From ae4f6a44ad09d2e2b996d07dc49e154cf2a1f083 Mon Sep 17 00:00:00 2001 From: Monsky Date: Wed, 19 Aug 2026 18:00:48 -0400 Subject: [PATCH 1/2] Correct CK-07R1 large planner path --- scripts/benchