binding['generation']) or + len(parent_binding['launch_nonce']) != 64 or + any(c not in '0123456789abcdef' for c in parent_binding['launch_nonce'])): + raise ValueError('independent actual parent launch binding required') + result = _decode(result_raw, original_record_bound) + counters = _decode(root_after_raw, original_record_bound) + preflight = _decode(preflight_raw, original_record_bound) + if (type(result) is not dict or set(result) != { + 'schema', 'status', 'binding', 'whole_variant_producer_completed', + 'runtime_qualified'} or + type(result['schema']) is not str or + result['schema'] != 'h25-v03-input-prefix-result-v1' or + type(result['status']) is not str or + result['status'] != 'ORIGINAL_INPUT_PREFIX_RETURNED' or + result['whole_variant_producer_completed'] is not False or + result['runtime_qualified'] is not False or + type(result['binding']) is not dict or + set(result['binding']) != set(parent_binding) or + any(type(result['binding'][k]) is not str or + result['binding'][k] != parent_binding[k] for k in parent_binding)): + return False + if (type(counters) is not dict or set(counters) != set(ROOT_COUNTERS) or + any(type(counters[k]) is not int or counters[k] != 0 for k in ROOT_COUNTERS)): + return False + return (type(preflight) is dict and set(preflight) == { + 'schema', 'authenticated_files', 'native_private_access', 'cached_admission'} and + type(preflight['schema']) is str and + preflight['schema'] == 'h25-public-runtime-preflight-v2' and + type(preflight['authenticated_files']) is int and + preflight['authenticated_files'] == 217 and + preflight['native_private_access'] is False and + preflight['cached_admission'] is False) diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/v2-pre-close-model/ORCHESTRATION-v2-normal.txt b/research/h25-v03-prefix-supervision/unit05/fixtures/v2-pre-close-model/ORCHESTRATION-v2-normal.txt new file mode 100644 index 0000000000..36ebf1809f --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/v2-pre-close-model/ORCHESTRATION-v2-normal.txt @@ -0,0 +1,16 @@ +test_changed_plan_raw_is_retained_before_rejection (__main__.OuterPlanTests.test_changed_plan_raw_is_retained_before_rejection) ... ok +test_outer_plan_row_is_counted (__main__.OuterPlanTests.test_outer_plan_row_is_counted) ... ok +test_plan_inode_cannot_alias_an_inner_row (__main__.OuterPlanTests.test_plan_inode_cannot_alias_an_inner_row) ... ok +test_plan_path_cannot_be_an_inner_row (__main__.OuterPlanTests.test_plan_path_cannot_be_an_inner_row) ... ok +test_three_actual_fixture_reads_retained_and_equal (__main__.OuterPlanTests.test_three_actual_fixture_reads_retained_and_equal) ... ok +test_partial_copy_failure_retains_already_captured_sources (__main__.RawRetentionTests.test_partial_copy_failure_retains_already_captured_sources) ... ok +test_adoption_and_observe_primary_survive_cleanup (__main__.SuperviseTests.test_adoption_and_observe_primary_survive_cleanup) ... ok +test_consumed_control_does_not_spawn_again (__main__.SuperviseTests.test_consumed_control_does_not_spawn_again) ... ok +test_failed_raw_close_is_not_retried_or_terminal (__main__.SuperviseTests.test_failed_raw_close_is_not_retried_or_terminal) ... ok +test_popen_primary_survives_cleanup_secondary (__main__.SuperviseTests.test_popen_primary_survives_cleanup_secondary) ... ok +test_uncertain_raw_open_stops_later_acquisitions (__main__.SuperviseTests.test_uncertain_raw_open_stops_later_acquisitions) ... ok + +---------------------------------------------------------------------- +Ran 11 tests in 0.105s + +OK diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/v2-pre-close-model/ORCHESTRATION-v2-optimized.txt b/research/h25-v03-prefix-supervision/unit05/fixtures/v2-pre-close-model/ORCHESTRATION-v2-optimized.txt new file mode 100644 index 0000000000..ceb174b0b6 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/v2-pre-close-model/ORCHESTRATION-v2-optimized.txt @@ -0,0 +1,16 @@ +test_changed_plan_raw_is_retained_before_rejection (__main__.OuterPlanTests.test_changed_plan_raw_is_retained_before_rejection) ... ok +test_outer_plan_row_is_counted (__main__.OuterPlanTests.test_outer_plan_row_is_counted) ... ok +test_plan_inode_cannot_alias_an_inner_row (__main__.OuterPlanTests.test_plan_inode_cannot_alias_an_inner_row) ... ok +test_plan_path_cannot_be_an_inner_row (__main__.OuterPlanTests.test_plan_path_cannot_be_an_inner_row) ... ok +test_three_actual_fixture_reads_retained_and_equal (__main__.OuterPlanTests.test_three_actual_fixture_reads_retained_and_equal) ... ok +test_partial_copy_failure_retains_already_captured_sources (__main__.RawRetentionTests.test_partial_copy_failure_retains_already_captured_sources) ... ok +test_adoption_and_observe_primary_survive_cleanup (__main__.SuperviseTests.test_adoption_and_observe_primary_survive_cleanup) ... ok +test_consumed_control_does_not_spawn_again (__main__.SuperviseTests.test_consumed_control_does_not_spawn_again) ... ok +test_failed_raw_close_is_not_retried_or_terminal (__main__.SuperviseTests.test_failed_raw_close_is_not_retried_or_terminal) ... ok +test_popen_primary_survives_cleanup_secondary (__main__.SuperviseTests.test_popen_primary_survives_cleanup_secondary) ... ok +test_uncertain_raw_open_stops_later_acquisitions (__main__.SuperviseTests.test_uncertain_raw_open_stops_later_acquisitions) ... ok + +---------------------------------------------------------------------- +Ran 11 tests in 0.093s + +OK diff --git a/research/h25-v03-prefix-supervision/unit05/fixtures/v2-pre-close-model/test_new_orchestration_v2.py b/research/h25-v03-prefix-supervision/unit05/fixtures/v2-pre-close-model/test_new_orchestration_v2.py new file mode 100644 index 0000000000..f02a07bba5 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/fixtures/v2-pre-close-model/test_new_orchestration_v2.py @@ -0,0 +1,199 @@ +"""NEW-body-only pure discriminators. Every service and PID/FD below is fake. + +No state/token returned here is an actual capability; no original function, +Popen, native call, kernel census, namespace or target process is executed. +""" +import ast +import hashlib +import json +from pathlib import Path +from types import SimpleNamespace as NS +import unittest + +BASE=Path('/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05') +IMPL=BASE/'implementation' + + +class FixtureStop(RuntimeError):pass + + +def need(value,message): + if value is not True:raise FixtureStop(message) + + +def extract(name,scope): + tree=ast.parse((IMPL/'v03_prefix_supervisor_v1.py').read_bytes(),feature_version=(3,12)) + functions=[n for n in tree.body if type(n) is ast.FunctionDef and n.name==name] + if len(functions)!=1:raise ValueError('unique NEW function required') + if name not in ('_supervise','_source_snapshot','_capture'):raise ValueError('not a newly authored test target') + if any(isinstance(n,(ast.Import,ast.ImportFrom)) for n in ast.walk(functions[0])):raise ValueError('unexpected function import') + data=dict(scope) + exec(compile(ast.Module(body=functions,type_ignores=[]),'','exec'),data) + return data[name] + + +def owner():return {'primary':[None],'pending':[False],'iterator_uncertain':[False],'quarantine':[False]} + + +class SuperviseTests(unittest.TestCase): + def fixture(self,fail=None,cleanup=None,close=None): + counts={'popen':0,'finish':0,'close_logs':0,'opens':0,'terminal':0,'adopt':0,'observe':0} + own=owner() + case={'output':'/FAKE/output','root_seconds':40,'address_space_bytes':1024,'rss_bytes':1024, + 'id':'FAKE','generation':'FAKE','launch_nonce':'0'*64,'stage_directory':'/FAKE/stage', + 'command':['FAKE-NO-EXEC'],'expectation':{'outcome':'FIXTURE-ONLY'}} + state={'unknown_owner':own,'plan':{'case':case,'session_directory':'/FAKE/session','mode':'normal'}, + 'phase':'READY','run':None,'errors':object(),'initial_sources':('FAKE-SNAPSHOT',),'pid':10,'shared_deadline':1000} + A=RuntimeError('A fake first');B=RuntimeError('B fake cleanup') + def stat(path,**kw): + if path==case['output']:raise FileNotFoundError('fake absent') + return NS(st_size=0) + def opening(*args): + counts['opens']+=1 + if fail=='open2' and counts['opens']==2:raise A + return 100+counts['opens'] + def popen(*args,**kw): + counts['popen']+=1 + if fail=='popen':raise A + return object() + def adopt(*args): + counts['adopt']+=1 + if fail=='adopt':raise A + return (11,10,11,11,123,'Z',0) + def observe(*args): + counts['observe']+=1 + if fail=='observe':raise A + return (),() + def finish(*args): + counts['finish']+=1 + if cleanup:raise B + def close_logs(run,primary): + counts['close_logs']+=1 + for n,fd in enumerate(run['log_fds']): + if fd is None or run['log_close_attempted'][n]:continue + run['log_close_attempted'][n]=True + if close:raise B + run['log_close_confirmed'][n]=True + def terminal(*args):counts['terminal']+=1;return {'FAKE-NOT-OWNERSHIP':True} + parent=NS(_STAT=stat,_GETRLIMIT=lambda x:(100,100),_OPEN=opening,_SETRLIMIT=lambda *x:None, + _GETTIMER=lambda *x:(0.0,0.0),_GETSIGNAL=lambda *x:None,_SIGNAL=lambda *x:None, + _SETTIMER=lambda *x:None,_alarm=lambda *x:None,_POPEN=popen,_SLEEP=lambda *x:None,_close_logs=close_logs) + domain=NS(CLEANUP_SECONDS=2,create_domain=lambda x:object(),adopt_popen=adopt, + observe=observe,poll_owned=lambda *x:0,finish_domain=finish) + scope={'schema':NS(need=need,EpochStop=FixtureStop,LOG_BYTES=2097152),'parent':parent,'domain':domain, + '_guard':lambda x:None,'_source_snapshot':lambda x:('FAKE-SNAPSHOT',),'_CLOCK':lambda:1, + 'copying':NS(write_once=lambda *a,**k:{'FAKE-FILE-PIN':True}),'_record_bytes':lambda x:b'FAKE', + 'resource':NS(RLIMIT_FSIZE=1,RLIMIT_AS=9),'signal':NS(ITIMER_REAL=0,SIGALRM=14), + '_clean':lambda x:None,'os':NS(O_WRONLY=1,O_CREAT=2,O_EXCL=4,O_CLOEXEC=8,O_NOFOLLOW=16), + 'subprocess':NS(DEVNULL=-3),'ENV':{'FAKE':'NOT-A-NATIVE-ENV'},'_terminal':terminal} + return extract('_supervise',scope),state,counts,A,B + + def test_popen_primary_survives_cleanup_secondary(self): + fn,s,c,A,B=self.fixture('popen',True) + with self.assertRaises(RuntimeError) as caught:fn(s) + self.assertIs(caught.exception,A) + self.assertIs(s['unknown_owner']['primary'][0],A) + self.assertIs(s['run']['errors'][3],B) + self.assertEqual((c['popen'],c['finish'],c['close_logs'],c['terminal']),(1,1,1,0)) + + def test_adoption_and_observe_primary_survive_cleanup(self): + for phase in ('adopt','observe'): + with self.subTest(phase=phase): + fn,s,c,A,B=self.fixture(phase,True) + with self.assertRaises(RuntimeError) as caught:fn(s) + self.assertIs(caught.exception,A) + self.assertIs(s['run']['errors'][3],B) + self.assertEqual(c['finish'],1) + self.assertEqual(c['terminal'],0) + + def test_uncertain_raw_open_stops_later_acquisitions(self): + fn,s,c,A,B=self.fixture('open2') + with self.assertRaises(RuntimeError) as caught:fn(s) + self.assertIs(caught.exception,A) + self.assertTrue(s['unknown_owner']['pending'][0]) + self.assertTrue(s['unknown_owner']['quarantine'][0]) + self.assertEqual((c['opens'],c['popen'],c['finish'],c['close_logs']),(2,0,1,1)) + self.assertEqual(s['run']['log_close_attempted'],[True,False]) + self.assertEqual(c['terminal'],0) + + def test_failed_raw_close_is_not_retried_or_terminal(self): + fn,s,c,A,B=self.fixture(close=True) + with self.assertRaises(RuntimeError) as caught:fn(s) + self.assertIs(caught.exception,B) + self.assertEqual(c['close_logs'],1) + self.assertTrue(s['unknown_owner']['quarantine'][0]) + self.assertEqual(s['run']['log_close_attempted'],[True,False]) + self.assertEqual(c['terminal'],0) + + def test_consumed_control_does_not_spawn_again(self): + fn,s,c,A,B=self.fixture() + fn(s) + with self.assertRaises(FixtureStop):fn(s) + self.assertEqual(c['popen'],1) + + +class OuterPlanTests(unittest.TestCase): + def fixture(self): + raw=b'{}';pin={'path':'/FAKE/outer-plan','identity':{'device':1,'inode':1}} + row={'path':'/FAKE/input','identity':{'device':1,'inode':2}} + state={'plan':{'source_files':[{'path':row['path']}],'case':{},'source_closure_admission_sha256':'0'*64}, + 'configuration':{'plan':pin},'errors':object(),'plan_raw':raw,'plan_endpoint_raw':[None]*3,'plan_endpoint_count':0} + calls=[];read=[raw];rows=[row] + def verified(pin,bound,**kw):calls.append((pin,bound));return read[0] + scope={'schema':NS(need=need,RECORD_BYTES=1048576,inode=lambda x:(x['identity']['device'],x['identity']['inode']),sha=lambda b:hashlib.sha256(b).hexdigest()), + 'copying':NS(read_verified=verified),'parent':NS(MAX_SOURCE_FILES=2,_snapshot_sources=lambda *a:rows,_stage=lambda *a:{}), + '_record_bytes':lambda obj:(json.dumps(obj,sort_keys=True)+'\n').encode()} + return extract('_source_snapshot',scope),state,calls,read,rows + + def test_three_actual_fixture_reads_retained_and_equal(self): + fn,s,c,r,rows=self.fixture();a=fn(s);b=fn(s);d=fn(s) + self.assertEqual(a,b);self.assertEqual(a,d) + self.assertEqual(len(c),3);self.assertEqual(s['plan_endpoint_raw'],[b'{}']*3) + self.assertEqual(s['plan_endpoint_count'],3) + with self.assertRaises(FixtureStop):fn(s) + self.assertEqual(len(c),3) + + def test_plan_path_cannot_be_an_inner_row(self): + fn,s,c,r,rows=self.fixture();s['plan']['source_files'][0]['path']=s['configuration']['plan']['path'] + with self.assertRaises(FixtureStop):fn(s) + self.assertEqual(c,[]) + + def test_plan_inode_cannot_alias_an_inner_row(self): + fn,s,c,r,rows=self.fixture();rows[0]['identity']['inode']=1 + with self.assertRaises(FixtureStop):fn(s) + self.assertEqual(len(c),1) + self.assertEqual(s['plan_endpoint_raw'][0],b'{}') + + def test_changed_plan_raw_is_retained_before_rejection(self): + fn,s,c,r,rows=self.fixture();r[0]=b'CHANGED-FAKE-RAW' + with self.assertRaises(FixtureStop):fn(s) + self.assertEqual(s['plan_endpoint_raw'][0],b'CHANGED-FAKE-RAW') + + def test_outer_plan_row_is_counted(self): + fn,s,c,r,rows=self.fixture();s['plan']['source_files'].append({'path':'/FAKE/extra'}) + with self.assertRaises(FixtureStop):fn(s) + self.assertEqual(c,[]) + + +class RawRetentionTests(unittest.TestCase): + def test_partial_copy_failure_retains_already_captured_sources(self): + class CopyFailure(RuntimeError):pass + B=CopyFailure('FAKE copy failure');own=owner();run={'retained':{}} + state={'unknown_owner':own,'errors':object(),'plan':{'session_directory':'/FAKE/session','case':{'output':'/FAKE/out','expectation':{}}}} + count=[0] + def inspect(path,bound,**kw):count[0]+=1;return {'path':path,'pair':(1,count[0])} + def copy(source,target,occupied,**kw): + if source['path'].endswith('stderr.raw'):raise B + return {'path':target,'pair':(2,1)} + scope={'schema':NS(LOG_BYTES=2097152,RECORD_BYTES=1048576,inode=lambda x:x['pair'],need=need), + '_expected_files':lambda e:(), '_guard':lambda s:None, + 'copying':NS(inspect=inspect,copy_once=copy,read_verified=lambda *a,**k:b'')} + fn=extract('_capture',scope) + with self.assertRaises(CopyFailure) as caught:fn(state,run) + self.assertIs(caught.exception,B) + self.assertIn('copy',run['retained']['stdout.raw']) + self.assertIn('source',run['retained']['stderr.raw']) + self.assertNotIn('copy',run['retained']['stderr.raw']) + + +if __name__=='__main__':unittest.main(verbosity=2) diff --git a/research/h25-v03-prefix-supervision/unit05/implementation/epoch_copy_v5.py b/research/h25-v03-prefix-supervision/unit05/implementation/epoch_copy_v5.py new file mode 100644 index 0000000000..0573ab23a5 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/implementation/epoch_copy_v5.py @@ -0,0 +1,1897 @@ +"""Bounded exclusive copy source with opaque error ownership; never executed here.""" +import hashlib +import os +import stat +import epoch_schema_v5 as schema + +COPY_CONFIGURATION = None +COPY_EXECUTION_APPROVAL = None +COPY_FUNDING = None +_TYPE, _LEN = type, len +_OPEN, _CLOSE, _READ, _WRITE = os.open, os.close, os.read, os.write +_FSTAT, _STAT, _LSEEK, _FSYNC = os.fstat, os.stat, os.lseek, os.fsync +_SCANDIR, _STAT_RESULT = os.scandir, os.stat_result + + +def _gate() -> None: + schema.exact(COPY_CONFIGURATION, ('leaf_policy_sha256', 'configuration_sha256', 'scandir_release_premise_sha256')) + schema.exact(COPY_EXECUTION_APPROVAL, ('external_launch_policy_sha256',)) + schema.exact(COPY_FUNDING, ('reservation_sha256',)) + for values in (COPY_CONFIGURATION, COPY_EXECUTION_APPROVAL, COPY_FUNDING): + for value in values.values(): + schema.digest(value) + + +def _fd(value) -> None: + schema.integer(value, 0, (1 << 31) - 1) + + +def _identity(info) -> dict: + schema.need(_TYPE(info) is _STAT_RESULT, 'exact native stat result required') + row = dict(zip(schema.IDENTITY_KEYS, (info.st_dev, info.st_ino, info.st_mode, info.st_nlink, + info.st_uid, info.st_gid, info.st_size, info.st_mtime_ns, info.st_ctime_ns))) + for value in row.values(): + schema.integer(value, 0, (1 << 127) - 1) + return row + + + + + +def _parent(path: str, owner, fd_slots: list, destination: int) -> str: + """Fill the caller-owned slot; caller's finally owns all five slots. + + No descriptor tuple crosses the helper return boundary. The fifth slot + owns the next ancestor until its transfer; any helper-entry/body failure + leaves all known descriptors reachable to the caller's inline cleanup. + """ + schema.path(path) + _state = schema.owner_state(owner) + _primary, _secondary, _phases, _uncertain = _state[0], _state[1], _state[2], _state[3] + _counts, _overflow, _io = _state[4], _state[5], _state[7] + _attempt_digits, _confirmed_digits = _io[7], _io[8] + _successors = schema.CUSTODY_SUCCESSORS + _quarantine_error = schema.IO_QUARANTINE_ERROR + _base_error, _close_native = BaseException, _CLOSE + _error_index = _digit = 0 + _owned_fd = _close_error = _acquisition_error = None + cleanup_primary = operation_primary = None + schema.need(_TYPE(fd_slots) is list and _LEN(fd_slots) == 5, 'internal FD slots differ') + schema.integer(destination, 0, 3) + schema.need(fd_slots[destination] is None and fd_slots[4] is None, 'parent slots already owned') + parts = path.split('/') + name = parts[-1] + flags = os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW | os.O_DIRECTORY + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + fd_slots[destination] = _OPEN('/', flags) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + _fd(fd_slots[destination]) + for part in parts[1:-1]: + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + fd_slots[4] = _OPEN(part, flags, dir_fd=fd_slots[destination]) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + _fd(fd_slots[4]) + previous = fd_slots[destination] + fd_slots[destination] = fd_slots[4] + fd_slots[4] = None + _owned_fd = previous + previous = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + if cleanup_primary is not None: + raise cleanup_primary + return name + +def _hash_fd(descriptor: int, limit: int) -> tuple[str, int]: + _fd(descriptor) + schema.integer(limit, 0, schema.FILE_BYTES) + digest, total, read_calls = hashlib.sha256(), 0, 0 + position = _LSEEK(descriptor, 0, os.SEEK_SET) + schema.integer(position, 0, 0) + while True: + read_calls += 1 + schema.need(read_calls <= schema.MAX_READ_CALLS, 'hash read-call bound exceeded') + raw = _READ(descriptor, min(schema.CHUNK_BYTES, limit + 1 - total)) + schema.need(_TYPE(raw) is bytes, 'native read returned foreign data') + if _LEN(raw) == 0: + break + total += _LEN(raw) + schema.need(total <= limit, 'file exceeds copy/hash bound') + digest.update(raw) + return digest.hexdigest(), total + + +def inspect(path: str, limit: int = schema.FILE_BYTES, *, error_owner) -> dict: + schema.owner_state(error_owner) + schema.path(path) + schema.integer(limit, 0, schema.FILE_BYTES) + _gate() + _state = schema.owner_state(error_owner) + _primary, _secondary, _phases, _uncertain = _state[0], _state[1], _state[2], _state[3] + _counts, _overflow, _io = _state[4], _state[5], _state[7] + _attempt_digits, _confirmed_digits = _io[7], _io[8] + _successors = schema.CUSTODY_SUCCESSORS + _quarantine_error = schema.IO_QUARANTINE_ERROR + _base_error, _close_native = BaseException, _CLOSE + _error_index = _digit = 0 + _owned_fd = _close_error = _acquisition_error = None + cleanup_primary = operation_primary = None + _fd_slots = [None] * 5 + _iterator = _owned_iterator = None + try: + name = _parent(path, error_owner, _fd_slots, 1) + parent = _fd_slots[1] + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + _fd_slots[0] = _OPEN(name, os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=parent) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + descriptor = _fd_slots[0] + _fd(descriptor) + before = _identity(_FSTAT(descriptor)) + schema.need(stat.S_ISREG(before['mode']) and before['links'] == 1 and before['size'] <= limit, + 'file kind/link/size differs') + digest, count = _hash_fd(descriptor, limit) + after = _identity(_FSTAT(descriptor)) + named = _identity(_STAT(name, dir_fd=parent, follow_symlinks=False)) + schema.need(before == after == named and count == before['size'], 'file changed during bounded snapshot') + result = {'path': path, 'sha256': digest, 'bytes': count, 'identity': after} + schema.blob(result, limit) + return result + except _base_error as operation_error: + operation_primary = operation_error + if _primary[0] is None: + _primary[0] = operation_error + _primary[1] = 'inspect' + _primary[2] = None + elif _primary[0] is not operation_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = operation_error + _phases[_error_index] = 'inspect' + _uncertain[_error_index] = None + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = operation_error + raise + finally: + _owned_fd = _fd_slots[0] + _fd_slots[0] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[1] + _fd_slots[1] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[2] + _fd_slots[2] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[3] + _fd_slots[3] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[4] + _fd_slots[4] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + if operation_primary is None and cleanup_primary is not None: + raise cleanup_primary + +def verify(expected: dict, limit: int = schema.FILE_BYTES, *, error_owner) -> None: + schema.owner_state(error_owner) + schema.blob(expected, limit) + schema.need(inspect(expected['path'], limit, error_owner=error_owner) == expected, + 'current source/store custody differs') + + +def copy_once(source: dict, destination: str, occupied_inodes: tuple, *, error_owner) -> dict: + schema.owner_state(error_owner) + schema.blob(source) + schema.path(destination) + schema.need(_TYPE(occupied_inodes) is tuple and _LEN(occupied_inodes) <= 51, 'inode collection differs') + for pair in occupied_inodes: + schema.need(_TYPE(pair) is tuple and _LEN(pair) == 2, 'inode pair differs') + schema.integer(pair[0], 0, (1 << 127) - 1) + schema.integer(pair[1], 1, (1 << 127) - 1) + schema.need(source['path'] != destination, 'copy path aliases source') + _gate() + verify(source, error_owner=error_owner) + _state = schema.owner_state(error_owner) + _primary, _secondary, _phases, _uncertain = _state[0], _state[1], _state[2], _state[3] + _counts, _overflow, _io = _state[4], _state[5], _state[7] + _attempt_digits, _confirmed_digits = _io[7], _io[8] + _successors = schema.CUSTODY_SUCCESSORS + _quarantine_error = schema.IO_QUARANTINE_ERROR + _base_error, _close_native = BaseException, _CLOSE + _error_index = _digit = 0 + _owned_fd = _close_error = _acquisition_error = None + cleanup_primary = operation_primary = None + _fd_slots = [None] * 5 + _iterator = _owned_iterator = None + try: + source_name = _parent(source['path'], error_owner, _fd_slots, 3) + source_parent = _fd_slots[3] + target_name = _parent(destination, error_owner, _fd_slots, 2) + target_parent = _fd_slots[2] + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + _fd_slots[1] = _OPEN(source_name, os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=source_parent) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + source_fd = _fd_slots[1] + _fd(source_fd) + before = _identity(_FSTAT(source_fd)) + schema.need(before == source['identity'], 'source changed before copy') + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + _fd_slots[0] = _OPEN(target_name, os.O_RDWR | os.O_CREAT | os.O_EXCL | os.O_CLOEXEC | os.O_NOFOLLOW, 0o600, dir_fd=target_parent) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + target_fd = _fd_slots[0] + _fd(target_fd) + initial = _identity(_FSTAT(target_fd)) + schema.need(stat.S_ISREG(initial['mode']) and initial['links'] == 1 and initial['size'] == 0 and + stat.S_IMODE(initial['mode']) == 0o600 and + (initial['device'], initial['inode']) not in occupied_inodes and + (initial['device'], initial['inode']) != schema.inode(source), 'exclusive destination alias') + digest, count, write_calls, read_calls = hashlib.sha256(), 0, 0, 0 + while True: + read_calls += 1 + schema.need(read_calls <= schema.MAX_READ_CALLS, 'copy read-call bound exceeded') + raw = _READ(source_fd, min(schema.CHUNK_BYTES, source['bytes'] + 1 - count)) + schema.need(_TYPE(raw) is bytes, 'native copy read returned foreign data') + if _LEN(raw) == 0: + break + count += _LEN(raw) + schema.need(count <= source['bytes'], 'source grew during copy') + digest.update(raw) + offset = 0 + while offset < _LEN(raw): + write_calls += 1 + schema.need(write_calls <= schema.MAX_WRITE_CALLS, 'copy write-call bound exceeded') + written = _WRITE(target_fd, raw[offset:]) + schema.integer(written, 1, _LEN(raw) - offset) + offset += written + schema.need(count == source['bytes'] and digest.hexdigest() == source['sha256'] and + _identity(_FSTAT(source_fd)) == source['identity'] and + _identity(_STAT(source_name, dir_fd=source_parent, follow_symlinks=False)) == source['identity'], + 'copy source custody/bytes differ') + _FSYNC(target_fd) + _FSYNC(target_parent) + before_readback = _identity(_FSTAT(target_fd)) + read_sha, read_size = _hash_fd(target_fd, schema.FILE_BYTES) + after = _identity(_FSTAT(target_fd)) + named = _identity(_STAT(target_name, dir_fd=target_parent, follow_symlinks=False)) + schema.need(read_sha == source['sha256'] and read_size == source['bytes'] and after['links'] == 1 and + (after['device'], after['inode']) == (initial['device'], initial['inode']) and + before_readback == after == named, 'destination readback/custody differs') + result = {'path': destination, 'sha256': read_sha, 'bytes': read_size, 'identity': after} + schema.blob(result) + verify(source, error_owner=error_owner) + schema.need(inspect(destination, error_owner=error_owner) == result, 'destination path changed after copy') + return result + except _base_error as operation_error: + operation_primary = operation_error + if _primary[0] is None: + _primary[0] = operation_error + _primary[1] = 'copy_once' + _primary[2] = None + elif _primary[0] is not operation_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = operation_error + _phases[_error_index] = 'copy_once' + _uncertain[_error_index] = None + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = operation_error + raise + finally: + _owned_fd = _fd_slots[0] + _fd_slots[0] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[1] + _fd_slots[1] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[2] + _fd_slots[2] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[3] + _fd_slots[3] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[4] + _fd_slots[4] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + if operation_primary is None and cleanup_primary is not None: + raise cleanup_primary + +def write_once(path: str, raw: bytes, *, error_owner) -> dict: + schema.owner_state(error_owner) + schema.path(path) + schema.need(_TYPE(raw) is bytes, 'exact record bytes required') + schema.need(0 < _LEN(raw) <= schema.RECORD_BYTES, 'record bound differs') + _gate() + _state = schema.owner_state(error_owner) + _primary, _secondary, _phases, _uncertain = _state[0], _state[1], _state[2], _state[3] + _counts, _overflow, _io = _state[4], _state[5], _state[7] + _attempt_digits, _confirmed_digits = _io[7], _io[8] + _successors = schema.CUSTODY_SUCCESSORS + _quarantine_error = schema.IO_QUARANTINE_ERROR + _base_error, _close_native = BaseException, _CLOSE + _error_index = _digit = 0 + _owned_fd = _close_error = _acquisition_error = None + cleanup_primary = operation_primary = None + _fd_slots = [None] * 5 + _iterator = _owned_iterator = None + try: + name = _parent(path, error_owner, _fd_slots, 1) + parent = _fd_slots[1] + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + _fd_slots[0] = _OPEN(name, os.O_RDWR | os.O_CREAT | os.O_EXCL | os.O_CLOEXEC | os.O_NOFOLLOW, 0o600, dir_fd=parent) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + descriptor = _fd_slots[0] + _fd(descriptor) + initial = _identity(_FSTAT(descriptor)) + schema.need(stat.S_ISREG(initial['mode']) and initial['links'] == 1 and initial['size'] == 0 and + stat.S_IMODE(initial['mode']) == 0o600, 'exclusive record file differs') + offset, calls = 0, 0 + while offset < _LEN(raw): + calls += 1 + schema.need(calls <= schema.MAX_RECORD_WRITE_CALLS, 'record write-call bound exceeded') + written = _WRITE(descriptor, raw[offset:offset + schema.CHUNK_BYTES]) + schema.integer(written, 1, min(schema.CHUNK_BYTES, _LEN(raw) - offset)) + offset += written + _FSYNC(descriptor) + _FSYNC(parent) + owned = _identity(_FSTAT(descriptor)) + result = inspect(path, schema.RECORD_BYTES, error_owner=error_owner) + schema.need(result['identity'] == owned and + (owned['device'], owned['inode']) == (initial['device'], initial['inode']) and + result['sha256'] == schema.sha(raw) and result['bytes'] == _LEN(raw), 'record readback differs') + return result + except _base_error as operation_error: + operation_primary = operation_error + if _primary[0] is None: + _primary[0] = operation_error + _primary[1] = 'write_once' + _primary[2] = None + elif _primary[0] is not operation_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = operation_error + _phases[_error_index] = 'write_once' + _uncertain[_error_index] = None + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = operation_error + raise + finally: + _owned_fd = _fd_slots[0] + _fd_slots[0] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[1] + _fd_slots[1] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[2] + _fd_slots[2] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[3] + _fd_slots[3] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[4] + _fd_slots[4] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + if operation_primary is None and cleanup_primary is not None: + raise cleanup_primary + +def read_verified(expected: dict, limit: int = schema.RECORD_BYTES, *, error_owner) -> bytes: + schema.owner_state(error_owner) + schema.integer(limit, 1, schema.RAW_RESULT_BYTES) + schema.blob(expected, limit) + _gate() + verify(expected, limit, error_owner=error_owner) + _state = schema.owner_state(error_owner) + _primary, _secondary, _phases, _uncertain = _state[0], _state[1], _state[2], _state[3] + _counts, _overflow, _io = _state[4], _state[5], _state[7] + _attempt_digits, _confirmed_digits = _io[7], _io[8] + _successors = schema.CUSTODY_SUCCESSORS + _quarantine_error = schema.IO_QUARANTINE_ERROR + _base_error, _close_native = BaseException, _CLOSE + _error_index = _digit = 0 + _owned_fd = _close_error = _acquisition_error = None + cleanup_primary = operation_primary = None + _fd_slots = [None] * 5 + _iterator = _owned_iterator = None + try: + name = _parent(expected['path'], error_owner, _fd_slots, 1) + parent = _fd_slots[1] + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + _fd_slots[0] = _OPEN(name, os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=parent) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + descriptor = _fd_slots[0] + _fd(descriptor) + schema.need(_identity(_FSTAT(descriptor)) == expected['identity'], 'evidence changed before read') + chunks, count, calls = [], 0, 0 + while True: + calls += 1 + schema.need(calls <= schema.MAX_READ_CALLS, 'evidence read-call bound exceeded') + raw = _READ(descriptor, min(schema.CHUNK_BYTES, limit + 1 - count)) + schema.need(_TYPE(raw) is bytes, 'native evidence read returned foreign data') + if _LEN(raw) == 0: + break + count += _LEN(raw) + schema.need(count <= limit, 'evidence byte bound exceeded') + chunks.append(raw) + result = b''.join(chunks) + schema.need(count == expected['bytes'] and schema.sha(result) == expected['sha256'] and + _identity(_FSTAT(descriptor)) == expected['identity'] and + _identity(_STAT(name, dir_fd=parent, follow_symlinks=False)) == expected['identity'], + 'retained evidence bytes/custody differ') + verify(expected, limit, error_owner=error_owner) + return result + except _base_error as operation_error: + operation_primary = operation_error + if _primary[0] is None: + _primary[0] = operation_error + _primary[1] = 'read_verified' + _primary[2] = None + elif _primary[0] is not operation_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = operation_error + _phases[_error_index] = 'read_verified' + _uncertain[_error_index] = None + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = operation_error + raise + finally: + _owned_fd = _fd_slots[0] + _fd_slots[0] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[1] + _fd_slots[1] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[2] + _fd_slots[2] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[3] + _fd_slots[3] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[4] + _fd_slots[4] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + if operation_primary is None and cleanup_primary is not None: + raise cleanup_primary + +def require_entries(directory: str, expected_names: tuple[str, ...], *, error_owner) -> None: + schema.owner_state(error_owner) + schema.path(directory) + schema.need(_TYPE(expected_names) is tuple and _LEN(expected_names) <= 7, 'census tuple differs') + # Validate all names before hashing, equality, membership, or set creation. + for name in expected_names: + schema.text(name, 256) + schema.need(0 < _LEN(name) and '/' not in name and name not in ('.', '..'), 'census name differs') + schema.need(_LEN(set(expected_names)) == _LEN(expected_names), 'duplicate census name') + _gate() + _state = schema.owner_state(error_owner) + _primary, _secondary, _phases, _uncertain = _state[0], _state[1], _state[2], _state[3] + _counts, _overflow, _io = _state[4], _state[5], _state[7] + _attempt_digits, _confirmed_digits = _io[7], _io[8] + _successors = schema.CUSTODY_SUCCESSORS + _quarantine_error = schema.IO_QUARANTINE_ERROR + _base_error, _close_native = BaseException, _CLOSE + _error_index = _digit = 0 + _owned_fd = _close_error = _acquisition_error = None + cleanup_primary = operation_primary = None + _fd_slots = [None] * 5 + _iterator = _owned_iterator = None + try: + name = _parent(directory, error_owner, _fd_slots, 1) + parent = _fd_slots[1] + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + _fd_slots[0] = _OPEN(name, os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW | os.O_DIRECTORY, dir_fd=parent) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + descriptor = _fd_slots[0] + _fd(descriptor) + before = _identity(_FSTAT(descriptor)) + schema.need(stat.S_ISDIR(before['mode']), 'copy root is not a directory') + names = [] + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + _iterator = _SCANDIR(descriptor) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + for entry in _iterator: + # Exact native entry guard remains before its attribute access. + schema.need(_TYPE(entry) is os.DirEntry, 'native directory entry type differs') + entry_name = entry.name + schema.text(entry_name, 256) + names.append(entry_name) + schema.need(_LEN(names) <= 7, 'copy root entry bound exceeded') + _owned_iterator = _iterator + _iterator = None + if _owned_iterator is not None: + try: + _owned_iterator.close() + except _base_error as _close_error: + if _io[5] is None: + _io[5] = _owned_iterator + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'scandir-close' + _primary[2] = None + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'scandir-close' + _uncertain[_error_index] = None + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + # A normal/no-op return after a delivered body error cannot + # invoke the selected release premise or clear uncertainty. + if operation_primary is None and not _io[0] and _io[5] is None: + _io[9] = True + _io[4] = True + if cleanup_primary is not None: + raise cleanup_primary + schema.need(set(names) == set(expected_names) and before == _identity(_FSTAT(descriptor)) == + _identity(_STAT(name, dir_fd=parent, follow_symlinks=False)), 'copy root entries/custody differ') + except _base_error as operation_error: + operation_primary = operation_error + # Any body failure may follow an ignored closedir result, including + # iterator OSError/MemoryError before an explicit close becomes a no-op. + # Root the exact error first; quarantine and retain stream uncertainty + # before cleanup or any optional helper/reporting can run. + _io[0] = True + _io[4] = True + if _io[5] is None: + if _iterator is not None: + _io[5] = _iterator + elif _owned_iterator is not None: + _io[5] = _owned_iterator + if _primary[0] is None: + _primary[0] = operation_error + _primary[1] = 'require_entries' + _primary[2] = None + elif _primary[0] is not operation_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = operation_error + _phases[_error_index] = 'require_entries' + _uncertain[_error_index] = None + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = operation_error + raise + finally: + _owned_iterator = _iterator + _iterator = None + if _owned_iterator is not None: + try: + _owned_iterator.close() + except _base_error as _close_error: + if _io[5] is None: + _io[5] = _owned_iterator + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'scandir-close' + _primary[2] = None + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'scandir-close' + _uncertain[_error_index] = None + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + # A normal/no-op return after a delivered body error cannot + # invoke the selected release premise or clear uncertainty. + if operation_primary is None and not _io[0] and _io[5] is None: + _io[9] = True + _io[4] = True + _owned_fd = _fd_slots[0] + _fd_slots[0] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[1] + _fd_slots[1] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[2] + _fd_slots[2] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[3] + _fd_slots[3] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[4] + _fd_slots[4] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + if operation_primary is None and cleanup_primary is not None: + raise cleanup_primary \ No newline at end of file diff --git a/research/h25-v03-prefix-supervision/unit05/implementation/epoch_schema_v5.py b/research/h25-v03-prefix-supervision/unit05/implementation/epoch_schema_v5.py new file mode 100644 index 0000000000..b95c2385a9 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/implementation/epoch_schema_v5.py @@ -0,0 +1,676 @@ +"""Finite negative-only data records. No import/load/compile/runtime authority. + +Source draft: no target execution has been authorized. These functions are not +run during source checks. Every caller must be a separately reviewed fixed +parent/child source; JSON never creates a parent capability. +""" +import hashlib +import json + +SCHEMA = 'h25-negative-build-epoch-v3' +CLAIM_SCHEMA = 'h25-negative-import-claim-v3' +ROLES = ('production', 'watcher', 'bounds', 'pyinit_failure', 'exec_failure') +PRODUCERS = ('group01', 'failure_variants') +GROUPS = ('02', '03', '04', '07', '08', '09', '10', '11', '12', '13', '14', '15', '16') +PROFILE_KEYS = ('source_manifest_sha256', 'project_headers_sha256', 'system_headers_sha256', + 'compiler_link_sha256', 'link_profile_sha256') +LAUNCH_KEYS = ('configuration_sha256', 'root_sha256', 'stage_sha256', 'command_sha256', + 'startup_tcb_sha256', 'expected_history_sha256') +FILE_BYTES = 64 * 1024 * 1024 +RECORD_BYTES = 1024 * 1024 +RAW_RESULT_BYTES = 4 * 1024 * 1024 +LOG_BYTES = 2 * 1024 * 1024 +JOURNAL_BYTES = 3 * 65536 +CHUNK_BYTES = 65536 +PATH_BYTES = 4096 +MAX_PATH_COMPONENTS = 64 +MAX_READ_CALLS = 8192 +MAX_WRITE_CALLS = 8192 +MAX_RECORD_WRITE_CALLS = 4096 +MAX_PRIVATE_COPIES = 41 +MAX_EXPORTS = 5 +MAX_EPOCH_FILE_BYTES = 46 * FILE_BYTES +IDENTITY_KEYS = ('device', 'inode', 'mode', 'links', 'uid', 'gid', 'size', 'mtime_ns', 'ctime_ns') + + +# Captured before any adverse input. Actual startup primitive/source admission +# is still required by the future caller; no module is imported in source work. +_TYPE, _LEN = type, len +_DICT, _LIST, _TUPLE, _STR, _INT, _BOOL, _BYTES = dict, list, tuple, str, int, bool, bytes +MAX_RECORD_KEYS = 256 +MAX_SEQUENCE = 256 +MAX_WIRE_NODES = 8192 +MAX_WIRE_DEPTH = 24 +MAX_WIRE_TEXT = 8192 +MAX_WIRE_TEXT_TOTAL = 512 * 1024 + + +class EpochStop(RuntimeError): + """Literal bounded source error; original foreign failures remain opaque.""" + + +def need(condition: bool, message: str) -> None: + # No truth testing or formatting of an unknown object. + if _TYPE(message) is not _STR or _LEN(message) > 256: + raise EpochStop('invalid internal error literal') + if condition is not True: + raise EpochStop(message) + + +def exact(value: dict, keys: tuple[str, ...]) -> None: + need(_TYPE(value) is _DICT, 'exact record type differs') + need(_LEN(value) <= MAX_RECORD_KEYS, 'record cardinality bound exceeded') + need(_TYPE(keys) is _TUPLE, 'exact expected key tuple differs') + need(_LEN(keys) <= MAX_RECORD_KEYS, 'expected key cardinality bound exceeded') + # Iteration over an exact dict does not hash its keys. Complete this walk + # before membership, set creation, or any value lookup in that dictionary. + for key in value: + need(_TYPE(key) is _STR, 'foreign record key rejected') + need(_LEN(key) <= MAX_WIRE_TEXT, 'record key length bound exceeded') + for key in keys: + need(_TYPE(key) is _STR, 'foreign expected key rejected') + need(_LEN(key) <= MAX_WIRE_TEXT, 'expected key length bound exceeded') + need(_LEN(value) == _LEN(keys), 'exact record keys differ') + seen = set() + for key in keys: + need(key not in seen, 'duplicate expected key') + seen.add(key) + for key in value: + need(key in seen, 'exact record keys differ') + + +def integer(value: int, lower: int, upper: int) -> None: + need(_TYPE(value) is _INT and _TYPE(lower) is _INT and _TYPE(upper) is _INT, + 'exact integer type differs') + need(lower <= value <= upper, 'bounded exact integer differs') + + +def boolean(value: bool) -> None: + need(_TYPE(value) is _BOOL, 'exact boolean type differs') + + +def text(value: str, limit: int = MAX_WIRE_TEXT) -> None: + need(_TYPE(value) is _STR and _TYPE(limit) is _INT, 'exact text/limit type differs') + need(0 <= limit <= MAX_WIRE_TEXT and _LEN(value) <= limit, 'text bound exceeded') + + +def choice(value: str, choices: tuple[str, ...]) -> None: + text(value) + need(_TYPE(choices) is _TUPLE and _LEN(choices) <= MAX_SEQUENCE, 'choice tuple differs') + for item in choices: + text(item) + need(value in choices, 'literal choice differs') + + +def sequence(value: list, count: int) -> None: + need(_TYPE(value) is _LIST and _TYPE(count) is _INT, 'exact sequence type differs') + need(0 <= count <= MAX_SEQUENCE and _LEN(value) == count, 'exact sequence count differs') + + +def digest(value: str) -> None: + text(value, 64) + need(_LEN(value) == 64 and all(c in '0123456789abcdef' for c in value), 'sha256 differs') + + +def label(value: str) -> None: + text(value, 96) + need(1 <= _LEN(value) <= 96 and + all(c in 'abcdefghijklmnopqrstuvwxyz0123456789-' for c in value), 'label differs') + + +def path(value: str) -> None: + text(value, PATH_BYTES) + need(1 < _LEN(value) <= PATH_BYTES and value.isascii() and value.startswith('/'), + 'canonical absolute path differs') + parts = value.split('/')[1:] + need(_LEN(parts) <= MAX_PATH_COMPONENTS and + all(p not in ('', '.', '..') for p in parts) and + all(32 <= ord(c) <= 126 for c in value), 'canonical absolute path differs') + + +def _plain(value, depth: int, budget: list): + # depth and budget are newly created private native values, never inputs. + budget[0] += 1 + need(budget[0] <= MAX_WIRE_NODES and depth <= MAX_WIRE_DEPTH, 'plain record node/depth bound') + kind = _TYPE(value) + if value is None or kind is _BOOL: + return value + if kind is _STR: + need(_LEN(value) <= MAX_WIRE_TEXT, 'plain text bound') + budget[1] += _LEN(value) + need(budget[1] <= MAX_WIRE_TEXT_TOTAL, 'plain total text bound') + return value + if kind is _INT: + need(-(1 << 127) <= value < (1 << 127), 'plain integer bound') + return value + if kind is _DICT: + need(_LEN(value) <= MAX_RECORD_KEYS, 'plain dictionary bound') + for key in value: + need(_TYPE(key) is _STR, 'plain foreign dictionary key') + need(_LEN(key) <= MAX_WIRE_TEXT, 'plain dictionary key bound') + result = {} + for key, item in value.items(): + budget[1] += _LEN(key) + need(budget[1] <= MAX_WIRE_TEXT_TOTAL, 'plain total key text bound') + result[key] = _plain(item, depth + 1, budget) + return result + if kind is _LIST or kind is _TUPLE: + need(_LEN(value) <= MAX_SEQUENCE, 'plain sequence bound') + return [_plain(item, depth + 1, budget) for item in value] + raise EpochStop('foreign plain-record value rejected') + + +def plain_copy(value): + """Bounded callback-free native copy before any codec/equality use.""" + return _plain(value, 0, [0, 0]) + + +def required_roles(group: str) -> tuple[str, ...]: + text(group, 2) + need(group in GROUPS, 'positive/non-native/unknown group cannot import') + return ROLES[:3] + (('pyinit_failure',) if group == '13' else + ('exec_failure',) if group == '14' else ()) + + +def profile(value: dict) -> None: + exact(value, PROFILE_KEYS) + for key in PROFILE_KEYS: + digest(value[key]) + + +def launch(value: dict) -> None: + exact(value, LAUNCH_KEYS) + for key in LAUNCH_KEYS: + digest(value[key]) + + +def blob(value: dict, limit: int = FILE_BYTES) -> None: + integer(limit, 0, FILE_BYTES) + exact(value, ('path', 'sha256', 'bytes', 'identity')) + path(value['path']) + digest(value['sha256']) + integer(value['bytes'], 0, limit) + identity = value['identity'] + exact(identity, IDENTITY_KEYS) + for key in IDENTITY_KEYS: + integer(identity[key], 0, (1 << 127) - 1) + need(identity['inode'] > 0 and identity['size'] == value['bytes'] and + identity['mode'] & 0o170000 == 0o100000 and identity['links'] == 1, + 'regular single-link file custody differs') + + +def inode(value: dict) -> tuple[int, int]: + blob(value) + return value['identity']['device'], value['identity']['inode'] + + +def canonical(value: dict) -> bytes: + need(_TYPE(value) is _DICT, 'canonical top-level exact dictionary required') + safe = plain_copy(value) + raw = json.dumps(safe, sort_keys=True, separators=(',', ':'), ensure_ascii=True, + allow_nan=False).encode('ascii') + b'\n' + need(_LEN(raw) <= RECORD_BYTES, 'record byte bound exceeded') + return raw + + +def sha(raw: bytes) -> str: + need(_TYPE(raw) is _BYTES, 'exact byte buffer required') + return hashlib.sha256(raw).hexdigest() + + +def _pairs(pairs: list) -> dict: + need(_TYPE(pairs) is _LIST and _LEN(pairs) <= MAX_RECORD_KEYS, 'decoded key count differs') + result = {} + for pair in pairs: + need(_TYPE(pair) is _TUPLE and _LEN(pair) == 2, 'decoded pair differs') + key, value = pair + text(key) + need(key not in result, 'duplicate JSON key') + result[key] = value + return result + + +def _reject_constant(value): + raise EpochStop('nonfinite JSON constant rejected') + + +def decode(raw: bytes) -> dict: + need(_TYPE(raw) is _BYTES, 'exact raw bytes required') + need(0 < _LEN(raw) <= RECORD_BYTES, 'raw record bound differs') + result = json.loads(raw.decode('ascii'), object_pairs_hook=_pairs, parse_constant=_reject_constant) + need(_TYPE(result) is _DICT, 'decoded top-level record differs') + safe = plain_copy(result) + need(canonical(safe) == raw, 'noncanonical record bytes') + return safe + + +def build(value: dict) -> None: + exact(value, ('role', 'producer_role', 'producer_generation', 'producer_stage_sha256', + 'command_sha256', 'profile', 'original_output', 'original_receipt', + 'attempt', 'journal', 'stdout', 'stderr')) + choice(value['role'], ROLES) + choice(value['producer_role'], PRODUCERS) + need((value['role'] in ROLES[:3]) == (value['producer_role'] == 'group01'), 'producer role swap') + label(value['producer_generation']) + digest(value['producer_stage_sha256']) + digest(value['command_sha256']) + profile(value['profile']) + blob(value['original_output']) + need(value['original_output']['bytes'] > 0, 'empty compiled artifact') + for key, bound in (('original_receipt', 65536), ('attempt', 65536), + ('journal', JOURNAL_BYTES), ('stdout', LOG_BYTES), ('stderr', LOG_BYTES)): + blob(value[key], bound) + + +def producer(value: dict) -> None: + exact(value, ('role', 'generation', 'stage_sha256', 'command_sha256', 'root_sha256', + 'terminal', 'raw_result', 'raw_groups', 'final_source_custody', + 'parent_observation', 'completion_checker_sha256', 'builds')) + choice(value['role'], PRODUCERS) + label(value['generation']) + for key in ('stage_sha256', 'command_sha256', 'root_sha256', 'completion_checker_sha256'): + digest(value[key]) + for key in ('terminal', 'raw_result', 'raw_groups', 'final_source_custody', 'parent_observation'): + blob(value[key], RAW_RESULT_BYTES) + roles = ROLES[:3] if value['role'] == 'group01' else ROLES[3:] + sequence(value['builds'], len(roles)) + for role, row in zip(roles, value['builds']): + build(row) + need(row['role'] == role and row['producer_role'] == value['role'] and + row['producer_generation'] == value['generation'] and + row['producer_stage_sha256'] == value['stage_sha256'], 'producer build binding differs') + + +def epoch(value: dict) -> None: + exact(value, ('schema', 'epoch_id', 'mode', 'publication_state', 'intent', 'producers', 'exports', + 'not_runtime_authority')) + text(value['schema']) + text(value['publication_state']) + boolean(value['not_runtime_authority']) + need(value['schema'] == SCHEMA and value['publication_state'] == 'COMMITTED' and + value['not_runtime_authority'] is True, 'epoch publication/schema/authority differs') + label(value['epoch_id']) + blob(value['intent'], RECORD_BYTES) + choice(value['mode'], ('normal', 'optimized')) + sequence(value['producers'], 2) + builds = [] + for role, row in zip(PRODUCERS, value['producers']): + producer(row) + need(row['role'] == role, 'producer order differs') + builds.extend(row['builds']) + need(value['producers'][0]['generation'] != value['producers'][1]['generation'], 'producer generation reused') + sequence(value['exports'], MAX_EXPORTS) + seen_paths, seen_inodes = set(), set() + for role, source, row in zip(ROLES, builds, value['exports']): + exact(row, ('role', 'build_sha256', 'file')) + digest(row['build_sha256']) + choice(row['role'], ROLES) + need(row['role'] == role and row['build_sha256'] == sha(canonical(source)), 'export build binding differs') + blob(row['file']) + need((row['file']['sha256'], row['file']['bytes']) == + (source['original_output']['sha256'], source['original_output']['bytes']), 'export bytes differ') + for record in (source['original_output'], row['file']): + need(record['path'] not in seen_paths and inode(record) not in seen_inodes, 'artifact/link alias') + seen_paths.add(record['path']) + seen_inodes.add(inode(record)) + + +def claim(value: dict, manifest: dict, expected_launch: dict, + expected_group: str, expected_generation: str, expected_private_directory: str) -> None: + epoch(manifest) + launch(expected_launch) + label(expected_generation) + path(expected_private_directory) + roles = required_roles(expected_group) + exact(value, ('schema', 'epoch_id', 'mode', 'group', 'generation', 'manifest_sha256', + 'launch', 'copies', 'local_compilations', 'not_runtime_authority', 'admission')) + text(value['schema']) + label(value['epoch_id']) + choice(value['mode'], ('normal', 'optimized')) + text(value['group'], 2) + label(value['generation']) + digest(value['manifest_sha256']) + integer(value['local_compilations'], 0, 0) + boolean(value['not_runtime_authority']) + text(value['admission']) + need(value['schema'] == CLAIM_SCHEMA and value['epoch_id'] == manifest['epoch_id'] and + value['mode'] == manifest['mode'] and value['group'] == expected_group and + value['generation'] == expected_generation and value['manifest_sha256'] == sha(canonical(manifest)), + 'claim independent epoch/mode/group/generation/manifest differs') + launch(value['launch']) + need(value['launch'] == expected_launch and type(value['local_compilations']) is int and + value['local_compilations'] == 0 and value['not_runtime_authority'] is True and + value['admission'] == 'CURRENT_CHILD_CHECKS_REQUIRED', 'claim authority/launch differs') + sequence(value['copies'], len(roles)) + export_by_role = {row['role']: row for row in manifest['exports']} + builds = [row for parent in manifest['producers'] for row in parent['builds']] + occupied_paths = {row['original_output']['path'] for row in builds} + occupied_inodes = {inode(row['original_output']) for row in builds} + occupied_paths.update(row['file']['path'] for row in manifest['exports']) + occupied_inodes.update(inode(row['file']) for row in manifest['exports']) + for role, row in zip(roles, value['copies']): + exact(row, ('role', 'build_sha256', 'source', 'destination')) + choice(row['role'], ROLES) + digest(row['build_sha256']) + blob(row['source']) + blob(row['destination']) + expected = export_by_role[role] + need(row['role'] == role and row['build_sha256'] == expected['build_sha256'] and + row['source'] == expected['file'], 'copy original source provenance differs') + dest = row['destination'] + need(dest['path'] == expected_private_directory + '/' + role + '.artifact', + 'private origin differs from independent launch') + need((dest['sha256'], dest['bytes']) == (row['source']['sha256'], row['source']['bytes']), + 'private copy bytes differ') + need(dest['path'] not in occupied_paths and inode(dest) not in occupied_inodes, 'private copy alias') + occupied_paths.add(dest['path']) + occupied_inodes.add(inode(dest)) + + +def imported_inputs(raw_manifest: bytes, raw_claim: bytes, expected_manifest_sha256: str, + expected_launch: dict, expected_group: str, expected_generation: str, + expected_private_directory: str) -> tuple: + """Validate data binding only. Child must still perform all original checks. + + Expected values must be supplied by independently pinned fresh launch source, + never from either JSON argument. This helper has no runtime admission state. + The negative Root must consume its one-attempt guard BEFORE invoking it. + """ + digest(expected_manifest_sha256) + need(sha(raw_manifest) == expected_manifest_sha256, 'independent parent manifest pin differs') + manifest, receipt = decode(raw_manifest), decode(raw_claim) + claim(receipt, manifest, expected_launch, expected_group, expected_generation, expected_private_directory) + return manifest, receipt + +# Opaque error/result custody. The owner never invokes a foreign object's +# string, equality, hash, attribute, metaclass, or formatting protocol. +ERROR_SLOTS = 64 +CASE_SLOTS = 64 +MAX_ERROR_ARGS = 2 +MAX_ERROR_ARG_CHARS = 256 +MAX_SECONDARY_PROJECTIONS = 6 +_BASE_ARGS_GET = BaseException.args.__get__ +_NATIVE_ERROR_LABELS = ( + (EpochStop, 'EPOCH_STOP'), (RuntimeError, 'RUNTIME_ERROR'), + (ValueError, 'VALUE_ERROR'), (TypeError, 'TYPE_ERROR'), + (OSError, 'OS_ERROR'), (FileNotFoundError, 'FILE_NOT_FOUND'), + (PermissionError, 'PERMISSION_ERROR'), (InterruptedError, 'INTERRUPTED_ERROR'), + (BlockingIOError, 'BLOCKING_IO_ERROR'), (MemoryError, 'MEMORY_ERROR'), + (KeyboardInterrupt, 'KEYBOARD_INTERRUPT'), (SystemExit, 'SYSTEM_EXIT'), + (OverflowError, 'OVERFLOW_ERROR'), (RecursionError, 'RECURSION_ERROR'), + (UnicodeDecodeError, 'UNICODE_DECODE_ERROR')) + + +CUSTODY_SUCCESSORS = tuple(range(1, 257)) +IO_QUARANTINE_ERROR = EpochStop('epoch IO quarantined; parent teardown required') + + +class ErrorOwner: + __slots__ = ('_state',) + + +_OWNER_GET = ErrorOwner._state.__get__ +_OWNER_SET = ErrorOwner._state.__set__ +_OBJECT_NEW = object.__new__ + + +def make_error_owner() -> ErrorOwner: + owner = _OBJECT_NEW(ErrorOwner) + # 0 primary [opaque,phase]; 1 errors; 2 phases; 3 uncertain FD; + # 4 counts [secondary,close_attempts,close_confirmed,cases]; + # 5 overflow [first opaque, incomplete flag]; + # 6 cases [name,opaque,is_error,capture_state,raw_sink_return,validated]. + state = [[None, None, None], [None] * ERROR_SLOTS, [None] * ERROR_SLOTS, + [None] * ERROR_SLOTS, [0, 0, 0, 0], [None, False], + [[None, None, False, 'NOT_RETURNED', None, False, None, None] for _ in range(CASE_SLOTS)], + [False, False, False, None, False, None, False, [0] * 5, [0] * 5, False, False, False, None], + [[None, False, 'NOT_RETURNED', None] for _ in range(CASE_SLOTS)]] + _OWNER_SET(owner, state) + return owner + + +def owner_state(owner: ErrorOwner) -> list: + need(_TYPE(owner) is ErrorOwner, 'exact trusted error owner required') + state = _OWNER_GET(owner, ErrorOwner) + need(_TYPE(state) is _LIST and _LEN(state) == 9, 'trusted owner state shape differs') + for index, count in ((0, 3), (1, ERROR_SLOTS), (2, ERROR_SLOTS), (3, ERROR_SLOTS), + (4, 4), (5, 2), (6, CASE_SLOTS), (7, 13), (8, CASE_SLOTS)): + need(_TYPE(state[index]) is _LIST and _LEN(state[index]) == count, 'trusted owner slot shape differs') + integer(state[4][0], 0, ERROR_SLOTS) + integer(state[4][1], 0, 1 << 32) + integer(state[4][2], 0, state[4][1]) + integer(state[4][3], 0, CASE_SLOTS) + boolean(state[5][1]) + io = state[7] + for index in (0, 1, 2, 4, 6, 9, 10, 11): + boolean(io[index]) + for index in (7, 8): + need(_TYPE(io[index]) is _LIST and _LEN(io[index]) == 5, 'close counter digits differ') + for digit in io[index][:4]: + integer(digit, 0, 255) + integer(io[index][4], 0, 1) + need(io[index][4] == 0 or io[index][:4] == [0, 0, 0, 0], 'close counter exceeds inherited bound') + # Fallible scalar projection occurs only at API entry/snapshot, never in + # the inline cleanup path. The five native digits are authoritative. + attempts = io[7][0] + (io[7][1] << 8) + (io[7][2] << 16) + (io[7][3] << 24) + (io[7][4] << 32) + confirmed = io[8][0] + (io[8][1] << 8) + (io[8][2] << 16) + (io[8][3] << 24) + (io[8][4] << 32) + need(confirmed <= attempts, 'native close confirmation exceeds attempt') + state[4][1], state[4][2] = attempts, confirmed + return state + + +def retain_primary(owner: ErrorOwner, opaque, phase: str, uncertain_fd=None) -> None: + state = owner_state(owner) + text(phase, 96) + if uncertain_fd is not None: + integer(uncertain_fd, 0, (1 << 31) - 1) + if state[0][0] is None: + state[0][0], state[0][1], state[0][2] = opaque, phase, uncertain_fd + elif state[0][0] is not opaque: + retain_secondary(owner, opaque, phase, uncertain_fd) + + +def retain_secondary(owner: ErrorOwner, opaque, phase: str, uncertain_fd) -> None: + state = owner_state(owner) + text(phase, 96) + if uncertain_fd is not None: + integer(uncertain_fd, 0, (1 << 31) - 1) + index = state[4][0] + if index < ERROR_SLOTS: + # Preallocated native slots: no error formatting/attributes, no append. + state[1][index], state[2][index], state[3][index] = opaque, phase, uncertain_fd + state[4][0] = index + 1 + else: + state[5][1] = True + if state[5][0] is None: + state[5][0] = opaque + + +def close_attempt(owner: ErrorOwner) -> None: + state = owner_state(owner) + need(state[4][1] < 1 << 32, 'close attempt counter bound') + digits = state[7][7] + index = 0 + while index < 4 and digits[index] == 255: + digits[index] = 0 + index = CUSTODY_SUCCESSORS[index] + digits[index] = CUSTODY_SUCCESSORS[digits[index]] + + +def close_confirmed(owner: ErrorOwner) -> None: + state = owner_state(owner) + need(state[4][2] < state[4][1], 'close confirmation lacks attempt') + digits = state[7][8] + index = 0 + while index < 4 and digits[index] == 255: + digits[index] = 0 + index = CUSTODY_SUCCESSORS[index] + digits[index] = CUSTODY_SUCCESSORS[digits[index]] + + +def project_error(opaque) -> dict: + kind = _TYPE(opaque) + label_value, admitted = 'FOREIGN_OPAQUE_EXCEPTION', False + for expected_kind, literal_label in _NATIVE_ERROR_LABELS: + if kind is expected_kind: + label_value, admitted = literal_label, True + break + strings, omitted = [], False + if admitted: + # Native BaseException descriptor, only after exact whitelisted type. + # No normal error.args/__dict__/cause/context/name/str access exists. + arguments = _BASE_ARGS_GET(opaque, BaseException) + if _TYPE(arguments) is _TUPLE: + omitted = _LEN(arguments) > MAX_ERROR_ARGS + for argument in arguments[:MAX_ERROR_ARGS]: + if _TYPE(argument) is _STR: + if _LEN(argument) <= MAX_ERROR_ARG_CHARS: + strings.append(argument) + else: + strings.append(argument[:MAX_ERROR_ARG_CHARS]) + omitted = True + else: + omitted = True + else: + omitted = True + return {'literal_type_label': label_value, 'exact_string_args': strings, + 'foreign_or_excess_args_omitted': omitted or not admitted, + 'original_object_retained_opaquely': True} + + +def error_snapshot(owner: ErrorOwner) -> dict: + state = owner_state(owner) + secondary = [] + for index in range(min(state[4][0], MAX_SECONDARY_PROJECTIONS)): + text(state[2][index], 96) + if state[3][index] is not None: + integer(state[3][index], 0, (1 << 31) - 1) + secondary.append({'slot': index, 'phase': state[2][index], + 'uncertain_close_fd': state[3][index], + 'error': project_error(state[1][index])}) + primary = None + if state[0][0] is not None: + text(state[0][1], 96) + if state[0][2] is not None: + integer(state[0][2], 0, (1 << 31) - 1) + primary = {'phase': state[0][1], 'uncertain_close_fd': state[0][2], + 'error': project_error(state[0][0])} + # Projection happens only after operation cleanup. At most six recorder + # errors are projected; a scan of all 64 slots counts omitted projections. + recording_failures = [] + recording_failure_count = 0 + for index, row in enumerate(state[8]): + if row[3] is not None: + recording_failure_count += 1 + if len(recording_failures) < MAX_SECONDARY_PROJECTIONS: + recording_failures.append({'slot': index, 'state': row[2], + 'target_is_error': row[1], 'recording_error': project_error(row[3]), + 'target_retained_opaquely': row[2] != 'NOT_RETURNED'}) + return {'primary': primary, 'secondary': secondary, + 'secondary_capture_incomplete': state[5][1], + 'secondary_projection_omitted': max(0, state[4][0] - MAX_SECONDARY_PROJECTIONS), + 'close_attempts': state[4][1], 'close_confirmed': state[4][2], + 'close_counter_incomplete': state[7][6], + 'io_quarantined': state[7][0], 'native_acquisition_pending': state[7][1], + 'possible_unreturned_native_fd': state[7][2], + 'parent_kernel_teardown_required': state[7][4], + 'uncertain_scandir_owner_retained': state[7][5] is not None, + 'scandir_close_returned_result_unobserved': state[7][9], + # An earlier normal close observation never overrides a later + # delivered failure or retained stream uncertainty. + 'scandir_release_uses_external_premise': (state[7][9] and not state[7][0] + and state[7][5] is None), + 'external_guard_acquisition_pending': state[7][10], + 'external_guard_fd_count_unavailable': state[7][11], + 'native_acquisition_error': None if state[7][3] is None else project_error(state[7][3]), + 'external_guard_error': None if state[7][12] is None else project_error(state[7][12]), + 'recording_failures': recording_failures, + 'recording_projection_omitted': max(0, recording_failure_count - MAX_SECONDARY_PROJECTIONS)} + + + +def record_case(owner: ErrorOwner, name: str, opaque, is_error: bool) -> int: + state = owner_state(owner) + text(name, 16) + boolean(is_error) + count = state[4][3] + need(count < CASE_SLOTS, 'case capacity exceeded') + for index in range(count): + row = state[6][index] + need(_TYPE(row) is _LIST and _LEN(row) == 8, 'case slot shape differs') + text(row[0], 16) + need(row[0] != name, 'case identity replay') + row = state[6][count] + need(_TYPE(row) is _LIST and _LEN(row) == 8, 'case slot shape differs') + text(row[3], 32) + need(row[3] == 'NOT_RETURNED', 'case slot already used') + row[0], row[1], row[2] = name, opaque, is_error + row[3] = 'RETURNED_NOT_CAPTURED' + state[4][3] = count + 1 + return count + + +def case_slot(owner: ErrorOwner, index: int) -> list: + state = owner_state(owner) + integer(index, 0, CASE_SLOTS - 1) + need(index < state[4][3], 'case not recorded') + row = state[6][index] + need(_TYPE(row) is _LIST and _LEN(row) == 8, 'case slot shape differs') + text(row[0], 16) + boolean(row[2]) + choice(row[3], ('NOT_RETURNED', 'RETURNED_NOT_CAPTURED', 'RAW_CAPTURED', 'VALIDATED')) + boolean(row[5]) + return row + +# Original-function record checks use native descriptors only after exact +# FunctionType/CellType gates. Provenance must come from the authenticated Root +# factory call, never a record recaptured after adverse input. +from types import FunctionType as _FUNCTION_TYPE, CellType as _CELL_TYPE +_FUNCTION_GETTERS = tuple(_FUNCTION_TYPE.__dict__[name].__get__ for name in + ('__code__', '__globals__', '__defaults__', '__kwdefaults__', '__closure__', '__annotations__', '__dict__')) +_CELL_GET = _CELL_TYPE.cell_contents.__get__ + + +def capture_original_function(function) -> tuple: + need(_TYPE(function) is _FUNCTION_TYPE, 'exact original function required') + values = tuple(getter(function, _FUNCTION_TYPE) for getter in _FUNCTION_GETTERS) + need(values[2] is None and values[3] is None, 'original callback defaults differ') + closure = values[4] + cells = [] + if closure is not None: + need(_TYPE(closure) is _TUPLE and _LEN(closure) <= 64, 'original closure bound differs') + for cell in closure: + need(_TYPE(cell) is _CELL_TYPE, 'original closure cell differs') + cells.append((cell, _CELL_GET(cell, _CELL_TYPE))) + return function, values, tuple(cells) + + +def check_original_function(function, record) -> None: + need(_TYPE(function) is _FUNCTION_TYPE, 'foreign callable rejected') + need(_TYPE(record) is _TUPLE and _LEN(record) == 3, 'original callback record differs') + need(function is record[0], 'original callback identity differs') + values, cells = record[1], record[2] + need(_TYPE(values) is _TUPLE and _LEN(values) == 7, 'original callback value record differs') + need(_TYPE(cells) is _TUPLE and _LEN(cells) <= 64, 'original callback cell record differs') + for getter, expected in zip(_FUNCTION_GETTERS, values): + need(getter(function, _FUNCTION_TYPE) is expected, 'original callback environment differs') + need(values[2] is None and values[3] is None, 'original callback defaults differ') + closure = values[4] + if closure is None: + need(_LEN(cells) == 0, 'unexpected original closure records') + return + need(_TYPE(closure) is _TUPLE and _LEN(closure) == _LEN(cells), 'original closure record count differs') + for actual_cell, pair in zip(closure, cells): + need(_TYPE(pair) is _TUPLE and _LEN(pair) == 2, 'original cell pair differs') + need(_TYPE(actual_cell) is _CELL_TYPE and actual_cell is pair[0], 'original cell identity differs') + need(_CELL_GET(actual_cell, _CELL_TYPE) is pair[1], 'original closure content identity differs') + + +def prepare_case_shadow(owner: ErrorOwner) -> tuple: + state = owner_state(owner) + count = state[4][3] + need(count < CASE_SLOTS, 'case shadow capacity exceeded') + row = state[8][count] + need(_TYPE(row) is _LIST and _LEN(row) == 4 and row[0] is None and row[3] is None and row[2] == 'NOT_RETURNED', + 'case shadow was already consumed') + return state, count, row diff --git a/research/h25-v03-prefix-supervision/unit05/implementation/group01_evidence_v1.py b/research/h25-v03-prefix-supervision/unit05/implementation/group01_evidence_v1.py new file mode 100644 index 0000000000..bde3f97232 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/implementation/group01_evidence_v1.py @@ -0,0 +1,256 @@ +"""Parent data replay of the exact unchanged Group01 finite producer route. + +All arguments come from the owning parent registry and independently frozen +prelaunch plan. A parsed status never establishes process ownership, native +correctness or historical source continuity. Those are separate original +source/runtime and owned-domain obligations. No function was executed here. +""" +import json +import math +import epoch_schema_v5 as schema +import epoch_copy_v5 as copying +import original_build_provenance_v5 as original_build +import parent_closure_v1 as closure +import group01_original_predicates_v1 as original_predicates + +_TYPE, _LEN = type, len +GROUP_ORDER = ('native', 'transport', 'collector', 'pure_initial', 'pure_extended', + 'pure_combined', 'root_model', 'sink_close_model', 'projection_model', 'aggregate') +GROUP_KEYS = ('native', 'transport', 'collector', 'elf', 'providers', 'elf_extended') +MAX_JSON_NODES = 200000 +MAX_JSON_BYTES = 4 * 1024 * 1024 +FINITE_KEYS = ('status', 'lanes', 'data_handling', 'data_source_custody', 'optimized', + 'original_controls', 'new_controls', 'new_source_custody', 'driver_sha256', + 'initial_native_tcb', 'initial_native_tcb_restoration', 'native_packet', + 'reference_driver_sha256', 'phases') + + +def _pairs(pairs): + schema.need(_TYPE(pairs) is list and _LEN(pairs) <= 8192, 'receipt JSON object bound') + result = {} + for key, value in pairs: + schema.need(_TYPE(key) is str and _LEN(key) <= 65536 and key not in result, + 'receipt duplicate/foreign/oversize key') + result[key] = value + return result + + +def _reject(value): + raise schema.EpochStop('nonfinite receipt JSON constant') + + +def _plain(value, budget, depth=0): + schema.need(depth <= 40 and budget[0] > 0, 'receipt JSON node/depth bound') + budget[0] -= 1 + kind = _TYPE(value) + if value is None or kind is bool: + return + if kind is int: + schema.need(value.bit_length() <= 4096, 'receipt integer bound') + return + if kind is float: + schema.need(math.isfinite(value), 'nonfinite receipt number') + return + if kind is str: + schema.need(_LEN(value) <= 65536, 'receipt string bound') + budget[1] += _LEN(value) + schema.need(budget[1] <= MAX_JSON_BYTES, 'receipt text budget') + return + schema.need(kind in (list, dict) and _LEN(value) <= 8192, 'receipt exact collection bound') + if kind is dict: + for key, item in value.items(): + schema.need(_TYPE(key) is str, 'receipt exact key required') + _plain(key, budget, depth + 1) + _plain(item, budget, depth + 1) + else: + for item in value: + _plain(item, budget, depth + 1) + + +def decode(raw): + schema.need(_TYPE(raw) is bytes and 0 < _LEN(raw) <= MAX_JSON_BYTES, 'receipt raw byte bound') + value = json.loads(raw.decode('ascii'), object_pairs_hook=_pairs, parse_constant=_reject) + schema.need(_TYPE(value) is dict, 'receipt top-level exact object required') + _plain(value, [MAX_JSON_NODES, 0]) + return value + + +def encode(value): + _plain(value, [MAX_JSON_NODES, 0]) + raw = json.dumps(value, sort_keys=True, separators=(',', ':'), ensure_ascii=True, + allow_nan=False).encode('ascii') + b'\n' + schema.need(_LEN(raw) <= MAX_JSON_BYTES, 'receipt canonical byte bound') + return raw + + +def same_json(left, right): + # Both operands are exact bounded JSON-native data. Canonical bytes retain + # bool/int/float distinctions that Python nested equality otherwise loses. + return encode(left) == encode(right) + + +def _read(path, bound, error_owner): + pin = copying.inspect(path, bound, error_owner=error_owner) + raw = copying.read_verified(pin, bound, error_owner=error_owner) + return pin, raw + + +def _captured_call(receiver_capability, module, name, *args): + # Exact module/function names below are source literals, not caller-selected + # callbacks. Current source/identity checks surround every receiving call. + closure.check_receivers(receiver_capability) + function = closure.receiver(receiver_capability, module, name) + result = function(*args) + closure.check_receivers(receiver_capability) + return result + + +def _legacy_controls(result, expected): + schema.exact(expected, ('original_counts', 'original_fixture_sha256', + 'original_v2_counts', 'original_v2_stream', 'new_controls')) + schema.digest(expected['original_fixture_sha256']) + native = result['original_controls'] + schema.need(_TYPE(native) is dict and native.get('status') == 'FINITE_NATIVE_GF2_CONTROLS_PASS' and + same_json(native.get('counts'), expected['original_counts']) and + native.get('fixture_sha256') == expected['original_fixture_sha256'] and + _TYPE(native.get('micro_repetitions')) is int and native['micro_repetitions'] == 128 and + native.get('independent_oracle') == + 'Dense binary lists, descending pivots, addition modulo 2; no packed/source/native helpers', + 'original native independent outcome projection differs') + schema.need(_TYPE(native.get('micro_fixtures')) is int and native['micro_fixtures'] > 0 and + _TYPE(native.get('native_and_fallback_calls')) is dict and + all(_TYPE(value) is int and value > 0 for value in native['native_and_fallback_calls'].values()), + 'original native and fallback paths not represented') + v2 = native.get('v2_controls') + schema.need(_TYPE(v2) is dict and v2.get('status') == 'V2_RUNTIME_AND_COMPLEMENT_STREAM_PASS' and + same_json(v2.get('counts'), expected['original_v2_counts']) and + same_json(v2.get('complement_fixture_stream'), expected['original_v2_stream']) and + _TYPE(v2.get('modified_helper_invocations')) is int and v2['modified_helper_invocations'] == 0, + 'original runtime/ordered-complement independent projection differs') + # The expected complete new-control tree is an independently approved input + # before launch. It is never learned from this result or an earlier PASS. + schema.need(same_json(result['new_controls'], expected['new_controls']), + 'complete original bookkeeping control return differs') + + +def authenticate_group01(output, expected, process_id, parent_file_limits, + receiver_capability, error_owner, stdout_raw): + """Return actual evidence data; only the owning launcher can mint authority.""" + schema.path(output) + schema.integer(process_id, 1, (1 << 31) - 1) + schema.exact(expected, ('mode', 'generation', 'stage_sha256', 'root_sha256', + 'driver_sha256', 'reference_driver_sha256', 'builds', 'legacy_outcomes', + 'source_receipts', 'tcb_files', 'hashlib_origin')) + schema.choice(expected['mode'], ('normal', 'optimized')) + schema.label(expected['generation']) + for key in ('stage_sha256', 'root_sha256', 'driver_sha256', 'reference_driver_sha256'): + schema.digest(expected[key]) + schema.path(expected['hashlib_origin']) + optimize = 0 if expected['mode'] == 'normal' else 1 + result_pin, result_raw = _read(output + '/receipt.json', MAX_JSON_BYTES, error_owner) + result = decode(result_raw) + schema.exact(result, FINITE_KEYS) + schema.need(result['status'] == 'H25_DATA_HANDLING_FINITE_PASS' and + result['lanes'] == 'all' and _TYPE(result['optimized']) is int and + result['optimized'] == optimize and + result['driver_sha256'] == expected['driver_sha256'] and + result['reference_driver_sha256'] == expected['reference_driver_sha256'], + 'original finite producer route/mode/source differs') + schema.need(same_json(decode(stdout_raw), result), 'original stdout and terminal finite receipt differ') + _legacy_controls(result, expected['legacy_outcomes']) + finite_pin, finite_raw = _read(output + '/finite-controls.json', MAX_JSON_BYTES, error_owner) + schema.need(same_json(decode(finite_raw), result['original_controls']), 'original finite raw result differs') + data, packet = result['data_handling'], result['native_packet'] + schema.need(_TYPE(data) is dict and data.get('schema') == 'h25-data-handling-v2' and + data.get('full_caller_run') is False and data.get('full_candidate_admission') is False and + data.get('cache_teardown_stops') == [] and same_json(data.get('native_packet'), packet), + 'original finite data or cleanup boundary differs') + original_predicates.check_original_control_union( + {'controls': data['controls'], 'native_packet': packet}, optimize, include_late=True) + schema.need(packet['late_started'] is True and packet['late_completed'] is True and + packet['field_service_closed'] is True and packet['direct_close_stop'] is None and + packet['field_group_stop'] is None and packet['field_restoration_receipt_checked'] is True and + packet['field_runtime_qualification'] is False, + 'original late/group/field cleanup or qualification boundary differs') + schema.exact(expected['source_receipts'], ('data_source_custody', 'new_source_custody', + 'compiler_dependencies')) + for key in ('data_source_custody', 'new_source_custody'): + schema.need(same_json(result[key], expected['source_receipts'][key]), 'source-derived receipt custody differs') + schema.need(same_json(packet['compiler_dependencies'], expected['source_receipts']['compiler_dependencies']), + 'original compiler/link/header receipt closure differs') + # Original placement is authenticated by exact launched source. This call + # replays its fixed data contract; it does not rerun initial native checks. + tcb_files = tuple(tuple(row) for row in expected['tcb_files']) + _captured_call(receiver_capability, 'restoration_contract_v1', 'validate_restoration', + result['initial_native_tcb'], data['controls']['native_initial_tcb'], + result['initial_native_tcb_restoration'], tcb_files, expected['hashlib_origin'], + expected['root_sha256'], len(tcb_files)) + schema.integer(result['initial_native_tcb']['pid'], 1, (1 << 31) - 1) + schema.integer(result['initial_native_tcb_restoration']['pid'], 1, (1 << 31) - 1) + schema.need(result['initial_native_tcb']['pid'] == process_id and + result['initial_native_tcb_restoration']['pid'] == process_id, + 'initial/restoration receipt belongs to another process') + initial_pin, initial_raw = _read(output + '/initial-native-tcb.json', MAX_JSON_BYTES, error_owner) + restored_pin, restored_raw = _read(output + '/initial-native-tcb-restoration.json', MAX_JSON_BYTES, error_owner) + schema.need(same_json(decode(initial_raw), result['initial_native_tcb']) and + same_json(decode(restored_raw), result['initial_native_tcb_restoration']), + 'initial/restoration retained raw differs') + controls_pin, controls_raw = _read(output + '/initial-tcb-controls/receipt.json', MAX_JSON_BYTES, error_owner) + schema.need(same_json(decode(controls_raw), data['controls']['native_initial_tcb']), 'original initial five-control raw differs') + delivery = packet['field_group_delivery'] + aggregate = delivery['aggregate'] + schema.need(same_json(data['controls']['native_fields'], aggregate), 'field aggregate projections differ') + # JSON object order is not the original insertion-order observation. Restore + # only this explicit source-fixed mapping order for the existing validator; + # no value/case/sequence/order or unknown-key repair is permitted. + schema.exact(aggregate['groups'], GROUP_KEYS) + aggregate['groups'] = {key: aggregate['groups'][key] for key in GROUP_KEYS} + _captured_call(receiver_capability, 'run_controls_v5', 'validate_all', delivery, expected['mode']) + values = (aggregate['groups']['native'], aggregate['groups']['transport'], + aggregate['groups']['collector'], aggregate['pure_v2']['initial'], + aggregate['pure_v2']['extended'], aggregate['pure_v2'], aggregate['root_model'], + aggregate['sink_close_model'], aggregate['projection_model'], aggregate) + group_rows = [] + for index, (group, value) in enumerate(zip(GROUP_ORDER, values)): + raw_ref = delivery['group_evidence']['raw_pins'][index][1] + validation_ref = delivery['group_evidence']['validation_pins'][index][1] + raw_pin, raw = _read(output + '/' + raw_ref['file'], 1048576, error_owner) + validation_pin, validation_raw = _read(output + '/' + validation_ref['file'], 8192, error_owner) + schema.need(raw_pin['sha256'] == raw_ref['sha256'] and raw_pin['bytes'] == raw_ref['bytes'] and + validation_pin['sha256'] == validation_ref['sha256'] and validation_pin['bytes'] == validation_ref['bytes'], + 'durable group pin differs from actual retained bytes') + schema.need(raw == encode(value), 'complete raw group differs from original aggregate projection') + note = {'schema': 'h25-full-group-evidence-sink-v5', 'mode': expected['mode'], 'group': group, + 'state': 'RETURNED_RAW_OUTER_VALIDATED', 'raw': raw_ref} + schema.need(validation_raw == encode(note), 'complete validation note differs') + group_rows.append({'group': group, 'raw': raw_pin, 'validation': validation_pin}) + builds = [] + schema.sequence(expected['builds'], 3) + for role, build_plan in zip(schema.ROLES[:3], expected['builds']): + schema.exact(build_plan, ('role', 'profile', 'command_sha256', 'original_output_path', 'expected_original')) + schema.need(build_plan['role'] == role, 'original build role order differs') + base = output + '/cold-native-metadata/' + role + original_record_pin, raw_receipt = _read(base + '-build.json', 65536, error_owner) + original_record = decode(raw_receipt) + schema.need(same_json(original_record, packet['builds'][role]), 'original build raw/terminal projection differs') + row = {'role': role, 'producer_role': 'group01', 'producer_generation': expected['generation'], + 'producer_stage_sha256': expected['stage_sha256'], 'command_sha256': build_plan['command_sha256'], + 'profile': build_plan['profile'], + 'original_output': copying.inspect(build_plan['original_output_path'], error_owner=error_owner), + 'original_receipt': original_record_pin, + 'attempt': copying.inspect(base + '.attempt.json', 65536, error_owner=error_owner), + 'journal': copying.inspect(base + '.attempt.jsonl', schema.JOURNAL_BYTES, error_owner=error_owner), + 'stdout': copying.inspect(base + '.stdout.raw', schema.LOG_BYTES, error_owner=error_owner), + 'stderr': copying.inspect(base + '.stderr.raw', schema.LOG_BYTES, error_owner=error_owner)} + independent = schema.plain_copy(build_plan['expected_original']) + independent['producer_process_id'] = process_id + independent['parent_file_limits'] = list(parent_file_limits) + closure.check_receivers(receiver_capability) + original_build.authenticate_original_build(row, independent, error_owner=error_owner) + closure.check_receivers(receiver_capability) + builds.append(row) + return {'raw_result': result_pin, 'group_rows': group_rows, 'builds': builds, + 'additional_raw': [finite_pin, initial_pin, restored_pin, controls_pin], + 'own_group01_source_and_result_contract_checked': True, + 'later_cross_root_aggregate_required_before_export': False, + 'native_runtime_or_full_union_qualified': False} diff --git a/research/h25-v03-prefix-supervision/unit05/implementation/h25_parent_supervisor.py b/research/h25-v03-prefix-supervision/unit05/implementation/h25_parent_supervisor.py new file mode 100644 index 0000000000..73ed60fe21 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/implementation/h25_parent_supervisor.py @@ -0,0 +1,475 @@ +"""Parent-only bounded process supervision; imports no candidate implementation. + +The runtime caller must establish the trusted clean launcher before calling us. +This source was prepared without loading ctypes or running any control. The +closed single-threaded child domain is an explicit premise, not a hostile-fork +sandbox. Numeric process IDs are never used as signal destinations. +""" +import fcntl +import hashlib +import json +import os +from pathlib import Path +import resource +import signal +import stat +import subprocess +import sys +import time + +FLAGS = ('-S', '-s', '-P', '-B') +ENV = {'PATH': '/usr/bin:/bin', 'PYTHONHASHSEED': '0', 'LANG': 'C.UTF-8', + 'LC_ALL': 'C.UTF-8', 'TZ': 'UTC', 'PYTHONDONTWRITEBYTECODE': '1'} +RUNNER_SHA = 'bd882e3dadb1b6aeaa63ee824f1a1c58f8ef2546b6840a2bffa46885a184d3eb' +QUEUE_SHA = '1348a7b4d7cc1f9fef556f5e0abdaf04411a998afdcd574d7812c76ab37dcf68' +TCB_SHA = '610492b3fc06baa0560175edc3ba27057de00d00b8fd3d58dbe55e5a371c042a' +LIBC = '/usr/lib/x86_64-linux-gnu/libc.so.6' +NATIVE_PINS = { + LIBC: '3a15d66867d83762c7f2f1e37359cb8f6c5743edb369c65285cb0b1c4f7498bf', + '/usr/lib/python3.12/lib-dynload/_ctypes.cpython-312-x86_64-linux-gnu.so': 'aad3e24f186e6c0a1c7efa8f16004f951f527db86f6451d30118657384a456c1', + '/usr/lib/x86_64-linux-gnu/libffi.so.8.1.4': '00f593fe192f2851b8ce23b25cec2488d769beb5a8f63e8c9e563071e1075153', + '/usr/lib/python3.12/ctypes/__init__.py': '0782592567ad71097198a3afe985ac3e2ea0b9b5e75452402c9460c89a86318a', + '/usr/lib/python3.12/ctypes/_endian.py': 'c5d692bdce10dfee242752620061bab684633bc72445a3def484961ef1bdbf3a', +} +CHUNK = 65536 +LOG_CAP = 2 * 1024 * 1024 +META_CAP = 256 * 1024 +CLEANUP_SECONDS = 2.0 + + +def need(condition, message): + if not condition: + raise RuntimeError(message) + + +def launch_contract(): + need(sys.executable == '/usr/bin/python3.12', 'Pinned interpreter required') + need(sys.flags.no_site == sys.flags.no_user_site == sys.flags.dont_write_bytecode == 1 and + sys.flags.safe_path and sys.flags.ignore_environment == sys.flags.isolated == + sys.flags.hash_randomization == 0, 'Trusted no-site safe-path fixed-seed flags required') + need(dict(os.environ) == ENV, 'Exact clean environment required') + need(tuple(sys.path) == ('/usr/lib/python312.zip', '/usr/lib/python3.12', + '/usr/lib/python3.12/lib-dynload'), 'Initial system stdlib path changed') + need(list(Path('/proc/self/task').iterdir()) == [Path('/proc/self/task') / str(os.getpid())], + 'Exactly one parent task required') + + +def identity(info): + return (info.st_dev, info.st_ino, info.st_mode, info.st_size, info.st_mtime_ns, info.st_ctime_ns) + + +def stable_file(path, limit, keep=False): + """Complete bounded snapshot; no file read can extend a growing snapshot.""" + path = Path(path) + before = path.stat(follow_symlinks=False) + need(stat.S_ISREG(before.st_mode) and before.st_size <= limit, 'File type/size bound: ' + str(path)) + fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK | os.O_CLOEXEC) + h, count, blocks = hashlib.sha256(), 0, [] + try: + opened = os.fstat(fd) + need(identity(before) == identity(opened), 'File changed while opening') + while count < opened.st_size: + block = os.read(fd, min(CHUNK, opened.st_size - count)) + need(bool(block), 'Short retained-file read') + count += len(block) + h.update(block) + if keep: + blocks.append(block) + after_fd = os.fstat(fd) + finally: + os.close(fd) + after = path.stat(follow_symlinks=False) + need(identity(before) == identity(after_fd) == identity(after), 'File drift during retained snapshot') + row = {'path': str(path), 'sha256': h.hexdigest(), 'bytes': count, + 'identity': list(identity(after)), 'stable': True, 'read_chunk_bytes': CHUNK} + return (row, b''.join(blocks)) if keep else row + + +def read_json(path, limit=META_CAP): + row, raw = stable_file(path, limit, True) + return json.loads(raw), row + + +def write_new(path, row): + raw = json.dumps(row, sort_keys=True, indent=2).encode('ascii') + b'\n' + need(len(raw) <= META_CAP, 'Bounded metadata record exceeded') + fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_CLOEXEC | os.O_NOFOLLOW, 0o600) + try: + view = memoryview(raw) + while view: + written = os.write(fd, view) + need(written > 0, 'Metadata write made no progress') + view = view[written:] + os.fsync(fd) + finally: + os.close(fd) + + +def proc(pid): + try: + with open('/proc/' + str(pid) + '/stat', 'rb') as stream: + raw = stream.read(8193) + need(len(raw) <= 8192, 'Unexpected process-stat size') + end = raw.rfind(b') ') + need(end >= 0, 'Malformed process stat') + fields = raw[end + 2:].split() + return {'pid': int(pid), 'ppid': int(fields[1]), 'pgid': int(fields[2]), + 'sid': int(fields[3]), 'start_ticks': int(fields[19]), + 'state': fields[0].decode('ascii'), + 'rss_bytes': int(fields[21]) * os.sysconf('SC_PAGE_SIZE')} + except (FileNotFoundError, ProcessLookupError, PermissionError): + return None + + +def census(): + found = {} + with os.scandir('/proc') as entries: + for entry in entries: + if entry.name.isdecimal(): + row = proc(int(entry.name)) + if row is not None: + found[row['pid']] = row + return found + + +def generation(row): + return row['pid'], row['start_ticks'] + + +def children_now(): + return [row for row in census().values() if row['ppid'] == os.getpid()] + + +def install_subreaper(root): + """Called only by the future parent, before any controlled root exists.""" + launch_contract() + need(not children_now(), 'Parent must own no preexisting child processes') + tcb, tcb_row = read_json(root / 'control/NATIVE-INITIAL-TCB-v1.json') + need(tcb_row['sha256'] == TCB_SHA, 'Accepted initial TCB changed') + need(any(row['path'] == LIBC and row['sha256'] == NATIVE_PINS[LIBC] + for row in tcb['files']), 'Pinned libc absent from accepted TCB') + evidence = {path: stable_file(path, 16 * 1024 * 1024) for path in NATIVE_PINS} + need(all(evidence[path]['sha256'] == expected for path, expected in NATIVE_PINS.items()), + 'Subreaper native/stdlib source supplement changed') + # This import and native call have NOT been performed during source authoring. + need(Path('/usr/lib/x86_64-linux-gnu/libffi.so.8').resolve() == + Path('/usr/lib/x86_64-linux-gnu/libffi.so.8.1.4'), 'Foreign libffi SONAME resolution') + import ctypes + need(sys.modules['_ctypes'].__file__ == + '/usr/lib/python3.12/lib-dynload/_ctypes.cpython-312-x86_64-linux-gnu.so', 'Foreign _ctypes owner') + need(ctypes.__file__ == '/usr/lib/python3.12/ctypes/__init__.py', 'Foreign ctypes owner') + library = ctypes.CDLL(LIBC, use_errno=True) + call = library.prctl + call.argtypes = [ctypes.c_int, ctypes.c_ulong, ctypes.c_ulong, ctypes.c_ulong, ctypes.c_ulong] + call.restype = ctypes.c_int + prior, actual = ctypes.c_int(), ctypes.c_int() + need(call(37, ctypes.addressof(prior), 0, 0, 0) == 0, 'PR_GET_CHILD_SUBREAPER failed') + need(call(36, 1, 0, 0, 0) == 0, 'PR_SET_CHILD_SUBREAPER failed') + need(call(37, ctypes.addressof(actual), 0, 0, 0) == 0 and actual.value == 1, + 'Same-process subreaper readback failed') + for path, expected in NATIVE_PINS.items(): + need(stable_file(path, 16 * 1024 * 1024)['sha256'] == expected, 'TCB bytes changed across load') + # Retain the CDLL and typed function in the owning parent for its whole queue. + return {'pid': os.getpid(), 'prior': prior.value, 'actual': actual.value, + 'tcb_sha256': TCB_SHA, 'native_source_evidence': evidence, + 'trust': 'Trusted OS/loader/initial system stdlib; file pins do not authenticate native memory'}, (library, call) + + +def ledger(root, allow_unclosed=False): + result = {} + runs = root / 'runtime/runs' + for folder in sorted(runs.iterdir()): + need(folder.is_dir() and not folder.is_symlink(), 'Unexpected round run entry') + if allow_unclosed and not (folder / 'receipt.json').exists(): + continue + receipt, _ = read_json(folder / 'receipt.json', 4 * 1024 * 1024) + amount = receipt.get('runner_wall_seconds', receipt.get('wall_seconds')) + need(type(amount) in (int, float) and amount >= 0, 'Invalid ledger amount') + result[folder.name] = float(amount) + return result + + +def budget(root): + phase, _ = read_json(root / 'control/EXECUTION-PHASE.json') + cap = phase['aggregate_cap_seconds'] + need(type(cap) is int and cap in (600, 2400), 'Unrecognized budget phase') + current = ledger(root) + need(sum(current.values()) < cap, 'Round budget consumed') + return cap, current + + +def parent_lock(root): + lock = (root / 'runtime/parent-queue.lock').open('a') + try: + fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB) + except BaseException: + lock.close() + raise + return lock + + +class ExecutionDeadline(RuntimeError): + pass + + +def deadline_handler(signum, frame): + raise ExecutionDeadline('Outer execution deadline reached, including Popen/preexec') + + +class OwnedDomain: + """Only our new children and their observed descendants enter this domain.""" + def __init__(self): + need(not children_now(), 'Owned child domain was not initially empty') + self.rows, self.fds, self.groups, self.reaped = {}, {}, set(), [] + self.root = None + self.parent_group = os.getpgrp() + self.parent_session = os.getsid(0) + + def add(self, row): + key = generation(row) + if key in self.rows: + if row['pgid'] != self.parent_group: + self.groups.add((row['pgid'], row['sid'])) + return + need(len(self.rows) < 128, 'Owned process observation limit exceeded') + need(row['pid'] != os.getpid(), 'Parent cannot enter its own child domain') + try: + fd = os.pidfd_open(row['pid'], 0) + except ProcessLookupError: + return + current = proc(row['pid']) + if current is None or generation(current) != key: + os.close(fd) + return + self.rows[key], self.fds[key] = dict(current), fd + # During interrupted Popen a child can briefly precede setsid. Its + # individual pidfd is owned; the queue parent group never is. + if current['pgid'] != self.parent_group: + self.groups.add((current['pgid'], current['sid'])) + + def observe(self): + all_rows = census() + known = {pid for pid, start in self.rows if pid in all_rows and + all_rows[pid]['start_ticks'] == start} + for pid in known: + self.add(all_rows[pid]) + changed = True + while changed: + changed = False + for pid, row in all_rows.items(): + if pid not in known and (row['ppid'] == os.getpid() or row['ppid'] in known): + self.add(row) + if generation(row) in self.rows: + known.add(pid) + changed = True + return all_rows, [all_rows[pid] for pid in known] + + def kill_owned(self): + self.observe() + for key, fd in self.fds.items(): + current = proc(key[0]) + if current is not None and generation(current) == key and current['state'] != 'Z': + try: + signal.pidfd_send_signal(fd, signal.SIGKILL, None, 0) + except ProcessLookupError: + pass + + def cleanup(self, process): + start = time.monotonic() + seen_after_root = [] + completed = False + while True: + _, current = self.observe() + if process is not None and process.returncode is not None: + seen_after_root.extend(generation(row) for row in current if row['pid'] != process.pid) + self.kill_owned() + if process is not None: + process.poll() + for key in list(self.rows): + row = proc(key[0]) + if row is None or generation(row) != key or row['ppid'] != os.getpid(): + continue + if process is not None and row['pid'] == process.pid: + continue + try: + pid, status = os.waitpid(row['pid'], os.WNOHANG) + except ChildProcessError: + continue + if pid: + self.reaped.append({'pid': pid, 'start_ticks': key[1], 'wait_status': status}) + all_rows, current = self.observe() + occupied = [row for row in all_rows.values() if (row['pgid'], row['sid']) in self.groups] + if not current and not occupied and not children_now(): + completed = True + break + if time.monotonic() - start >= CLEANUP_SECONDS: + break + time.sleep(0.01) + final_rows = census() + remaining = [row for row in final_rows.values() if + generation(row) in self.rows or (row['pgid'], row['sid']) in self.groups or + row['ppid'] == os.getpid()] + for fd in self.fds.values(): + os.close(fd) + self.fds.clear() + return {'complete': completed and not remaining, + 'owned_generations': list(self.rows.values()), + 'groups': [{'pgid': g, 'sid': s} for g, s in sorted(self.groups)], + 'reaped_adopted': self.reaped, + 'observed_after_root_exit': [list(key) for key in sorted(set(seen_after_root))], + 'remaining': remaining, 'cleanup_seconds': time.monotonic() - start, + 'cleanup_tail_limit_seconds': CLEANUP_SECONDS, + 'group_empty_proved': completed and not remaining, + 'signal_method': 'SIGKILL via generation-checked pidfd only; never killpg'} + + +def reconcile_missing_receipt(root, label, began, cause, cleanup): + folder = root / 'runtime/runs' / label + folder.mkdir(exist_ok=True) + if not cleanup['complete'] and not (folder / 'receipt.json').exists(): + # A surviving root must never race a replacement canonical receipt. + # Leave its attempt unclosed, blocking the unchanged runner, and add a + # distinct charged STOP record for the parent to reconcile manually. + folder = root / 'runtime/runs' / (label + '-outer-unclosed-stop') + folder.mkdir() + path = folder / 'receipt.json' + if path.exists(): + return None + start = {} + if (folder / 'START.json').exists(): + start, _ = read_json(folder / 'START.json') + row = dict(start, schema='h25-outer-reconciled-stop-v1', status='STOP', label=label, + kind='outer_reconciled_incomplete_root', termination=cause, attempt_label=label, + wall_seconds=time.monotonic() - began, original_root_receipt_absent=True, + original_root_completion_claimed=False, cleanup_complete=cleanup['complete'], + all_prior_files_preserved=True) + row['label'] = folder.name + row['runner_wall_seconds'] = row['wall_seconds'] + if not (folder / 'START.json').exists(): + write_new(folder / 'START.json', {'kind': row['kind'], 'label': label}) + write_new(path, row) + return row + + +def run_root(root, case, evidence, seconds, shared_deadline, as_bytes=201326592, + rss_bytes=201326592): + """One root. Cleanup and stable custody finish before returning to a queue.""" + launch_contract() + need(stable_file(root / 'run_guarded_v3.py', META_CAP)['sha256'] == RUNNER_SHA, + 'Actual root runner changed') + need(time.monotonic() + CLEANUP_SECONDS < shared_deadline, 'No reserved cleanup tail remains') + command = ['/usr/bin/python3.12', *FLAGS, str(root / 'run_guarded_v3.py'), + case['stage'], case['job'], case['label']] + for value in (case['stage'], case['job'], case['label']): + need(type(value) is str and value and all(c in 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_' for c in value), + 'Unsafe case identity') + evidence.mkdir() + need(type(seconds) in (int, float) and 0 < seconds <= 190, 'Unadmitted root deadline') + need(type(as_bytes) is int and 0 < as_bytes <= 1024 ** 3, 'Unadmitted root address-space bound') + need(type(rss_bytes) is int and 0 < rss_bytes <= 1024 ** 3, 'Unadmitted aggregate RSS bound') + began = time.monotonic() + deadline = min(began + seconds, shared_deadline - CLEANUP_SECONDS) + domain = OwnedDomain() + process, failure, cleanup = None, None, None + peak, spawn_entered, captured = 0, False, None + setter, limit_kind, limits = resource.setrlimit, resource.RLIMIT_AS, (as_bytes, as_bytes) + need(list(Path('/proc/self/task').iterdir()) == [Path('/proc/self/task') / str(os.getpid())], + 'Root preexec requires exactly one task') + def child_limit(): + setter(limit_kind, limits) + old_handler = signal.getsignal(signal.SIGALRM) + need(signal.getitimer(signal.ITIMER_REAL) == (0.0, 0.0), 'Parent already has an execution alarm') + write_new(evidence / 'LAUNCH.json', {'command': command, 'parent_pid': os.getpid(), + 'parent_pgid': os.getpgrp(), 'parent_sid': os.getsid(0), + 'root_execution_seconds': seconds, 'address_space_bytes': as_bytes, + 'rss_sum_bytes': rss_bytes, 'new_session': True, 'cleanup_reserved_seconds': CLEANUP_SECONDS}) + try: + with (evidence / 'root.stdout.raw').open('xb') as out, (evidence / 'root.stderr.raw').open('xb') as err: + signal.signal(signal.SIGALRM, deadline_handler) + signal.setitimer(signal.ITIMER_REAL, max(0.000001, deadline - time.monotonic())) + try: + spawn_entered = True + process = subprocess.Popen(command, cwd=root, env=dict(ENV), stdout=out, + stderr=err, start_new_session=True, preexec_fn=child_limit) + # Popen leaves an exited root waitable; capture its generation BEFORE poll. + captured = proc(process.pid) + need(captured is not None and captured['pgid'] == captured['sid'] == process.pid, + 'New root process/session identity missing') + domain.root = generation(captured) + domain.add(captured) + write_new(evidence / 'ROOT-PROCESS.json', captured) + while True: + _, current = domain.observe() + peak = max(peak, sum(row['rss_bytes'] for row in current)) + need(peak <= rss_bytes, 'Owned process RSS sum exceeded') + need(max((evidence / name).stat().st_size for name in + ('root.stdout.raw', 'root.stderr.raw')) <= LOG_CAP, 'Outer raw log cap exceeded') + if process.poll() is not None: + break + time.sleep(0.01) + finally: + signal.setitimer(signal.ITIMER_REAL, 0) + signal.signal(signal.SIGALRM, old_handler) + except BaseException as error: + failure = {'type': type(error).__name__, 'message': str(error)[:2048]} + finally: + signal.setitimer(signal.ITIMER_REAL, 0) + signal.signal(signal.SIGALRM, old_handler) + # This is also required when Popen raised before returning an object. + try: + cleanup = domain.cleanup(process) + except BaseException as cleanup_error: + cleanup = {'complete': False, 'group_empty_proved': False, + 'owned_generations': list(domain.rows.values()), + 'groups': [{'pgid': g, 'sid': sid} for g, sid in sorted(domain.groups)], + 'reaped_adopted': domain.reaped, 'observed_after_root_exit': [], + 'remaining': 'UNKNOWN_AFTER_CLEANUP_ERROR', + 'error': {'type': type(cleanup_error).__name__, 'message': str(cleanup_error)[:2048]}} + for fd in domain.fds.values(): + os.close(fd) + domain.fds.clear() + if not cleanup['complete']: + failure = failure or {'type': 'CleanupIncomplete', 'message': 'Owned descendants/group remain after bounded cleanup tail'} + if time.monotonic() > shared_deadline: + failure = failure or {'type': 'SharedDeadline', 'message': 'Shared cap crossed; necessary cleanup charged'} + reconciled = reconcile_missing_receipt(root, case['label'], began, + failure or {'type': 'MissingRootReceipt', 'message': 'Root exited without receipt'}, cleanup) + if reconciled is not None: + failure = failure or {'type': 'MissingRootReceipt', 'message': 'New reconciled STOP receipt; no retry'} + logs = {} + for name in ('root.stdout.raw', 'root.stderr.raw'): + try: + logs[name] = stable_file(evidence / name, LOG_CAP) + except BaseException as error: + failure = failure or {'type': type(error).__name__, 'message': str(error)[:2048]} + logs[name] = {'path': str(evidence / name), 'complete_hash': None, 'stable': False} + result = {'schema': 'h25-parent-root-supervision-v1', 'label': case['label'], + 'status': 'STOP' if failure else 'ROOT_COMPLETED_AND_OWNED_DOMAIN_EMPTY', + 'failure': failure, 'spawn_entered': spawn_entered, + 'spawn_returned': process is not None, 'captured_root': captured, + 'returncode': None if process is None else process.returncode, + 'cleanup': cleanup, 'outer_logs': logs, 'sampled_owned_rss_bytes': peak, + 'execution_and_cleanup_seconds': time.monotonic() - began, + 'root_receipt_reconciled': reconciled is not None, + 'no_hostile_fork_or_concurrent_children_claim': True} + write_new(evidence / 'SUPERVISION.json', result) + return result + + +def stop_supplement(root, label, reason): + folder = root / 'runtime/runs' / (label + '-supervision-stop') + folder.mkdir() + row = {'status': 'STOP', 'label': folder.name, 'kind': 'supervision_failure_marker', + 'failure': reason, 'wall_seconds': 0.0, 'runner_wall_seconds': 0.0, + 'cost_accounted_by_enclosing_queue_overhead': True, 'original_receipts_preserved': True} + write_new(folder / 'START.json', {'kind': row['kind']}) + write_new(folder / 'receipt.json', row) + + +def packet_unchanged(directory, manifest): + for name, expected in manifest['files'].items(): + row = stable_file(directory / name, META_CAP) + need(row['sha256'] == expected['sha256'] and row['bytes'] == expected['bytes'], + 'Parent source packet changed: ' + name) + need(not (directory / name).stat().st_mode & 0o222, 'Parent source packet became writable') + return True diff --git a/research/h25-v03-prefix-supervision/unit05/implementation/parent_closure_v1.py b/research/h25-v03-prefix-supervision/unit05/implementation/parent_closure_v1.py new file mode 100644 index 0000000000..cd9b3758ac --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/implementation/parent_closure_v1.py @@ -0,0 +1,271 @@ +"""Finite concrete receiver admission inside the original trusted parent. + +This verifies pinned source, bytecode derived from those bytes without executing +them, concrete local import edges, and the current captured object graph. It is +not a new Python sandbox or proof of the initial OS/interpreter/native memory. +The original parent must load these exact modules through its admitted bootstrap +before adverse input. No user supplied arbitrary checker is accepted. +""" +import ast +import builtins +import __future__ +import copy +import dataclasses +import fcntl +import gc +import hashlib +import json +import marshal +import math +import os +import pathlib +import posix +import resource +import signal +import struct +import subprocess +import sys +import time +import types +import epoch_schema_v5 as schema +import epoch_copy_v5 as copying + +_TYPE, _LEN, _COMPILE = type, len, compile +_MODULE_DICT = types.ModuleType.__dict__['__dict__'].__get__ +_FUNCTION_GETTERS = tuple(types.FunctionType.__dict__[name].__get__ for name in + ('__code__', '__globals__', '__builtins__', '__defaults__', '__kwdefaults__', '__closure__', '__dict__')) +_CELL_GET = types.CellType.__dict__['cell_contents'].__get__ +_CLASS_DICT = type.__dict__['__dict__'].__get__ +_STATIC_FUNCTION = staticmethod.__dict__['__func__'].__get__ +_CLASS_FUNCTION = classmethod.__dict__['__func__'].__get__ +_SOURCE_RECEIVERS = [] +_STDLIB_MODULES = {name: module for name, module in tuple(sys.modules.items()) + if _TYPE(name) is str and _TYPE(module) is types.ModuleType} +MAX_MODULES = 48 +MAX_GLOBALS = 512 + +# These exact registries are intentionally mutated only by their original +# source. Their object identities are still checked. Private-state sabotage +# by code already running in this trusted parent remains outside the boundary. +_MUTABLE_NAMES = { + 'v03_prefix_supervisor_v1': ('_PREFIX', '_UNKNOWN_OWNER'), + 'epoch_parent_v5': ('_RESERVED_EPOCHS', '_PARENT_OWNERS'), + 'epoch_schema_v5': ('_ERROR_OWNERS',), + 'epoch_stop_v5': ('_SINK_REGISTRY',), + 'parent_domain_v1': ('_DOMAINS',), + 'parent_completion_v1': ('_PARENTS', '_PROCESS'), + 'parent_closure_v1': ('_SOURCE_RECEIVERS',), +} +_GATE_SUFFIXES = ('CONFIGURATION', 'SOURCE_REVIEW', 'EXECUTION_APPROVAL', 'FUNDING', + 'STAGE_APPROVAL', 'COMMAND_APPROVAL', 'VALIDATION_EXECUTION') + + +def _namespace(module): + schema.need(_TYPE(module) is types.ModuleType, 'exact original module required') + namespace = _MODULE_DICT(module, types.ModuleType) + schema.need(_TYPE(namespace) is dict and _LEN(namespace) <= MAX_GLOBALS, + 'original module namespace bound differs') + for key in namespace: + schema.text(key, 256) + return namespace + + +def _function_record(function): + schema.need(_TYPE(function) is types.FunctionType, 'exact source function required') + values = tuple(getter(function, types.FunctionType) for getter in _FUNCTION_GETTERS) + closure = values[5] + cells = () if closure is None else tuple((cell, _CELL_GET(cell, types.CellType)) for cell in closure) + schema.need(_LEN(cells) <= 64, 'source function closure bound exceeded') + return function, values, cells + + +def _function_check(record): + function, values, cells = record + schema.need(_TYPE(function) is types.FunctionType, 'source function identity changed') + for getter, expected in zip(_FUNCTION_GETTERS, values): + schema.need(getter(function, types.FunctionType) is expected, + 'source function code/globals/builtins/defaults/closure/dict changed') + for cell, expected in cells: + schema.need(_CELL_GET(cell, types.CellType) is expected, 'source function closure contents changed') + + +def _codes(code, result): + result.setdefault(code.co_qualname, []).append(code) + for child in code.co_consts: + if _TYPE(child) is types.CodeType: + _codes(child, result) + + +def _data(value, depth=0): + """Snapshot literal data only; no foreign repr/hash/eq/iteration protocols.""" + schema.need(depth <= 32, 'literal snapshot depth exceeded') + kind = _TYPE(value) + if value is None or kind in (str, int, bool, bytes, float): + return (kind, value) + if kind in (list, tuple): + schema.need(_LEN(value) <= 65536, 'literal sequence bound exceeded') + return (kind, tuple(_data(item, depth + 1) for item in value)) + if kind is dict: + schema.need(_LEN(value) <= 8192, 'literal mapping bound exceeded') + for key in value: + schema.need(_TYPE(key) in (str, int), 'nonliteral mapping key') + return (kind, tuple((_data(key, depth + 1), _data(item, depth + 1)) + for key, item in value.items())) + if kind in (set, frozenset): + schema.need(_LEN(value) <= 8192 and all(_TYPE(item) in (str, int) for item in value), + 'nonliteral set value') + return (kind, frozenset(value)) + raise schema.EpochStop('not literal data') + + +def _validate_code(function, compiled_codes, namespace): + values = tuple(getter(function, types.FunctionType) for getter in _FUNCTION_GETTERS) + code = values[0] + schema.need(values[1] is namespace and values[2] is builtins.__dict__, + 'source function original namespace/builtins differs') + candidates = compiled_codes.get(code.co_qualname, ()) + encoded = marshal.dumps(code) + schema.need(any(marshal.dumps(expected) == encoded for expected in candidates), + 'receiving function bytecode differs from pinned source') + + +def bind_receivers(modules, source_policy, error_owner): + """Only the source-fixed original parent calls this before child launch. + + source_policy is a separately pinned, prelaunch source inventory, never a + report supplied by a child. The two producer-specific validators have fixed + names; unsupported or absent variant source cannot be substituted by a + callable argument. Every received module must be listed in the policy. + """ + schema.owner_state(error_owner) + schema.need(_TYPE(modules) is dict and 1 <= _LEN(modules) <= MAX_MODULES and + _TYPE(source_policy) is dict, 'finite receiver module map required') + for name in modules: + schema.text(name, 128) + for name in source_policy: + schema.text(name, 128) + schema.need(set(modules) == set(source_policy), 'exact receiver closure differs') + records = [] + for name in sorted(modules): + module = modules[name] + namespace = _namespace(module) + pin = source_policy[name] + schema.blob(pin) + raw = copying.read_verified(pin, schema.FILE_BYTES, error_owner=error_owner) + schema.need(namespace.get('__name__') == name and namespace.get('__file__') == pin['path'], + 'original receiving module origin differs') + tree = ast.parse(raw, filename=pin['path']) + compiled = _COMPILE(raw, pin['path'], 'exec', dont_inherit=True, optimize=sys.flags.optimize) + compiled_codes = {} + _codes(compiled, compiled_codes) + functions, classes, literals, imports = [], [], [], [] + for node in tree.body: + if _TYPE(node) is ast.FunctionDef: + function = namespace[node.name] + _validate_code(function, compiled_codes, namespace) + functions.append(_function_record(function)) + elif _TYPE(node) is ast.ClassDef: + cls = namespace[node.name] + schema.need(_TYPE(cls) is type, 'source class type differs') + class_namespace = _CLASS_DICT(cls, type) + for item in node.body: + if _TYPE(item) is ast.FunctionDef: + method = class_namespace[item.name] + # The currently selected explicit methods have no + # property/classmethod/staticmethod decorators. + schema.need(not item.decorator_list, 'unreviewed decorated receiver method') + # Python implicitly wraps __new__ and two class hooks. + # No arbitrary descriptor protocol is invoked. + if item.name == '__new__' and _TYPE(method) is staticmethod: + method = _STATIC_FUNCTION(method, staticmethod) + elif item.name in ('__init_subclass__', '__class_getitem__') and _TYPE(method) is classmethod: + method = _CLASS_FUNCTION(method, classmethod) + _validate_code(method, compiled_codes, namespace) + functions.append(_function_record(method)) + # Dataclass-generated methods are part of the inherited + # dataclasses/initial-parent trust, not compiled from this + # class body. Their actual original code/environment remains + # captured and checked; they cannot be changed after capture. + for method in class_namespace.values(): + if _TYPE(method) is types.FunctionType and not any(method is r[0] for r in functions): + functions.append(_function_record(method)) + classes.append((cls, tuple(class_namespace.items()))) + elif _TYPE(node) in (ast.Import, ast.ImportFrom): + for alias in node.names: + schema.need(alias.name != '*', 'star receiver import unsupported') + if _TYPE(node) is ast.Import: + source_name = alias.name + local_name = alias.asname or source_name.split('.')[0] + expected = modules.get(source_name, _STDLIB_MODULES.get(source_name)) + else: + source_name = node.module + schema.need(node.level == 0, 'relative receiver import unsupported') + local_name = alias.asname or alias.name + source_module = modules.get(source_name, _STDLIB_MODULES.get(source_name)) + schema.need(source_module is not None, 'receiver import dependency absent') + expected = _namespace(source_module).get(alias.name) + schema.need(expected is not None and namespace.get(local_name) is expected, + 'concrete receiving import identity differs') + imports.append((local_name, expected)) + elif _TYPE(node) is ast.Assign: + if _LEN(node.targets) != 1 or _TYPE(node.targets[0]) is not ast.Name: + continue + key = node.targets[0].id + if key in _MUTABLE_NAMES.get(name, ()) or key.endswith(_GATE_SUFFIXES): + continue + try: + literal = ast.literal_eval(node.value) + except (ValueError, TypeError, SyntaxError): + continue + schema.need(_data(namespace[key]) == _data(literal), 'receiver literal differs from source') + literals.append((key, _data(literal))) + for function in namespace.values(): + if _TYPE(function) is types.FunctionType and not any(function is r[0] for r in functions): + functions.append(_function_record(function)) + records.append((name, module, namespace, pin, tuple(namespace.items()), + tuple(functions), tuple(classes), tuple(literals), tuple(imports))) + capability = object() + packet = (capability, tuple(records), error_owner) + schema.need(_LEN(_SOURCE_RECEIVERS) < 2, 'receiver closure finite parent bound exceeded') + _SOURCE_RECEIVERS.append(packet) + check_receivers(capability) + return capability + + +def _packet(capability): + schema.need(_TYPE(capability) is object, 'exact receiver capability required') + for packet in _SOURCE_RECEIVERS: + if packet[0] is capability: + return packet + raise schema.EpochStop('unknown original receiver closure') + + +def check_receivers(capability): + packet = _packet(capability) + for name, module, namespace, pin, original_items, functions, classes, literals, imports in packet[1]: + schema.need(_namespace(module) is namespace and _LEN(namespace) == _LEN(original_items), + 'receiver namespace identity/census changed') + for key, expected in original_items: + schema.need(namespace.get(key) is expected, 'receiver namespace binding changed') + for record in functions: + _function_check(record) + for cls, items in classes: + current = _CLASS_DICT(cls, type) + schema.need(_LEN(current) == _LEN(items), 'receiver class census changed') + for key, expected in items: + schema.need(current.get(key) is expected, 'receiver class binding changed') + for key, expected in literals: + schema.need(_data(namespace[key]) == expected, 'receiver literal data changed') + copying.verify(pin, error_owner=packet[2]) + return None + + +def receiver(capability, module_name, name): + """Return only a specifically named original from the registered closure.""" + schema.text(module_name, 128) + schema.text(name, 128) + for row in _packet(capability)[1]: + if row[0] == module_name: + schema.need(name in row[2], 'fixed receiving entry missing') + return row[2][name] + raise schema.EpochStop('fixed receiving module missing') diff --git a/research/h25-v03-prefix-supervision/unit05/implementation/parent_completion_v1.py b/research/h25-v03-prefix-supervision/unit05/implementation/parent_completion_v1.py new file mode 100644 index 0000000000..3191be7570 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/implementation/parent_completion_v1.py @@ -0,0 +1,880 @@ +"""Source-only two-producer completion owner for one future guarded parent. + +No configuration or execution gate is installed. The original trusted parent +must authenticate this source, its exact receiver closure and initial OS/runtime +before importing it. Capabilities are process local. This component never +invokes run_guarded, a queue wrapper, a global ledger writer, or a child report +as authority. The enclosing single orchestrator pays this entire component +once, including all child, validation, retention, failure and final-exit costs. +""" +import fcntl +import os +import resource +import signal +import stat +import subprocess +import sys +import time +import epoch_schema_v5 as schema +import epoch_copy_v5 as copying +import epoch_parent_v5 as epoch +import parent_closure_v1 as closure +import parent_domain_v1 as domain +import group01_evidence_v1 as group01 + +CONFIGURATION = None +SOURCE_REVIEW = None +STAGE_APPROVAL = None +COMMAND_APPROVAL = None +FUNDING = None +EXECUTION_APPROVAL = None + +FLAGS = ('-S', '-s', '-P', '-B') +ENV = {'PATH': '/usr/bin:/bin', 'PYTHONHASHSEED': '0', 'LANG': 'C.UTF-8', + 'LC_ALL': 'C.UTF-8', 'TZ': 'UTC', 'PYTHONDONTWRITEBYTECODE': '1'} +_TYPE, _LEN = type, len +_OPEN, _CLOSE, _MKDIR, _STAT, _SCANDIR = os.open, os.close, os.mkdir, os.stat, os.scandir +_POPEN = subprocess.Popen +_CLOCK, _SLEEP = time.monotonic, time.sleep +_SETRLIMIT, _GETRLIMIT = resource.setrlimit, resource.getrlimit +_SETTIMER, _GETTIMER = signal.setitimer, signal.getitimer +_SIGNAL, _GETSIGNAL = signal.signal, signal.getsignal +_PARENTS = [] +_PROCESS = [None] +# Shared before the first constructor read, including failures before a parent +# capability can be published. No mode can replace or reset this owner. +_UNKNOWN_OWNER = {'quarantine': [False], 'pending': [False], + 'iterator_uncertain': [False], 'primary': [None], + 'native_errors': [None] * 4} +_EPOCH_ENTRY = epoch._entry_state +_EPOCH_RESERVE = epoch.ParentEpoch.reserve_producer +_EPOCH_ACCEPT = epoch.ParentEpoch.accept_completed_producer +_EPOCH_COMPLETION = epoch.ParentCompletion +_EPOCH_COMMIT = epoch.ParentEpoch.commit_exports +_EPOCH_CLOSE = epoch.ParentEpoch.close +MAX_SOURCE_FILES = 8192 +MAX_STAGE_ENTRIES = 16384 +MAX_RAW_VARIANT_FILES = 64 +VARIANT_MODULE = 'variant_validation_v1' +VARIANT_FUNCTION = 'validate_variant_producer' +MAX_VARIANT_RAW_BYTES = 32 * 1024 * 1024 +# Source-literal inventory copied from the separately pinned concrete interface. +VARIANT_FILES = ('initial-tcb.raw.json', 'initial-controls.raw.json', 'initial-restoration.raw.json', 'root-before.raw.json', 'preflight-before.raw.json', 'custody-before.raw.json', 'pyinit_failure/control.attempt.json', 'pyinit_failure/control.attempt.jsonl', 'pyinit_failure/control.stdout.raw', 'pyinit_failure/control.stderr.raw', 'pyinit_failure/helper-return.raw.json', 'pyinit_failure/build.json', 'pyinit_failure/_h25_dict_probe.cpython-312-x86_64-linux-gnu.so', 'pyinit_failure/elf.raw.json', 'exec_failure/control.attempt.json', 'exec_failure/control.attempt.jsonl', 'exec_failure/control.stdout.raw', 'exec_failure/control.stderr.raw', 'exec_failure/helper-return.raw.json', 'exec_failure/build.json', 'exec_failure/_h25_dict_probe.cpython-312-x86_64-linux-gnu.so', 'exec_failure/elf.raw.json', 'preflight-after.raw.json', 'custody-after.raw.json', 'root-after.raw.json', 'receipt.json') +VARIANT_GROUPS = ('initial-tcb.raw.json', 'initial-controls.raw.json', 'initial-restoration.raw.json', 'root-before.raw.json', 'preflight-before.raw.json', 'custody-before.raw.json', 'pyinit_failure/helper-return.raw.json', 'pyinit_failure/elf.raw.json', 'exec_failure/helper-return.raw.json', 'exec_failure/elf.raw.json', 'preflight-after.raw.json', 'custody-after.raw.json', 'root-after.raw.json') +REQUIRED_MODULES = ( + 'epoch_schema_v5', 'epoch_copy_v5', 'epoch_parent_v5', 'epoch_stop_v5', + 'original_build_provenance_v5', 'h25_parent_supervisor', 'parent_closure_v1', + 'parent_domain_v1', 'parent_completion_v1', 'group01_evidence_v1', + 'group01_original_predicates_v1', 'receipt_contract_v1', 'native_field_controls_v1', + 'transport_controls_v1', 'collector_controls_v1', 'elf_literal_fixture_v1', + 'elf_controls_v1', 'provider_controls_v1', 'run_pure_controls_v1', + 'elf_literal_fixture_v2', 'elf_extended_controls_v2', 'run_pure_controls_v2', + 'restoration_contract_v1', 'loader_model_controls_v1', 'driver_model_body_sources_v3', + 'root_model_body_sources_v3', 'loader_model_controls_v3', 'group_evidence_v5', + 'close_model_controls_v5', 'projection_model_controls_v5', 'run_controls_v5', + 'variant_validation_v1', 'sealed_elf_profile_v2') + + +class ParentDeadline(RuntimeError): + pass + + +def _alarm(signum, frame): + raise ParentDeadline('owned producer deadline including Popen/preexec') + + +def _gate(): + schema.exact(CONFIGURATION, ('plans', 'receiver_policy', 'checker_source')) + schema.exact(CONFIGURATION['plans'], ('normal', 'optimized')) + for pin in tuple(CONFIGURATION['plans'].values()) + (CONFIGURATION['receiver_policy'], CONFIGURATION['checker_source']): + schema.blob(pin, schema.RECORD_BYTES) + for record, key in ((SOURCE_REVIEW, 'review_sha256'), (STAGE_APPROVAL, 'stage_review_sha256'), + (COMMAND_APPROVAL, 'command_review_sha256'), (FUNDING, 'reservation_sha256'), + (EXECUTION_APPROVAL, 'external_launch_policy_sha256')): + schema.exact(record, (key,)) + schema.digest(record[key]) + + +def _state(capability): + schema.need(_TYPE(capability) is object, 'exact parent capability required') + for token, state in _PARENTS: + if token is capability: + return state + raise schema.EpochStop('unregistered parent completion owner') + + +def _receiver_gate_values(receivers): + # Fail before any producer if the concrete downstream parsers are still + # source-only. These stronger parent envelopes are installed by the + # independently authenticated original bootstrap; hashes alone grant none. + specifications = ( + ('original_build_provenance_v5', 'PARSER_CONFIGURATION', + ('leaf_policy_sha256', 'configuration_sha256', 'original_helper_sha256')), + ('original_build_provenance_v5', 'PARSER_EXECUTION_APPROVAL', ('external_launch_policy_sha256',)), + ('original_build_provenance_v5', 'PARSER_FUNDING', ('reservation_sha256',)), + ('variant_validation_v1', 'VALIDATION_CONFIGURATION', ('leaf_policy_sha256', 'configuration_sha256')), + ('variant_validation_v1', 'VALIDATION_SOURCE_REVIEW', ('review_sha256',)), + ('variant_validation_v1', 'VALIDATION_EXECUTION', ('external_launch_policy_sha256',)), + ('variant_validation_v1', 'VALIDATION_FUNDING', ('reservation_sha256',))) + result = {} + for module, name, keys in specifications: + value = closure.receiver(receivers, module, name) + schema.exact(value, keys) + for item in value.values(): + schema.digest(item) + result[module + '.' + name] = schema.plain_copy(value) + schema.need(result['original_build_provenance_v5.PARSER_CONFIGURATION']['original_helper_sha256'] == + 'aa0a315110e031e19291970c9611fe5e0f91465fa20eaec51e81186099563f78', + 'original helper source protocol differs before producer launch') + return result + + +def _guard(state): + _gate() + schema.need(state['phase'] not in ('STOP', 'CLOSED'), 'parent completion owner is terminal') + domain.refresh_unknown_owner(state['unknown_owner']) + schema.need(state['io_quarantine'][0] is False and state['unknown_owner']['pending'][0] is False and + state['unknown_owner']['iterator_uncertain'][0] is False and + state['unknown_owner']['primary'][0] is None, + 'parent I/O ownership requires kernel teardown') + schema.need(os.getpid() == state['pid'], 'parent capability cannot cross exec/process') + schema.need(_POPEN is subprocess.Popen and _OPEN is os.open and _CLOSE is os.close and + _SETRLIMIT is resource.setrlimit and _GETRLIMIT is resource.getrlimit and + _CLOCK is time.monotonic and _SETTIMER is signal.setitimer and + _GETTIMER is signal.getitimer and _SIGNAL is signal.signal and + _GETSIGNAL is signal.getsignal, + 'original parent runtime primitive binding changed') + schema.need(epoch._entry_state is _EPOCH_ENTRY and epoch.ParentEpoch.reserve_producer is _EPOCH_RESERVE and + epoch.ParentEpoch.accept_completed_producer is _EPOCH_ACCEPT and + epoch.ParentCompletion is _EPOCH_COMPLETION and epoch.ParentEpoch.commit_exports is _EPOCH_COMMIT and + epoch.ParentEpoch.close is _EPOCH_CLOSE, 'original epoch receiving entry changed') + closure.check_receivers(state['receivers']) + schema.need(_receiver_gate_values(state['receivers']) == state['receiver_gate_snapshot'], + 'independently installed receiver gates changed') + for key in ('plan', 'receiver_policy', 'checker_source'): + current = CONFIGURATION['plans'][state['plan']['mode']] if key == 'plan' else CONFIGURATION[key] + schema.need(current == state['configuration'][key], 'configured source binding changed') + copying.verify(state['configuration'][key], error_owner=state['errors']) + schema.need(_CLOCK() <= state['shared_deadline'], 'complete parent reservation deadline exceeded') + + +def _stop(state, operation, primary): + # No formatting or instance dispatch on an exception. Capture failure is + # separate, never a reason to replace the already delivered primary. + state['phase'] = 'STOP' + # The shared slot was stored inline at the first delivered local/domain + # failure, before any optional retention helper or cleanup call. + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = primary + elif state['unknown_owner']['primary'][0] is not primary: + if state['fallback'][4] is None: + state['fallback'][4] = primary + primary = state['unknown_owner']['primary'][0] + if state['stop'][0] is None: + state['stop'][0] = primary + state['stop'][1] = operation + try: + domain.refresh_unknown_owner(state['unknown_owner']) + except BaseException as error: + # Failure even to inspect retained ownership cannot permit a writer. + state['io_quarantine'][0] = True + if state['fallback'][5] is None: + state['fallback'][5] = error + try: + schema.retain_primary(state['errors'], primary, operation) + except BaseException as error: + state['fallback'][0] = error + # An uncertain native acquisition prevents further diagnostic I/O. The + # outer guard must retain memory state and observe kernel parent teardown. + if (state['directory_created'] and not state['stop_write_attempted'] and not state['io_quarantine'][0] and + not state['unknown_owner']['pending'][0] and not state['unknown_owner']['iterator_uncertain'][0] and + not (_PROCESS[0] is not None and _PROCESS[0]['acquisition_in_flight'])): + try: + state['stop_write_attempted'] = True + record = {'schema': 'h25-parent-completion-stop-v1', 'operation': operation, + 'epoch_id': state['plan']['epoch_id'], 'mode': state['plan']['mode'], + 'status': 'STOP', 'retry_or_restore_allowed': False, + 'error': schema.error_snapshot(state['errors']), + 'domain_obligations_may_be_incomplete': True, + 'enclosing_guard_must_observe_parent_exit': True} + state['stop_file'] = copying.write_once(state['plan']['session_directory'] + '/STOP.json', + schema.canonical(record), error_owner=state['errors']) + except BaseException as error: + state['fallback'][1] = error + + +def _snapshot_sources(plan, error_owner): + schema.need(_TYPE(plan['source_files']) is list and 1 <= _LEN(plan['source_files']) <= MAX_SOURCE_FILES, + 'complete prelaunch source inventory bound differs') + rows, paths, categories = [], set(), set() + for expected in plan['source_files']: + schema.exact(expected, ('category', 'path', 'sha256', 'bytes', 'mode')) + schema.choice(expected['category'], ('parent', 'root', 'provider', 'driver', 'project', + 'system_headers', 'compiler_link', 'oracle', 'stage')) + schema.path(expected['path']) + schema.digest(expected['sha256']) + schema.integer(expected['bytes'], 1, schema.FILE_BYTES) + schema.integer(expected['mode'], 0, 0o7777) + schema.need(expected['path'] not in paths, 'duplicate prelaunch source path') + paths.add(expected['path']) + categories.add(expected['category']) + actual = copying.inspect(expected['path'], schema.FILE_BYTES, error_owner=error_owner) + schema.need(actual['sha256'] == expected['sha256'] and actual['bytes'] == expected['bytes'] and + actual['identity']['mode'] & 0o7777 == expected['mode'], 'source/profile/closure changed') + rows.append(actual) + schema.need(categories == {'parent', 'root', 'provider', 'driver', 'project', 'system_headers', + 'compiler_link', 'oracle', 'stage'}, 'a mandatory source category is absent') + return rows + + +def _tree(root, state): + """Bounded exact stage census; all actual file contents are separately read.""" + schema.path(root) + pending, files, directories = [('', root)], [], [] + count = 0 + while pending: + schema.need(state['io_quarantine'][0] is False and state['unknown_owner']['pending'][0] is False and + state['unknown_owner']['iterator_uncertain'][0] is False, + 'stage census cannot acquire after uncertain ownership') + relative, current = pending.pop() + before = _STAT(current, follow_symlinks=False) + schema.need(stat.S_ISDIR(before.st_mode) and not before.st_mode & 0o222, + 'immutable stage directory kind/mode differs') + entries, primary = None, None + state['unknown_owner']['pending'][0] = True + try: + entries = _SCANDIR(current) + state['unknown_owner']['pending'][0] = False + for entry in entries: + count += 1 + schema.need(count <= MAX_STAGE_ENTRIES, 'stage census bound exceeded') + name = entry.name + schema.need(_TYPE(name) is str and name not in ('.', '..') and '/' not in name, + 'stage entry name differs') + child = name if not relative else relative + '/' + name + info = entry.stat(follow_symlinks=False) + if stat.S_ISREG(info.st_mode): + files.append(child) + elif stat.S_ISDIR(info.st_mode): + directories.append(child) + pending.append((child, current + '/' + name)) + else: + raise schema.EpochStop('stage has symlink or special file') + except BaseException as error: + primary = error + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['io_quarantine'][0] = True + state['unknown_owner']['iterator_uncertain'][0] = True + state['fallback'][2] = error + raise + finally: + if entries is not None: + owned = entries + entries = None + try: + owned.close() + except BaseException as error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['io_quarantine'][0] = True + state['unknown_owner']['iterator_uncertain'][0] = True + state['fallback'][3] = error + if primary is None: + raise + after = _STAT(current, follow_symlinks=False) + schema.need((before.st_dev, before.st_ino, before.st_mode, before.st_mtime_ns, before.st_ctime_ns) == + (after.st_dev, after.st_ino, after.st_mode, after.st_mtime_ns, after.st_ctime_ns), + 'stage directory changed during census') + return sorted(files), sorted(directories) + + +def _stage(plan, error_owner, state): + copying.verify(plan['stage_manifest'], error_owner=error_owner) + raw = copying.read_verified(plan['stage_manifest'], schema.RECORD_BYTES, error_owner=error_owner) + declared = group01.decode(raw) + schema.need(_TYPE(declared.get('files')) is dict and + plan['stage_manifest']['path'] == plan['stage_directory'] + '/STAGE.json', + 'independent stage manifest origin differs') + files, directories = _tree(plan['stage_directory'], state) + schema.need(files == sorted(list(declared['files']) + ['STAGE.json']) and + directories == plan['stage_directories'], 'complete immutable stage census differs') + source_by_path = {row['path']: row for row in plan['source_files']} + for relative, expected in declared['files'].items(): + schema.need(_TYPE(relative) is str and not relative.startswith('/') and + all(part not in ('', '.', '..') for part in relative.split('/')), + 'stage relative path differs') + path = plan['stage_directory'] + '/' + relative + schema.need(path in source_by_path and expected == + {'sha256': source_by_path[path]['sha256'], 'mode': source_by_path[path]['mode']}, + 'stage file absent from independently fixed current source closure') + return {'manifest': plan['stage_manifest'], 'file_count': len(files), 'directories': directories} + + +def _validate_plan(plan): + schema.exact(plan, ('schema', 'epoch_id', 'mode', 'round_root', 'session_directory', + 'session_seconds', 'source_closure_admission_sha256', 'source_files', 'producers')) + schema.need(plan['schema'] == 'h25-parent-completion-plan-v1', 'parent plan schema differs') + schema.label(plan['epoch_id']) + schema.choice(plan['mode'], ('normal', 'optimized')) + schema.path(plan['round_root']) + schema.path(plan['session_directory']) + schema.integer(plan['session_seconds'], 1, 600) + schema.digest(plan['source_closure_admission_sha256']) + schema.exact(plan['producers'], ('group01', 'failure_variants')) + for role in schema.PRODUCERS: + row = plan['producers'][role] + schema.exact(row, ('epoch_plan', 'command', 'cwd', 'output', 'evidence_directory', + 'stage_directory', 'stage_manifest', 'stage_directories', 'launch_binding', 'launch_nonce', + 'root_seconds', 'address_space_bytes', 'rss_bytes', 'evidence_plan', 'launch_artifacts')) + epoch._plan(row['epoch_plan'], role) + schema.launch(row['launch_binding']) + schema.text(row['launch_nonce'], 64) + schema.need(_LEN(row['launch_nonce']) == 64 and + all(c in '0123456789abcdef' for c in row['launch_nonce']), 'one-use launch nonce differs') + for key in ('cwd', 'output', 'evidence_directory', 'stage_directory'): + schema.path(row[key]) + schema.blob(row['stage_manifest'], schema.RECORD_BYTES) + schema.need(row['stage_manifest']['sha256'] == row['epoch_plan']['stage_sha256'] == + row['launch_binding']['stage_sha256'], 'independent producer stage pins differ') + schema.need(row['launch_binding']['root_sha256'] == row['epoch_plan']['root_sha256'], + 'independent producer root pins differ') + schema.integer(row['root_seconds'], 1, 180) + schema.integer(row['address_space_bytes'], 1, 1024 ** 3) + schema.integer(row['rss_bytes'], 1, 1024 ** 3) + command = row['command'] + schema.need(_TYPE(command) is list and 6 <= _LEN(command) <= 128, 'bounded original root argv required') + for argument in command: + schema.text(argument, 8192) + schema.need(bool(argument), 'empty root argument') + prefix = ['/usr/bin/python3.12', *FLAGS] + (['-O'] if plan['mode'] == 'optimized' else []) + schema.need(command[:len(prefix)] == prefix, 'original root interpreter/flags/mode differs') + entry = command[len(prefix)] + schema.path(entry) + schema.need(entry.startswith(row['stage_directory'] + '/') and + entry == row['stage_directory'] + '/integration/full_driver.py', + 'source-fixed genuine root entry differs') + schema.need(command.count('--output') == 1 and + command[command.index('--output') + 1] == row['output'], 'independent root output differs') + args = command[len(prefix) + 1:] + schema.need(len(args) >= 11 and args[0] == '--root-sha256' and args[2] == '--provider' and + args[5] == '--driver' and args[8] == '--integration' and args[10] == '--', + 'original bootstrap argv positions differ') + by_path = {item['path']: item for item in plan['source_files']} + integration = row['stage_directory'] + '/integration' + schema.need(args[1] == row['epoch_plan']['root_sha256'] and args[9] == integration and + args[3].rsplit('/', 1)[0] == args[6].rsplit('/', 1)[0] == integration, + 'actual root/provider/driver source origins differ') + for path, digest, category in ((entry, args[1], 'root'), (args[3], args[4], 'provider'), + (args[6], args[7], 'driver')): + schema.need(path in by_path and by_path[path]['sha256'] == digest and + by_path[path]['category'] == category, 'bootstrap hash not in independent source closure') + schema.exact(row['launch_artifacts'], ('configuration_sha256', 'startup_tcb_sha256', 'expected_history_sha256')) + for key, pin in row['launch_artifacts'].items(): + schema.blob(pin, schema.RECORD_BYTES) + schema.need(pin['sha256'] == row['launch_binding'][key] and pin['path'] in by_path and + by_path[pin['path']]['sha256'] == pin['sha256'] and + by_path[pin['path']]['bytes'] == pin['bytes'], 'launch data binding lacks actual source pin') + evidence = row['evidence_plan'] + if role == 'group01': + schema.need(command.count('--finite-only') == 1 and command.count('--lanes') == 1 and + command[command.index('--lanes') + 1] == 'candidate', 'Group01 must use original finite candidate route') + schema.need(evidence['mode'] == plan['mode'] and evidence['generation'] == row['epoch_plan']['generation'] and + evidence['stage_sha256'] == row['epoch_plan']['stage_sha256'] and + evidence['root_sha256'] == args[1] and evidence['driver_sha256'] == args[7], + 'Group01 evidence expectation not bound to actual independent launch') + else: + schema.need(args[11:] == ['--output', row['output'], '--generation', row['epoch_plan']['generation'], + '--launch-nonce', row['launch_nonce']], 'variant exact tail argv differs') + schema.need(args[1] == 'f5a2d33f2b4d3651f214156a0e7094c2bb516ce2d5ab7698d18c11f98f35dee0' and + args[3] == integration + '/probe_binding_v3.py' and + args[4] == '9cbb7368f89e71d1e6cc46db5dc77efed3e03ed2a801c98c88fe316e4d9f3ef2' and + args[6] == integration + '/variant_driver_v1.py', 'variant genuine original bootstrap differs') + schema.need(evidence['binding'] == {'mode': plan['mode'], 'generation': row['epoch_plan']['generation'], + 'launch_nonce': row['launch_nonce']} and evidence['output'] == row['output'] and + evidence['stage_root'] == row['stage_directory'] and evidence['raw_file_names'] == list(VARIANT_FILES), + 'variant expectation not bound to actual independent launch') + schema.need(schema.sha(schema.canonical({'argv': command})) == row['epoch_plan']['command_sha256'] == + row['launch_binding']['command_sha256'], 'independent exact root command digest differs') + schema.need(row['evidence_directory'] == plan['session_directory'] + '/' + role and + row['output'] == row['evidence_directory'] + '/producer-output', + 'source-fixed private producer origins differ') + schema.need(plan['producers']['group01']['launch_nonce'] != plan['producers']['failure_variants']['launch_nonce'], + 'producer exec launch nonce reused') + + +def make_parent(original_epoch, original_authority, original_receivers): + _gate() + schema.need(_LEN(_PARENTS) < 2, 'finite two-mode parent owner bound exceeded') + # A second mode shares the same process and therefore the same unknown + # resources. Check before the first configuration read can acquire an FD. + for unused, prior in _PARENTS: + owner = prior['unknown_owner'] + domain.refresh_unknown_owner(owner) + schema.need(prior['phase'] != 'STOP' and owner['primary'][0] is None and + owner['quarantine'][0] is False and owner['pending'][0] is False and + owner['iterator_uncertain'][0] is False, + 'prior parent failure forbids a new mode or configuration read') + schema.need(_PROCESS[0] is None or _PROCESS[0]['acquisition_in_flight'] is False, + 'uncertain process-owned lock acquisition requires kernel teardown') + owner = _UNKNOWN_OWNER + domain.refresh_unknown_owner(owner) + schema.need(owner['primary'][0] is None and owner['quarantine'][0] is False and + owner['pending'][0] is False and owner['iterator_uncertain'][0] is False, + 'earlier constructor failure prohibits configuration reads') + try: + errors = schema.make_error_owner() + native_index = 2 * len(_PARENTS) + owner['native_errors'][native_index] = schema.owner_state(errors) + original_state = _EPOCH_ENTRY(original_epoch, original_authority) + owner['native_errors'][native_index + 1] = schema.owner_state(original_state['_error_owner']) + domain.refresh_unknown_owner(owner) + schema.need(owner['quarantine'][0] is False, 'original V5 owner already requires teardown') + mode = original_state['_mode'] + schema.choice(mode, ('normal', 'optimized')) + schema.need(not any(item[1]['plan']['mode'] == mode for item in _PARENTS), 'mode parent already consumed') + configuration = schema.plain_copy({'plan': CONFIGURATION['plans'][mode], + 'receiver_policy': CONFIGURATION['receiver_policy'], 'checker_source': CONFIGURATION['checker_source']}) + plan = group01.decode(copying.read_verified(configuration['plan'], schema.RECORD_BYTES, error_owner=errors)) + _validate_plan(plan) + policy = group01.decode(copying.read_verified(configuration['receiver_policy'], schema.RECORD_BYTES, error_owner=errors)) + schema.need(set(policy) == set(REQUIRED_MODULES), 'exact fixed parent/producer receiving closure differs') + schema.need(policy['parent_completion_v1'] == configuration['checker_source'], + 'actual completion source differs from configured checker') + receivers = closure.bind_receivers(original_receivers, policy, errors) + receiver_gate_snapshot = _receiver_gate_values(receivers) + schema.need(closure.receiver(receivers, 'epoch_parent_v5', 'ParentEpoch') is epoch.ParentEpoch and + closure.receiver(receivers, 'epoch_schema_v5', 'need') is schema.need and + closure.receiver(receivers, 'epoch_copy_v5', 'inspect') is copying.inspect, + 'parent/checker epoch module identities differ') + source_guard = closure.receiver(receivers, 'h25_parent_supervisor', 'launch_contract') + source_guard() + closure.check_receivers(receivers) + original_state = _EPOCH_ENTRY(original_epoch, original_authority) + schema.need(original_state['_epoch_id'] == plan['epoch_id'] and original_state['_mode'] == plan['mode'] and + original_state['_state'] == 'PRODUCERS_PENDING' and + original_state['_plans'] == {role: row['epoch_plan'] for role, row in plan['producers'].items()} and + epoch.CONFIGURATION['parent_checker_sha256'] == configuration['checker_source']['sha256'], + 'original constructor registry is not this prelaunch epoch/plan/checker') + token = object() + state = {'pid': os.getpid(), 'phase': 'CONSTRUCTING', 'epoch': original_epoch, + 'authority': original_authority, 'errors': errors, 'plan': plan, 'configuration': configuration, + 'receivers': receivers, 'receiver_gate_snapshot': receiver_gate_snapshot, + 'runs': {}, 'next': 0, 'directory_created': False, + 'stop': [None, None], 'fallback': [None] * 8, 'stop_file': None, + 'stop_write_attempted': False, 'io_quarantine': owner['quarantine'], + 'unknown_owner': owner, + 'began': _CLOCK(), 'shared_deadline': _CLOCK() + plan['session_seconds'], + 'subreaper': None, 'native_keeper': None, 'lock_fds': [None, None], + 'lock_attempted': [False, False], 'initial_sources': None} + _PARENTS.append((token, state)) + except BaseException as error: + # Reserve the original error before another call or native cleanup. + # This also covers failures before _PARENTS receives a capability. + if owner['primary'][0] is None: + owner['primary'][0] = error + owner['quarantine'][0] = True + raise + try: + # Exclusive creation is the persistent no-restore marker. It is never + # deleted by this source; a crashed/partial same-plan session cannot run. + _MKDIR(plan['session_directory'], 0o700) + state['directory_created'] = True + if _PROCESS[0] is None: + process_record = {'pid': state['pid'], 'locks': [None, None], 'keeper': None, + 'subreaper': None, 'acquisition_in_flight': False} + _PROCESS[0] = process_record + for index, name in enumerate(('parent-queue.lock', 'science.lock')): + process_record['acquisition_in_flight'] = True + process_record['locks'][index] = _OPEN(plan['round_root'] + '/runtime/' + name, + os.O_RDWR | os.O_CREAT | os.O_CLOEXEC | os.O_NOFOLLOW, 0o600) + process_record['acquisition_in_flight'] = False + fcntl.flock(process_record['locks'][index], fcntl.LOCK_EX | fcntl.LOCK_NB) + installer = closure.receiver(receivers, 'h25_parent_supervisor', 'install_subreaper') + # Original installer has a concrete pinned source/TCB/native closure. + # Its path interface is the original pathlib.Path contract. + from pathlib import Path + subreaper, keeper = installer(Path(plan['round_root'])) + process_record['subreaper'], process_record['keeper'] = subreaper, keeper + process_record = _PROCESS[0] + schema.need(process_record['pid'] == state['pid'] and process_record['keeper'] is not None, + 'original same-process subreaper ownership missing') + state['subreaper'], state['native_keeper'] = process_record['subreaper'], process_record['keeper'] + closure.check_receivers(receivers) + state['initial_sources'] = _snapshot_sources(plan, errors) + copying.verify(configuration['checker_source'], error_owner=errors) + copying.write_once(plan['session_directory'] + '/PARENT-INTENT.json', + schema.canonical({'schema': 'h25-parent-completion-intent-v1', 'epoch_id': plan['epoch_id'], + 'mode': plan['mode'], 'configuration': configuration, 'parent_pid': state['pid'], + 'source_closure_admission_sha256': plan['source_closure_admission_sha256'], + 'retry_or_restore_allowed': False, 'accounting': 'nested non-additive; paid by one outer orchestrator'}), + error_owner=errors) + state['phase'] = 'READY' + _guard(state) + return token + except BaseException as primary: + _stop(state, 'make_parent', primary) + raise + + +def _close_logs(run, primary): + first = None + for index in range(2): + descriptor = run['log_fds'][index] + if descriptor is None or run['log_close_attempted'][index]: + continue + run['log_close_attempted'][index] = True + try: + _CLOSE(descriptor) + run['log_close_confirmed'][index] = True + except BaseException as error: + if run['unknown_owner']['primary'][0] is None: + run['unknown_owner']['primary'][0] = primary if primary is not None else error + run['unknown_owner']['quarantine'][0] = True + run['errors'][index] = error + if first is None: + first = error + if primary is None and first is not None: + raise first + + +def run_producer(owner_capability, producer_role): + state = _state(owner_capability) + try: + _guard(state) + schema.choice(producer_role, schema.PRODUCERS) + schema.need(state['phase'] == 'READY' and state['next'] < 2 and + producer_role == schema.PRODUCERS[state['next']] and producer_role not in state['runs'], + 'producer order, replay or prior completion differs') + except BaseException as primary: + _stop(state, 'run_producer_entry', primary) + raise + row = state['plan']['producers'][producer_role] + # Burn the actual epoch ticket before any later preparation or launch. + try: + ticket = _EPOCH_RESERVE(state['epoch'], state['authority'], producer_role) + run_token = object() + run = {'token': run_token, 'ticket': ticket, 'role': producer_role, 'phase': 'RESERVED', + 'unknown_owner': state['unknown_owner'], + 'plan': row, 'domain': None, 'process': None, 'root': None, 'terminal': None, + 'log_fds': [None, None], 'log_close_attempted': [False, False], + 'log_close_confirmed': [False, False], 'errors': [None] * 8, + 'primary': [None], 'acquisition_in_flight': False, 'spawn_entered': False, + 'spawn_returned': False, 'source_before': None, 'stage_before': None, + 'began': _CLOCK(), 'peak_rss': 0, 'file_limits': tuple(_GETRLIMIT(resource.RLIMIT_FSIZE))} + state['runs'][producer_role] = run + state['phase'] = 'PRODUCER_IN_FLIGHT' + except BaseException as primary: + _stop(state, 'run_producer_reservation', primary) + raise + primary = None + old_handler = None + alarm_installed = False + try: + _guard(state) + _MKDIR(row['evidence_directory'], 0o700) + # output remains absent; the genuine original Root creates it exclusively. + try: + _STAT(row['output'], follow_symlinks=False) + except FileNotFoundError: + pass + else: + raise schema.EpochStop('producer output already exists') + local_plan = dict(state['plan'], **row) + run['source_before'] = _snapshot_sources(state['plan'], state['errors']) + run['stage_before'] = _stage(local_plan, state['errors'], state) + # Reject oversized complete-custody records BEFORE any child launch. + run['source_bytes_before'] = _source_custody_bytes(state, run['source_before'], run['stage_before']) + for pin in row['launch_artifacts'].values(): + copying.verify(pin, schema.RECORD_BYTES, error_owner=state['errors']) + run['domain'] = domain.create_domain(state['unknown_owner']) + launch = {'schema': 'h25-owned-producer-launch-v1', 'epoch_id': state['plan']['epoch_id'], + 'mode': state['plan']['mode'], 'role': producer_role, + 'generation': row['epoch_plan']['generation'], 'launch_nonce': row['launch_nonce'], + 'parent_pid': state['pid'], 'command': row['command'], 'environment': ENV, 'cwd': row['cwd'], + 'launch_binding': row['launch_binding'], 'parent_file_limits': list(run['file_limits']), + 'new_session': True, 'close_fds': True, 'pass_fds': [], + 'root_seconds': row['root_seconds'], 'rss_bytes': row['rss_bytes'], + 'address_space_bytes': row['address_space_bytes']} + run['launch'] = copying.write_once(row['evidence_directory'] + '/LAUNCH.json', + schema.canonical(launch), error_owner=state['errors']) + for index, name in enumerate(('stdout.raw', 'stderr.raw')): + schema.need(state['io_quarantine'][0] is False and state['unknown_owner']['pending'][0] is False and + state['unknown_owner']['iterator_uncertain'][0] is False, + 'raw stream cannot acquire after uncertain ownership') + run['acquisition_in_flight'] = True + state['unknown_owner']['pending'][0] = True + run['log_fds'][index] = _OPEN(row['evidence_directory'] + '/' + name, + os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_CLOEXEC | os.O_NOFOLLOW, 0o600) + run['acquisition_in_flight'] = False + state['unknown_owner']['pending'][0] = False + setter, kind, limits = _SETRLIMIT, resource.RLIMIT_AS, (row['address_space_bytes'], row['address_space_bytes']) + def child_limit(): + setter(kind, limits) + schema.need(_GETTIMER(signal.ITIMER_REAL) == (0.0, 0.0), 'existing parent timer cannot be replaced') + old_handler = _GETSIGNAL(signal.SIGALRM) + _SIGNAL(signal.SIGALRM, _alarm) + alarm_installed = True + deadline = min(run['began'] + row['root_seconds'], state['shared_deadline'] - domain.CLEANUP_SECONDS) + schema.need(_CLOCK() < deadline, 'no funded root/cleanup interval remains') + _SETTIMER(signal.ITIMER_REAL, max(0.000001, deadline - _CLOCK())) + run['spawn_entered'] = True + run['process'] = _POPEN(row['command'], cwd=row['cwd'], env=dict(ENV), + stdout=run['log_fds'][0], stderr=run['log_fds'][1], stdin=subprocess.DEVNULL, + close_fds=True, pass_fds=(), start_new_session=True, preexec_fn=child_limit) + run['spawn_returned'] = True + run['root'] = domain.adopt_popen(run['domain'], run['process']) + while True: + unused, current = domain.observe(run['domain']) + run['peak_rss'] = max(run['peak_rss'], sum(item[6] for item in current)) + schema.need(run['peak_rss'] <= row['rss_bytes'], 'owned process RSS sum exceeded') + schema.need(max(_STAT(row['evidence_directory'] + '/' + name, follow_symlinks=False).st_size + for name in ('stdout.raw', 'stderr.raw')) <= schema.LOG_BYTES, 'root output bound exceeded') + if domain.poll_owned(run['domain']) is not None: + break + _SLEEP(0.01) + except BaseException as error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + primary = state['unknown_owner']['primary'][0] + run['primary'][0] = primary + if primary is not error: + run['errors'][4] = error + if (run['acquisition_in_flight'] or state['unknown_owner']['pending'][0] or + state['unknown_owner']['iterator_uncertain'][0] or _TYPE(error) is MemoryError): + state['io_quarantine'][0] = True + raise primary + finally: + # Preserve the first locally delivered primary through all cleanup. + first_cleanup = None + if alarm_installed: + try: + _SETTIMER(signal.ITIMER_REAL, 0) + _SIGNAL(signal.SIGALRM, old_handler) + except BaseException as error: + run['errors'][2] = error + first_cleanup = error + if run['domain'] is not None: + try: + domain.finish_domain(run['domain']) + except BaseException as error: + run['errors'][3] = error + state['io_quarantine'][0] = True + if first_cleanup is None: + first_cleanup = error + try: + _close_logs(run, primary if primary is not None else first_cleanup) + except BaseException as error: + if first_cleanup is None: + first_cleanup = error + for index in range(2): + if run['log_close_attempted'][index] and not run['log_close_confirmed'][index]: + state['io_quarantine'][0] = True + if primary is not None: + _stop(state, 'run_producer', primary) + elif first_cleanup is not None: + _stop(state, 'run_producer_cleanup', first_cleanup) + raise first_cleanup + try: + schema.need(run['spawn_entered'] is True and run['spawn_returned'] is True and + run['acquisition_in_flight'] is False and all(run['log_close_confirmed']), + 'root spawn or raw stream ownership incomplete') + run['terminal'] = domain.terminal_facts(run['domain']) + schema.need(tuple(_GETRLIMIT(resource.RLIMIT_FSIZE)) == run['file_limits'], 'parent file limit drift') + run['phase'] = 'JOINED' + state['phase'] = 'PRODUCER_JOINED' + _guard(state) + return run_token + except BaseException as primary: + _stop(state, 'postcleanup_terminal', primary) + raise + + +def _source_custody_bytes(state, files, stage): + raw = group01.encode({'schema': 'h25-parent-current-source-custody-v1', 'files': files, + 'stage': stage, 'source_closure_admission_sha256': state['plan']['source_closure_admission_sha256'], + 'historical_compiler_interval_proof_claimed_by_this_record': False}) + schema.need(len(raw) <= schema.RECORD_BYTES, 'complete source custody record exceeds admitted writer bound') + return raw + + +def _variant(state, run, stdout_raw): + """Dedicated concrete typed receiver; source remains external until frozen.""" + expected = group01.decode(group01.encode(run['plan']['evidence_plan'])) + expected['producer_process_id'] = run['root'][0] + expected['parent_file_limits'] = list(run['file_limits']) + files = expected['raw_file_names'] + schema.need(_TYPE(files) is list and files == list(VARIANT_FILES), + 'fixed variant raw file inventory missing') + raw_files, pins, total = {}, [], 0 + for relative in files: + schema.text(relative, 256) + schema.need(not relative.startswith('/') and all(part not in ('', '.', '..') for part in relative.split('/')), + 'variant raw origin differs') + path = run['plan']['output'] + '/' + relative + limit = 8388608 if relative.endswith('.so') else schema.LOG_BYTES if relative.endswith('.raw') else schema.RECORD_BYTES + pin = copying.inspect(path, limit, error_owner=state['errors']) + total += pin['bytes'] + schema.need(total <= MAX_VARIANT_RAW_BYTES, 'variant aggregate byte bound exceeded before allocation') + raw_files[relative] = copying.read_verified(pin, limit, error_owner=state['errors']) + pins.append(pin) + closure.check_receivers(state['receivers']) + validator = closure.receiver(state['receivers'], VARIANT_MODULE, VARIANT_FUNCTION) + result = validator(raw_files, expected) + closure.check_receivers(state['receivers']) + # Exact result schema is fixed with the separately frozen variant source. + # This branch cannot run before that complete source/interface is admitted. + schema.exact(result, ('schema', 'raw_result_relative', 'raw_group_relatives', 'builds', + 'zero_candidate_loads', 'not_runtime_authority')) + schema.need(result['schema'] == 'h25-negative-variant-data-authentication-v1' and + result['zero_candidate_loads'] is True and result['not_runtime_authority'] is True, + 'variant data-validation scope differs') + pin_by_relative = dict(zip(files, pins)) + schema.need(result['raw_result_relative'] == 'receipt.json' and + group01.same_json(group01.decode(stdout_raw), group01.decode(raw_files['receipt.json'])), + 'variant original stdout/final raw result differs') + builds = [] + schema.sequence(result['builds'], 2) + for role, row in zip(schema.ROLES[3:], result['builds']): + schema.exact(row, ('role', 'command_sha256', 'profile', 'files')) + schema.need(row['role'] == role, 'variant build role order differs') + schema.exact(row['files'], ('original_output', 'original_receipt', 'attempt', 'journal', 'stdout', 'stderr')) + build = {'role': role, 'producer_role': 'failure_variants', + 'producer_generation': run['plan']['epoch_plan']['generation'], + 'producer_stage_sha256': run['plan']['epoch_plan']['stage_sha256'], + 'command_sha256': row['command_sha256'], 'profile': row['profile']} + for key, relative in row['files'].items(): + schema.text(relative, 256) + schema.need(relative in pin_by_relative, 'variant validator returned unowned file') + build[key] = pin_by_relative[relative] + schema.build(build) + builds.append(build) + schema.need(result['raw_group_relatives'] == list(VARIANT_GROUPS), 'variant exact raw group census differs') + raw_groups = [] + for relative in result['raw_group_relatives']: + schema.text(relative, 256) + schema.need(relative in pin_by_relative, 'variant validator returned unowned raw group') + raw_groups.append({'file': relative, 'raw': pin_by_relative[relative]}) + return {'raw_result': pin_by_relative['receipt.json'], 'group_rows': raw_groups, + 'builds': builds, 'additional_raw': pins, + 'native_runtime_or_full_union_qualified': False} + + +def accept_producer(owner_capability, completed_run_capability): + state = _state(owner_capability) + try: + _guard(state) + schema.need(_TYPE(completed_run_capability) is object and state['phase'] == 'PRODUCER_JOINED', + 'joined original producer capability required') + matches = [run for run in state['runs'].values() if run['token'] is completed_run_capability] + schema.need(_LEN(matches) == 1 and matches[0]['phase'] == 'JOINED', 'unknown or replayed producer completion') + run = matches[0] + run['phase'] = 'COMPLETION_CONSUMED' + terminal = domain.terminal_facts(run['domain']) + schema.need(terminal == run['terminal'], 'owned terminal facts changed') + row, errors = run['plan'], state['errors'] + stdout = copying.inspect(row['evidence_directory'] + '/stdout.raw', schema.LOG_BYTES, error_owner=errors) + stderr = copying.inspect(row['evidence_directory'] + '/stderr.raw', schema.LOG_BYTES, error_owner=errors) + schema.need(stderr['bytes'] == 0, 'original producer stderr is not empty') + stdout_raw = copying.read_verified(stdout, schema.LOG_BYTES, error_owner=errors) + if run['role'] == 'group01': + actual = group01.authenticate_group01(row['output'], row['evidence_plan'], run['root'][0], + run['file_limits'], state['receivers'], errors, stdout_raw) + else: + actual = _variant(state, run, stdout_raw) + # These facts are parent-derived from current bytes and real owned + # cleanup, never child status flags or an imported ParentCompletion. + source_after = _snapshot_sources(state['plan'], errors) + schema.need(source_after == run['source_before'] == state['initial_sources'], 'complete current source identity changed') + stage_after = _stage(dict(state['plan'], **row), errors, state) + schema.need(stage_after == run['stage_before'], 'late complete stage custody changed') + closure.check_receivers(state['receivers']) + schema.need(domain.terminal_facts(run['domain']) == terminal, 'late parent-domain cleanup changed') + copying.verify(stdout, schema.LOG_BYTES, error_owner=errors) + copying.verify(stderr, schema.LOG_BYTES, error_owner=errors) + for build in actual['builds']: + for key, limit in (('original_output', schema.FILE_BYTES), ('original_receipt', 65536), + ('attempt', 65536), ('journal', schema.JOURNAL_BYTES), ('stdout', schema.LOG_BYTES), ('stderr', schema.LOG_BYTES)): + copying.verify(build[key], limit, error_owner=errors) + for pin in actual['additional_raw']: + copying.verify(pin, schema.FILE_BYTES, error_owner=errors) + copying.verify(actual['raw_result'], schema.RAW_RESULT_BYTES, error_owner=errors) + for pin in row['launch_artifacts'].values(): + copying.verify(pin, schema.RECORD_BYTES, error_owner=errors) + for group in actual['group_rows']: + copying.verify(group['raw'], schema.RECORD_BYTES, error_owner=errors) + if run['role'] == 'group01': + copying.verify(group['validation'], 8192, error_owner=errors) + directory = row['evidence_directory'] + terminal_pin = copying.write_once(directory + '/TERMINAL.json', schema.canonical({ + 'schema': 'h25-owned-producer-terminal-v1', 'launch': run['launch'], + 'generation': row['epoch_plan']['generation'], 'launch_nonce': row['launch_nonce'], + 'actual': terminal, 'stdout': stdout, 'stderr': stderr, + 'root_wall_before_completion_diagnostic_nanoseconds': int((_CLOCK() - run['began']) * 1000000000), + 'diagnostic_is_nested_not_additive': True}), error_owner=errors) + raw_groups = copying.write_once(directory + '/RAW-GROUPS.json', + group01.encode({'schema': 'h25-parent-retained-raw-groups-v1', 'rows': actual['group_rows'], + 'additional_raw': actual['additional_raw'], 'returned_groups_checked_before_mint': True}), error_owner=errors) + source_bytes_after = _source_custody_bytes(state, source_after, stage_after) + schema.need(source_bytes_after == run['source_bytes_before'], 'source custody changed after prelaunch size gate') + source_pin = copying.write_once(directory + '/FINAL-SOURCE-CUSTODY.json', source_bytes_after, error_owner=errors) + _guard(state) + schema.need(_CLOCK() - run['began'] <= row['root_seconds'], 'complete root including validation/custody exceeded bound') + observation = {'schema': 'h25-owned-parent-observation-v1', 'epoch_id': state['plan']['epoch_id'], + 'mode': state['plan']['mode'], 'producer_role': run['role'], 'generation': row['epoch_plan']['generation'], + 'launch_nonce': row['launch_nonce'], 'launch': run['launch'], 'terminal': terminal_pin, + 'raw_result': actual['raw_result'], 'raw_groups': raw_groups, 'final_source_custody': source_pin, + 'root_pid': run['root'][0], 'root_start_ticks': run['root'][4], + 'later_cross_root_aggregate_required_before_export': False, + 'native_full_or_gain_qualification': False} + observed_pin = copying.write_once(directory + '/PARENT-OBSERVATION.json', schema.canonical(observation), error_owner=errors) + record = {key: row['epoch_plan'][key] for key in ('role', 'generation', 'stage_sha256', 'command_sha256', 'root_sha256')} + record.update(terminal=terminal_pin, raw_result=actual['raw_result'], raw_groups=raw_groups, + final_source_custody=source_pin, parent_observation=observed_pin, + completion_checker_sha256=state['configuration']['checker_source']['sha256'], builds=actual['builds']) + schema.producer(record) + # The only mint site is below every actual launch/domain/raw/source + # check. Neither ticket nor completion is ever returned to a caller. + _guard(state) + completion = _EPOCH_COMPLETION(run['ticket'], state['configuration']['checker_source']['sha256'], + observed_pin['sha256'], row['epoch_plan']['generation'], state['plan']['mode'], run['role'], + run['root'][0], run['root'][4], True, True, True, True, True, True) + _EPOCH_ACCEPT(state['epoch'], state['authority'], run['ticket'], completion, record) + _guard(state) + schema.need(_CLOCK() - run['began'] <= row['root_seconds'], + 'complete root plus acceptance tail exceeded bound') + run['phase'], run['record'] = 'ACCEPTED', record + state['next'] += 1 + state['phase'] = 'READY' if state['next'] < 2 else 'PRODUCERS_ACCEPTED' + return schema.plain_copy(record) + except BaseException as primary: + _stop(state, 'accept_producer', primary) + raise + + +def commit_exports(owner_capability): + state = _state(owner_capability) + try: + _guard(state) + schema.need(state['phase'] == 'PRODUCERS_ACCEPTED' and state['next'] == 2 and + all(run['phase'] == 'ACCEPTED' for run in state['runs'].values()), + 'only two genuinely accepted producer records may export') + result = _EPOCH_COMMIT(state['epoch'], state['authority']) + _guard(state) + state['phase'] = 'EXPORTED' + return result + except BaseException as primary: + _stop(state, 'commit_exports', primary) + raise + + +def stop_evidence(owner_capability): + state = _state(owner_capability) + summaries = [{'role': run['role'], 'phase': run['phase'], + 'spawn_entered': run['spawn_entered'], 'spawn_returned': run['spawn_returned'], + 'log_close_attempted': list(run['log_close_attempted']), + 'log_close_confirmed': list(run['log_close_confirmed'])} + for run in state['runs'].values()] + # Never expose the epoch ticket, Popen object, domain capability or private + # run sidecar through diagnostic return values. + return state['stop'], state['errors'], state['fallback'], summaries diff --git a/research/h25-v03-prefix-supervision/unit05/implementation/parent_domain_v1.py b/research/h25-v03-prefix-supervision/unit05/implementation/parent_domain_v1.py new file mode 100644 index 0000000000..a0f242854a --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/implementation/parent_domain_v1.py @@ -0,0 +1,532 @@ +"""Owned Linux child domains for one trusted, single-threaded parent process. + +Source proposal only. No target was imported or run during authoring. The +external launcher must authenticate the OS, interpreter, system modules and +original subreaper installer before importing this module. This is the original +closed child-domain premise, not a sandbox against hostile forking or a hostile +host. Acquisition/unwind ambiguity quarantines the parent; it never authorizes +another launch or a completion. The enclosing guard must observe parent exit. +""" +import os +import signal +import subprocess +import time +import epoch_schema_v5 as schema + +_TYPE, _LEN = type, len +_OPEN, _READ, _CLOSE = os.open, os.read, os.close +_STAT = os.stat +_SCANDIR, _GETPID, _GETPGRP, _GETSID = os.scandir, os.getpid, os.getpgrp, os.getsid +_PIDFD_OPEN, _PIDFD_SIGNAL = os.pidfd_open, signal.pidfd_send_signal +_WAITPID, _CLOCK, _SLEEP = os.waitpid, time.monotonic, time.sleep +_POPEN, _POLL = subprocess.Popen, subprocess.Popen.poll +_PAGE_BYTES = os.sysconf('SC_PAGE_SIZE') +_DOMAINS = [] +MAX_GENERATIONS = 128 +MAX_PROC_ENTRIES = 131072 +MAX_PROC_BYTES = 8192 +CLEANUP_SECONDS = 2.0 + + +def _state(capability): + schema.need(_TYPE(capability) is object, 'exact owned domain capability required') + for token, state in _DOMAINS: + if token is capability: + return state + raise schema.EpochStop('unregistered owned domain') + + +def refresh_unknown_owner(owner): + # These are exact V5 ErrorOwner state references captured by the original + # parent before use. Read only the pinned private shape; no projection, + # callback, native I/O or interpretation of historical release slot9. + for native in owner['native_errors']: + if native is None: + continue + io = native[7] + if (io[0] or io[1] or io[2] or io[4] or io[6] or io[10] or io[11] or + io[5] is not None or native[5][1] or io[7][4] == 1): + owner['quarantine'][0] = True + if io[5] is not None: + owner['iterator_uncertain'][0] = True + + +def _fresh_acquisition(state): + # This shares the original parent's preallocated unknown-resource owner. + # Pending acquisition and delivered census failure are independent of a + # later Python close return. Neither flag is cleared by cleanup. + owner = state['unknown_owner'] + refresh_unknown_owner(owner) + schema.need(state['quarantine'] is False and state['acquisition_in_flight'] is False and + state['io_uncertain'] is False and owner['quarantine'][0] is False and + owner['pending'][0] is False and owner['iterator_uncertain'][0] is False, + 'uncertain ownership prohibits a fresh native acquisition') + + +def _opaque(state, error, slot): + # Preallocated slots retain the actual delivered object, without formatting. + # A secondary never replaces the first primary. Slots are finite and an + # overflow means quarantine, not a successful evidence projection. + state['quarantine'] = True + if state['primary'][0] is None: + state['primary'][0] = error + elif state['secondary'][slot] is None: + state['secondary'][slot] = error + else: + state['overflow'][0] = error + + +def _proc(pid, state): + schema.integer(pid, 1, (1 << 31) - 1) + descriptor = None + primary = None + _fresh_acquisition(state) + # The uncertain acquisition flag is set before the native entry. If open + # raises after an undisclosed descriptor acquisition, parent exit is needed. + try: + try: + _STAT('/proc/' + str(pid) + '/stat', dir_fd=None, follow_symlinks=False) + except (FileNotFoundError, ProcessLookupError): + # Only the pinned metadata-only primitive establishes absence. + # An exception from a later acquisition never proves no FD existed. + return None + state['acquisition_in_flight'] = True + state['unknown_owner']['pending'][0] = True + descriptor = _OPEN('/proc/' + str(pid) + '/stat', + os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW | os.O_NONBLOCK) + state['acquisition_in_flight'] = False + state['unknown_owner']['pending'][0] = False + raw = _READ(descriptor, MAX_PROC_BYTES + 1) + schema.need(_TYPE(raw) is bytes and _LEN(raw) <= MAX_PROC_BYTES, + 'bounded proc stat read differs') + end = raw.rfind(b') ') + schema.need(end >= 0, 'malformed proc stat') + fields = raw[end + 2:].split() + schema.need(_LEN(fields) >= 22 and raw[:raw.find(b' ')] == str(pid).encode('ascii'), + 'proc stat identity or shape differs') + row = (pid, int(fields[1]), int(fields[2]), int(fields[3]), + int(fields[19]), fields[0].decode('ascii'), int(fields[21]) * _PAGE_BYTES) + schema.need(row[4] > 0 and row[6] >= 0, 'proc generation or RSS differs') + return row + except BaseException as error: + primary = error + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + _opaque(state, error, 0) + raise + finally: + if descriptor is not None: + # Burn before entry; a failed native close is not retried. + owned = descriptor + descriptor = None + try: + _CLOSE(owned) + except BaseException as close_error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = close_error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + state['io_uncertain'] = True + _opaque(state, close_error, 1) + if primary is None: + raise + + +def _census(state): + iterator = None + primary = None + rows = {} + _fresh_acquisition(state) + state['acquisition_in_flight'] = True + state['unknown_owner']['pending'][0] = True + try: + iterator = _SCANDIR('/proc') + state['acquisition_in_flight'] = False + state['unknown_owner']['pending'][0] = False + count = 0 + for entry in iterator: + count += 1 + schema.need(count <= MAX_PROC_ENTRIES, 'proc census entry bound exceeded') + name = entry.name + if name.isdecimal(): + row = _proc(int(name), state) + if row is not None: + rows[row[0]] = row + return rows + except BaseException as error: + primary = error + # All delivered iteration/body failures latch before optional helper + # entry. A no-op/successful close cannot establish release afterward. + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['quarantine'] = True + state['io_uncertain'] = True + state['unknown_owner']['quarantine'][0] = True + state['unknown_owner']['iterator_uncertain'][0] = True + _opaque(state, error, 2) + raise + finally: + if iterator is not None: + owned = iterator + iterator = None + try: + owned.close() + except BaseException as close_error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = close_error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + state['unknown_owner']['iterator_uncertain'][0] = True + state['io_uncertain'] = True + _opaque(state, close_error, 3) + if primary is None: + raise + + +def create_domain(unknown_owner): + """Called only after the original same-process subreaper was installed.""" + schema.need(_LEN(_DOMAINS) < 4, 'two modes by two producers domain bound exceeded') + schema.exact(unknown_owner, ('quarantine', 'pending', 'iterator_uncertain', 'primary', 'native_errors')) + for key in ('quarantine', 'pending', 'iterator_uncertain', 'primary'): + schema.need(_TYPE(unknown_owner[key]) is list and _LEN(unknown_owner[key]) == 1, + 'original parent unknown-resource slot differs') + schema.need(_TYPE(unknown_owner['native_errors']) is list and _LEN(unknown_owner['native_errors']) == 4, + 'exact two-mode V5 error-owner registry required') + for native in unknown_owner['native_errors']: + schema.need(native is None or (_TYPE(native) is list and _LEN(native) == 9 and + _TYPE(native[7]) is list and _LEN(native[7]) == 13), + 'original captured V5 error-owner shape differs') + refresh_unknown_owner(unknown_owner) + schema.need(all(unknown_owner[key][0] is False for key in + ('quarantine', 'pending', 'iterator_uncertain')) and unknown_owner['primary'][0] is None, + 'unknown-resource parent already requires teardown') + token = object() + state = {'rows': [None] * MAX_GENERATIONS, 'fds': [None] * MAX_GENERATIONS, + 'fd_attempted': [False] * MAX_GENERATIONS, + 'fd_closed': [False] * MAX_GENERATIONS, 'count': 0, + 'groups': set(), 'reaped': [], 'after_root': set(), + 'process': None, 'root': None, 'returncode': None, + 'parent_pid': _GETPID(), 'parent_group': _GETPGRP(), 'parent_session': _GETSID(0), + 'phase': 'CONSTRUCTING', 'quarantine': False, + 'acquisition_in_flight': False, 'io_uncertain': False, 'primary': [None], + 'unknown_owner': unknown_owner, + 'secondary': [None] * 16, 'overflow': [None], + 'final_rows': None, 'closure_confirmed': False} + _DOMAINS.append((token, state)) + try: + rows = _census(state) + schema.need(not any(row[1] == state['parent_pid'] for row in rows.values()), + 'parent has preexisting child processes') + state['phase'] = 'RESERVED' + return token + except BaseException as error: + if unknown_owner['primary'][0] is None: + unknown_owner['primary'][0] = error + unknown_owner['quarantine'][0] = True + state['quarantine'] = True + _opaque(state, error, 4) + state['phase'] = 'STOP' + raise + + +def _add(state, row): + _fresh_acquisition(state) + key = row[0], row[4] + schema.need(row[0] != state['parent_pid'], 'parent cannot enter own child domain') + for index in range(state['count']): + prior = state['rows'][index] + if prior is not None and (prior[0], prior[4]) == key: + if row[2] != state['parent_group']: + state['groups'].add((row[2], row[3])) + return True + index = state['count'] + schema.need(index < MAX_GENERATIONS, 'owned process generation bound exceeded') + # Reserve the slot before native acquisition. No role/generation slot is + # recycled after a failed or disappeared acquisition. + state['count'] = index + 1 + state['rows'][index] = row + state['acquisition_in_flight'] = True + state['unknown_owner']['pending'][0] = True + try: + state['fds'][index] = _PIDFD_OPEN(row[0], 0) + state['acquisition_in_flight'] = False + state['unknown_owner']['pending'][0] = False + current = _proc(row[0], state) + if current is None or (current[0], current[4]) != key: + return False # The actual FD stays owned for one terminal close. + if current[2] != state['parent_group']: + state['groups'].add((current[2], current[3])) + return True + except BaseException as error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + _opaque(state, error, 5) + raise + + +def observe(capability): + state = _state(capability) + all_rows = _census(state) + known = set() + for index in range(state['count']): + prior = state['rows'][index] + current = None if prior is None else all_rows.get(prior[0]) + if current is not None and current[4] == prior[4]: + known.add(current[0]) + _add(state, current) + for unused in range(MAX_GENERATIONS + 1): + changed = False + for pid, row in all_rows.items(): + if pid not in known and (row[1] == state['parent_pid'] or row[1] in known): + if _add(state, row): + known.add(pid) + changed = True + if not changed: + break + else: + raise schema.EpochStop('child-domain closure iteration bound exceeded') + return all_rows, tuple(all_rows[pid] for pid in sorted(known)) + + +def adopt_popen(capability, process): + state = _state(capability) + schema.need(state['phase'] == 'RESERVED' and state['process'] is None and + _TYPE(process) is _POPEN, 'Popen ownership or one-attempt state differs') + state['process'] = process # Exact original return, never a supplied proxy. + row = _proc(process.pid, state) + schema.need(row is not None and row[1] == state['parent_pid'] and + row[2] == row[3] == process.pid, + 'new child PID/session/generation missing before first poll') + state['root'] = row + schema.need(_add(state, row) is True, 'original child pidfd generation not owned') + state['phase'] = 'RUNNING' + return row + + +def poll_owned(capability): + state = _state(capability) + schema.need(state['phase'] == 'RUNNING' and _TYPE(state['process']) is _POPEN, + 'original running Popen required') + result = _POLL(state['process']) + if result is not None: + schema.integer(result, -128, 255) + state['returncode'] = result + return result + + +def _kill(state): + for index in range(state['count']): + fd, prior = state['fds'][index], state['rows'][index] + if fd is None or state['fd_attempted'][index]: + continue + current = _proc(prior[0], state) + if current is not None and current[4] == prior[4] and current[5] != 'Z': + try: + _PIDFD_SIGNAL(fd, signal.SIGKILL, None, 0) + except ProcessLookupError: + pass + + +def finish_domain(capability): + """Always attempted, including Popen exceptions; no caller closure claims.""" + state = _state(capability) + schema.need(state['phase'] in ('RESERVED', 'RUNNING'), 'domain cleanup replay') + state['phase'] = 'CLEANUP_CONSUMED' + started = _CLOCK() + primary = None + try: + _fresh_acquisition(state) + while True: + all_rows, current = observe(capability) + process = state['process'] + if process is not None and process.returncode is not None: + for row in current: + if row[0] != process.pid: + state['after_root'].add((row[0], row[4])) + _kill(state) + if process is not None: + result = _POLL(process) + if result is not None: + state['returncode'] = result + for index in range(state['count']): + prior = state['rows'][index] + row = _proc(prior[0], state) + if (row is None or row[4] != prior[4] or row[1] != state['parent_pid'] or + (process is not None and row[0] == process.pid)): + continue + try: + pid, status = _WAITPID(row[0], os.WNOHANG) + except ChildProcessError: + continue + if pid: + state['reaped'].append((pid, prior[4], status)) + all_rows, current = observe(capability) + remaining = tuple(row for row in all_rows.values() + if row[1] == state['parent_pid'] or (row[2], row[3]) in state['groups'] or + any(prior is not None and (row[0], row[4]) == (prior[0], prior[4]) + for prior in state['rows'][:state['count']])) + state['final_rows'] = remaining + if not current and not remaining: + state['closure_confirmed'] = True + break + if _CLOCK() - started >= CLEANUP_SECONDS: + break + _SLEEP(0.01) + except BaseException as error: + primary = error + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + _opaque(state, error, 6) + raise + finally: + # Every known FD gets one attempt even if a prior close failed. Native + # return/boxing, Python call-entry and final unwind still have no total + # recovery theorem; any such failure forbids minting and parent reuse. + first_close = None + for index in range(state['count']): + descriptor = state['fds'][index] + if descriptor is None or state['fd_attempted'][index]: + continue + state['fd_attempted'][index] = True + try: + _CLOSE(descriptor) + state['fd_closed'][index] = True + except BaseException as error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + state['io_uncertain'] = True + _opaque(state, error, 7) + if first_close is None: + first_close = error + state['phase'] = 'CLOSED' if primary is None and first_close is None else 'STOP' + if primary is None and first_close is not None: + raise first_close + + +def terminal_facts(capability): + state = _state(capability) + _fresh_acquisition(state) + schema.need(state['phase'] == 'CLOSED' and state['quarantine'] is False and + state['acquisition_in_flight'] is False and state['io_uncertain'] is False and state['root'] is not None and + state['returncode'] == 0 and state['closure_confirmed'] is True and + state['final_rows'] == () and not state['after_root'] and not state['reaped'] and + all(fd is None or (state['fd_attempted'][index] and state['fd_closed'][index]) + for index, fd in enumerate(state['fds'])), + 'owned terminal domain is incomplete, failed, orphaned or quarantined') + # Fresh census after FD cleanup. This is independent of receipt booleans. + rows = _census(state) + schema.need(not any(row[1] == state['parent_pid'] or + (row[2], row[3]) in state['groups'] for row in rows.values()), + 'postcleanup owned child/group still present') + return {'root': list(state['root']), 'returncode': state['returncode'], + 'owned_generations': [list(row) for row in state['rows'][:state['count']]], + 'groups': [list(pair) for pair in sorted(state['groups'])], + 'remaining': [], 'adopted_reaps': [], 'observed_after_root_exit': [], + 'pidfd_close_attempted': list(state['fd_attempted'][:state['count']]), + 'pidfd_close_confirmed': list(state['fd_closed'][:state['count']]), + 'source': 'original in-process Popen and owned generation registry', + 'hostile_fork_or_privileged_host_resistance_claimed': False} + + +def stop_slots(capability): + state = _state(capability) + return state['primary'], state['secondary'], state['overflow'], { + 'phase': state['phase'], 'quarantine': state['quarantine'], + 'acquisition_in_flight': state['acquisition_in_flight'], + 'io_uncertain': state['io_uncertain'], + 'shared_pending': state['unknown_owner']['pending'][0], + 'shared_iterator_uncertain': state['unknown_owner']['iterator_uncertain'][0], + 'shared_quarantine': state['unknown_owner']['quarantine'][0], + 'closure_confirmed': state['closure_confirmed'], + 'pidfd_close_attempted': list(state['fd_attempted'][:state['count']]), + 'pidfd_close_confirmed': list(state['fd_closed'][:state['count']])} + + +def prefix_exit1_terminal_facts(capability): + """Return cleanup/exit DATA for an actual owned prefix child exiting 1. + + Separate from production terminal_facts. Never creates an epoch ticket, + ParentCompletion, source admission, or control-family acceptance. + """ + state = _state(capability) + owner = state['unknown_owner'] + try: + schema.need(_GETPID() == state['parent_pid'], + 'prefix terminal observer is not the owning parent') + _fresh_acquisition(state) + schema.need(owner['primary'][0] is None and + state['primary'][0] is None, + 'earlier error forbids prefix terminal observation') + schema.need( + state['phase'] == 'CLOSED' and + state['quarantine'] is False and + state['acquisition_in_flight'] is False and + state['io_uncertain'] is False and + state['root'] is not None and + _TYPE(state['returncode']) is int and + state['returncode'] == 1 and + state['closure_confirmed'] is True and + state['final_rows'] == () and + not state['after_root'] and + not state['reaped'] and + all(fd is None or + (state['fd_attempted'][index] and state['fd_closed'][index]) + for index, fd in enumerate(state['fds'])), + 'owned exit1 prefix domain is incomplete or quarantined', + ) + rows = _census(state) + schema.need( + not any(row[1] == state['parent_pid'] or + (row[2], row[3]) in state['groups'] + for row in rows.values()), + 'postcleanup owned prefix child/group still present', + ) + return { + 'schema': 'h25-prefix-exit1-terminal-facts-v1', + 'root': list(state['root']), + 'returncode': state['returncode'], + 'owned_generations': [ + list(row) for row in state['rows'][:state['count']] + ], + 'groups': [list(pair) for pair in sorted(state['groups'])], + 'remaining': [], + 'adopted_reaps': [], + 'observed_after_root_exit': [], + 'pidfd_close_attempted': list( + state['fd_attempted'][:state['count']] + ), + 'pidfd_close_confirmed': list( + state['fd_closed'][:state['count']] + ), + 'source': 'original in-process Popen and owned generation registry', + 'production_completion': False, + 'refusal_semantics_authenticated_by_this_function': False, + 'hostile_fork_or_privileged_host_resistance_claimed': False, + } + except BaseException as error: + if owner['primary'][0] is None: + prior = state['primary'][0] + owner['primary'][0] = error if prior is None else prior + primary = owner['primary'][0] + if state['primary'][0] is None: + state['primary'][0] = primary + if error is not primary: + if state['secondary'][8] is None: + state['secondary'][8] = error + elif state['overflow'][0] is None: + state['overflow'][0] = error + state['quarantine'] = True + owner['quarantine'][0] = True + # Do not change phase: an invalid early call must not prevent + # finish_domain from reaching its known-FD cleanup. + if primary is error: + raise + raise primary diff --git a/research/h25-v03-prefix-supervision/unit05/implementation/test_v03_prefix_supervisor_v1.py b/research/h25-v03-prefix-supervision/unit05/implementation/test_v03_prefix_supervisor_v1.py new file mode 100644 index 0000000000..02fbb90fc9 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/implementation/test_v03_prefix_supervisor_v1.py @@ -0,0 +1,173 @@ +"""Pure fixtures for newly authored functions; no archived module import. + +These tests establish local predicates and error retention only. Synthetic +states are never evidence of Popen, kernel cleanup, source admission or C05. +""" +import ast +import copy +from pathlib import Path +from types import SimpleNamespace +import unittest + + +def new_function(path, name, globals_map): + source = Path(path).read_text(encoding='utf-8') + tree = ast.parse(source, feature_version=(3, 12)) + matches = [node for node in tree.body + if type(node) is ast.FunctionDef and node.name == name] + if len(matches) != 1: + raise ValueError('unique newly authored function required') + module = ast.Module(body=matches, type_ignores=[]) + scope = dict(globals_map) + exec(compile(module, '', 'exec'), scope) + return scope[name] + + +class Stop(RuntimeError): + pass + + +def need(condition, message): + if condition is not True: + raise Stop(message) + + +class AccessorTests(unittest.TestCase): + def setUp(self): + self.owner = { + 'primary': [None], 'quarantine': [False], + 'pending': [False], 'iterator_uncertain': [False], + 'native_errors': [None] * 4, + } + self.state = { + 'parent_pid': 10, 'unknown_owner': self.owner, + 'primary': [None], 'secondary': [None] * 16, + 'overflow': [None], 'phase': 'CLOSED', + 'quarantine': False, 'acquisition_in_flight': False, + 'io_uncertain': False, + 'root': (11, 10, 11, 11, 123, 'Z', 0), + 'returncode': 1, 'closure_confirmed': True, + 'final_rows': (), 'after_root': set(), 'reaped': [], + 'fds': [7], 'fd_attempted': [True], 'fd_closed': [True], + 'rows': [(11, 10, 11, 11, 123, 'Z', 0)], + 'count': 1, 'groups': {(11, 11)}, + } + self.token = object() + self.rows = {} + self.census_calls = 0 + + def state(token): + need(token is self.token, 'synthetic token mismatch') + return self.state + + def fresh(value): + owner = value['unknown_owner'] + need(not owner['quarantine'][0] and + not owner['pending'][0] and + not owner['iterator_uncertain'][0], + 'synthetic uncertainty') + + def census(value): + self.census_calls += 1 + return self.rows + + self.call = new_function( + 'parent_domain_v1.py', 'prefix_exit1_terminal_facts', + {'_state': state, '_GETPID': lambda: 10, + '_fresh_acquisition': fresh, '_census': census, + '_TYPE': type, 'schema': SimpleNamespace(need=need)}) + + def test_intact_exit1_predicate(self): + result = self.call(self.token) + self.assertEqual(result['returncode'], 1) + self.assertIs(result['production_completion'], False) + self.assertIs( + result['refusal_semantics_authenticated_by_this_function'], False) + self.assertEqual(self.census_calls, 1) + + def test_other_exit_dispositions(self): + for value in (0, 2, -9, True, 1.0): + with self.subTest(value=repr(value)): + self.setUp() + self.state['returncode'] = value + with self.assertRaises(Stop): + self.call(self.token) + self.assertEqual(self.census_calls, 0) + + def test_unclosed_fd(self): + self.state['fd_closed'][0] = False + with self.assertRaises(Stop): + self.call(self.token) + + def test_late_owned_child(self): + self.rows = {12: (12, 10, 12, 12, 456, 'R', 1)} + with self.assertRaises(Stop): + self.call(self.token) + + def test_existing_primary_identity(self): + first = RuntimeError('first') + self.owner['primary'][0] = first + try: + self.call(self.token) + except BaseException as caught: + self.assertIs(caught, first) + else: + self.fail('earlier primary was accepted') + self.assertEqual(self.census_calls, 0) + + def test_local_primary_identity(self): + first = RuntimeError('local first') + self.state['primary'][0] = first + try: + self.call(self.token) + except BaseException as caught: + self.assertIs(caught, first) + self.assertIs(self.owner['primary'][0], first) + else: + self.fail('local primary was replaced') + + def test_invalid_early_call_keeps_cleanup_phase(self): + self.state['phase'] = 'RUNNING' + with self.assertRaises(Stop): + self.call(self.token) + self.assertEqual(self.state['phase'], 'RUNNING') + self.assertTrue(self.owner['quarantine'][0]) + + +class SourceStructureTests(unittest.TestCase): + def test_supervisor_has_no_mint_call(self): + source = Path('v03_prefix_supervisor_v1.py').read_text() + tree = ast.parse(source) + forbidden = { + 'ParentEpoch', 'ParentCompletion', 'reserve_producer', + 'accept_completed_producer', 'commit_exports', + '_EPOCH_COMPLETION', '_EPOCH_ACCEPT', + } + names = {node.id for node in ast.walk(tree) + if type(node) is ast.Name} + attributes = {node.attr for node in ast.walk(tree) + if type(node) is ast.Attribute} + self.assertFalse(forbidden & (names | attributes)) + + def test_complete_observer_selected(self): + source = Path('v03_prefix_supervisor_v1.py').read_text() + self.assertIn("'corroborate_complete_refusal'", source) + self.assertNotIn("'corroborate_raw_refusal'", source) + + def test_source_gates_remain_none(self): + tree = ast.parse(Path('v03_prefix_supervisor_v1.py').read_text()) + required = { + 'CONFIGURATION', 'SOURCE_REVIEW', 'STAGE_APPROVAL', + 'COMMAND_APPROVAL', 'FUNDING', 'EXECUTION_APPROVAL', + } + found = {} + for node in tree.body: + if type(node) is ast.Assign and len(node.targets) == 1: + target = node.targets[0] + if type(target) is ast.Name and target.id in required: + found[target.id] = ast.literal_eval(node.value) + self.assertEqual(found, {name: None for name in required}) + + +if __name__ == '__main__': + unittest.main() diff --git a/research/h25-v03-prefix-supervision/unit05/implementation/v03_integrated_constructor_v1.py b/research/h25-v03-prefix-supervision/unit05/implementation/v03_integrated_constructor_v1.py new file mode 100644 index 0000000000..15c56b7dd1 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/implementation/v03_integrated_constructor_v1.py @@ -0,0 +1,130 @@ +"""Pure authoring support for the proposed genuine-Root V03 prefix route. + +No original module is imported or executed. Output is a source draft with +all eight original admission/configuration literals still None. The selected +prefix requires independent review as V03 source-gate coverage, and is not V01. +""" +import ast +import hashlib + +ROOT_SHA = 'f5a2d33f2b4d3651f214156a0e7094c2bb516ce2d5ab7698d18c11f98f35dee0' +PROVIDER_SHA = '9cbb7368f89e71d1e6cc46db5dc77efed3e03ed2a801c98c88fe316e4d9f3ef2' +VARIANT_SHA = 'cdb1479253358508088f8aa0e1e92e6c75ffcc127e54552698598a02de061254' +NATIVE_ENV = { + b'PATH': b'/usr/bin:/bin', b'PYTHONHASHSEED': b'0', + b'LANG': b'C.UTF-8', b'LC_ALL': b'C.UTF-8', b'TZ': b'UTC', + b'PYTHONDONTWRITEBYTECODE': b'1', +} +GATES = ('VARIANT_CONFIGURATION', 'VARIANT_SOURCE_REVIEW', + 'VARIANT_STAGE_ADMISSION', 'VARIANT_NATIVE_PROFILE', + 'VARIANT_HEADER_ADMISSION', 'VARIANT_COMMAND_ADMISSION', + 'VARIANT_FUNDING', 'VARIANT_EXECUTION') +TAIL = b'''try: + _variant_main() +except BaseException as _variant_error: + _VARIANT_TERMINAL_ERROR[0] = _variant_error + raise +''' +CONTROL_TAIL = b'''_V03_RESULT = [None] +try: + _V03_RESULT[0] = _v03_original_input_prefix() + _vroot(_INITIAL_OUTPUT + '/v03-root-after.raw.json') + _vraw(_INITIAL_OUTPUT + '/v03-input-result.raw.json', { + 'schema': 'h25-v03-input-prefix-result-v1', + 'status': 'ORIGINAL_INPUT_PREFIX_RETURNED', + 'binding': _V03_RESULT[0], + 'whole_variant_producer_completed': False, + 'runtime_qualified': False}) +except BaseException as _v03_error: + _VARIANT_TERMINAL_ERROR[0] = _v03_error + # No diagnostic allocation or I/O after an inherited failure. The genuine + # parent retains its raw stderr stream and owned terminal facts; absent or + # incomplete evidence is STOP, never a successful negative control. + raise +''' + + +def need(condition, message): + if not condition: + raise ValueError(message) + + +def absolute(path): + need(type(path) is str and 1 < len(path) <= 4096 and + path.startswith('/') and all(32 <= ord(c) < 127 for c in path) and + all(part not in ('', '.', '..') for part in path.split('/')[1:]), + 'canonical bounded absolute ASCII path required') + return path + + +def build_control_driver(original): + """Construct an unconfigured driver by a checked source transformation.""" + need(type(original) is bytes and len(original) == 41337 and + hashlib.sha256(original).hexdigest() == VARIANT_SHA, + 'exact original variant source required') + tree = ast.parse(original, feature_version=(3, 12)) + functions = [node for node in tree.body if isinstance(node, ast.FunctionDef) + and node.name == '_variant_main'] + need(len(functions) == 1, 'unique original main required') + function = functions[0] + lines = original.splitlines(keepends=True) + body = b''.join(lines[function.lineno - 1:function.end_lineno]) + cut = b' builds = []\n' + need(body.count(cut) == 1 and body.startswith(b'def _variant_main():\n'), + 'original prebuild boundary differs') + prefix = body.split(cut, 1)[0] + prefix = prefix.replace(b'def _variant_main():\n', + b'def _v03_original_input_prefix():\n', 1) + prefix += b' return binding\n\n\n' + need(original.endswith(TAIL) and original.count(TAIL) == 1, + 'original terminal entry differs') + result = original[:-len(TAIL)] + prefix + CONTROL_TAIL + need(len(result) <= 262144, 'genuine Root driver limit exceeded') + result_tree = ast.parse(result, feature_version=(3, 12)) + found = {} + for node in result_tree.body: + if isinstance(node, ast.Assign) and len(node.targets) == 1: + target = node.targets[0] + if isinstance(target, ast.Name) and target.id in GATES: + need(isinstance(node.value, ast.Constant) and + node.value.value is None, 'original gate was configured') + found[target.id] = None + need(set(found) == set(GATES), 'original gate census differs') + return result + + +def genuine_launch(stage, output, generation, nonce, mode, driver_bytes): + """Return launch DATA only. It is not stage/source/funding admission. + + CWD=stage is an explicit choice of this launch instance, allowed by the + original Root. It becomes part of Gamma and must enter C05 rule derivation. + The future parent must authenticate and own that exact stage and output + ancestor before actually passing these values to its genuine Popen route. + """ + absolute(stage) + absolute(output) + need(output != stage and not output.startswith(stage + '/'), + 'output must be outside the immutable stage') + need(type(generation) is str and 1 <= len(generation) <= 96 and + all(c in 'abcdefghijklmnopqrstuvwxyz0123456789-' for c in generation), + 'generation differs') + need(type(nonce) is str and len(nonce) == 64 and + all(c in '0123456789abcdef' for c in nonce), 'nonce differs') + need(type(mode) is str and mode in ('normal', 'optimized'), 'mode differs') + need(type(driver_bytes) is bytes and 0 < len(driver_bytes) <= 262144, + 'bounded reviewed driver bytes required') + integration = stage + '/integration' + command = ['/usr/bin/python3.12', '-S', '-s', '-P', '-B'] + if mode == 'optimized': + command.append('-O') + command += [integration + '/full_driver.py', + '--root-sha256', ROOT_SHA, + '--provider', integration + '/probe_binding_v3.py', PROVIDER_SHA, + '--driver', integration + '/v03_control_driver_v1.py', + hashlib.sha256(driver_bytes).hexdigest(), + '--integration', integration, '--', + '--output', output, '--generation', generation, + '--launch-nonce', nonce] + return {'command': command, 'env': dict(NATIVE_ENV), 'cwd': stage, + 'mode': mode, 'generation': generation, 'launch_nonce': nonce, + 'source_admitted': False, 'execution_admitted': False} diff --git a/research/h25-v03-prefix-supervision/unit05/implementation/v03_integrated_constructor_v2.py b/research/h25-v03-prefix-supervision/unit05/implementation/v03_integrated_constructor_v2.py new file mode 100644 index 0000000000..16989cabf0 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/implementation/v03_integrated_constructor_v2.py @@ -0,0 +1,133 @@ +"""Pure authoring support for the proposed genuine-Root V03 prefix route. + +No original module is imported or executed. Output is a source draft with +all eight original admission/configuration literals still None. The selected +prefix requires independent review as V03 source-gate coverage, and is not V01. +""" +import ast +import hashlib + +ROOT_SHA = 'f5a2d33f2b4d3651f214156a0e7094c2bb516ce2d5ab7698d18c11f98f35dee0' +PROVIDER_SHA = '9cbb7368f89e71d1e6cc46db5dc77efed3e03ed2a801c98c88fe316e4d9f3ef2' +VARIANT_SHA = 'cdb1479253358508088f8aa0e1e92e6c75ffcc127e54552698598a02de061254' +NATIVE_ENV = ( + (b'PATH', b'/usr/bin:/bin'), + (b'PYTHONHASHSEED', b'0'), + (b'LANG', b'C.UTF-8'), + (b'LC_ALL', b'C.UTF-8'), + (b'TZ', b'UTC'), + (b'PYTHONDONTWRITEBYTECODE', b'1'), +) +GATES = ('VARIANT_CONFIGURATION', 'VARIANT_SOURCE_REVIEW', + 'VARIANT_STAGE_ADMISSION', 'VARIANT_NATIVE_PROFILE', + 'VARIANT_HEADER_ADMISSION', 'VARIANT_COMMAND_ADMISSION', + 'VARIANT_FUNDING', 'VARIANT_EXECUTION') +TAIL = b'''try: + _variant_main() +except BaseException as _variant_error: + _VARIANT_TERMINAL_ERROR[0] = _variant_error + raise +''' +CONTROL_TAIL = b'''_V03_RESULT = [None] +try: + _V03_RESULT[0] = _v03_original_input_prefix() + _vroot(_INITIAL_OUTPUT + '/v03-root-after.raw.json') + _vraw(_INITIAL_OUTPUT + '/v03-input-result.raw.json', { + 'schema': 'h25-v03-input-prefix-result-v1', + 'status': 'ORIGINAL_INPUT_PREFIX_RETURNED', + 'binding': _V03_RESULT[0], + 'whole_variant_producer_completed': False, + 'runtime_qualified': False}) +except BaseException as _v03_error: + _VARIANT_TERMINAL_ERROR[0] = _v03_error + # No diagnostic allocation or I/O after an inherited failure. The genuine + # parent retains its raw stderr stream and owned terminal facts; absent or + # incomplete evidence is STOP, never a successful negative control. + raise +''' + + +def need(condition, message): + if not condition: + raise ValueError(message) + + +def absolute(path): + need(type(path) is str and 1 < len(path) <= 4096 and + path.startswith('/') and all(32 <= ord(c) < 127 for c in path) and + all(part not in ('', '.', '..') for part in path.split('/')[1:]), + 'canonical bounded absolute ASCII path required') + return path + + +def build_control_driver(original): + """Construct an unconfigured driver by a checked source transformation.""" + need(type(original) is bytes and len(original) == 41337 and + hashlib.sha256(original).hexdigest() == VARIANT_SHA, + 'exact original variant source required') + tree = ast.parse(original, feature_version=(3, 12)) + functions = [node for node in tree.body if isinstance(node, ast.FunctionDef) + and node.name == '_variant_main'] + need(len(functions) == 1, 'unique original main required') + function = functions[0] + lines = original.splitlines(keepends=True) + body = b''.join(lines[function.lineno - 1:function.end_lineno]) + cut = b' builds = []\n' + need(body.count(cut) == 1 and body.startswith(b'def _variant_main():\n'), + 'original prebuild boundary differs') + prefix = body.split(cut, 1)[0] + prefix = prefix.replace(b'def _variant_main():\n', + b'def _v03_original_input_prefix():\n', 1) + prefix += b' return binding\n\n\n' + need(original.endswith(TAIL) and original.count(TAIL) == 1, + 'original terminal entry differs') + result = original[:-len(TAIL)] + prefix + CONTROL_TAIL + need(len(result) <= 262144, 'genuine Root driver limit exceeded') + result_tree = ast.parse(result, feature_version=(3, 12)) + found = {} + for node in result_tree.body: + if isinstance(node, ast.Assign) and len(node.targets) == 1: + target = node.targets[0] + if isinstance(target, ast.Name) and target.id in GATES: + need(isinstance(node.value, ast.Constant) and + node.value.value is None, 'original gate was configured') + found[target.id] = None + need(set(found) == set(GATES), 'original gate census differs') + return result + + +def genuine_launch(stage, output, generation, nonce, mode, driver_bytes): + """Return launch DATA only. It is not stage/source/funding admission. + + CWD=stage is an explicit choice of this launch instance, allowed by the + original Root. It becomes part of Gamma and must enter C05 rule derivation. + The future parent must authenticate and own that exact stage and output + ancestor before actually passing these values to its genuine Popen route. + """ + absolute(stage) + absolute(output) + need(output != stage and not output.startswith(stage + '/'), + 'output must be outside the immutable stage') + need(type(generation) is str and 1 <= len(generation) <= 96 and + all(c in 'abcdefghijklmnopqrstuvwxyz0123456789-' for c in generation), + 'generation differs') + need(type(nonce) is str and len(nonce) == 64 and + all(c in '0123456789abcdef' for c in nonce), 'nonce differs') + need(type(mode) is str and mode in ('normal', 'optimized'), 'mode differs') + need(type(driver_bytes) is bytes and 0 < len(driver_bytes) <= 262144, + 'bounded reviewed driver bytes required') + integration = stage + '/integration' + command = ['/usr/bin/python3.12', '-S', '-s', '-P', '-B'] + if mode == 'optimized': + command.append('-O') + command += [integration + '/full_driver.py', + '--root-sha256', ROOT_SHA, + '--provider', integration + '/probe_binding_v3.py', PROVIDER_SHA, + '--driver', integration + '/v03_control_driver_v1.py', + hashlib.sha256(driver_bytes).hexdigest(), + '--integration', integration, '--', + '--output', output, '--generation', generation, + '--launch-nonce', nonce] + return {'command': command, 'env': dict(NATIVE_ENV), 'cwd': stage, + 'mode': mode, 'generation': generation, 'launch_nonce': nonce, + 'source_admitted': False, 'execution_admitted': False} diff --git a/research/h25-v03-prefix-supervision/unit05/implementation/v03_prefix_derivation_v1.py b/research/h25-v03-prefix-supervision/unit05/implementation/v03_prefix_derivation_v1.py new file mode 100644 index 0000000000..8140477dcd --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/implementation/v03_prefix_derivation_v1.py @@ -0,0 +1,99 @@ +"""Verify only eight literal replacements in the exact reviewed V03 prefix. + +Source proposal, Apache-2.0. Preserve original authors and derivation notices. +Pinned gate-value DATA does not confer source/native/funding/runtime admission. +""" +import ast +from v03_integrated_constructor_v2 import GATES, build_control_driver + + +def _plain(value): + budget = [0, 0] + + def walk(item, depth): + budget[0] += 1 + if depth > 24 or budget[0] > 65536: + raise ValueError('gate tree bound') + kind = type(item) + if item is None or kind is bool: + return + if kind is int: + if not -(1 << 64) <= item < (1 << 64): + raise ValueError('gate integer bound') + return + if kind is str: + budget[1] += len(item) + if len(item) > 8192 or budget[1] > 524288: + raise ValueError('gate text bound') + return + if kind not in (list, dict) or len(item) > 1024: + raise ValueError('gate exact JSON domain') + if kind is dict: + for key in item: + if type(key) is not str: + raise ValueError('gate exact string key required') + walk(key, depth + 1) + walk(item[key], depth + 1) + else: + for child in item: + walk(child, depth + 1) + + walk(value, 0) + + +def _same(left, right): + if type(left) is not type(right): + return False + if type(left) is dict: + return (set(left) == set(right) and + all(_same(left[k], right[k]) for k in left)) + if type(left) is list: + return (len(left) == len(right) and + all(_same(a, b) for a, b in zip(left, right))) + return left == right + + +def verify_configured_prefix(original_bytes, driver_bytes, frozen_gate_values): + expected = build_control_driver(original_bytes) + if type(driver_bytes) is not bytes or not 0 < len(driver_bytes) <= 262144: + raise ValueError('selected driver byte bound') + _plain(frozen_gate_values) + if type(frozen_gate_values) is not dict or set(frozen_gate_values) != set(GATES): + raise ValueError('exact eight frozen gates required') + + tree = ast.parse(driver_bytes, feature_version=(3, 12)) + offsets, position = [], 0 + for line in driver_bytes.splitlines(keepends=True): + offsets.append(position) + position += len(line) + + actual, spans = {}, [] + for node in tree.body: + if (type(node) is ast.Assign and len(node.targets) == 1 and + type(node.targets[0]) is ast.Name and + node.targets[0].id in GATES): + name, value = node.targets[0].id, node.value + if name in actual: + raise ValueError('duplicate configured gate') + pending, count = [(value, 0)], 0 + while pending: + child, depth = pending.pop() + count += 1 + if depth > 26 or count > 65536: + raise ValueError('literal AST bound') + pending.extend((part, depth + 1) + for part in ast.iter_child_nodes(child)) + actual[name] = ast.literal_eval(value) + spans.append(( + offsets[value.lineno - 1] + value.col_offset, + offsets[value.end_lineno - 1] + value.end_col_offset, + )) + + _plain(actual) + if set(actual) != set(GATES) or not _same(actual, frozen_gate_values): + raise ValueError('configured values differ from independently pinned data') + normalized = driver_bytes + for start, end in sorted(spans, reverse=True): + normalized = normalized[:start] + b'None' + normalized[end:] + if normalized != expected: + raise ValueError('selected source differs outside eight literal values') diff --git a/research/h25-v03-prefix-supervision/unit05/implementation/v03_prefix_supervisor_v1.py b/research/h25-v03-prefix-supervision/unit05/implementation/v03_prefix_supervisor_v1.py new file mode 100644 index 0000000000..9d79e7dd85 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/implementation/v03_prefix_supervisor_v1.py @@ -0,0 +1,830 @@ +"""One non-minting genuine-Root V03 prefix observation per fresh parent. + +Conditional source proposal, Apache-2.0. Derived from the recovered original +parent/domain/closure/copy/supervisor sources. Preserve all original notices. + +The enclosing trusted bootstrap must authenticate this source, its imports, +configured selections and native/OS startup before import. C07 ancestor and +immutable-lifetime conditions remain actual external prerequisites. + +No epoch is created, reserved, accepted, committed or completed here. +""" +import fcntl +import os +from pathlib import Path +import resource +import signal +import stat +import subprocess +import time + +import epoch_schema_v5 as schema +import epoch_copy_v5 as copying +import parent_domain_v1 as domain +import parent_closure_v1 as closure +import parent_completion_v1 as parent +import group01_evidence_v1 as group01 +import v03_prefix_derivation_v1 as derivation + +CONFIGURATION = None +SOURCE_REVIEW = None +STAGE_APPROVAL = None +COMMAND_APPROVAL = None +FUNDING = None +EXECUTION_APPROVAL = None + +ROOT_SHA = 'f5a2d33f2b4d3651f214156a0e7094c2bb516ce2d5ab7698d18c11f98f35dee0' +PROVIDER_SHA = '9cbb7368f89e71d1e6cc46db5dc77efed3e03ed2a801c98c88fe316e4d9f3ef2' +VARIANT_SHA = 'cdb1479253358508088f8aa0e1e92e6c75ffcc127e54552698598a02de061254' +OBSERVER = 'v03_source_refusal_observer_v1' +ENV = {'PATH': '/usr/bin:/bin', 'PYTHONHASHSEED': '0', + 'LANG': 'C.UTF-8', 'LC_ALL': 'C.UTF-8', 'TZ': 'UTC', + 'PYTHONDONTWRITEBYTECODE': '1'} + +_PID, _CLOCK, _FLOCK = os.getpid, time.monotonic, fcntl.flock +_PREFIX = [False, None] +_UNKNOWN_OWNER = { + 'quarantine': [False], 'pending': [False], + 'iterator_uncertain': [False], 'primary': [None], + 'native_errors': [None] * 4, +} +_INITIAL = ( + 'initial-tcb.raw.json', 'initial-controls.raw.json', + 'initial-restoration.raw.json', +) +_PREFLIGHT = _INITIAL + ('root-before.raw.json', 'preflight-before.raw.json') +_CUSTODY = _PREFLIGHT + ('custody-before.raw.json',) +_RETURNED = _CUSTODY + ( + 'v03-root-after.raw.json', 'v03-input-result.raw.json', +) + + +def _gate_snapshot(): + schema.exact(CONFIGURATION, ( + 'plan', 'receiver_policy', 'checker_source', 'original_variant', + )) + for pin in CONFIGURATION.values(): + schema.blob(pin, schema.RECORD_BYTES) + records = ( + (SOURCE_REVIEW, 'review_sha256'), + (STAGE_APPROVAL, 'stage_review_sha256'), + (COMMAND_APPROVAL, 'command_review_sha256'), + (FUNDING, 'reservation_sha256'), + (EXECUTION_APPROVAL, 'external_launch_policy_sha256'), + ) + for record, key in records: + schema.exact(record, (key,)) + schema.digest(record[key]) + copying._gate() + return schema.plain_copy({ + 'configuration': CONFIGURATION, + 'source': SOURCE_REVIEW, 'stage': STAGE_APPROVAL, + 'command': COMMAND_APPROVAL, 'funding': FUNDING, + 'execution': EXECUTION_APPROVAL, + 'copy_configuration': copying.COPY_CONFIGURATION, + 'copy_execution': copying.COPY_EXECUTION_APPROVAL, + 'copy_funding': copying.COPY_FUNDING, + }) + + +def _state(token): + schema.need(type(token) is object and _PREFIX[1] is not None and + _PREFIX[1][0] is token, 'unknown prefix owner') + return _PREFIX[1][1] + + +def _clean(owner): + domain.refresh_unknown_owner(owner) + schema.need(owner['primary'][0] is None and + owner['quarantine'][0] is False and + owner['pending'][0] is False and + owner['iterator_uncertain'][0] is False, + 'prefix owner requires kernel teardown') + + +def _native_bindings(): + schema.need( + _PID is os.getpid and _CLOCK is time.monotonic and + _FLOCK is fcntl.flock and parent.ENV == ENV and + parent._OPEN is os.open and parent._CLOSE is os.close and + parent._MKDIR is os.mkdir and parent._STAT is os.stat and + parent._SCANDIR is os.scandir and + parent._POPEN is subprocess.Popen and + parent._CLOCK is time.monotonic and parent._SLEEP is time.sleep and + parent._SETRLIMIT is resource.setrlimit and + parent._GETRLIMIT is resource.getrlimit and + parent._SETTIMER is signal.setitimer and + parent._GETTIMER is signal.getitimer and + parent._SIGNAL is signal.signal and + parent._GETSIGNAL is signal.getsignal, + 'prefix native primitive binding changed', + ) + + +def _guard(state): + schema.need(state['phase'] not in ('STOP', 'CLOSED'), + 'prefix owner is terminal') + schema.need(_PID() == state['pid'], 'prefix owner crossed process') + _native_bindings() + _clean(state['unknown_owner']) + schema.need(_gate_snapshot() == state['admissions'], + 'prefix admission selections changed') + closure.check_receivers(state['receivers']) + for pin in state['configuration'].values(): + copying.verify(pin, error_owner=state['errors']) + schema.need(state['native_keeper'] is not None and + all(type(fd) is int and fd >= 0 for fd in state['lock_fds']), + 'prefix real keeper or lock ownership missing') + schema.need(_CLOCK() <= state['shared_deadline'], + 'complete prefix owner deadline exceeded') + + +def _expected_files(expected): + schema.exact(expected, ( + 'outcome', 'exception_type', 'message', 'terminal_function', + 'v03_discriminator', 'compiler_launches', 'candidate_image_loads', + 'complete_raw_and_owned_terminal_required', + )) + schema.boolean(expected['v03_discriminator']) + schema.need(type(expected['compiler_launches']) is int and + expected['compiler_launches'] == 0 and + type(expected['candidate_image_loads']) is int and + expected['candidate_image_loads'] == 0 and + expected['complete_raw_and_owned_terminal_required'] is True, + 'prefix expectation scope differs') + outcome = expected['outcome'] + function, message = expected['terminal_function'], expected['message'] + if outcome == 'PREFIX_RETURN': + schema.need(function is None and message is None and + expected['exception_type'] is None, + 'positive prefix expectation differs') + return _RETURNED + schema.need(outcome == 'EXACT_SOURCE_REFUSAL' and + expected['exception_type'] == 'RuntimeError', + 'prefix refusal expectation differs') + if function == '_vcheck_literal_sources': + schema.need(message in ( + 'Variant source role path differs', + 'Variant reviewed source/header differs', + 'Variant role file omitted from closure', + ), 'prefix literal refusal site differs') + return _INITIAL + if function == '_vcheck_custody': + schema.need(message == 'Variant current source closure differs', + 'prefix custody refusal site differs') + return _CUSTODY + schema.need(function == '_v03_original_input_prefix', + 'prefix refusal function differs') + if message == 'Variant literal configuration differs': + return _INITIAL + schema.need(message == 'Variant original preflight differs' and + expected['v03_discriminator'] is False, + 'earlier preflight refusal cannot receive V03 credit') + return _PREFLIGHT + + +def _validate_plan(plan): + schema.exact(plan, ( + 'schema', 'mode', 'round_root', 'session_directory', + 'session_seconds', 'source_closure_admission_sha256', + 'source_files', 'case', + )) + schema.need(plan['schema'] == 'h25-v03-prefix-parent-plan-v1', + 'prefix plan schema differs') + schema.choice(plan['mode'], ('normal', 'optimized')) + for key in ('round_root', 'session_directory'): + schema.path(plan[key]) + schema.integer(plan['session_seconds'], 1, 600) + schema.digest(plan['source_closure_admission_sha256']) + schema.need(type(plan['source_files']) is list and + 1 <= len(plan['source_files']) + 1 <= parent.MAX_SOURCE_FILES, + 'prefix parent source inventory bound differs') + case = plan['case'] + schema.exact(case, ( + 'id', 'generation', 'launch_nonce', 'stage_directory', + 'stage_manifest', 'stage_directories', 'output', 'command', + 'root_seconds', 'address_space_bytes', 'rss_bytes', + 'root_source', 'driver_source', 'gate_values', 'expectation', + )) + schema.label(case['id']) + schema.label(case['generation']) + schema.digest(case['launch_nonce']) + schema.path(case['stage_directory']) + schema.path(case['output']) + schema.need( + case['output'] == plan['session_directory'] + '/producer-output' and + case['output'] != case['stage_directory'] and + not case['output'].startswith(case['stage_directory'] + '/'), + 'prefix source/output origins differ', + ) + schema.integer(case['root_seconds'], 1, 180) + schema.integer(case['address_space_bytes'], 1, 1024 ** 3) + schema.integer(case['rss_bytes'], 1, 1024 ** 3) + for key in ('stage_manifest', 'root_source', 'driver_source', 'gate_values'): + schema.blob(case[key], schema.RECORD_BYTES) + schema.need(type(case['stage_directories']) is list and + len(case['stage_directories']) <= parent.MAX_STAGE_ENTRIES, + 'prefix stage directory declaration differs') + integration = case['stage_directory'] + '/integration' + schema.need( + case['root_source']['path'] == integration + '/full_driver.py' and + case['root_source']['sha256'] == ROOT_SHA and + case['root_source']['bytes'] == 38851 and + case['driver_source']['path'] == + integration + '/v03_control_driver_v1.py' and + 0 < case['driver_source']['bytes'] <= 262144, + 'prefix genuine Root/selected driver source differs', + ) + command = ['/usr/bin/python3.12', '-S', '-s', '-P', '-B'] + if plan['mode'] == 'optimized': + command.append('-O') + command += [ + integration + '/full_driver.py', '--root-sha256', ROOT_SHA, + '--provider', integration + '/probe_binding_v3.py', PROVIDER_SHA, + '--driver', case['driver_source']['path'], + case['driver_source']['sha256'], '--integration', integration, '--', + '--output', case['output'], '--generation', case['generation'], + '--launch-nonce', case['launch_nonce'], + ] + schema.need(type(case['command']) is list and + all(type(arg) is str for arg in case['command']) and + case['command'] == command, + 'prefix exact original Root command differs') + _expected_files(case['expectation']) + + +def _record_bytes(value): + raw = group01.encode(value) + schema.need(len(raw) <= schema.RECORD_BYTES, + 'prefix parent record exceeds original writer bound') + return raw + + +def _source_snapshot(state): + plan = state['plan'] + plan_pin = state['configuration']['plan'] + schema.need(len(plan['source_files']) + 1 <= parent.MAX_SOURCE_FILES, + 'outer plan row exceeds original parent inventory bound') + schema.need(all(row['path'] != plan_pin['path'] + for row in plan['source_files']), + 'outer plan cannot be its own inner source row') + index = state['plan_endpoint_count'] + schema.need(type(index) is int and 0 <= index < 3, + 'outer plan endpoint read count differs') + state['plan_endpoint_count'] = index + 1 + endpoint = copying.read_verified( + plan_pin, schema.RECORD_BYTES, error_owner=state['errors']) + state['plan_endpoint_raw'][index] = endpoint + schema.need(endpoint == state['plan_raw'], + 'outer authenticated plan bytes changed') + files = parent._snapshot_sources(plan, state['errors']) + plan_inode = schema.inode(plan_pin) + schema.need(all(schema.inode(row) != plan_inode for row in files), + 'outer plan inode aliases an inner source input') + stage = parent._stage(dict(plan, **plan['case']), state['errors'], state) + raw = _record_bytes({ + 'schema': 'h25-prefix-source-custody-v1', + 'outer_plan': {'pin': plan_pin, 'bytes': len(endpoint), + 'sha256': schema.sha(endpoint)}, + 'parent_source_rows_including_outer_plan': len(files) + 1, + 'files': files, 'stage': stage, + 'source_closure_admission_sha256': + plan['source_closure_admission_sha256'], + 'interval_proved_by_endpoint_equality': False, + }) + return files, stage, raw + + +def make_prefix_owner(original_receivers): + schema.need(_PREFIX[0] is False, 'one prefix owner per fresh process') + _PREFIX[0] = True + began = _CLOCK() + state = None + try: + admissions = _gate_snapshot() + _native_bindings() + _clean(_UNKNOWN_OWNER) + errors = schema.make_error_owner() + _UNKNOWN_OWNER['native_errors'][0] = schema.owner_state(errors) + configuration = schema.plain_copy(CONFIGURATION) + plan_raw = copying.read_verified( + configuration['plan'], schema.RECORD_BYTES, error_owner=errors) + plan = group01.decode(plan_raw) + _validate_plan(plan) + policy = group01.decode(copying.read_verified( + configuration['receiver_policy'], schema.RECORD_BYTES, + error_owner=errors)) + schema.need(type(policy) is dict and + policy.get('v03_prefix_supervisor_v1') == + configuration['checker_source'], + 'prefix checker absent from independent source policy') + receivers = closure.bind_receivers(original_receivers, policy, errors) + schema.need( + closure.receiver(receivers, 'v03_prefix_supervisor_v1', + 'make_prefix_owner') is make_prefix_owner and + closure.receiver(receivers, 'epoch_schema_v5', + 'make_error_owner') is schema.make_error_owner and + closure.receiver(receivers, 'epoch_copy_v5', + 'inspect') is copying.inspect and + closure.receiver(receivers, 'parent_domain_v1', + 'create_domain') is domain.create_domain and + closure.receiver(receivers, 'parent_completion_v1', + '_snapshot_sources') is parent._snapshot_sources and + closure.receiver(receivers, 'v03_prefix_derivation_v1', + 'verify_configured_prefix') is + derivation.verify_configured_prefix, + 'prefix actual receiver identities differ', + ) + schema.need(parent._PARENTS == [] and parent._PROCESS[0] is None and + domain._DOMAINS == [], + 'prefix requires a fresh parent/domain lifetime') + _clean(parent._UNKNOWN_OWNER) + launch_contract = closure.receiver( + receivers, 'h25_parent_supervisor', 'launch_contract') + installer = closure.receiver( + receivers, 'h25_parent_supervisor', 'install_subreaper') + launch_contract() + closure.check_receivers(receivers) + + case = plan['case'] + state = { + 'pid': _PID(), 'phase': 'CONSTRUCTING', 'errors': errors, + 'plan': plan, 'configuration': configuration, + 'plan_raw': plan_raw, 'plan_endpoint_raw': [None, None, None], + 'plan_endpoint_count': 0, + 'admissions': admissions, 'receivers': receivers, + 'unknown_owner': _UNKNOWN_OWNER, + 'io_quarantine': _UNKNOWN_OWNER['quarantine'], + 'fallback': [None] * 8, + 'began': began, + 'shared_deadline': began + plan['session_seconds'], + 'lock_fds': [None, None], + 'native_keeper': None, 'subreaper': None, + 'initial_sources': None, 'run': None, + } + # Retain construction resources even if no capability is returned. + _PREFIX[1] = (None, state) + + parent._MKDIR(plan['session_directory'], 0o700) + parent._MKDIR(plan['session_directory'] + '/retained', 0o700) + for index, name in enumerate(('parent-queue.lock', 'science.lock')): + _clean(_UNKNOWN_OWNER) + _UNKNOWN_OWNER['pending'][0] = True + state['lock_fds'][index] = parent._OPEN( + plan['round_root'] + '/runtime/' + name, + os.O_RDWR | os.O_CREAT | os.O_CLOEXEC | os.O_NOFOLLOW, 0o600) + _UNKNOWN_OWNER['pending'][0] = False + _FLOCK(state['lock_fds'][index], fcntl.LOCK_EX | fcntl.LOCK_NB) + + _UNKNOWN_OWNER['pending'][0] = True + installed = installer(Path(plan['round_root'])) + state['subreaper'], state['native_keeper'] = installed + _UNKNOWN_OWNER['pending'][0] = False + closure.check_receivers(receivers) + _clean(_UNKNOWN_OWNER) + + state['initial_sources'] = _source_snapshot(state) + by_path = {row['path']: row for row in plan['source_files']} + pins = tuple(pin for name, pin in configuration.items() + if name != 'plan') + ( + case['root_source'], case['driver_source'], case['gate_values'], + ) + for pin in pins: + schema.need(pin['path'] in by_path and + by_path[pin['path']]['sha256'] == pin['sha256'] and + by_path[pin['path']]['bytes'] == pin['bytes'] and + by_path[pin['path']]['mode'] == + pin['identity']['mode'] & 0o7777, + 'prefix input absent from parent source custody') + state['root_bytes'] = copying.read_verified( + case['root_source'], 262144, error_owner=errors) + state['driver_bytes'] = copying.read_verified( + case['driver_source'], 262144, error_owner=errors) + original = copying.read_verified( + configuration['original_variant'], 262144, error_owner=errors) + schema.need(configuration['original_variant']['sha256'] == VARIANT_SHA, + 'original variant source pin differs') + gate_raw = copying.read_verified( + case['gate_values'], schema.RECORD_BYTES, error_owner=errors) + decode = closure.receiver(receivers, OBSERVER, '_decode') + values = decode(gate_raw, schema.RECORD_BYTES) + derivation.verify_configured_prefix( + original, state['driver_bytes'], values) + schema.need(all(value is not None for value in values.values()), + 'prefix remains unconfigured; launch withheld') + # The check above does not approve these values. Their genuine + # admission must already be established by the authenticated bootstrap. + state['before_pin'] = copying.write_once( + plan['session_directory'] + '/SOURCE-BEFORE.json', + state['initial_sources'][2], error_owner=errors) + state['phase'] = 'READY' + _guard(state) + token = object() + _PREFIX[1] = (token, state) + return token + except BaseException as error: + if _UNKNOWN_OWNER['primary'][0] is None: + _UNKNOWN_OWNER['primary'][0] = error + _UNKNOWN_OWNER['quarantine'][0] = True + if state is not None: + state['phase'] = 'STOP' + primary = _UNKNOWN_OWNER['primary'][0] + if primary is error: + raise + raise primary + + +def _terminal(state, run): + _guard(state) + schema.need(run['primary'][0] is None, + 'earlier run error forbids terminal observation') + if run['expectation']['outcome'] == 'PREFIX_RETURN': + return domain.terminal_facts(run['domain']) + return domain.prefix_exit1_terminal_facts(run['domain']) + + +def _supervise(state): + owner, plan = state['unknown_owner'], state['plan'] + case = plan['case'] + run = None + primary = first_cleanup = None + old_handler = None + alarm_installed = False + try: + _guard(state) + schema.need(state['phase'] == 'READY' and state['run'] is None, + 'prefix control already consumed') + state['phase'] = 'CONTROL_CONSUMED' + run = { + 'plan': case, 'unknown_owner': owner, + 'domain': None, 'process': None, 'root': None, 'terminal': None, + 'log_fds': [None, None], + 'log_close_attempted': [False, False], + 'log_close_confirmed': [False, False], + 'errors': [None] * 8, 'primary': [None], + 'acquisition_in_flight': False, + 'spawn_entered': False, 'spawn_returned': False, + 'finish_attempted': False, + 'began': _CLOCK(), 'peak_rss': 0, 'file_limits': None, + 'retained': {}, 'expectation': case['expectation'], + } + state['run'] = run + before = _source_snapshot(state) + schema.need(before == state['initial_sources'], + 'prefix source/stage changed before launch') + try: + parent._STAT(case['output'], follow_symlinks=False) + except FileNotFoundError: + pass + else: + raise schema.EpochStop('prefix output already exists') + + run['file_limits'] = tuple(parent._GETRLIMIT(resource.RLIMIT_FSIZE)) + run['domain'] = domain.create_domain(owner) + run['launch'] = copying.write_once( + plan['session_directory'] + '/LAUNCH.json', + _record_bytes({ + 'schema': 'h25-prefix-control-launch-v1', + 'case': case['id'], 'mode': plan['mode'], + 'generation': case['generation'], + 'launch_nonce': case['launch_nonce'], + 'parent_pid': state['pid'], 'command': case['command'], + 'cwd': case['stage_directory'], 'environment': ENV, + 'parent_file_limits': list(run['file_limits']), + 'root_seconds': case['root_seconds'], + 'address_space_bytes': case['address_space_bytes'], + 'rss_bytes': case['rss_bytes'], + 'new_session': True, 'close_fds': True, 'pass_fds': [], + 'production_completion': False, + }), error_owner=state['errors']) + + for index, name in enumerate(('stdout.raw', 'stderr.raw')): + _clean(owner) + run['acquisition_in_flight'] = True + owner['pending'][0] = True + run['log_fds'][index] = parent._OPEN( + plan['session_directory'] + '/' + name, + os.O_WRONLY | os.O_CREAT | os.O_EXCL | + os.O_CLOEXEC | os.O_NOFOLLOW, 0o600) + run['acquisition_in_flight'] = False + owner['pending'][0] = False + + setter, kind = parent._SETRLIMIT, resource.RLIMIT_AS + limits = (case['address_space_bytes'], case['address_space_bytes']) + + def child_limit(): + setter(kind, limits) + + schema.need(parent._GETTIMER(signal.ITIMER_REAL) == (0.0, 0.0), + 'existing timer cannot be replaced') + old_handler = parent._GETSIGNAL(signal.SIGALRM) + parent._SIGNAL(signal.SIGALRM, parent._alarm) + alarm_installed = True + deadline = min(run['began'] + case['root_seconds'], + state['shared_deadline'] - domain.CLEANUP_SECONDS) + schema.need(_CLOCK() < deadline, 'no funded root/cleanup interval') + parent._SETTIMER(signal.ITIMER_REAL, + max(0.000001, deadline - _CLOCK())) + _guard(state) + run['spawn_entered'] = True + run['process'] = parent._POPEN( + case['command'], cwd=case['stage_directory'], env=dict(ENV), + stdout=run['log_fds'][0], stderr=run['log_fds'][1], + stdin=subprocess.DEVNULL, close_fds=True, pass_fds=(), + start_new_session=True, preexec_fn=child_limit) + run['spawn_returned'] = True + run['root'] = domain.adopt_popen(run['domain'], run['process']) + while True: + unused, current = domain.observe(run['domain']) + run['peak_rss'] = max(run['peak_rss'], + sum(row[6] for row in current)) + schema.need(run['peak_rss'] <= case['rss_bytes'], + 'owned prefix RSS sum exceeded') + schema.need(max(parent._STAT( + plan['session_directory'] + '/' + name, + follow_symlinks=False).st_size + for name in ('stdout.raw', 'stderr.raw')) <= schema.LOG_BYTES, + 'prefix raw log bound exceeded') + if domain.poll_owned(run['domain']) is not None: + break + parent._SLEEP(0.01) + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + primary = owner['primary'][0] + if run is not None: + run['primary'][0] = primary + if error is not primary: + run['errors'][4] = error + if (owner['pending'][0] or owner['iterator_uncertain'][0] or + (run is not None and run['acquisition_in_flight']) or + type(error) is MemoryError): + owner['quarantine'][0] = True + finally: + if alarm_installed: + try: + parent._SETTIMER(signal.ITIMER_REAL, 0) + parent._SIGNAL(signal.SIGALRM, old_handler) + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + if run is not None: + run['errors'][2] = error + first_cleanup = error + if run is not None and run['domain'] is not None: + run['finish_attempted'] = True + try: + domain.finish_domain(run['domain']) + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + owner['quarantine'][0] = True + run['errors'][3] = error + if first_cleanup is None: + first_cleanup = error + if run is not None: + try: + parent._close_logs( + run, primary if primary is not None else first_cleanup) + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + if first_cleanup is None: + first_cleanup = error + for index in range(2): + if (run['log_close_attempted'][index] and + not run['log_close_confirmed'][index]): + owner['quarantine'][0] = True + + if owner['primary'][0] is not None: + state['phase'] = 'STOP' + raise owner['primary'][0] + schema.need(run is not None and run['spawn_entered'] is True and + run['spawn_returned'] is True and + run['finish_attempted'] is True and + run['acquisition_in_flight'] is False and + all(run['log_close_confirmed']), + 'prefix spawn/stream ownership incomplete') + schema.need(tuple(parent._GETRLIMIT(resource.RLIMIT_FSIZE)) == + run['file_limits'], 'parent file limit drift') + run['terminal'] = _terminal(state, run) + state['phase'] = 'CONTROL_JOINED' + return run + + +def _directory_identity(info): + return (info.st_dev, info.st_ino, info.st_mode, info.st_nlink, + info.st_uid, info.st_gid, info.st_size, + info.st_mtime_ns, info.st_ctime_ns) + + +def _census_output(state, directory, files, directories): + """Original path-census ownership pattern; C07 remains a prerequisite.""" + _clean(state['unknown_owner']) + schema.path(directory) + schema.need(len(files) + len(directories) <= 9, + 'prefix output declaration bound') + before = parent._STAT(directory, follow_symlinks=False) + schema.need(stat.S_ISDIR(before.st_mode), 'prefix directory kind differs') + owner = state['unknown_owner'] + iterator = None + primary = None + found_files, found_directories = [], [] + owner['pending'][0] = True + try: + iterator = parent._SCANDIR(directory) + owner['pending'][0] = False + for entry in iterator: + schema.need(type(entry) is os.DirEntry, + 'prefix native directory entry differs') + name = entry.name + schema.need(type(name) is str and 0 < len(name) <= 256 and + '/' not in name and name not in ('.', '..'), + 'prefix directory entry name differs') + schema.need(len(found_files) + len(found_directories) < 9, + 'prefix output entry bound exceeded') + info = entry.stat(follow_symlinks=False) + if stat.S_ISREG(info.st_mode): + found_files.append(name) + elif stat.S_ISDIR(info.st_mode): + found_directories.append(name) + else: + raise schema.EpochStop('prefix symlink/special output refused') + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + primary = owner['primary'][0] + owner['quarantine'][0] = True + owner['iterator_uncertain'][0] = True + if primary is error: + raise + raise primary + finally: + if iterator is not None: + owned = iterator + iterator = None + try: + owned.close() + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + owner['quarantine'][0] = True + owner['iterator_uncertain'][0] = True + if state['fallback'][3] is None: + state['fallback'][3] = error + if primary is None: + raise owner['primary'][0] + after = parent._STAT(directory, follow_symlinks=False) + schema.need(_directory_identity(before) == _directory_identity(after), + 'prefix directory changed during census') + schema.need(sorted(found_files) == sorted(files) and + sorted(found_directories) == sorted(directories), + 'prefix exact output census differs') + return _directory_identity(after) + + +def _capture(state, run): + plan, case = state['plan'], state['plan']['case'] + names = _expected_files(case['expectation']) + occupied, raw, pins = (), {}, {} + sources = ( + ('stdout.raw', plan['session_directory'] + '/stdout.raw', + schema.LOG_BYTES), + ('stderr.raw', plan['session_directory'] + '/stderr.raw', + schema.LOG_BYTES), + ) + tuple((name, case['output'] + '/' + name, schema.RECORD_BYTES) + for name in names) + + # Complete exclusive copies precede semantic interpretation. + for name, path, bound in sources: + _guard(state) + source = copying.inspect(path, bound, error_owner=state['errors']) + run['retained'][name] = {'source': source} + pair = schema.inode(source) + schema.need(pair not in occupied, 'prefix raw occurrences alias') + occupied += (pair,) + copied = copying.copy_once( + source, plan['session_directory'] + '/retained/' + name, + occupied, error_owner=state['errors']) + run['retained'][name]['copy'] = copied + occupied += (schema.inode(copied),) + raw[name] = copying.read_verified( + copied, bound, error_owner=state['errors']) + pins[name] = (source, copied, bound) + + output_identity = _census_output( + state, case['output'], names, ('initial-tcb-controls',)) + scratch_identity = _census_output( + state, case['output'] + '/initial-tcb-controls', (), ()) + decode = closure.receiver(state['receivers'], OBSERVER, '_decode') + values = {name: decode(raw[name], schema.RECORD_BYTES) for name in names} + closure.check_receivers(state['receivers']) + schema.need(raw['stdout.raw'] == b'', 'prefix stdout is not empty') + for name in ('initial-tcb.raw.json', 'initial-restoration.raw.json'): + receipt = values[name] + schema.need(type(receipt) is dict and + type(receipt.get('pid')) is int and + receipt['pid'] == run['root'][0], + 'prefix initial/restoration PID differs') + + expected = case['expectation'] + binding = {'mode': plan['mode'], 'generation': case['generation'], + 'launch_nonce': case['launch_nonce']} + if expected['outcome'] == 'PREFIX_RETURN': + schema.need(raw['stderr.raw'] == b'', + 'positive prefix stderr is not empty') + check = closure.receiver( + state['receivers'], OBSERVER, 'corroborate_positive') + ok = check(raw['v03-input-result.raw.json'], + raw['v03-root-after.raw.json'], + raw['preflight-before.raw.json'], + binding, schema.RECORD_BYTES) + else: + check = closure.receiver( + state['receivers'], OBSERVER, 'corroborate_complete_refusal') + ok = check(state['driver_bytes'], state['root_bytes'], + case['driver_source']['path'], case['root_source']['path'], + raw['stderr.raw'], expected['terminal_function'], + expected['message'], schema.LOG_BYTES) + schema.need(ok is True, 'complete prefix data corroboration differs') + closure.check_receivers(state['receivers']) + for source, copied, bound in pins.values(): + _clean(state['unknown_owner']) + copying.verify(source, bound, error_owner=state['errors']) + copying.verify(copied, bound, error_owner=state['errors']) + schema.need( + _census_output(state, case['output'], names, + ('initial-tcb-controls',)) == output_identity and + _census_output(state, case['output'] + '/initial-tcb-controls', + (), ()) == scratch_identity, + 'prefix output changed after capture', + ) + + +def run_prefix(token): + state = _state(token) + owner = state['unknown_owner'] + try: + run = _supervise(state) + _capture(state, run) + after = _source_snapshot(state) + schema.need(after == state['initial_sources'], + 'complete prefix source/stage custody changed') + schema.need(_terminal(state, run) == run['terminal'], + 'prefix owned terminal facts changed') + case = state['plan']['case'] + schema.need(_CLOCK() - run['began'] <= case['root_seconds'], + 'complete prefix root/capture tail exceeded bound') + _guard(state) + record = { + 'schema': 'h25-owned-v03-prefix-observation-v1', + 'case': case['id'], 'mode': state['plan']['mode'], + 'generation': case['generation'], + 'launch_nonce': case['launch_nonce'], + 'launch': run['launch'], 'terminal': run['terminal'], + 'source_before': state['before_pin'], + 'source_after_equals_before': True, + 'outer_plan_endpoint_reads': state['plan_endpoint_count'], + 'raw': run['retained'], + 'data_corroboration': 'COMPLETE_PREFIX_DATA_ONLY', + 'independent_native_receipt_replay_performed': False, + 'interval_proved_by_endpoint_equality': False, + 'parent_exit_observed_here': False, + 'enclosing_guard_must_observe_parent_exit': True, + 'production_completion': False, + 'full_c05': False, 'full_v03': False, + 'runtime_qualified': False, + } + result = copying.write_once( + state['plan']['session_directory'] + '/PREFIX-OBSERVATION.json', + _record_bytes(record), error_owner=state['errors']) + _guard(state) + schema.need(_CLOCK() - run['began'] <= case['root_seconds'], + 'complete prefix result-writing tail exceeded bound') + state['phase'] = 'CLOSED' + # Plain file pin DATA only. No owner/domain/Popen/epoch token escapes. + return schema.plain_copy(result) + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + state['phase'] = 'STOP' + if owner['pending'][0] or owner['iterator_uncertain'][0]: + owner['quarantine'][0] = True + primary = owner['primary'][0] + if primary is error: + raise + raise primary + + +def stop_evidence(token): + state = _state(token) + run = state['run'] + summary = None if run is None else { + 'spawn_entered': run['spawn_entered'], + 'spawn_returned': run['spawn_returned'], + 'finish_attempted': run['finish_attempted'], + 'log_close_attempted': list(run['log_close_attempted']), + 'log_close_confirmed': list(run['log_close_confirmed']), + } + return (state['unknown_owner']['primary'], state['errors'], + state['fallback'], summary) diff --git a/research/h25-v03-prefix-supervision/unit05/implementation/v03_source_refusal_observer_v1.py b/research/h25-v03-prefix-supervision/unit05/implementation/v03_source_refusal_observer_v1.py new file mode 100644 index 0000000000..d03b4e14bd --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/implementation/v03_source_refusal_observer_v1.py @@ -0,0 +1,290 @@ +"""Pure source-location corroboration for parent-retained V03 stderr. + +This does not establish ownership, currentness, admission, or even that a child +ran. The genuine parent must supply its complete retained raw stderr after +actual owned termination, with independently authenticated driver/stage pins. +No result of this function by itself is a V03 PASS or a ParentCompletion. +""" +import ast +import hashlib +import json + +COMPONENT_LOG_BYTES = 2 * 1024 * 1024 +COMPONENT_RECORD_BYTES = 1048576 +ROOT_COUNTERS = ('load_calls', 'native_creations', 'native_execs', + 'activation_attempts', 'successful_bindings', + 'deactivation_attempts', 'cleanup_failures', + 'control_module_creations') + +MESSAGES = { + '_vcheck_literal_sources': ( + 'Variant source role path differs', + 'Variant reviewed source/header differs', + 'Variant role file omitted from closure'), + '_vcheck_custody': ('Variant current source closure differs',), + '_v03_original_input_prefix': ( + 'Variant literal configuration differs', + 'Variant original preflight differs'), +} + + +def source_site(driver_bytes, function, message): + """Derive the unique original logical-raise line without running code.""" + if (type(driver_bytes) is not bytes or not 0 < len(driver_bytes) <= 262144 or + type(function) is not str or type(message) is not str or + function not in MESSAGES or message not in MESSAGES[function]): + raise ValueError('bounded source and literal V03 refusal required') + tree = ast.parse(driver_bytes, feature_version=(3, 12)) + candidates = [node for node in tree.body + if isinstance(node, ast.FunctionDef) and node.name == function] + if len(candidates) != 1: + raise ValueError('unique actual control function required') + sites = [] + for node in ast.walk(candidates[0]): + if not isinstance(node, ast.Raise): + continue + value = node.exc + if (isinstance(value, ast.Call) and isinstance(value.func, ast.Name) and + value.func.id == 'RuntimeError' and len(value.args) == 1 and + not value.keywords and isinstance(value.args[0], ast.Constant) and + type(value.args[0].value) is str and value.args[0].value == message): + sites.append(node.lineno) + if len(sites) != 1: + raise ValueError('unique actual literal raise required') + return sites[0] + + +def corroborate_raw_refusal(driver_bytes, driver_path, stderr_raw, + function, message, original_log_bound): + """Recognize only the expected terminal logical source refusal. + + All exceptions from this checker mean incomplete verification. A False + return means different or insufficient raw evidence; never generic success. + The bound is the existing parent's independently fixed log limit, not a + newly increased allowance. This is terminal-site corroboration only: it + refuses conventional chaining but does not establish the middle frames or + complete traceback grammar. Use corroborate_complete_refusal as well before + accepting the proposed genuine-Root source-refusal route. + """ + if (type(driver_path) is not str or not 1 < len(driver_path) <= 4096 or + not driver_path.startswith('/') or + any(not 32 <= ord(c) < 127 for c in driver_path) or + type(original_log_bound) is not int or original_log_bound <= 0): + raise ValueError('actual source path and existing parent log limit required') + if (type(stderr_raw) is not bytes or + len(stderr_raw) > min(original_log_bound, COMPONENT_LOG_BYTES)): + return False + line_number = source_site(driver_bytes, function, message) + header = (' File "' + driver_path + '", line ' + str(line_number) + + ', in ' + function).encode('ascii') + ending = ('RuntimeError: ' + message + '\n').encode('ascii') + start = b'Traceback (most recent call last):\n' + if (not stderr_raw.startswith(start) or not stderr_raw.endswith(ending) or + stderr_raw.count(start) != 1 or + b'During handling of the above exception' in stderr_raw or + b'The above exception was the direct cause' in stderr_raw): + return False + frames = [line for line in stderr_raw.splitlines() if line.startswith(b' File "')] + return bool(frames) and frames[-1] == header + + +def _executed_calls(node, name): + """Find module/function-body calls without descending into new scopes.""" + result = [] + pending = list(ast.iter_child_nodes(node)) + while pending: + child = pending.pop() + if isinstance(child, (ast.FunctionDef, ast.AsyncFunctionDef, + ast.ClassDef, ast.Lambda)): + continue + if (isinstance(child, ast.Call) and isinstance(child.func, ast.Name) + and child.func.id == name): + result.append(child.lineno) + pending.extend(ast.iter_child_nodes(child)) + if len(result) != 1: + raise ValueError('unique actual source call required') + return result[0] + + +def corroborate_complete_refusal(driver_bytes, root_bytes, driver_path, + root_path, stderr_raw, function, message, + original_log_bound): + """Check the full standard traceback shape for the exact f5 Root route. + + This is a strict source-derived corroborator. It grants no ownership, + authenticity, currentness, error-delivery or admission credential. The parent + must separately authenticate the exact selected driver and complete streams. + Unavailable source lines, custom formatters, elision and nonstandard output + are refused, rather than silently accepted as complete original evidence. + """ + if not corroborate_raw_refusal(driver_bytes, driver_path, stderr_raw, + function, message, original_log_bound): + return False + if (type(root_bytes) is not bytes or len(root_bytes) != 38851 or + hashlib.sha256(root_bytes).hexdigest() != + 'f5a2d33f2b4d3651f214156a0e7094c2bb516ce2d5ab7698d18c11f98f35dee0' or + type(root_path) is not str or not 1 < len(root_path) <= 4096 or + not root_path.startswith('/') or root_path == driver_path or + any(not 32 <= ord(c) < 127 for c in root_path)): + raise ValueError('exact original Root bytes and distinct path required') + root_tree = ast.parse(root_bytes, feature_version=(3, 12)) + driver_tree = ast.parse(driver_bytes, feature_version=(3, 12)) + roots = [n for n in root_tree.body + if isinstance(n, ast.FunctionDef) and n.name == '_entry'] + prefixes = [n for n in driver_tree.body if isinstance(n, ast.FunctionDef) + and n.name == '_v03_original_input_prefix'] + if len(roots) != 1 or len(prefixes) != 1: + raise ValueError('unique actual Root entry and control prefix required') + terminal = source_site(driver_bytes, function, message) + expected = [(root_path, _executed_calls(root_tree, '_entry'), ''), + (root_path, _executed_calls(roots[0], '_EXEC'), '_entry'), + (driver_path, _executed_calls(driver_tree, + '_v03_original_input_prefix'), + '')] + if function != '_v03_original_input_prefix': + expected.append((driver_path, _executed_calls(prefixes[0], function), + '_v03_original_input_prefix')) + expected.append((driver_path, terminal, function)) + root_lines = root_bytes.decode('utf-8').splitlines() + driver_lines = driver_bytes.decode('utf-8').splitlines() + raw_lines = stderr_raw.splitlines(keepends=True) + position = 1 # The terminal corroborator already checked the initial header. + for path, line, frame in expected: + header = (' File "' + path + '", line ' + str(line) + ', in ' + + frame + '\n').encode('ascii') + source = root_lines if path == root_path else driver_lines + printed = (' ' + source[line - 1].strip() + '\n').encode('utf-8') + if (position + 1 >= len(raw_lines) or raw_lines[position] != header or + raw_lines[position + 1] != printed): + return False + position += 2 + # CPython may add a range indicator. It has no extra source authority. + if (position < len(raw_lines) and + raw_lines[position].startswith(b' ') and + raw_lines[position].strip(b' \n') and + all(c in b' ~^\n' for c in raw_lines[position]) and + b'^' in raw_lines[position]): + indicator = raw_lines[position].strip(b' \n') + # The standard formatter has one contiguous primary caret range. + first = indicator.find(b'^') + last = indicator.rfind(b'^') + if (any(c != 126 for c in indicator[:first]) or + any(c != 94 for c in indicator[first:last+1]) or + any(c != 126 for c in indicator[last+1:])): + return False + position += 1 + ending = ('RuntimeError: ' + message + '\n').encode('ascii') + return position == len(raw_lines) - 1 and raw_lines[position] == ending + + +def _no_noninteger(token): + raise ValueError('noninteger JSON number or constant') + + +def _integer(token): + if len(token) > 21: + raise ValueError('JSON integer length bound') + value = int(token) + if not -(1 << 64) <= value < (1 << 64): + raise ValueError('JSON integer domain') + return value + + +def _pairs(pairs): + if len(pairs) > 1024: + raise ValueError('JSON mapping bound') + result = {} + for key, value in pairs: + if key in result: + raise ValueError('duplicate JSON key') + result[key] = value + return result + + +def _tree(value, depth, budget): + budget[0] += 1 + if depth > 24 or budget[0] > 65536: + raise ValueError('JSON tree bound') + kind = type(value) + if value is None or kind is bool or kind is int: + return + if kind is str: + budget[1] += len(value) + if len(value) > 8192 or budget[1] > 524288: + raise ValueError('JSON text bound') + return + if kind is list: + if len(value) > 1024: + raise ValueError('JSON sequence bound') + for item in value: + _tree(item, depth + 1, budget) + return + if kind is dict: + for key in value: + _tree(key, depth + 1, budget) + _tree(value[key], depth + 1, budget) + return + raise ValueError('foreign JSON value') + + +def _decode(raw, original_record_bound): + if (type(original_record_bound) is not int or original_record_bound <= 0 or + type(raw) is not bytes or + not 0 < len(raw) <= min(original_record_bound, COMPONENT_RECORD_BYTES)): + raise ValueError('existing parent/raw component byte bound') + value = json.loads(raw.decode('ascii'), object_pairs_hook=_pairs, + parse_int=_integer, parse_float=_no_noninteger, + parse_constant=_no_noninteger) + _tree(value, 0, [0, 0]) + return value + + +def corroborate_positive(result_raw, root_after_raw, preflight_raw, + parent_binding, original_record_bound): + """Corroborate three complete raw records against independent launch data. + + A True result is ONLY these three checks. Original initial TCB/five-control/ + restoration records, custody-before, independent dependencies, parent source + continuity, domain ownership and terminal capture remain required elsewhere. + Limits here are additional component ceilings, never increased parent caps. + Decode resource/MemoryError failures propagate for parent first-error capture. + """ + if (type(parent_binding) is not dict or + any(type(k) is not str for k in parent_binding) or set(parent_binding) != { + 'mode', 'generation', 'launch_nonce'} or + any(type(v) is not str for v in parent_binding.values()) or + parent_binding['mode'] not in ('normal', 'optimized') or + not 1 <= len(parent_binding['generation']) <= 96 or + any(c not in 'abcdefghijklmnopqrstuvwxyz0123456789-' + for c in parent_binding['generation']) or + len(parent_binding['launch_nonce']) != 64 or + any(c not in '0123456789abcdef' for c in parent_binding['launch_nonce'])): + raise ValueError('independent actual parent launch binding required') + result = _decode(result_raw, original_record_bound) + counters = _decode(root_after_raw, original_record_bound) + preflight = _decode(preflight_raw, original_record_bound) + if (type(result) is not dict or set(result) != { + 'schema', 'status', 'binding', 'whole_variant_producer_completed', + 'runtime_qualified'} or + type(result['schema']) is not str or + result['schema'] != 'h25-v03-input-prefix-result-v1' or + type(result['status']) is not str or + result['status'] != 'ORIGINAL_INPUT_PREFIX_RETURNED' or + result['whole_variant_producer_completed'] is not False or + result['runtime_qualified'] is not False or + type(result['binding']) is not dict or + set(result['binding']) != set(parent_binding) or + any(type(result['binding'][k]) is not str or + result['binding'][k] != parent_binding[k] for k in parent_binding)): + return False + if (type(counters) is not dict or set(counters) != set(ROOT_COUNTERS) or + any(type(counters[k]) is not int or counters[k] != 0 for k in ROOT_COUNTERS)): + return False + return (type(preflight) is dict and set(preflight) == { + 'schema', 'authenticated_files', 'native_private_access', 'cached_admission'} and + type(preflight['schema']) is str and + preflight['schema'] == 'h25-public-runtime-preflight-v2' and + type(preflight['authenticated_files']) is int and + preflight['authenticated_files'] == 217 and + preflight['native_private_access'] is False and + preflight['cached_admission'] is False) diff --git a/research/h25-v03-prefix-supervision/unit05/proposal/closure-allowance.py.fragment b/research/h25-v03-prefix-supervision/unit05/proposal/closure-allowance.py.fragment new file mode 100644 index 0000000000..3c75d25e27 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/proposal/closure-allowance.py.fragment @@ -0,0 +1 @@ + 'v03_prefix_supervisor_v1': ('_PREFIX', '_UNKNOWN_OWNER'), diff --git a/research/h25-v03-prefix-supervision/unit05/proposal/domain-prefix-accessor.py.fragment b/research/h25-v03-prefix-supervision/unit05/proposal/domain-prefix-accessor.py.fragment new file mode 100644 index 0000000000..f58451915f --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/proposal/domain-prefix-accessor.py.fragment @@ -0,0 +1,80 @@ +def prefix_exit1_terminal_facts(capability): + """Return cleanup/exit DATA for an actual owned prefix child exiting 1. + + Separate from production terminal_facts. Never creates an epoch ticket, + ParentCompletion, source admission, or control-family acceptance. + """ + state = _state(capability) + owner = state['unknown_owner'] + try: + schema.need(_GETPID() == state['parent_pid'], + 'prefix terminal observer is not the owning parent') + _fresh_acquisition(state) + schema.need(owner['primary'][0] is None and + state['primary'][0] is None, + 'earlier error forbids prefix terminal observation') + schema.need( + state['phase'] == 'CLOSED' and + state['quarantine'] is False and + state['acquisition_in_flight'] is False and + state['io_uncertain'] is False and + state['root'] is not None and + _TYPE(state['returncode']) is int and + state['returncode'] == 1 and + state['closure_confirmed'] is True and + state['final_rows'] == () and + not state['after_root'] and + not state['reaped'] and + all(fd is None or + (state['fd_attempted'][index] and state['fd_closed'][index]) + for index, fd in enumerate(state['fds'])), + 'owned exit1 prefix domain is incomplete or quarantined', + ) + rows = _census(state) + schema.need( + not any(row[1] == state['parent_pid'] or + (row[2], row[3]) in state['groups'] + for row in rows.values()), + 'postcleanup owned prefix child/group still present', + ) + return { + 'schema': 'h25-prefix-exit1-terminal-facts-v1', + 'root': list(state['root']), + 'returncode': state['returncode'], + 'owned_generations': [ + list(row) for row in state['rows'][:state['count']] + ], + 'groups': [list(pair) for pair in sorted(state['groups'])], + 'remaining': [], + 'adopted_reaps': [], + 'observed_after_root_exit': [], + 'pidfd_close_attempted': list( + state['fd_attempted'][:state['count']] + ), + 'pidfd_close_confirmed': list( + state['fd_closed'][:state['count']] + ), + 'source': 'original in-process Popen and owned generation registry', + 'production_completion': False, + 'refusal_semantics_authenticated_by_this_function': False, + 'hostile_fork_or_privileged_host_resistance_claimed': False, + } + except BaseException as error: + if owner['primary'][0] is None: + prior = state['primary'][0] + owner['primary'][0] = error if prior is None else prior + primary = owner['primary'][0] + if state['primary'][0] is None: + state['primary'][0] = primary + if error is not primary: + if state['secondary'][8] is None: + state['secondary'][8] = error + elif state['overflow'][0] is None: + state['overflow'][0] = error + state['quarantine'] = True + owner['quarantine'][0] = True + # Do not change phase: an invalid early call must not prevent + # finish_domain from reaching its known-FD cleanup. + if primary is error: + raise + raise primary diff --git a/research/h25-v03-prefix-supervision/unit05/proposal/test_v03_prefix_supervisor_v1.py b/research/h25-v03-prefix-supervision/unit05/proposal/test_v03_prefix_supervisor_v1.py new file mode 100644 index 0000000000..02fbb90fc9 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/proposal/test_v03_prefix_supervisor_v1.py @@ -0,0 +1,173 @@ +"""Pure fixtures for newly authored functions; no archived module import. + +These tests establish local predicates and error retention only. Synthetic +states are never evidence of Popen, kernel cleanup, source admission or C05. +""" +import ast +import copy +from pathlib import Path +from types import SimpleNamespace +import unittest + + +def new_function(path, name, globals_map): + source = Path(path).read_text(encoding='utf-8') + tree = ast.parse(source, feature_version=(3, 12)) + matches = [node for node in tree.body + if type(node) is ast.FunctionDef and node.name == name] + if len(matches) != 1: + raise ValueError('unique newly authored function required') + module = ast.Module(body=matches, type_ignores=[]) + scope = dict(globals_map) + exec(compile(module, '', 'exec'), scope) + return scope[name] + + +class Stop(RuntimeError): + pass + + +def need(condition, message): + if condition is not True: + raise Stop(message) + + +class AccessorTests(unittest.TestCase): + def setUp(self): + self.owner = { + 'primary': [None], 'quarantine': [False], + 'pending': [False], 'iterator_uncertain': [False], + 'native_errors': [None] * 4, + } + self.state = { + 'parent_pid': 10, 'unknown_owner': self.owner, + 'primary': [None], 'secondary': [None] * 16, + 'overflow': [None], 'phase': 'CLOSED', + 'quarantine': False, 'acquisition_in_flight': False, + 'io_uncertain': False, + 'root': (11, 10, 11, 11, 123, 'Z', 0), + 'returncode': 1, 'closure_confirmed': True, + 'final_rows': (), 'after_root': set(), 'reaped': [], + 'fds': [7], 'fd_attempted': [True], 'fd_closed': [True], + 'rows': [(11, 10, 11, 11, 123, 'Z', 0)], + 'count': 1, 'groups': {(11, 11)}, + } + self.token = object() + self.rows = {} + self.census_calls = 0 + + def state(token): + need(token is self.token, 'synthetic token mismatch') + return self.state + + def fresh(value): + owner = value['unknown_owner'] + need(not owner['quarantine'][0] and + not owner['pending'][0] and + not owner['iterator_uncertain'][0], + 'synthetic uncertainty') + + def census(value): + self.census_calls += 1 + return self.rows + + self.call = new_function( + 'parent_domain_v1.py', 'prefix_exit1_terminal_facts', + {'_state': state, '_GETPID': lambda: 10, + '_fresh_acquisition': fresh, '_census': census, + '_TYPE': type, 'schema': SimpleNamespace(need=need)}) + + def test_intact_exit1_predicate(self): + result = self.call(self.token) + self.assertEqual(result['returncode'], 1) + self.assertIs(result['production_completion'], False) + self.assertIs( + result['refusal_semantics_authenticated_by_this_function'], False) + self.assertEqual(self.census_calls, 1) + + def test_other_exit_dispositions(self): + for value in (0, 2, -9, True, 1.0): + with self.subTest(value=repr(value)): + self.setUp() + self.state['returncode'] = value + with self.assertRaises(Stop): + self.call(self.token) + self.assertEqual(self.census_calls, 0) + + def test_unclosed_fd(self): + self.state['fd_closed'][0] = False + with self.assertRaises(Stop): + self.call(self.token) + + def test_late_owned_child(self): + self.rows = {12: (12, 10, 12, 12, 456, 'R', 1)} + with self.assertRaises(Stop): + self.call(self.token) + + def test_existing_primary_identity(self): + first = RuntimeError('first') + self.owner['primary'][0] = first + try: + self.call(self.token) + except BaseException as caught: + self.assertIs(caught, first) + else: + self.fail('earlier primary was accepted') + self.assertEqual(self.census_calls, 0) + + def test_local_primary_identity(self): + first = RuntimeError('local first') + self.state['primary'][0] = first + try: + self.call(self.token) + except BaseException as caught: + self.assertIs(caught, first) + self.assertIs(self.owner['primary'][0], first) + else: + self.fail('local primary was replaced') + + def test_invalid_early_call_keeps_cleanup_phase(self): + self.state['phase'] = 'RUNNING' + with self.assertRaises(Stop): + self.call(self.token) + self.assertEqual(self.state['phase'], 'RUNNING') + self.assertTrue(self.owner['quarantine'][0]) + + +class SourceStructureTests(unittest.TestCase): + def test_supervisor_has_no_mint_call(self): + source = Path('v03_prefix_supervisor_v1.py').read_text() + tree = ast.parse(source) + forbidden = { + 'ParentEpoch', 'ParentCompletion', 'reserve_producer', + 'accept_completed_producer', 'commit_exports', + '_EPOCH_COMPLETION', '_EPOCH_ACCEPT', + } + names = {node.id for node in ast.walk(tree) + if type(node) is ast.Name} + attributes = {node.attr for node in ast.walk(tree) + if type(node) is ast.Attribute} + self.assertFalse(forbidden & (names | attributes)) + + def test_complete_observer_selected(self): + source = Path('v03_prefix_supervisor_v1.py').read_text() + self.assertIn("'corroborate_complete_refusal'", source) + self.assertNotIn("'corroborate_raw_refusal'", source) + + def test_source_gates_remain_none(self): + tree = ast.parse(Path('v03_prefix_supervisor_v1.py').read_text()) + required = { + 'CONFIGURATION', 'SOURCE_REVIEW', 'STAGE_APPROVAL', + 'COMMAND_APPROVAL', 'FUNDING', 'EXECUTION_APPROVAL', + } + found = {} + for node in tree.body: + if type(node) is ast.Assign and len(node.targets) == 1: + target = node.targets[0] + if type(target) is ast.Name and target.id in required: + found[target.id] = ast.literal_eval(node.value) + self.assertEqual(found, {name: None for name in required}) + + +if __name__ == '__main__': + unittest.main() diff --git a/research/h25-v03-prefix-supervision/unit05/proposal/v03_prefix_derivation_v1.py b/research/h25-v03-prefix-supervision/unit05/proposal/v03_prefix_derivation_v1.py new file mode 100644 index 0000000000..25d0cdfbc9 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/proposal/v03_prefix_derivation_v1.py @@ -0,0 +1,99 @@ +"""Verify only eight literal replacements in the exact reviewed V03 prefix. + +Source proposal, Apache-2.0. Preserve original authors and derivation notices. +Pinned gate-value DATA does not confer source/native/funding/runtime admission. +""" +import ast +from v03_integrated_constructor_v1 import GATES, build_control_driver + + +def _plain(value): + budget = [0, 0] + + def walk(item, depth): + budget[0] += 1 + if depth > 24 or budget[0] > 65536: + raise ValueError('gate tree bound') + kind = type(item) + if item is None or kind is bool: + return + if kind is int: + if not -(1 << 64) <= item < (1 << 64): + raise ValueError('gate integer bound') + return + if kind is str: + budget[1] += len(item) + if len(item) > 8192 or budget[1] > 524288: + raise ValueError('gate text bound') + return + if kind not in (list, dict) or len(item) > 1024: + raise ValueError('gate exact JSON domain') + if kind is dict: + for key in item: + if type(key) is not str: + raise ValueError('gate exact string key required') + walk(key, depth + 1) + walk(item[key], depth + 1) + else: + for child in item: + walk(child, depth + 1) + + walk(value, 0) + + +def _same(left, right): + if type(left) is not type(right): + return False + if type(left) is dict: + return (set(left) == set(right) and + all(_same(left[k], right[k]) for k in left)) + if type(left) is list: + return (len(left) == len(right) and + all(_same(a, b) for a, b in zip(left, right))) + return left == right + + +def verify_configured_prefix(original_bytes, driver_bytes, frozen_gate_values): + expected = build_control_driver(original_bytes) + if type(driver_bytes) is not bytes or not 0 < len(driver_bytes) <= 262144: + raise ValueError('selected driver byte bound') + _plain(frozen_gate_values) + if type(frozen_gate_values) is not dict or set(frozen_gate_values) != set(GATES): + raise ValueError('exact eight frozen gates required') + + tree = ast.parse(driver_bytes, feature_version=(3, 12)) + offsets, position = [], 0 + for line in driver_bytes.splitlines(keepends=True): + offsets.append(position) + position += len(line) + + actual, spans = {}, [] + for node in tree.body: + if (type(node) is ast.Assign and len(node.targets) == 1 and + type(node.targets[0]) is ast.Name and + node.targets[0].id in GATES): + name, value = node.targets[0].id, node.value + if name in actual: + raise ValueError('duplicate configured gate') + pending, count = [(value, 0)], 0 + while pending: + child, depth = pending.pop() + count += 1 + if depth > 26 or count > 65536: + raise ValueError('literal AST bound') + pending.extend((part, depth + 1) + for part in ast.iter_child_nodes(child)) + actual[name] = ast.literal_eval(value) + spans.append(( + offsets[value.lineno - 1] + value.col_offset, + offsets[value.end_lineno - 1] + value.end_col_offset, + )) + + _plain(actual) + if set(actual) != set(GATES) or not _same(actual, frozen_gate_values): + raise ValueError('configured values differ from independently pinned data') + normalized = driver_bytes + for start, end in sorted(spans, reverse=True): + normalized = normalized[:start] + b'None' + normalized[end:] + if normalized != expected: + raise ValueError('selected source differs outside eight literal values') diff --git a/research/h25-v03-prefix-supervision/unit05/proposal/v03_prefix_supervisor_v1.py b/research/h25-v03-prefix-supervision/unit05/proposal/v03_prefix_supervisor_v1.py new file mode 100644 index 0000000000..e65414302f --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/proposal/v03_prefix_supervisor_v1.py @@ -0,0 +1,804 @@ +"""One non-minting genuine-Root V03 prefix observation per fresh parent. + +Conditional source proposal, Apache-2.0. Derived from the recovered original +parent/domain/closure/copy/supervisor sources. Preserve all original notices. + +The enclosing trusted bootstrap must authenticate this source, its imports, +configured selections and native/OS startup before import. C07 ancestor and +immutable-lifetime conditions remain actual external prerequisites. + +No epoch is created, reserved, accepted, committed or completed here. +""" +import fcntl +import os +from pathlib import Path +import resource +import signal +import stat +import subprocess +import time + +import epoch_schema_v5 as schema +import epoch_copy_v5 as copying +import parent_domain_v1 as domain +import parent_closure_v1 as closure +import parent_completion_v1 as parent +import group01_evidence_v1 as group01 +import v03_prefix_derivation_v1 as derivation + +CONFIGURATION = None +SOURCE_REVIEW = None +STAGE_APPROVAL = None +COMMAND_APPROVAL = None +FUNDING = None +EXECUTION_APPROVAL = None + +ROOT_SHA = 'f5a2d33f2b4d3651f214156a0e7094c2bb516ce2d5ab7698d18c11f98f35dee0' +PROVIDER_SHA = '9cbb7368f89e71d1e6cc46db5dc77efed3e03ed2a801c98c88fe316e4d9f3ef2' +VARIANT_SHA = 'cdb1479253358508088f8aa0e1e92e6c75ffcc127e54552698598a02de061254' +OBSERVER = 'v03_source_refusal_observer_v1' +ENV = {'PATH': '/usr/bin:/bin', 'PYTHONHASHSEED': '0', + 'LANG': 'C.UTF-8', 'LC_ALL': 'C.UTF-8', 'TZ': 'UTC', + 'PYTHONDONTWRITEBYTECODE': '1'} + +_PID, _CLOCK, _FLOCK = os.getpid, time.monotonic, fcntl.flock +_PREFIX = [False, None] +_UNKNOWN_OWNER = { + 'quarantine': [False], 'pending': [False], + 'iterator_uncertain': [False], 'primary': [None], + 'native_errors': [None] * 4, +} +_INITIAL = ( + 'initial-tcb.raw.json', 'initial-controls.raw.json', + 'initial-restoration.raw.json', +) +_PREFLIGHT = _INITIAL + ('root-before.raw.json', 'preflight-before.raw.json') +_CUSTODY = _PREFLIGHT + ('custody-before.raw.json',) +_RETURNED = _CUSTODY + ( + 'v03-root-after.raw.json', 'v03-input-result.raw.json', +) + + +def _gate_snapshot(): + schema.exact(CONFIGURATION, ( + 'plan', 'receiver_policy', 'checker_source', 'original_variant', + )) + for pin in CONFIGURATION.values(): + schema.blob(pin, schema.RECORD_BYTES) + records = ( + (SOURCE_REVIEW, 'review_sha256'), + (STAGE_APPROVAL, 'stage_review_sha256'), + (COMMAND_APPROVAL, 'command_review_sha256'), + (FUNDING, 'reservation_sha256'), + (EXECUTION_APPROVAL, 'external_launch_policy_sha256'), + ) + for record, key in records: + schema.exact(record, (key,)) + schema.digest(record[key]) + copying._gate() + return schema.plain_copy({ + 'configuration': CONFIGURATION, + 'source': SOURCE_REVIEW, 'stage': STAGE_APPROVAL, + 'command': COMMAND_APPROVAL, 'funding': FUNDING, + 'execution': EXECUTION_APPROVAL, + 'copy_configuration': copying.COPY_CONFIGURATION, + 'copy_execution': copying.COPY_EXECUTION_APPROVAL, + 'copy_funding': copying.COPY_FUNDING, + }) + + +def _state(token): + schema.need(type(token) is object and _PREFIX[1] is not None and + _PREFIX[1][0] is token, 'unknown prefix owner') + return _PREFIX[1][1] + + +def _clean(owner): + domain.refresh_unknown_owner(owner) + schema.need(owner['primary'][0] is None and + owner['quarantine'][0] is False and + owner['pending'][0] is False and + owner['iterator_uncertain'][0] is False, + 'prefix owner requires kernel teardown') + + +def _native_bindings(): + schema.need( + _PID is os.getpid and _CLOCK is time.monotonic and + _FLOCK is fcntl.flock and parent.ENV == ENV and + parent._OPEN is os.open and parent._CLOSE is os.close and + parent._MKDIR is os.mkdir and parent._STAT is os.stat and + parent._SCANDIR is os.scandir and + parent._POPEN is subprocess.Popen and + parent._CLOCK is time.monotonic and parent._SLEEP is time.sleep and + parent._SETRLIMIT is resource.setrlimit and + parent._GETRLIMIT is resource.getrlimit and + parent._SETTIMER is signal.setitimer and + parent._GETTIMER is signal.getitimer and + parent._SIGNAL is signal.signal and + parent._GETSIGNAL is signal.getsignal, + 'prefix native primitive binding changed', + ) + + +def _guard(state): + schema.need(state['phase'] not in ('STOP', 'CLOSED'), + 'prefix owner is terminal') + schema.need(_PID() == state['pid'], 'prefix owner crossed process') + _native_bindings() + _clean(state['unknown_owner']) + schema.need(_gate_snapshot() == state['admissions'], + 'prefix admission selections changed') + closure.check_receivers(state['receivers']) + for pin in state['configuration'].values(): + copying.verify(pin, error_owner=state['errors']) + schema.need(state['native_keeper'] is not None and + all(type(fd) is int and fd >= 0 for fd in state['lock_fds']), + 'prefix real keeper or lock ownership missing') + schema.need(_CLOCK() <= state['shared_deadline'], + 'complete prefix owner deadline exceeded') + + +def _expected_files(expected): + schema.exact(expected, ( + 'outcome', 'exception_type', 'message', 'terminal_function', + 'v03_discriminator', 'compiler_launches', 'candidate_image_loads', + 'complete_raw_and_owned_terminal_required', + )) + schema.boolean(expected['v03_discriminator']) + schema.need(type(expected['compiler_launches']) is int and + expected['compiler_launches'] == 0 and + type(expected['candidate_image_loads']) is int and + expected['candidate_image_loads'] == 0 and + expected['complete_raw_and_owned_terminal_required'] is True, + 'prefix expectation scope differs') + outcome = expected['outcome'] + function, message = expected['terminal_function'], expected['message'] + if outcome == 'PREFIX_RETURN': + schema.need(function is None and message is None and + expected['exception_type'] is None, + 'positive prefix expectation differs') + return _RETURNED + schema.need(outcome == 'EXACT_SOURCE_REFUSAL' and + expected['exception_type'] == 'RuntimeError', + 'prefix refusal expectation differs') + if function == '_vcheck_literal_sources': + schema.need(message in ( + 'Variant source role path differs', + 'Variant reviewed source/header differs', + 'Variant role file omitted from closure', + ), 'prefix literal refusal site differs') + return _INITIAL + if function == '_vcheck_custody': + schema.need(message == 'Variant current source closure differs', + 'prefix custody refusal site differs') + return _CUSTODY + schema.need(function == '_v03_original_input_prefix', + 'prefix refusal function differs') + if message == 'Variant literal configuration differs': + return _INITIAL + schema.need(message == 'Variant original preflight differs' and + expected['v03_discriminator'] is False, + 'earlier preflight refusal cannot receive V03 credit') + return _PREFLIGHT + + +def _validate_plan(plan): + schema.exact(plan, ( + 'schema', 'mode', 'round_root', 'session_directory', + 'session_seconds', 'source_closure_admission_sha256', + 'source_files', 'case', + )) + schema.need(plan['schema'] == 'h25-v03-prefix-parent-plan-v1', + 'prefix plan schema differs') + schema.choice(plan['mode'], ('normal', 'optimized')) + for key in ('round_root', 'session_directory'): + schema.path(plan[key]) + schema.integer(plan['session_seconds'], 1, 600) + schema.digest(plan['source_closure_admission_sha256']) + schema.need(type(plan['source_files']) is list and + 1 <= len(plan['source_files']) <= parent.MAX_SOURCE_FILES, + 'prefix parent source inventory bound differs') + case = plan['case'] + schema.exact(case, ( + 'id', 'generation', 'launch_nonce', 'stage_directory', + 'stage_manifest', 'stage_directories', 'output', 'command', + 'root_seconds', 'address_space_bytes', 'rss_bytes', + 'root_source', 'driver_source', 'gate_values', 'expectation', + )) + schema.label(case['id']) + schema.label(case['generation']) + schema.digest(case['launch_nonce']) + schema.path(case['stage_directory']) + schema.path(case['output']) + schema.need( + case['output'] == plan['session_directory'] + '/producer-output' and + case['output'] != case['stage_directory'] and + not case['output'].startswith(case['stage_directory'] + '/'), + 'prefix source/output origins differ', + ) + schema.integer(case['root_seconds'], 1, 180) + schema.integer(case['address_space_bytes'], 1, 1024 ** 3) + schema.integer(case['rss_bytes'], 1, 1024 ** 3) + for key in ('stage_manifest', 'root_source', 'driver_source', 'gate_values'): + schema.blob(case[key], schema.RECORD_BYTES) + schema.need(type(case['stage_directories']) is list and + len(case['stage_directories']) <= parent.MAX_STAGE_ENTRIES, + 'prefix stage directory declaration differs') + integration = case['stage_directory'] + '/integration' + schema.need( + case['root_source']['path'] == integration + '/full_driver.py' and + case['root_source']['sha256'] == ROOT_SHA and + case['root_source']['bytes'] == 38851 and + case['driver_source']['path'] == + integration + '/v03_control_driver_v1.py' and + 0 < case['driver_source']['bytes'] <= 262144, + 'prefix genuine Root/selected driver source differs', + ) + command = ['/usr/bin/python3.12', '-S', '-s', '-P', '-B'] + if plan['mode'] == 'optimized': + command.append('-O') + command += [ + integration + '/full_driver.py', '--root-sha256', ROOT_SHA, + '--provider', integration + '/probe_binding_v3.py', PROVIDER_SHA, + '--driver', case['driver_source']['path'], + case['driver_source']['sha256'], '--integration', integration, '--', + '--output', case['output'], '--generation', case['generation'], + '--launch-nonce', case['launch_nonce'], + ] + schema.need(type(case['command']) is list and + all(type(arg) is str for arg in case['command']) and + case['command'] == command, + 'prefix exact original Root command differs') + _expected_files(case['expectation']) + + +def _record_bytes(value): + raw = group01.encode(value) + schema.need(len(raw) <= schema.RECORD_BYTES, + 'prefix parent record exceeds original writer bound') + return raw + + +def _source_snapshot(state): + plan = state['plan'] + files = parent._snapshot_sources(plan, state['errors']) + stage = parent._stage(dict(plan, **plan['case']), state['errors'], state) + raw = _record_bytes({ + 'schema': 'h25-prefix-source-custody-v1', + 'files': files, 'stage': stage, + 'source_closure_admission_sha256': + plan['source_closure_admission_sha256'], + 'interval_proved_by_endpoint_equality': False, + }) + return files, stage, raw + + +def make_prefix_owner(original_receivers): + schema.need(_PREFIX[0] is False, 'one prefix owner per fresh process') + _PREFIX[0] = True + began = _CLOCK() + state = None + try: + admissions = _gate_snapshot() + _native_bindings() + _clean(_UNKNOWN_OWNER) + errors = schema.make_error_owner() + _UNKNOWN_OWNER['native_errors'][0] = schema.owner_state(errors) + configuration = schema.plain_copy(CONFIGURATION) + plan = group01.decode(copying.read_verified( + configuration['plan'], schema.RECORD_BYTES, error_owner=errors)) + _validate_plan(plan) + policy = group01.decode(copying.read_verified( + configuration['receiver_policy'], schema.RECORD_BYTES, + error_owner=errors)) + schema.need(type(policy) is dict and + policy.get('v03_prefix_supervisor_v1') == + configuration['checker_source'], + 'prefix checker absent from independent source policy') + receivers = closure.bind_receivers(original_receivers, policy, errors) + schema.need( + closure.receiver(receivers, 'v03_prefix_supervisor_v1', + 'make_prefix_owner') is make_prefix_owner and + closure.receiver(receivers, 'epoch_schema_v5', + 'make_error_owner') is schema.make_error_owner and + closure.receiver(receivers, 'epoch_copy_v5', + 'inspect') is copying.inspect and + closure.receiver(receivers, 'parent_domain_v1', + 'create_domain') is domain.create_domain and + closure.receiver(receivers, 'parent_completion_v1', + '_snapshot_sources') is parent._snapshot_sources and + closure.receiver(receivers, 'v03_prefix_derivation_v1', + 'verify_configured_prefix') is + derivation.verify_configured_prefix, + 'prefix actual receiver identities differ', + ) + schema.need(parent._PARENTS == [] and parent._PROCESS[0] is None and + domain._DOMAINS == [], + 'prefix requires a fresh parent/domain lifetime') + _clean(parent._UNKNOWN_OWNER) + launch_contract = closure.receiver( + receivers, 'h25_parent_supervisor', 'launch_contract') + installer = closure.receiver( + receivers, 'h25_parent_supervisor', 'install_subreaper') + launch_contract() + closure.check_receivers(receivers) + + case = plan['case'] + state = { + 'pid': _PID(), 'phase': 'CONSTRUCTING', 'errors': errors, + 'plan': plan, 'configuration': configuration, + 'admissions': admissions, 'receivers': receivers, + 'unknown_owner': _UNKNOWN_OWNER, + 'io_quarantine': _UNKNOWN_OWNER['quarantine'], + 'fallback': [None] * 8, + 'began': began, + 'shared_deadline': began + plan['session_seconds'], + 'lock_fds': [None, None], + 'native_keeper': None, 'subreaper': None, + 'initial_sources': None, 'run': None, + } + # Retain construction resources even if no capability is returned. + _PREFIX[1] = (None, state) + + parent._MKDIR(plan['session_directory'], 0o700) + parent._MKDIR(plan['session_directory'] + '/retained', 0o700) + for index, name in enumerate(('parent-queue.lock', 'science.lock')): + _clean(_UNKNOWN_OWNER) + _UNKNOWN_OWNER['pending'][0] = True + state['lock_fds'][index] = parent._OPEN( + plan['round_root'] + '/runtime/' + name, + os.O_RDWR | os.O_CREAT | os.O_CLOEXEC | os.O_NOFOLLOW, 0o600) + _UNKNOWN_OWNER['pending'][0] = False + _FLOCK(state['lock_fds'][index], fcntl.LOCK_EX | fcntl.LOCK_NB) + + _UNKNOWN_OWNER['pending'][0] = True + installed = installer(Path(plan['round_root'])) + state['subreaper'], state['native_keeper'] = installed + _UNKNOWN_OWNER['pending'][0] = False + closure.check_receivers(receivers) + _clean(_UNKNOWN_OWNER) + + state['initial_sources'] = _source_snapshot(state) + by_path = {row['path']: row for row in plan['source_files']} + pins = tuple(configuration.values()) + ( + case['root_source'], case['driver_source'], case['gate_values'], + ) + for pin in pins: + schema.need(pin['path'] in by_path and + by_path[pin['path']]['sha256'] == pin['sha256'] and + by_path[pin['path']]['bytes'] == pin['bytes'] and + by_path[pin['path']]['mode'] == + pin['identity']['mode'] & 0o7777, + 'prefix input absent from parent source custody') + state['root_bytes'] = copying.read_verified( + case['root_source'], 262144, error_owner=errors) + state['driver_bytes'] = copying.read_verified( + case['driver_source'], 262144, error_owner=errors) + original = copying.read_verified( + configuration['original_variant'], 262144, error_owner=errors) + schema.need(configuration['original_variant']['sha256'] == VARIANT_SHA, + 'original variant source pin differs') + gate_raw = copying.read_verified( + case['gate_values'], schema.RECORD_BYTES, error_owner=errors) + decode = closure.receiver(receivers, OBSERVER, '_decode') + values = decode(gate_raw, schema.RECORD_BYTES) + derivation.verify_configured_prefix( + original, state['driver_bytes'], values) + schema.need(all(value is not None for value in values.values()), + 'prefix remains unconfigured; launch withheld') + # The check above does not approve these values. Their genuine + # admission must already be established by the authenticated bootstrap. + state['before_pin'] = copying.write_once( + plan['session_directory'] + '/SOURCE-BEFORE.json', + state['initial_sources'][2], error_owner=errors) + state['phase'] = 'READY' + _guard(state) + token = object() + _PREFIX[1] = (token, state) + return token + except BaseException as error: + if _UNKNOWN_OWNER['primary'][0] is None: + _UNKNOWN_OWNER['primary'][0] = error + _UNKNOWN_OWNER['quarantine'][0] = True + if state is not None: + state['phase'] = 'STOP' + primary = _UNKNOWN_OWNER['primary'][0] + if primary is error: + raise + raise primary + + +def _terminal(state, run): + _guard(state) + schema.need(run['primary'][0] is None, + 'earlier run error forbids terminal observation') + if run['expectation']['outcome'] == 'PREFIX_RETURN': + return domain.terminal_facts(run['domain']) + return domain.prefix_exit1_terminal_facts(run['domain']) + + +def _supervise(state): + owner, plan = state['unknown_owner'], state['plan'] + case = plan['case'] + run = None + primary = first_cleanup = None + old_handler = None + alarm_installed = False + try: + _guard(state) + schema.need(state['phase'] == 'READY' and state['run'] is None, + 'prefix control already consumed') + state['phase'] = 'CONTROL_CONSUMED' + run = { + 'plan': case, 'unknown_owner': owner, + 'domain': None, 'process': None, 'root': None, 'terminal': None, + 'log_fds': [None, None], + 'log_close_attempted': [False, False], + 'log_close_confirmed': [False, False], + 'errors': [None] * 8, 'primary': [None], + 'acquisition_in_flight': False, + 'spawn_entered': False, 'spawn_returned': False, + 'finish_attempted': False, + 'began': _CLOCK(), 'peak_rss': 0, 'file_limits': None, + 'retained': {}, 'expectation': case['expectation'], + } + state['run'] = run + before = _source_snapshot(state) + schema.need(before == state['initial_sources'], + 'prefix source/stage changed before launch') + try: + parent._STAT(case['output'], follow_symlinks=False) + except FileNotFoundError: + pass + else: + raise schema.EpochStop('prefix output already exists') + + run['file_limits'] = tuple(parent._GETRLIMIT(resource.RLIMIT_FSIZE)) + run['domain'] = domain.create_domain(owner) + run['launch'] = copying.write_once( + plan['session_directory'] + '/LAUNCH.json', + _record_bytes({ + 'schema': 'h25-prefix-control-launch-v1', + 'case': case['id'], 'mode': plan['mode'], + 'generation': case['generation'], + 'launch_nonce': case['launch_nonce'], + 'parent_pid': state['pid'], 'command': case['command'], + 'cwd': case['stage_directory'], 'environment': ENV, + 'parent_file_limits': list(run['file_limits']), + 'root_seconds': case['root_seconds'], + 'address_space_bytes': case['address_space_bytes'], + 'rss_bytes': case['rss_bytes'], + 'new_session': True, 'close_fds': True, 'pass_fds': [], + 'production_completion': False, + }), error_owner=state['errors']) + + for index, name in enumerate(('stdout.raw', 'stderr.raw')): + _clean(owner) + run['acquisition_in_flight'] = True + owner['pending'][0] = True + run['log_fds'][index] = parent._OPEN( + plan['session_directory'] + '/' + name, + os.O_WRONLY | os.O_CREAT | os.O_EXCL | + os.O_CLOEXEC | os.O_NOFOLLOW, 0o600) + run['acquisition_in_flight'] = False + owner['pending'][0] = False + + setter, kind = parent._SETRLIMIT, resource.RLIMIT_AS + limits = (case['address_space_bytes'], case['address_space_bytes']) + + def child_limit(): + setter(kind, limits) + + schema.need(parent._GETTIMER(signal.ITIMER_REAL) == (0.0, 0.0), + 'existing timer cannot be replaced') + old_handler = parent._GETSIGNAL(signal.SIGALRM) + parent._SIGNAL(signal.SIGALRM, parent._alarm) + alarm_installed = True + deadline = min(run['began'] + case['root_seconds'], + state['shared_deadline'] - domain.CLEANUP_SECONDS) + schema.need(_CLOCK() < deadline, 'no funded root/cleanup interval') + parent._SETTIMER(signal.ITIMER_REAL, + max(0.000001, deadline - _CLOCK())) + _guard(state) + run['spawn_entered'] = True + run['process'] = parent._POPEN( + case['command'], cwd=case['stage_directory'], env=dict(ENV), + stdout=run['log_fds'][0], stderr=run['log_fds'][1], + stdin=subprocess.DEVNULL, close_fds=True, pass_fds=(), + start_new_session=True, preexec_fn=child_limit) + run['spawn_returned'] = True + run['root'] = domain.adopt_popen(run['domain'], run['process']) + while True: + unused, current = domain.observe(run['domain']) + run['peak_rss'] = max(run['peak_rss'], + sum(row[6] for row in current)) + schema.need(run['peak_rss'] <= case['rss_bytes'], + 'owned prefix RSS sum exceeded') + schema.need(max(parent._STAT( + plan['session_directory'] + '/' + name, + follow_symlinks=False).st_size + for name in ('stdout.raw', 'stderr.raw')) <= schema.LOG_BYTES, + 'prefix raw log bound exceeded') + if domain.poll_owned(run['domain']) is not None: + break + parent._SLEEP(0.01) + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + primary = owner['primary'][0] + if run is not None: + run['primary'][0] = primary + if error is not primary: + run['errors'][4] = error + if (owner['pending'][0] or owner['iterator_uncertain'][0] or + (run is not None and run['acquisition_in_flight']) or + type(error) is MemoryError): + owner['quarantine'][0] = True + finally: + if alarm_installed: + try: + parent._SETTIMER(signal.ITIMER_REAL, 0) + parent._SIGNAL(signal.SIGALRM, old_handler) + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + if run is not None: + run['errors'][2] = error + first_cleanup = error + if run is not None and run['domain'] is not None: + run['finish_attempted'] = True + try: + domain.finish_domain(run['domain']) + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + owner['quarantine'][0] = True + run['errors'][3] = error + if first_cleanup is None: + first_cleanup = error + if run is not None: + try: + parent._close_logs( + run, primary if primary is not None else first_cleanup) + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + if first_cleanup is None: + first_cleanup = error + for index in range(2): + if (run['log_close_attempted'][index] and + not run['log_close_confirmed'][index]): + owner['quarantine'][0] = True + + if owner['primary'][0] is not None: + state['phase'] = 'STOP' + raise owner['primary'][0] + schema.need(run is not None and run['spawn_entered'] is True and + run['spawn_returned'] is True and + run['finish_attempted'] is True and + run['acquisition_in_flight'] is False and + all(run['log_close_confirmed']), + 'prefix spawn/stream ownership incomplete') + schema.need(tuple(parent._GETRLIMIT(resource.RLIMIT_FSIZE)) == + run['file_limits'], 'parent file limit drift') + run['terminal'] = _terminal(state, run) + state['phase'] = 'CONTROL_JOINED' + return run + + +def _directory_identity(info): + return (info.st_dev, info.st_ino, info.st_mode, info.st_nlink, + info.st_uid, info.st_gid, info.st_size, + info.st_mtime_ns, info.st_ctime_ns) + + +def _census_output(state, directory, files, directories): + """Original path-census ownership pattern; C07 remains a prerequisite.""" + _clean(state['unknown_owner']) + schema.path(directory) + schema.need(len(files) + len(directories) <= 9, + 'prefix output declaration bound') + before = parent._STAT(directory, follow_symlinks=False) + schema.need(stat.S_ISDIR(before.st_mode), 'prefix directory kind differs') + owner = state['unknown_owner'] + iterator = None + primary = None + found_files, found_directories = [], [] + owner['pending'][0] = True + try: + iterator = parent._SCANDIR(directory) + owner['pending'][0] = False + for entry in iterator: + schema.need(type(entry) is os.DirEntry, + 'prefix native directory entry differs') + name = entry.name + schema.need(type(name) is str and 0 < len(name) <= 256 and + '/' not in name and name not in ('.', '..'), + 'prefix directory entry name differs') + schema.need(len(found_files) + len(found_directories) < 9, + 'prefix output entry bound exceeded') + info = entry.stat(follow_symlinks=False) + if stat.S_ISREG(info.st_mode): + found_files.append(name) + elif stat.S_ISDIR(info.st_mode): + found_directories.append(name) + else: + raise schema.EpochStop('prefix symlink/special output refused') + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + primary = owner['primary'][0] + owner['quarantine'][0] = True + owner['iterator_uncertain'][0] = True + if primary is error: + raise + raise primary + finally: + if iterator is not None: + owned = iterator + iterator = None + try: + owned.close() + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + owner['quarantine'][0] = True + owner['iterator_uncertain'][0] = True + if state['fallback'][3] is None: + state['fallback'][3] = error + if primary is None: + raise owner['primary'][0] + after = parent._STAT(directory, follow_symlinks=False) + schema.need(_directory_identity(before) == _directory_identity(after), + 'prefix directory changed during census') + schema.need(sorted(found_files) == sorted(files) and + sorted(found_directories) == sorted(directories), + 'prefix exact output census differs') + return _directory_identity(after) + + +def _capture(state, run): + plan, case = state['plan'], state['plan']['case'] + names = _expected_files(case['expectation']) + occupied, raw, pins = (), {}, {} + sources = ( + ('stdout.raw', plan['session_directory'] + '/stdout.raw', + schema.LOG_BYTES), + ('stderr.raw', plan['session_directory'] + '/stderr.raw', + schema.LOG_BYTES), + ) + tuple((name, case['output'] + '/' + name, schema.RECORD_BYTES) + for name in names) + + # Complete exclusive copies precede semantic interpretation. + for name, path, bound in sources: + _guard(state) + source = copying.inspect(path, bound, error_owner=state['errors']) + run['retained'][name] = {'source': source} + pair = schema.inode(source) + schema.need(pair not in occupied, 'prefix raw occurrences alias') + occupied += (pair,) + copied = copying.copy_once( + source, plan['session_directory'] + '/retained/' + name, + occupied, error_owner=state['errors']) + run['retained'][name]['copy'] = copied + occupied += (schema.inode(copied),) + raw[name] = copying.read_verified( + copied, bound, error_owner=state['errors']) + pins[name] = (source, copied, bound) + + output_identity = _census_output( + state, case['output'], names, ('initial-tcb-controls',)) + scratch_identity = _census_output( + state, case['output'] + '/initial-tcb-controls', (), ()) + decode = closure.receiver(state['receivers'], OBSERVER, '_decode') + values = {name: decode(raw[name], schema.RECORD_BYTES) for name in names} + closure.check_receivers(state['receivers']) + schema.need(raw['stdout.raw'] == b'', 'prefix stdout is not empty') + for name in ('initial-tcb.raw.json', 'initial-restoration.raw.json'): + receipt = values[name] + schema.need(type(receipt) is dict and + type(receipt.get('pid')) is int and + receipt['pid'] == run['root'][0], + 'prefix initial/restoration PID differs') + + expected = case['expectation'] + binding = {'mode': plan['mode'], 'generation': case['generation'], + 'launch_nonce': case['launch_nonce']} + if expected['outcome'] == 'PREFIX_RETURN': + schema.need(raw['stderr.raw'] == b'', + 'positive prefix stderr is not empty') + check = closure.receiver( + state['receivers'], OBSERVER, 'corroborate_positive') + ok = check(raw['v03-input-result.raw.json'], + raw['v03-root-after.raw.json'], + raw['preflight-before.raw.json'], + binding, schema.RECORD_BYTES) + else: + check = closure.receiver( + state['receivers'], OBSERVER, 'corroborate_complete_refusal') + ok = check(state['driver_bytes'], state['root_bytes'], + case['driver_source']['path'], case['root_source']['path'], + raw['stderr.raw'], expected['terminal_function'], + expected['message'], schema.LOG_BYTES) + schema.need(ok is True, 'complete prefix data corroboration differs') + closure.check_receivers(state['receivers']) + for source, copied, bound in pins.values(): + _clean(state['unknown_owner']) + copying.verify(source, bound, error_owner=state['errors']) + copying.verify(copied, bound, error_owner=state['errors']) + schema.need( + _census_output(state, case['output'], names, + ('initial-tcb-controls',)) == output_identity and + _census_output(state, case['output'] + '/initial-tcb-controls', + (), ()) == scratch_identity, + 'prefix output changed after capture', + ) + + +def run_prefix(token): + state = _state(token) + owner = state['unknown_owner'] + try: + run = _supervise(state) + _capture(state, run) + after = _source_snapshot(state) + schema.need(after == state['initial_sources'], + 'complete prefix source/stage custody changed') + schema.need(_terminal(state, run) == run['terminal'], + 'prefix owned terminal facts changed') + case = state['plan']['case'] + schema.need(_CLOCK() - run['began'] <= case['root_seconds'], + 'complete prefix root/capture tail exceeded bound') + _guard(state) + record = { + 'schema': 'h25-owned-v03-prefix-observation-v1', + 'case': case['id'], 'mode': state['plan']['mode'], + 'generation': case['generation'], + 'launch_nonce': case['launch_nonce'], + 'launch': run['launch'], 'terminal': run['terminal'], + 'source_before': state['before_pin'], + 'source_after_equals_before': True, + 'raw': run['retained'], + 'data_corroboration': 'COMPLETE_PREFIX_DATA_ONLY', + 'independent_native_receipt_replay_performed': False, + 'interval_proved_by_endpoint_equality': False, + 'parent_exit_observed_here': False, + 'enclosing_guard_must_observe_parent_exit': True, + 'production_completion': False, + 'full_c05': False, 'full_v03': False, + 'runtime_qualified': False, + } + result = copying.write_once( + state['plan']['session_directory'] + '/PREFIX-OBSERVATION.json', + _record_bytes(record), error_owner=state['errors']) + _guard(state) + schema.need(_CLOCK() - run['began'] <= case['root_seconds'], + 'complete prefix result-writing tail exceeded bound') + state['phase'] = 'CLOSED' + # Plain file pin DATA only. No owner/domain/Popen/epoch token escapes. + return schema.plain_copy(result) + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + state['phase'] = 'STOP' + if owner['pending'][0] or owner['iterator_uncertain'][0]: + owner['quarantine'][0] = True + primary = owner['primary'][0] + if primary is error: + raise + raise primary + + +def stop_evidence(token): + state = _state(token) + run = state['run'] + summary = None if run is None else { + 'spawn_entered': run['spawn_entered'], + 'spawn_returned': run['spawn_returned'], + 'finish_attempted': run['finish_attempted'], + 'log_close_attempted': list(run['log_close_attempted']), + 'log_close_confirmed': list(run['log_close_confirmed']), + } + return (state['unknown_owner']['primary'], state['errors'], + state['fallback'], summary) diff --git a/research/h25-v03-prefix-supervision/unit05/review-derivation-closure-input-gate-v1.json b/research/h25-v03-prefix-supervision/unit05/review-derivation-closure-input-gate-v1.json new file mode 100644 index 0000000000..2a479ef7c0 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/review-derivation-closure-input-gate-v1.json @@ -0,0 +1,100 @@ +{ + "schema": "unit05-independent-derivation-closure-review-v1", + "reviewed_utc": "2026-11-02 11:13:33 UTC", + "input_gate_status": "SOURCE_INPUTS_AND_NEW_TEST_ISOLATION_PRESENT", + "initial_disposition": "DERIVATION_NARROW_PASS_CLOSURE_CAPTURE_FAIL_REPAIR_PENDING", + "finding": { + "id": "DC01", + "severity": "critical source integration blocker", + "source": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_integrated_constructor_v1.py", + "sha256": "5e08ff84298fe1249be5e8790ea259e6179048f4736fb7eafdb6e170b8bc1cf9", + "anchors": [ + "constructor13-17", + "original parent_closure bind_receivers209-220", + "original _data107-112" + ], + "counterexample": "NATIVE_ENV literal has6 bytes dictionary keys; original closure rejects keys outside exact str/int", + "observed_by": "static literal-data/predicate comparison; original closure function never executed", + "minimal_repair": "Explicit local constructor successor with tuple-of-bytes-pairs; dict(NATIVE_ENV) identical; no mutable exemption/no Unit01 edit", + "repair_delta_accepted": false + }, + "derivation": { + "path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_prefix_derivation_v1.py", + "bytes": 3830, + "sha256": "4591de196d008f0fdc094f4a74b19a84c095e2def5d28dbdaea7085e4630f8a7", + "accepted_scope": "Only8 literal value replacements in exact authenticated rendering, not gate admission", + "probes": [ + { + "name": "eight None gates", + "accepted": true + }, + { + "name": "UTF8 multibyte literal", + "accepted": true + }, + { + "name": "nongate edit", + "accepted": false + }, + { + "name": "duplicate gate", + "accepted": false + }, + { + "name": "bool/int mismatch", + "accepted": false + }, + { + "name": "Call expression", + "accepted": false, + "expression_executed": false + } + ], + "exact_original_sha256": "cdb1479253358508088f8aa0e1e92e6c75ffcc127e54552698598a02de061254", + "unconfigured_render_sha256": "913e2ad11489014fff9980e8ca3e1722d213a268d92309f6fdc2e21b9c5e7c3d", + "original_driver_executed": false + }, + "preservation": { + "original_domain_byte_prefix_plus_exact_accessor": true, + "closure_only63byte_named_allowance": true, + "production_parent_byte_identical": true, + "production_parent_sha256": "d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5", + "original_production_terminal_facts_unchanged": true, + "original_production_mint_unchanged": true, + "final_observer_sha256": "abf25690d3bee4a9783ee504567c29f7fb47da670e0ec95f57cb5944bf57264f" + }, + "closure": { + "byte_leaves_in_tuple_supported_by_original_data": true, + "second_literal_key_mismatch_found": false, + "twelve_file_assembly_complete_transitive_runtime": false, + "required": "Actual approved modules incl epoch_parent_v5, complete receiver policy and preimport bootstrap" + }, + "supplied_tests": { + "path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/test_v03_prefix_supervisor_v1.py", + "sha256": "b5f8055da6f9a48e85a4eed0868f7076859adca317e0691e5b2336e0bdb58d52", + "only_new_accessor_body_with_fake_globals": true, + "remaining_tests_static_only": true, + "original_module_import": false, + "original_function_execution": false, + "actual_Popen_native_or_namespace": false + }, + "source_hashes": { + "supervisor": "75bef7834fe7278638010f79a8efca84b49b1e48320d3c8ac2d93cadea5a8262", + "domain_initial_successor": "a51264289803b4b17bb262f2460ddd4ed72500aaa21e5eb80fa2db4583689361", + "closure_initial_successor": "a15424f14baa3d484fe04bfbe7e449c32561c866dbaca2c1b5f646dfb377ed1f", + "complete_pro6_response": "d1b15e2a92c6cbf137319ef2c165e2d920202d5f2d7509d7a8d572d90b4ffa13" + }, + "absent_authority": [ + "authentic enclosing-parent preimport bootstrap", + "C07 immutable source/ancestor lifetime", + "native/stage/command/funding/execution admission", + "concrete original-instance binding", + "complete source/runtime closure" + ], + "original_work_executed": false, + "full_C05": false, + "full_V03": false, + "original_activity_credit": false, + "costs": "OPEN_NOT_ZERO" +} + diff --git a/research/h25-v03-prefix-supervision/unit05/review-derivation-closure-input-gate-v1.md b/research/h25-v03-prefix-supervision/unit05/review-derivation-closure-input-gate-v1.md new file mode 100644 index 0000000000..3a2d4a3c71 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/review-derivation-closure-input-gate-v1.md @@ -0,0 +1,36 @@ +# Unit05 independent derivation, closure and test-isolation review + +Initial source-gate disposition: **required source inputs/test isolation present; narrow configured-prefix proof accepted; actual receiver capture FAILS pending the declared repair**. This is not parent/bootstrap, C07, native, funding, process or runtime admission. + +## Critical finding DC01 + +Pro6 requires the pure constructor in the actual receiver policy (RESPONSE-v6:49). The exact assembled constructor SHA256 `5e08ff84298fe1249be5e8790ea259e6179048f4736fb7eafdb6e170b8bc1cf9` defines NATIVE_ENV as a literal dictionary with six exact bytes keys (13-17). Original closure bind_receivers captures nonexempt literal assignments (original209-220; assembled210-221), and _data rejects dictionary keys other than str/int (original107-112; assembled108-113). NATIVE_ENV is not exempt. Consequently the proposed actual closure capture rejects this dependency before an owner can be constructed. A hash or the new supervisor registry allowance does not repair that mismatch. + +The original _data does accept bytes scalar leaves and recursively accepts tuples/lists. A separately reviewed local constructor successor using a tuple of bytes pairs makes the value captureable while dict(NATIVE_ENV) preserves the six-entry bytes environment. Preserve the closed Unit01 file and its old hash, give the successor a new hash/policy entry, and do not grant NATIVE_ENV a mutable exemption. Root alone opened the single repair at11:07:10.897421–11:22:10.897421UTC; this initial report does not accept that delta before readback. + +## Accepted narrow derivation result + +The 3830-byte configured-prefix verifier (`4591de196d008f0fdc094f4a74b19a84c095e2def5d28dbdaea7085e4630f8a7`) obtains the exact authenticated prefix rendering, permits only the eight top-level gate value spans to normalize to None, and requires every other byte to equal that rendering. It rejects duplicate assignments, nonliteral expressions and mismatched exact data types. _plain checks exact native types, string keys, integer domain, depth24/nodes65536/string8192/aggregate-text524288/container1024; driver bytes are limited to262144. These are local bounds, not complete admission or a physical-resource reservation. + +AST columns are UTF8 byte offsets and the implementation computes offsets in bytes. Independent NEW-function probes accepted eight None gates and a multibyte UTF8 gate; rejected a nongate edit, duplicate gate, bool/int substitution and a Call expression. The expression was parsed as inert syntax and never invoked. Exact original41337-byte source `cdb1479253358508088f8aa0e1e92e6c75ffcc127e54552698598a02de061254` produced unconfigured rendering SHA256 `913e2ad11489014fff9980e8ca3e1722d213a268d92309f6fdc2e21b9c5e7c3d`, accepted by the verifier. No selected driver or original function body was executed. + +## Preservation, dependencies and test isolation + +Byte comparisons established the entire original domain source is an unchanged prefix plus exactly two LF and the new accessor; the original closure has only the named63-byte dictionary insertion; production parent bytes are unchanged at `d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5`. Thus original production terminal_facts and production mint/accept functions are preserved in the initial assembly. The final Unit01 observer remains unchanged at `abf25690d3bee4a9783ee504567c29f7fb47da670e0ec95f57cb5944bf57264f`. + +Static AST examination of literal globals in the assembled runtime files found no second literal-key capture mismatch. The12-file assembly is not a deployable transitive closure: parent_completion still imports epoch_parent_v5 and the original import graph extends further. Exact source exists in retained inputs, but the actual approved module objects, complete receiver policy and pre-import authentication remain required external inputs. + +The supplied tests extract only the appended NEW accessor into an AST module with fake _state/_GETPID/_fresh_acquisition/_census/schema; their state is expressly synthetic. Remaining supplied tests parse source or check strings. They do not import the archived domain, execute original functions, call Popen, install a subreaper or perform native/control/namespace work. The accessor has no decorators/default expressions that could run at extraction. These fixtures establish local predicates only. + +## Source identities + +All paths below are under /home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/implementation: + +- derivation `4591de196d008f0fdc094f4a74b19a84c095e2def5d28dbdaea7085e4630f8a7` +- supervisor `75bef7834fe7278638010f79a8efca84b49b1e48320d3c8ac2d93cadea5a8262` +- domain initial successor `a51264289803b4b17bb262f2460ddd4ed72500aaa21e5eb80fa2db4583689361` +- closure initial successor `a15424f14baa3d484fe04bfbe7e449c32561c866dbaca2c1b5f646dfb377ed1f` +- supplied test file `b5f8055da6f9a48e85a4eed0868f7076859adca317e0691e5b2336e0bdb58d52` + +Complete Pro6 response read; SHA256 `d1b15e2a92c6cbf137319ef2c165e2d920202d5f2d7509d7a8d572d90b4ffa13`. The source proposal supplies no authentic enclosing-parent bootstrap, immutable lifetime, native/funding admission, concrete original instance, or runtime capability. Full C05/V03 and original activity credit remain false. Costs OPEN_NOT_ZERO. + diff --git a/research/h25-v03-prefix-supervision/unit05/review-derivation-closure-v1.json b/research/h25-v03-prefix-supervision/unit05/review-derivation-closure-v1.json new file mode 100644 index 0000000000..b2e54d529d --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/review-derivation-closure-v1.json @@ -0,0 +1,153 @@ +{ + "schema": "unit05-independent-derivation-closure-review-v1", + "reviewed_utc": "2026-11-02 11:13:33 UTC", + "input_gate_status": "SOURCE_INPUTS_AND_NEW_TEST_ISOLATION_PRESENT", + "initial_disposition": "DERIVATION_NARROW_PASS_CLOSURE_CAPTURE_FAIL_REPAIR_PENDING", + "finding": { + "id": "DC01", + "severity": "critical source integration blocker", + "source": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_integrated_constructor_v1.py", + "sha256": "5e08ff84298fe1249be5e8790ea259e6179048f4736fb7eafdb6e170b8bc1cf9", + "anchors": [ + "constructor13-17", + "original parent_closure bind_receivers209-220", + "original _data107-112" + ], + "counterexample": "NATIVE_ENV literal has6 bytes dictionary keys; original closure rejects keys outside exact str/int", + "observed_by": "static literal-data/predicate comparison; original closure function never executed", + "minimal_repair": "Explicit local constructor successor with tuple-of-bytes-pairs; dict(NATIVE_ENV) identical; no mutable exemption/no Unit01 edit", + "repair_delta_accepted": true + }, + "derivation": { + "path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_prefix_derivation_v1.py", + "bytes": 3830, + "sha256": "4591de196d008f0fdc094f4a74b19a84c095e2def5d28dbdaea7085e4630f8a7", + "accepted_scope": "Only8 literal value replacements in exact authenticated rendering, not gate admission", + "probes": [ + { + "name": "eight None gates", + "accepted": true + }, + { + "name": "UTF8 multibyte literal", + "accepted": true + }, + { + "name": "nongate edit", + "accepted": false + }, + { + "name": "duplicate gate", + "accepted": false + }, + { + "name": "bool/int mismatch", + "accepted": false + }, + { + "name": "Call expression", + "accepted": false, + "expression_executed": false + } + ], + "exact_original_sha256": "cdb1479253358508088f8aa0e1e92e6c75ffcc127e54552698598a02de061254", + "unconfigured_render_sha256": "913e2ad11489014fff9980e8ca3e1722d213a268d92309f6fdc2e21b9c5e7c3d", + "original_driver_executed": false + }, + "preservation": { + "original_domain_byte_prefix_plus_exact_accessor": true, + "closure_only63byte_named_allowance": true, + "production_parent_byte_identical": true, + "production_parent_sha256": "d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5", + "original_production_terminal_facts_unchanged": true, + "original_production_mint_unchanged": true, + "final_observer_sha256": "abf25690d3bee4a9783ee504567c29f7fb47da670e0ec95f57cb5944bf57264f" + }, + "closure": { + "byte_leaves_in_tuple_supported_by_original_data": true, + "second_literal_key_mismatch_found": false, + "twelve_file_assembly_complete_transitive_runtime": false, + "required": "Actual approved modules incl epoch_parent_v5, complete receiver policy and preimport bootstrap" + }, + "supplied_tests": { + "path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/test_v03_prefix_supervisor_v1.py", + "sha256": "b5f8055da6f9a48e85a4eed0868f7076859adca317e0691e5b2336e0bdb58d52", + "only_new_accessor_body_with_fake_globals": true, + "remaining_tests_static_only": true, + "original_module_import": false, + "original_function_execution": false, + "actual_Popen_native_or_namespace": false + }, + "source_hashes": { + "supervisor": "75bef7834fe7278638010f79a8efca84b49b1e48320d3c8ac2d93cadea5a8262", + "domain_initial_successor": "a51264289803b4b17bb262f2460ddd4ed72500aaa21e5eb80fa2db4583689361", + "closure_initial_successor": "a15424f14baa3d484fe04bfbe7e449c32561c866dbaca2c1b5f646dfb377ed1f", + "complete_pro6_response": "d1b15e2a92c6cbf137319ef2c165e2d920202d5f2d7509d7a8d572d90b4ffa13" + }, + "absent_authority": [ + "authentic enclosing-parent preimport bootstrap", + "C07 immutable source/ancestor lifetime", + "native/stage/command/funding/execution admission", + "concrete original-instance binding", + "complete source/runtime closure" + ], + "original_work_executed": false, + "full_C05": false, + "full_V03": false, + "original_activity_credit": false, + "costs": "OPEN_NOT_ZERO", + "final_derivation_closure_disposition": "PASS_NARROW_SOURCE_DELTA_NOT_ACTUAL_RUNTIME_CAPTURE", + "repaired_delta": { + "reviewed_utc": "2026-11-02 11:19:46 UTC", + "constructor_successor": { + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_integrated_constructor_v2.py", + "bytes": 6111, + "sha256": "a80a60b390bc60e9bc434b79cda5ae6db88e4f0c6c7436de9adfe1f48a2045b1", + "only_literal_representation_changed": true, + "all_four_FunctionDef_source_segments_byte_identical": true, + "tuple_has_six_exact_bytes_pairs": true, + "dict_of_tuple_equals_original_native_environment": true + }, + "derivation": { + "sha256": "1ed813148c10d5fbd3cd6781d51eca650a347eda7a6323f581d740e6ea9cb6e2", + "only_import_changed_to_v2": true, + "new_pure_None_and_UTF8_probes": "PASS", + "same_render_sha256": "913e2ad11489014fff9980e8ca3e1722d213a268d92309f6fdc2e21b9c5e7c3d" + }, + "closure_predicate_compatibility": "Static source proof: original _data accepts exact bytes scalar leaves inside tuples; no forbidden dict key remains in successor NATIVE_ENV", + "original_closure_function_executed": false, + "Unit01_file_unchanged": true, + "no_extra_mutable_exemption": true, + "active_receiver_policy_requirement": "Select constructor_v2/new hash, do not capture historical constructor_v1 as an active dependency", + "new_orchestration_tests": { + "path": "outputs/c05-v03-completion-20261102T055710Z/unit05/fixtures/test_new_orchestration_v2.py", + "sha256": "7193e4eadf500a1a1e630236dbbda73703e20cfc7cbc7ab174e18636a5d6362c", + "inspected_methods": 13, + "source_targets": [ + "_supervise", + "_source_snapshot", + "_capture" + ], + "all_process_domain_copy_signal_resource_and_FS_services_faked": true, + "original_functions_executed": false, + "full_supervisor_imported": false, + "reviewer_repeated_complete_suite": false, + "earlier_inspected_snapshot_sha256": "251bc23c4b7ad15526bdfe0bdb3b053848f2fffc0fe8210b386a898f1838c610" + }, + "actual_receiver_capture_executed": false, + "bootstrap_C07_native_funding_runtime_authority_established": false, + "scope": "DC01 and configured-prefix/source-preservation/test-isolation delta only; not full supervisor approval or original qualification", + "author_receipt_sha256": "9563e2b533ce5b06bf72911c2ad66ee389ef14119b423a7cd3309b521c4db02e", + "initial_gate_report_preserved_exact": { + "md": "da729f70f5a4198dacf9e8813943758a45d0f1035f061bd7d85dfc437b1dc9d8", + "json": "9063c6d4132df9564b382e153de71770350662a31c67cd7df93e3117546ef23d", + "method": "known-hash-verified reconstruction of initial prefix/JSON after earlier extension; originals retained separately" + }, + "new_derivation_tests": { + "sha256": "37260fe75234e3b4565cea65fba6c4374cd0a30a407b5cfaa670f198df5b8a82", + "methods": 8, + "isolation": "Only pinned NEW constructor/verifier modules; controlled import whitelist; original driver inert bytes only", + "saved_logs_normal_optimized": "8 tests OK each; reviewer did not rerun full suite" + } + } +} diff --git a/research/h25-v03-prefix-supervision/unit05/review-derivation-closure-v1.md b/research/h25-v03-prefix-supervision/unit05/review-derivation-closure-v1.md new file mode 100644 index 0000000000..006a05f4da --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/review-derivation-closure-v1.md @@ -0,0 +1,50 @@ +# Unit05 independent derivation, closure and test-isolation review + +Initial source-gate disposition: **required source inputs/test isolation present; narrow configured-prefix proof accepted; actual receiver capture FAILS pending the declared repair**. This is not parent/bootstrap, C07, native, funding, process or runtime admission. + +## Critical finding DC01 + +Pro6 requires the pure constructor in the actual receiver policy (RESPONSE-v6:49). The exact assembled constructor SHA256 `5e08ff84298fe1249be5e8790ea259e6179048f4736fb7eafdb6e170b8bc1cf9` defines NATIVE_ENV as a literal dictionary with six exact bytes keys (13-17). Original closure bind_receivers captures nonexempt literal assignments (original209-220; assembled210-221), and _data rejects dictionary keys other than str/int (original107-112; assembled108-113). NATIVE_ENV is not exempt. Consequently the proposed actual closure capture rejects this dependency before an owner can be constructed. A hash or the new supervisor registry allowance does not repair that mismatch. + +The original _data does accept bytes scalar leaves and recursively accepts tuples/lists. A separately reviewed local constructor successor using a tuple of bytes pairs makes the value captureable while dict(NATIVE_ENV) preserves the six-entry bytes environment. Preserve the closed Unit01 file and its old hash, give the successor a new hash/policy entry, and do not grant NATIVE_ENV a mutable exemption. Root alone opened the single repair at11:07:10.897421–11:22:10.897421UTC; this initial report does not accept that delta before readback. + +## Accepted narrow derivation result + +The 3830-byte configured-prefix verifier (`4591de196d008f0fdc094f4a74b19a84c095e2def5d28dbdaea7085e4630f8a7`) obtains the exact authenticated prefix rendering, permits only the eight top-level gate value spans to normalize to None, and requires every other byte to equal that rendering. It rejects duplicate assignments, nonliteral expressions and mismatched exact data types. _plain checks exact native types, string keys, integer domain, depth24/nodes65536/string8192/aggregate-text524288/container1024; driver bytes are limited to262144. These are local bounds, not complete admission or a physical-resource reservation. + +AST columns are UTF8 byte offsets and the implementation computes offsets in bytes. Independent NEW-function probes accepted eight None gates and a multibyte UTF8 gate; rejected a nongate edit, duplicate gate, bool/int substitution and a Call expression. The expression was parsed as inert syntax and never invoked. Exact original41337-byte source `cdb1479253358508088f8aa0e1e92e6c75ffcc127e54552698598a02de061254` produced unconfigured rendering SHA256 `913e2ad11489014fff9980e8ca3e1722d213a268d92309f6fdc2e21b9c5e7c3d`, accepted by the verifier. No selected driver or original function body was executed. + +## Preservation, dependencies and test isolation + +Byte comparisons established the entire original domain source is an unchanged prefix plus exactly two LF and the new accessor; the original closure has only the named63-byte dictionary insertion; production parent bytes are unchanged at `d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5`. Thus original production terminal_facts and production mint/accept functions are preserved in the initial assembly. The final Unit01 observer remains unchanged at `abf25690d3bee4a9783ee504567c29f7fb47da670e0ec95f57cb5944bf57264f`. + +Static AST examination of literal globals in the assembled runtime files found no second literal-key capture mismatch. The12-file assembly is not a deployable transitive closure: parent_completion still imports epoch_parent_v5 and the original import graph extends further. Exact source exists in retained inputs, but the actual approved module objects, complete receiver policy and pre-import authentication remain required external inputs. + +The supplied tests extract only the appended NEW accessor into an AST module with fake _state/_GETPID/_fresh_acquisition/_census/schema; their state is expressly synthetic. Remaining supplied tests parse source or check strings. They do not import the archived domain, execute original functions, call Popen, install a subreaper or perform native/control/namespace work. The accessor has no decorators/default expressions that could run at extraction. These fixtures establish local predicates only. + +## Source identities + +All paths below are under /home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/implementation: + +- derivation `4591de196d008f0fdc094f4a74b19a84c095e2def5d28dbdaea7085e4630f8a7` +- supervisor `75bef7834fe7278638010f79a8efca84b49b1e48320d3c8ac2d93cadea5a8262` +- domain initial successor `a51264289803b4b17bb262f2460ddd4ed72500aaa21e5eb80fa2db4583689361` +- closure initial successor `a15424f14baa3d484fe04bfbe7e449c32561c866dbaca2c1b5f646dfb377ed1f` +- supplied test file `b5f8055da6f9a48e85a4eed0868f7076859adca317e0691e5b2336e0bdb58d52` + +Complete Pro6 response read; SHA256 `d1b15e2a92c6cbf137319ef2c165e2d920202d5f2d7509d7a8d572d90b4ffa13`. The source proposal supplies no authentic enclosing-parent bootstrap, immutable lifetime, native/funding admission, concrete original instance, or runtime capability. Full C05/V03 and original activity credit remain false. Costs OPEN_NOT_ZERO. + + +## Repaired delta accepted + +DC01 is resolved in the local constructor successor, reviewed before the single repair deadline. `v03_integrated_constructor_v2.py` is6111bytes SHA256 `a80a60b390bc60e9bc434b79cda5ae6db88e4f0c6c7436de9adfe1f48a2045b1`. Its only source change is NATIVE_ENV's literal dict to six tuples of exact bytes pairs. All four original NEW constructor FunctionDef source segments remain byte-identical; dict(tuple) equals the original six-entry bytes mapping. The closed Unit01 file remains unchanged. No mutable exemption was added. Original _data accepts bytes leaves within tuple recursion; this compatibility is a static source conclusion, not an executed original capture. + +The derivation verifier's sole dependency change is import of constructor_v2; current hash `1ed813148c10d5fbd3cd6781d51eca650a347eda7a6323f581d740e6ea9cb6e2`. Independent NEW-only None/UTF8 probes pass against the unchanged rendering hash913e2ad11489014fff9980e8ca3e1722d213a268d92309f6fdc2e21b9c5e7c3d. Future receiver policy must bind v2 and its new hash; the historical v1 byte-key module must not be treated as an active capturable dependency. + +The expanded11-method orchestration fixture SHA256 `251bc23c4b7ad15526bdfe0bdb3b053848f2fffc0fe8210b386a898f1838c610` was inspected for isolation: only NEW _supervise/_source_snapshot/_capture bodies are AST-extracted; Popen/domain/copy/signal/resource/FS services are explicit fakes. No archived function or full supervisor is imported by those tests. I did not repeat the complete suite. Their fake ownership is not runtime evidence. + +Final disposition for my owned scope: PASS for configured-prefix derivation, repaired literal capture compatibility, initial original-function preservation and NEW-test isolation. Actual capture, full supervisor semantics, authenticated bootstrap, C07 interval and all native/funding/runtime authority remain separate. The initial failed composition remains documented above; no full C05/V03 or original activity credit follows. + +Final fixture readback: the completed orchestration fixture has13 fake-only methods, SHA2567193e4eadf500a1a1e630236dbbda73703e20cfc7cbc7ab174e18636a5d6362c; the added8-method derivation fixture SHA25637260fe75234e3b4565cea65fba6c4374cd0a30a407b5cfaa670f198df5b8a82 executes only pinned NEW pure modules under a controlled import whitelist. Original source remains inert bytes. Saved derivation logs report8 tests OK in normal/optimized modes. The earlier11-method inspection was an intermediate snapshot, not the final fixture hash. + +The original pre-gate reports were already extended before the preservation request. Their exact initial bytes have now been reconstructed and verified against INPUT-GATE-v1 hashes, then retained separately as review-derivation-closure-input-gate-v1.md/.json. No uncertain reconstruction was substituted. diff --git a/research/h25-v03-prefix-supervision/unit05/review-supervision-domain-input-gate-RESTORATION-v1.json b/research/h25-v03-prefix-supervision/unit05/review-supervision-domain-input-gate-RESTORATION-v1.json new file mode 100644 index 0000000000..d7ddd5db68 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/review-supervision-domain-input-gate-RESTORATION-v1.json @@ -0,0 +1,25 @@ +{ + "schema": "unit05-input-gate-review-restoration-v1", + "recorded_utc": "2026-11-02T11:26:57.192971+00:00", + "scope": "Archival evidence restoration only, after source freeze; not a new source gate, test, admission or source-clock restart.", + "md_method": "Exact first10242-byte prefix of frozen final Markdown; verified against the original input-gate size/SHA before writing.", + "json_method": "Explicit reconstruction from frozen final JSON by restoring phase INPUT_GATE_V1_REJECTED_REPAIR_PENDING and repair.status pending actual corrected bytes, deleting final_review, serializing UTF-8 with two-space indentation and final LF. Exact original input-gate size/SHA verified before writing.", + "restored": [ + { + "path": "review-supervision-domain-input-gate-v1.md", + "bytes": 10242, + "sha256": "21c02459c76b114caffd77ff6310c3c9933f4d8c627dbc5b667001b1bb5b5153" + }, + { + "path": "review-supervision-domain-input-gate-v1.json", + "bytes": 5449, + "sha256": "7367c65eadb755719696d72358b81a043e53626b978f3b523baaea3fcaa9d7fc" + } + ], + "frozen_final_files_unchanged": true, + "final_md_sha256": "467e6aeb70d98f45a73489b2041477d1cc95d02f510b033cb91b3e84337baaa5", + "final_json_sha256": "9ee2baceb9a3f70f465c433e6f00b9bf69d028f685c1161fddfa720c5c9ba0b1", + "source_edited": false, + "tests_executed": false, + "source_clock_restarted": false +} diff --git a/research/h25-v03-prefix-supervision/unit05/review-supervision-domain-input-gate-v1.json b/research/h25-v03-prefix-supervision/unit05/review-supervision-domain-input-gate-v1.json new file mode 100644 index 0000000000..e44f2a8814 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/review-supervision-domain-input-gate-v1.json @@ -0,0 +1,147 @@ +{ + "schema": "unit05-supervision-domain-independent-review-v1", + "recorded_utc": "2026-11-02 11:11:35 UTC", + "phase": "INPUT_GATE_V1_REJECTED_REPAIR_PENDING", + "supervisor_v1": "REJECTED_NEW_PLAN_SELF_HASH_DEPENDENCY", + "critical_finding": { + "file": "unit05/implementation/v03_prefix_supervisor_v1.py", + "sha256": "75bef7834fe7278638010f79a8efca84b49b1e48320d3c8ac2d93cadea5a8262", + "spans": [ + "289-291 decode plan", + "363-373 require configuration['plan'] inside its own embedded source_files" + ], + "dependency": "plan bytes -> embedded own SHA256 source row -> plan bytes", + "scope": "unavailable bounded acyclic constructor; no mathematical fixed-point impossibility claim", + "first_reported_to_parent_utc": "2026-11-02T11:04Z" + }, + "repair": { + "parent_declared_only_window": { + "start": "2026-11-02T11:07:10.897421Z", + "end": "2026-11-02T11:22:10.897421Z" + }, + "status": "pending actual corrected bytes", + "requirements": [ + "outer authenticated real plan pin remains in actual construction/prelaunch/postcapture custody", + "read actual plan with original bounded copying APIs and compare exact constructor-decoded bytes", + "keep other mandatory input membership", + "account separate plan occurrence within8192", + "reject plan path/object alias in inner inventory", + "preserve C07 missing interval and no runtime admission" + ] + }, + "scoped_passes": { + "all_12_assembly_pins_match": true, + "domain_exact_original_plus_2LF_plus_fragment": true, + "closure_only_63_byte_mutable_insertion": true, + "parent_completion_byte_identical": true, + "supervisor_exact_proposal": true, + "accessor": "PASS conditional original-owned exit1 cleanup DATA; no refusal/production credential", + "supplied_test_isolation": "PASS new accessor extraction/fakes and static source checks only; no original execution" + }, + "runtime_bounds": { + "domain_registry": 4, + "receiver_captures": 2, + "modules": 48, + "globals_per_module": 512, + "source_rows_including_external_plan_after_required_repair": 8192, + "stage_entries": 16384, + "record_bytes": 1048576, + "stream_bytes": 2097152, + "occupied_inode_pairs_largest_prefix": 20, + "copying_occupied_pair_bound": 51, + "child_raw_records": [ + 3, + 5, + 6, + 8 + ], + "total_copies": [ + 5, + 7, + 8, + 10 + ], + "maximum_raw_payload_bytes": 12582912 + }, + "static_top_level_bound_name_counts": { + "parent_domain_v1": 44, + "parent_closure_v1": 48, + "v03_prefix_supervisor_v1": 52, + "note": "syntax counts only; not initialized module census" + }, + "runtime_gaps": [ + "authentic preimport enclosing-parent bootstrap", + "actual complete transitive receiver policy and initialized module/global census", + "actual C05 complete configured-domain/source closure", + "C07 immutable source/ancestor/output interval", + "actual current native/funding/execution admissions", + "observed enclosing-parent teardown" + ], + "necessary_isolated_failure_tests": [ + "Popen A + domain cleanup B propagates A by identity and retains B", + "uncertain raw acquisition stops fresh acquisition and consumes known cleanup", + "raw close failure has no retry/no result", + "timer cleanup failures retain primary", + "incomplete forged traceback", + "exit0 plus refusal stderr", + "earlier gate/native failure", + "missing extra reached raw", + "postchild source change", + "nongate selected source tamper", + "constructor failure before token", + "public token replay" + ], + "tests_executed_by_this_reviewer": 0, + "original_modules_imported": false, + "original_functions_executed": false, + "pins": [ + { + "path": "unit05/PLAN.json", + "sha256": "c6c6e3a464ec54f69f942187d7d1962a83f870cb91395afad7864d91be9549bc" + }, + { + "path": "consultation/RESPONSE-v6.txt", + "sha256": "d1b15e2a92c6cbf137319ef2c165e2d920202d5f2d7509d7a8d572d90b4ffa13" + }, + { + "path": "unit05/fixtures/ASSEMBLY-v1.json", + "sha256": "fcb9d53fbb77583a12ace09ebec7edb9e9820d7eeb00e15b6b7410888738763b" + }, + { + "path": "unit05/proposal/domain-prefix-accessor.py.fragment", + "sha256": "5397f59e65cef18d03581afe1c2727a288506248aaabc0dd88c06811e810f6b1" + }, + { + "path": "unit05/implementation/v03_prefix_supervisor_v1.py", + "sha256": "75bef7834fe7278638010f79a8efca84b49b1e48320d3c8ac2d93cadea5a8262", + "bytes": 35491 + }, + { + "path": "unit05/implementation/parent_domain_v1.py", + "sha256": "a51264289803b4b17bb262f2460ddd4ed72500aaa21e5eb80fa2db4583689361", + "bytes": 23942 + }, + { + "path": "unit05/implementation/parent_closure_v1.py", + "sha256": "a15424f14baa3d484fe04bfbe7e449c32561c866dbaca2c1b5f646dfb377ed1f", + "bytes": 13463 + }, + { + "path": "unit05/implementation/parent_completion_v1.py", + "sha256": "d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5", + "bytes": 54168 + }, + { + "path": "unit05/implementation/test_v03_prefix_supervisor_v1.py", + "sha256": "b5f8055da6f9a48e85a4eed0868f7076859adca317e0691e5b2336e0bdb58d52", + "bytes": 6381 + } + ], + "full_C05": false, + "full_V03": false, + "runtime_qualified": false, + "original_execution": false, + "original_activity_credit": 0, + "physical_costs": "OPEN_NOT_ZERO", + "prior_units_reopened": false +} diff --git a/research/h25-v03-prefix-supervision/unit05/review-supervision-domain-input-gate-v1.md b/research/h25-v03-prefix-supervision/unit05/review-supervision-domain-input-gate-v1.md new file mode 100644 index 0000000000..e2b6f4a789 --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/review-supervision-domain-input-gate-v1.md @@ -0,0 +1,48 @@ +# Unit05 lifecycle/domain/error review — input verdict + +Recorded before the 11:15:20.190742 UTC input gate. This review executes no original module/function, compiler, native, namespace, Popen or target operation. It owns only this Markdown and its JSON companion. + +**Supervisor v1: REJECTED for a new plan self-hash construction dependency. Repair is pending in the parent's sole shared window, 11:07:10.897421–11:22:10.897421 UTC.** The independently scoped accessor/source-preservation findings below are accepted; they do not accept the integrated supervisor, its missing runtime dependencies, or any original V03 control. + +## Critical v1 defect + +In implementation/v03_prefix_supervisor_v1.py (SHA25675bef7834fe7278638010f79a8efca84b49b1e48320d3c8ac2d93cadea5a8262), make_prefix_owner reads the authenticated plan at289–291. Lines363–373 then requires every configuration pin, including configuration['plan'], to occur in the decoded plan['source_files'] with its exact SHA/size/mode. That list is embedded in the same plan bytes. The dependency is: + +plan bytes -> embedded source_files row for plan -> SHA256(plan bytes) -> plan bytes. + +No acyclic constructor or fixed-point construction is provided. This is an unavailable bounded construction, not a theorem that cryptographic fixed points cannot exist. The requirement is absent from original make_parent lines436–505. It also recurs through _source_snapshot's original parent._snapshot_sources verification, so supplying an invented row cannot bypass it. + +The parent accepted the finding and opened the one repair window. The minimal correction being reviewed must keep the plan as a separately, externally authenticated actual input; observe/read it with original bounded copying APIs at construction, prelaunch and postcapture; bind its bytes and blob identity to the exact originally decoded plan; retain endpoint custody independently of the inner inventory; count that extra occurrence inside8192; and prevent a self/alias row from reintroducing the cycle. Other configuration/root/driver/gate membership checks must remain. Removing plan custody or replacing it with a serialized assertion is insufficient. C07 interval evidence remains external and absent. + +## Independently accepted narrow source scopes + +**Preservation PASS.** Passive byte/AST analysis verified all12 ASSEMBLY-v1.json rows against actual size and SHA. The domain successor equals all20,456 original bytes + two LF + exact3,484-byte accessor fragment. The closure successor equals the original with one63-byte dictionary insertion. parent_completion_v1.py is byte-identical to the original54,168-byte d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5. The supervisor equals the recovered proposal. No original function or production mint route was edited. + +**Exit1 accessor PASS as conditional cleanup DATA only.** The appended parent_domain_v1.py lines453–532 (SHA a51264289803b4b17bb262f2460ddd4ed72500aaa21e5eb80fa2db4583689361) resolves the original exact-object domain token and checks actual owning PID, original uncertainty gate, both shared/local primary slots, CLOSED phase, no quarantine/acquisition/I/O uncertainty, exact integer exit1, genuine root, confirmed closure, empty final rows, no after-root/reaped descendants and every known FD's consumed successful close. It performs the same fresh genuine proc census and rejects remaining owned children/groups. Catching a later error preserves an earlier actual primary by identity, retains secondary/overflow evidence, quarantines, and leaves phase unchanged so an invalid early call cannot disable original cleanup. Its output explicitly authenticates neither refusal semantics nor production completion. Original terminal_facts still requires exit0, and original finish_domain/pidfd handling remains literal. + +**Closure allowance PASS as a small source delta.** The sole new mutable allowance is v03_prefix_supervisor_v1: (_PREFIX, _UNKNOWN_OWNER); actual registry object identities remain checked. Original limits remain four domains, two captures, 48 modules and512 globals per module. Static top-level bound-name counts were44/domain,48/closure,52/supervisor; those are syntax observations, not initialized namespace counts or proof that a future complete receiver policy fits. The concrete transitive receiver policy and authenticated loading history have not been supplied. + +**Supplied test isolation PASS, restricted scope.** The frozen6,381-byte test file (SHA b5f8055da6f9a48e85a4eed0868f7076859adca317e0691e5b2336e0bdb58d52) parses inert source, extracts only the newly appended accessor FunctionDef and compiles that body into a fake supplied namespace. It does not import or execute archived functions. Its remaining tests inspect supervisor AST/text. Its synthetic token, census and FD state are not runtime capabilities. I inspected this isolation; I did not run those tests in this review. These supplied tests do not exercise the full _supervise orchestration. + +## Remaining supervisor paths inspected + +The constructor burns the process slot before reading inputs (277–299), creates a genuine original ErrorOwner, binds supplied actual receiver module objects through the original closure API, checks required identities and a fresh original parent/domain lifetime (299–325), retains state before acquiring resources (328–342), creates an exclusive session, acquires two actual original lock FDs/flocks and calls the actual original subreaper installer, retaining its real keeper (344–360). Those operations are source calls to the real interfaces, not success booleans. Locks/keeper intentionally remain owned until enclosing parent teardown. Failure before token publication burns the lifetime and retains internal state; it supplies no successful capability. + +The real launch path (421–587) takes source/stage endpoints before launch, requires an absent output, creates the actual original domain, writes launch DATA, acquires complete raw log descriptors, preserves original AS callback/timer/env/cwd/DEVNULL/close_fds/pass_fds/new-session selections, calls actual Popen and adopts that exact returned object. The domain retains genuine generation/session/pidfd ownership. The loop checks summed owned RSS and both log sizes. Cleanup attempts original finish_domain and original _close_logs; shared first-primary storage prevents a delivered Popen error A from being replaced by cleanup B. Unknown acquisition and failed closes quarantine. Timers/FD/child/native failure guarantees remain the inherited scoped caught-primary guarantee; this is not a total pre-handler recovery theorem. + +After cleanup, a negative uses the separate exit1 accessor; a positive uses unchanged terminal_facts. Neither exit disposition alone accepts a source refusal. The capture path (661–736) copies actual complete stdout/stderr and expected reached raw occurrences before semantic decoding, checks exact output/scratch census and PID binding, uses the final complete traceback corroborator, re-verifies source/copy pins and recenses. Unexpected/missing files stop; already present owned output files are not converted into invented records. Original initial controls writes its raw record before adding an in-memory success status; that missing serialized status must not be fabricated. + +Source-derived reached child raw counts are3 for literal/configuration refusal,5 for earlier preflight refusal,6 for custody refusal and8 for intact prefix. Complete copies including stdout/stderr are5/7/8/10, requiring at most20 occupied source/destination inode pairs (original51 bound), at most12MiB raw payload before rereads/metadata/source custody. _record_bytes enforces the original1MiB writer bound; the source snapshots reject overlarge custody before launch. These bounds do not establish complete physical costs or that an arbitrary8192-row inventory fits a record. + +run_prefix (739–790) requires postcapture source/stage endpoint equality, a second owned terminal observation and complete root/capture/result-tail deadlines before returning only a file pin. Its DATA record expressly denies production completion, full C05/V03, runtime qualification and endpoint-as-interval proof, and requires an enclosing guard to observe parent exit. No epoch reservation, acceptance or mint call occurs through the selected helpers. Production scheduling and full two-build validation remain unchanged. + +## Exact unresolved gates and required new discriminators + +A genuinely authenticated pre-import enclosing-parent bootstrap is absent. It must bind the supervisor, all actual transitive imports, fixed source/receiver policy, configured selections and native startup before this constructor is reachable. The child f5 Root does not authenticate the enclosing parent. A dictionary of plausible pins, JSON gates or ErrorOwner-shaped data cannot substitute. + +Actual current stage/source completeness, C05/C07 immutable lifetime and output ancestors, full configured child admissions/native profile, current funded reservation/execution policy and observed enclosing-parent teardown remain absent. Endpoint equality is not the missing interval. Thus even a repaired supervisor is only a conditional source operation, not a currently obtainable runtime capability or original V03 acceptance. + +Before integrated source acceptance, new isolated fixtures should exercise Popen A plus cleanup B retaining A identity; uncertain raw acquisition prohibiting further acquisition while consuming known closes; first-close failure without retry; timer-cleanup failures; forged/incomplete negative stderr; exit0 with refusal stderr; earlier gate/native failure; missing/extra raw; postchild source change; non-gate selected-source tamper; constructor failure before token; and token replay without a second domain/Popen. Original controls remain unexecuted. A complete actual transitive policy is required to claim48/512 fit;12 assembled source files are not that policy. + +Final repaired-delta disposition will be appended only after reading the actual correction and exact hashes within the one repair window. Full C05=false; full V03=false; original execution=false; original activity credit0; physical costs OPEN_NOT_ZERO. + diff --git a/research/h25-v03-prefix-supervision/unit05/review-supervision-domain-v1.json b/research/h25-v03-prefix-supervision/unit05/review-supervision-domain-v1.json new file mode 100644 index 0000000000..ced8ff09ac --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/review-supervision-domain-v1.json @@ -0,0 +1,195 @@ +{ + "schema": "unit05-supervision-domain-independent-review-v1", + "recorded_utc": "2026-11-02 11:11:35 UTC", + "phase": "REPAIRED_CONDITIONAL_SOURCE_PASS_WITH_RUNTIME_BLOCKERS", + "supervisor_v1": "REJECTED_NEW_PLAN_SELF_HASH_DEPENDENCY", + "critical_finding": { + "file": "unit05/implementation/v03_prefix_supervisor_v1.py", + "sha256": "75bef7834fe7278638010f79a8efca84b49b1e48320d3c8ac2d93cadea5a8262", + "spans": [ + "289-291 decode plan", + "363-373 require configuration['plan'] inside its own embedded source_files" + ], + "dependency": "plan bytes -> embedded own SHA256 source row -> plan bytes", + "scope": "unavailable bounded acyclic constructor; no mathematical fixed-point impossibility claim", + "first_reported_to_parent_utc": "2026-11-02T11:04Z" + }, + "repair": { + "parent_declared_only_window": { + "start": "2026-11-02T11:07:10.897421Z", + "end": "2026-11-02T11:22:10.897421Z" + }, + "status": "corrected bytes and isolated fixture delta reviewed within the sole declared window; v1 rejection preserved", + "requirements": [ + "outer authenticated real plan pin remains in actual construction/prelaunch/postcapture custody", + "read actual plan with original bounded copying APIs and compare exact constructor-decoded bytes", + "keep other mandatory input membership", + "account separate plan occurrence within8192", + "reject plan path/object alias in inner inventory", + "preserve C07 missing interval and no runtime admission" + ] + }, + "scoped_passes": { + "all_12_assembly_pins_match": true, + "domain_exact_original_plus_2LF_plus_fragment": true, + "closure_only_63_byte_mutable_insertion": true, + "parent_completion_byte_identical": true, + "supervisor_exact_proposal": true, + "accessor": "PASS conditional original-owned exit1 cleanup DATA; no refusal/production credential", + "supplied_test_isolation": "PASS new accessor extraction/fakes and static source checks only; no original execution" + }, + "runtime_bounds": { + "domain_registry": 4, + "receiver_captures": 2, + "modules": 48, + "globals_per_module": 512, + "source_rows_including_external_plan_after_required_repair": 8192, + "stage_entries": 16384, + "record_bytes": 1048576, + "stream_bytes": 2097152, + "occupied_inode_pairs_largest_prefix": 20, + "copying_occupied_pair_bound": 51, + "child_raw_records": [ + 3, + 5, + 6, + 8 + ], + "total_copies": [ + 5, + 7, + 8, + 10 + ], + "maximum_raw_payload_bytes": 12582912 + }, + "static_top_level_bound_name_counts": { + "parent_domain_v1": 44, + "parent_closure_v1": 48, + "v03_prefix_supervisor_v1": 52, + "note": "syntax counts only; not initialized module census" + }, + "runtime_gaps": [ + "authentic preimport enclosing-parent bootstrap", + "actual complete transitive receiver policy and initialized module/global census", + "actual C05 complete configured-domain/source closure", + "C07 immutable source/ancestor/output interval", + "actual current native/funding/execution admissions", + "observed enclosing-parent teardown" + ], + "necessary_isolated_failure_tests": [ + "Popen A + domain cleanup B propagates A by identity and retains B", + "uncertain raw acquisition stops fresh acquisition and consumes known cleanup", + "raw close failure has no retry/no result", + "timer cleanup failures retain primary", + "incomplete forged traceback", + "exit0 plus refusal stderr", + "earlier gate/native failure", + "missing extra reached raw", + "postchild source change", + "nongate selected source tamper", + "constructor failure before token", + "public token replay" + ], + "tests_executed_by_this_reviewer": 0, + "original_modules_imported": false, + "original_functions_executed": false, + "pins": [ + { + "path": "unit05/PLAN.json", + "sha256": "c6c6e3a464ec54f69f942187d7d1962a83f870cb91395afad7864d91be9549bc" + }, + { + "path": "consultation/RESPONSE-v6.txt", + "sha256": "d1b15e2a92c6cbf137319ef2c165e2d920202d5f2d7509d7a8d572d90b4ffa13" + }, + { + "path": "unit05/fixtures/ASSEMBLY-v1.json", + "sha256": "fcb9d53fbb77583a12ace09ebec7edb9e9820d7eeb00e15b6b7410888738763b" + }, + { + "path": "unit05/proposal/domain-prefix-accessor.py.fragment", + "sha256": "5397f59e65cef18d03581afe1c2727a288506248aaabc0dd88c06811e810f6b1" + }, + { + "path": "unit05/implementation/v03_prefix_supervisor_v1.py", + "sha256": "75bef7834fe7278638010f79a8efca84b49b1e48320d3c8ac2d93cadea5a8262", + "bytes": 35491 + }, + { + "path": "unit05/implementation/parent_domain_v1.py", + "sha256": "a51264289803b4b17bb262f2460ddd4ed72500aaa21e5eb80fa2db4583689361", + "bytes": 23942 + }, + { + "path": "unit05/implementation/parent_closure_v1.py", + "sha256": "a15424f14baa3d484fe04bfbe7e449c32561c866dbaca2c1b5f646dfb377ed1f", + "bytes": 13463 + }, + { + "path": "unit05/implementation/parent_completion_v1.py", + "sha256": "d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5", + "bytes": 54168 + }, + { + "path": "unit05/implementation/test_v03_prefix_supervisor_v1.py", + "sha256": "b5f8055da6f9a48e85a4eed0868f7076859adca317e0691e5b2336e0bdb58d52", + "bytes": 6381 + } + ], + "final_review": { + "observed_utc": "2026-11-02T11:18:36Z", + "decision": "CONDITIONAL_SOURCE_PASS_NAMED_REPAIR_AND_LOCAL_NONMINTING_OPERATION", + "actual_runtime_capability_available": false, + "remaining_critical_defect_found_in_bounded_corrected_scope": false, + "supervisor": { + "path": "unit05/implementation/v03_prefix_supervisor_v1.py", + "bytes": 36954, + "sha256": "f97b07d4a5f461d4134a2bdf4cfcc28da12acc7e7144c18f6cc0a017cdee86f6", + "spans": ["263-295 bounded outer plan custody", "310-312 actual raw plan", "350-354 endpoint allocation", "388-391 only plan excluded from inner membership"], + "outer_plan_endpoint_reads": 3, + "plan_row_charged_inside8192": true, + "plan_path_and_inode_alias_rejected": true, + "all_other_input_membership_and_configuration_guard_retained": true, + "endpoint_equality_is_interval_proof": false + }, + "constructor_v2": { + "path": "unit05/implementation/v03_integrated_constructor_v2.py", + "bytes": 6111, + "sha256": "a80a60b390bc60e9bc434b79cda5ae6db88e4f0c6c7436de9adfe1f48a2045b1", + "delta": "immutable tuple of byte-pairs replaces byte-key literal dictionary; genuine_launch still creates same mapping", + "new_mutable_exemption": false, + "closed_unit01_changed": false + }, + "derivation": { + "path": "unit05/implementation/v03_prefix_derivation_v1.py", + "bytes": 3830, + "sha256": "1ed813148c10d5fbd3cd6781d51eca650a347eda7a6323f581d740e6ea9cb6e2", + "delta": "sole import switch to v03_integrated_constructor_v2" + }, + "orchestration_fixture": { + "path": "unit05/fixtures/test_new_orchestration_v2.py", + "bytes": 12170, + "sha256": "7193e4eadf500a1a1e630236dbbda73703e20cfc7cbc7ab174e18636a5d6362c", + "isolation": "only three newly authored supervisor functions extracted; all operational services fake; no original functions executed", + "initial_close_model_scope_defect": "helper-abort was mislabeled ordinary first-close failure; old source/raw preserved by author under v2-pre-close-model", + "correction": "narrowed label plus new faithful per-FD catch/continue fake; both known FD attempts consumed exactly once; primary A survives close B", + "normal": {"tests": 13, "result": "PASS", "seconds": 0.121, "raw_path": "unit05/fixtures/ORCHESTRATION-v2-normal.txt", "raw_sha256": "8f8900c0604a2f63cb4234a16749915cdbe8d2a617b4f76dc88a9f256c10835f"}, + "optimized": {"tests": 13, "result": "PASS", "seconds": 0.114, "raw_path": "unit05/fixtures/ORCHESTRATION-v2-optimized.txt", "raw_sha256": "fb797a332abdf3285f00365390e24c040d4d1a2f50f997f47ea3586a4b02ed70"}, + "reviewer_reran_tests": false, + "real_process_descriptor_or_kernel_ownership_proved": false, + "plan_raw_retention_limit": "only helper-returned bytes; actual read_verified may reject before returning changed bytes" + }, + "complete_transitive_receiver_policy_or_initialized_namespace_fit_established": false, + "runtime_blockers_preserved": true, + "production_mint_or_original_function_changes": false, + "additional_repair_or_extension_granted": false + }, + "full_C05": false, + "full_V03": false, + "runtime_qualified": false, + "original_execution": false, + "original_activity_credit": 0, + "physical_costs": "OPEN_NOT_ZERO", + "prior_units_reopened": false +} diff --git a/research/h25-v03-prefix-supervision/unit05/review-supervision-domain-v1.md b/research/h25-v03-prefix-supervision/unit05/review-supervision-domain-v1.md new file mode 100644 index 0000000000..e62b9eb3df --- /dev/null +++ b/research/h25-v03-prefix-supervision/unit05/review-supervision-domain-v1.md @@ -0,0 +1,62 @@ +# Unit05 lifecycle/domain/error review — input verdict + +Recorded before the 11:15:20.190742 UTC input gate. This review executes no original module/function, compiler, native, namespace, Popen or target operation. It owns only this Markdown and its JSON companion. + +**Supervisor v1: REJECTED for a new plan self-hash construction dependency. Repair is pending in the parent's sole shared window, 11:07:10.897421–11:22:10.897421 UTC.** The independently scoped accessor/source-preservation findings below are accepted; they do not accept the integrated supervisor, its missing runtime dependencies, or any original V03 control. + +## Critical v1 defect + +In implementation/v03_prefix_supervisor_v1.py (SHA25675bef7834fe7278638010f79a8efca84b49b1e48320d3c8ac2d93cadea5a8262), make_prefix_owner reads the authenticated plan at289–291. Lines363–373 then requires every configuration pin, including configuration['plan'], to occur in the decoded plan['source_files'] with its exact SHA/size/mode. That list is embedded in the same plan bytes. The dependency is: + +plan bytes -> embedded source_files row for plan -> SHA256(plan bytes) -> plan bytes. + +No acyclic constructor or fixed-point construction is provided. This is an unavailable bounded construction, not a theorem that cryptographic fixed points cannot exist. The requirement is absent from original make_parent lines436–505. It also recurs through _source_snapshot's original parent._snapshot_sources verification, so supplying an invented row cannot bypass it. + +The parent accepted the finding and opened the one repair window. The minimal correction being reviewed must keep the plan as a separately, externally authenticated actual input; observe/read it with original bounded copying APIs at construction, prelaunch and postcapture; bind its bytes and blob identity to the exact originally decoded plan; retain endpoint custody independently of the inner inventory; count that extra occurrence inside8192; and prevent a self/alias row from reintroducing the cycle. Other configuration/root/driver/gate membership checks must remain. Removing plan custody or replacing it with a serialized assertion is insufficient. C07 interval evidence remains external and absent. + +## Independently accepted narrow source scopes + +**Preservation PASS.** Passive byte/AST analysis verified all12 ASSEMBLY-v1.json rows against actual size and SHA. The domain successor equals all20,456 original bytes + two LF + exact3,484-byte accessor fragment. The closure successor equals the original with one63-byte dictionary insertion. parent_completion_v1.py is byte-identical to the original54,168-byte d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5. The supervisor equals the recovered proposal. No original function or production mint route was edited. + +**Exit1 accessor PASS as conditional cleanup DATA only.** The appended parent_domain_v1.py lines453–532 (SHA a51264289803b4b17bb262f2460ddd4ed72500aaa21e5eb80fa2db4583689361) resolves the original exact-object domain token and checks actual owning PID, original uncertainty gate, both shared/local primary slots, CLOSED phase, no quarantine/acquisition/I/O uncertainty, exact integer exit1, genuine root, confirmed closure, empty final rows, no after-root/reaped descendants and every known FD's consumed successful close. It performs the same fresh genuine proc census and rejects remaining owned children/groups. Catching a later error preserves an earlier actual primary by identity, retains secondary/overflow evidence, quarantines, and leaves phase unchanged so an invalid early call cannot disable original cleanup. Its output explicitly authenticates neither refusal semantics nor production completion. Original terminal_facts still requires exit0, and original finish_domain/pidfd handling remains literal. + +**Closure allowance PASS as a small source delta.** The sole new mutable allowance is v03_prefix_supervisor_v1: (_PREFIX, _UNKNOWN_OWNER); actual registry object identities remain checked. Original limits remain four domains, two captures, 48 modules and512 globals per module. Static top-level bound-name counts were44/domain,48/closure,52/supervisor; those are syntax observations, not initialized namespace counts or proof that a future complete receiver policy fits. The concrete transitive receiver policy and authenticated loading history have not been supplied. + +**Supplied test isolation PASS, restricted scope.** The frozen6,381-byte test file (SHA b5f8055da6f9a48e85a4eed0868f7076859adca317e0691e5b2336e0bdb58d52) parses inert source, extracts only the newly appended accessor FunctionDef and compiles that body into a fake supplied namespace. It does not import or execute archived functions. Its remaining tests inspect supervisor AST/text. Its synthetic token, census and FD state are not runtime capabilities. I inspected this isolation; I did not run those tests in this review. These supplied tests do not exercise the full _supervise orchestration. + +## Remaining supervisor paths inspected + +The constructor burns the process slot before reading inputs (277–299), creates a genuine original ErrorOwner, binds supplied actual receiver module objects through the original closure API, checks required identities and a fresh original parent/domain lifetime (299–325), retains state before acquiring resources (328–342), creates an exclusive session, acquires two actual original lock FDs/flocks and calls the actual original subreaper installer, retaining its real keeper (344–360). Those operations are source calls to the real interfaces, not success booleans. Locks/keeper intentionally remain owned until enclosing parent teardown. Failure before token publication burns the lifetime and retains internal state; it supplies no successful capability. + +The real launch path (421–587) takes source/stage endpoints before launch, requires an absent output, creates the actual original domain, writes launch DATA, acquires complete raw log descriptors, preserves original AS callback/timer/env/cwd/DEVNULL/close_fds/pass_fds/new-session selections, calls actual Popen and adopts that exact returned object. The domain retains genuine generation/session/pidfd ownership. The loop checks summed owned RSS and both log sizes. Cleanup attempts original finish_domain and original _close_logs; shared first-primary storage prevents a delivered Popen error A from being replaced by cleanup B. Unknown acquisition and failed closes quarantine. Timers/FD/child/native failure guarantees remain the inherited scoped caught-primary guarantee; this is not a total pre-handler recovery theorem. + +After cleanup, a negative uses the separate exit1 accessor; a positive uses unchanged terminal_facts. Neither exit disposition alone accepts a source refusal. The capture path (661–736) copies actual complete stdout/stderr and expected reached raw occurrences before semantic decoding, checks exact output/scratch census and PID binding, uses the final complete traceback corroborator, re-verifies source/copy pins and recenses. Unexpected/missing files stop; already present owned output files are not converted into invented records. Original initial controls writes its raw record before adding an in-memory success status; that missing serialized status must not be fabricated. + +Source-derived reached child raw counts are3 for literal/configuration refusal,5 for earlier preflight refusal,6 for custody refusal and8 for intact prefix. Complete copies including stdout/stderr are5/7/8/10, requiring at most20 occupied source/destination inode pairs (original51 bound), at most12MiB raw payload before rereads/metadata/source custody. _record_bytes enforces the original1MiB writer bound; the source snapshots reject overlarge custody before launch. These bounds do not establish complete physical costs or that an arbitrary8192-row inventory fits a record. + +run_prefix (739–790) requires postcapture source/stage endpoint equality, a second owned terminal observation and complete root/capture/result-tail deadlines before returning only a file pin. Its DATA record expressly denies production completion, full C05/V03, runtime qualification and endpoint-as-interval proof, and requires an enclosing guard to observe parent exit. No epoch reservation, acceptance or mint call occurs through the selected helpers. Production scheduling and full two-build validation remain unchanged. + +## Exact unresolved gates and required new discriminators + +A genuinely authenticated pre-import enclosing-parent bootstrap is absent. It must bind the supervisor, all actual transitive imports, fixed source/receiver policy, configured selections and native startup before this constructor is reachable. The child f5 Root does not authenticate the enclosing parent. A dictionary of plausible pins, JSON gates or ErrorOwner-shaped data cannot substitute. + +Actual current stage/source completeness, C05/C07 immutable lifetime and output ancestors, full configured child admissions/native profile, current funded reservation/execution policy and observed enclosing-parent teardown remain absent. Endpoint equality is not the missing interval. Thus even a repaired supervisor is only a conditional source operation, not a currently obtainable runtime capability or original V03 acceptance. + +Before integrated source acceptance, new isolated fixtures should exercise Popen A plus cleanup B retaining A identity; uncertain raw acquisition prohibiting further acquisition while consuming known closes; first-close failure without retry; timer-cleanup failures; forged/incomplete negative stderr; exit0 with refusal stderr; earlier gate/native failure; missing/extra raw; postchild source change; non-gate selected-source tamper; constructor failure before token; and token replay without a second domain/Popen. Original controls remain unexecuted. A complete actual transitive policy is required to claim48/512 fit;12 assembled source files are not that policy. + +Final repaired-delta disposition will be appended only after reading the actual correction and exact hashes within the one repair window. Full C05=false; full V03=false; original execution=false; original activity credit0; physical costs OPEN_NOT_ZERO. + +## Repaired-delta disposition, 11:19 UTC + +**CONDITIONAL SOURCE PASS for the repaired plan-custody delta and local non-minting lifecycle operation.** The initial v1 rejection remains valid and preserved above; this decision concerns the exact repaired bytes below. It does not accept a currently obtainable runtime capability, a complete transitive-policy capture, total error recovery, or original V03 completion. The original domain/closure/production preservation findings remain unchanged. + +The repaired supervisor is36,954 bytes, SHA256 f97b07d4a5f461d4134a2bdf4cfcc28da12acc7e7144c18f6cc0a017cdee86f6. Its lines263–295 read the actual externally authenticated plan with original read_verified/1MiB bounds at each of the three source-snapshot points; consume a preallocated endpoint slot before acquisition; retain returned bytes before comparing them to the constructor-decoded raw plan; reject plan path and actual inode aliases in the inner inventory; count the separate plan occurrence within8192; and include its blob/hash/byte observations in bounded custody DATA. Constructor lines310–312 retains the exact raw plan, lines350–354 preallocates endpoint slots, and lines388–391 excludes only the plan from the mandatory inner membership checks. _guard continues verifying every configuration pin, including the plan. The count never exceeds three successful snapshot endpoints; ordinary read_verified/guard verification work is additional and must still be paid. This removes the mandatory self-hash without dropping actual plan custody. Endpoint equality remains explicitly insufficient for C07. + +The new constructor successor v03_integrated_constructor_v2.py is6,111 bytes, SHA256 a80a60b390bc60e9bc434b79cda5ae6db88e4f0c6c7436de9adfe1f48a2045b1. Its only delta from preserved Unit01 v1 is an immutable tuple of six byte-pairs for NATIVE_ENV. The actual original closure _data lines98–112 accepts tuple/bytes but refuses byte dictionary keys, so the old direct dictionary was not capture-compatible. genuine_launch still builds dict(NATIVE_ENV), preserving environment contents. The3,830-byte derivation verifier SHA2561ed813148c10d5fbd3cd6781d51eca650a347eda7a6323f581d740e6ea9cb6e2 changes only its import to the new constructor. No mutable exemption was added. The future actual policy must bind that v2 import; preserved unused v1 must not be blindly included as though its old literal were compatible. Unit01 remains untouched. + +I read the entire newly authored orchestration fixture and both retained raw outputs. Its extractor permits only the new _supervise, _source_snapshot and _capture function bodies, forbids imports in those bodies and supplies fake parent/domain/Popen/copy/resource/signal services. It runs no original helper. The initial11-test version incorrectly described a helper-abort injection as an ordinary first-close failure: its fake aborted before the second FD, while original _close_logs catches per-FD failures and continues. That fixture/raw history is preserved by the author under v2-pre-close-model. Within the same repair window, the author narrowed that label and added a newly written faithful per-FD fake. The final tests require attempted=[True,True], confirmed=[False,True], error B retained, and Popen A still primary when combined with close B. Candidate supervisor code did not change for this fixture correction. + +Final test source: fixtures/test_new_orchestration_v2.py,12,170 bytes, SHA2567193e4eadf500a1a1e630236dbbda73703e20cfc7cbc7ab174e18636a5d6362c. The inspected raw outputs show13/13 PASS in normal0.121s and optimized0.114s. Their SHA256 values are8f8900c0604a2f63cb4234a16749915cdbe8d2a617b4f76dc88a9f256c10835f and fb797a332abdf3285f00365390e24c040d4d1a2f50f997f47ea3586a4b02ed70. They establish selected local orchestrator/predicate behavior, not actual Popen/FD/kernel ownership. The plan-change fixture demonstrates retention of bytes returned by a fake read helper; the real original read_verified may reject before changed bytes are returned. No stronger inherited raw-retention guarantee follows. + +No remaining critical defect was identified within this bounded corrected lifecycle/domain scope. The broader unexecuted discriminators and all bootstrap, complete-policy, C05/C07, native, funding, execution and enclosing-parent-exit obligations above remain open before any original admission. No tests were rerun by this reviewer; evidence is source inspection plus exact author-produced new-fixture raw records. This repair grants no second window, original execution, completion credit or unit extension. + diff --git a/research/h25-v03-prefix-supervision/verify.py b/research/h25-v03-prefix-supervision/verify.py new file mode 100644 index 0000000000..65a4590b1c --- /dev/null +++ b/research/h25-v03-prefix-supervision/verify.py @@ -0,0 +1,44 @@ +# SPDX-License-Identifier: Apache-2.0 +"""Archive and production-body preservation checks; no archived code execution.""" +from pathlib import Path, PurePosixPath +import ast +import hashlib +import json +ROOT = Path(__file__).resolve().parent + +def need(ok, message): + if ok is not True: + raise RuntimeError(message) + +def check(): + manifest = json.loads((ROOT / 'ARTIFACTS.json').read_text()) + expected = set() + for row in manifest['files']: + name = row['path']; path = PurePosixPath(name) + need(path.as_posix() == name and not path.is_absolute() and all(x not in ('', '.', '..') for x in path.parts) and name not in expected, 'invalid archive path') + expected.add(name); target = ROOT / name + need(not any(p.is_symlink() for p in (target, *target.parents) if p.is_relative_to(ROOT)), 'archive link') + raw = target.read_bytes() + need(len(raw) == row['bytes'] and hashlib.sha256(raw).hexdigest() == row['sha256'], 'archive identity: ' + name) + actual = {p.relative_to(ROOT).as_posix() for p in ROOT.rglob('*') if p.is_file() and '__pycache__' not in p.parts} + need(actual == expected | {'ARTIFACTS.json'}, 'archive inventory') + impl = ROOT / 'unit05/implementation' + old_domain = (ROOT / 'basis/parent_domain_v1.py.txt').read_bytes() + domain = (impl / 'parent_domain_v1.py').read_bytes() + fragment = (ROOT / 'unit05/proposal/domain-prefix-accessor.py.fragment').read_bytes() + need(domain == old_domain + b'\n\n' + fragment, 'domain append changed') + old_closure = (ROOT / 'basis/parent_closure_v1.py.txt').read_bytes() + closure = (impl / 'parent_closure_v1.py').read_bytes() + allowance = (ROOT / 'unit05/proposal/closure-allowance.py.fragment').read_bytes() + need(len(allowance) == 63 and closure.count(allowance) == 1 and closure.replace(allowance, b'', 1) == old_closure, 'closure delta changed') + parent = (impl / 'parent_completion_v1.py').read_bytes() + need(parent == (ROOT / 'basis/parent_completion_v1.py.txt').read_bytes(), 'production parent changed') + for before, after in ((old_domain, domain), (old_closure, closure), (parent, parent)): + old = {n.name:n for n in ast.parse(before).body if isinstance(n, (ast.FunctionDef, ast.ClassDef))} + new = {n.name:n for n in ast.parse(after).body if isinstance(n, (ast.FunctionDef, ast.ClassDef))} + for name, node in old.items(): + need(ast.get_source_segment(before.decode(), node) == ast.get_source_segment(after.decode(), new[name]), 'original production source changed') + print('PASS_PREFIX_SUPERVISION_ARCHIVE_ONLY files=' + str(len(expected)), flush=True) + +if __name__ == '__main__': + check()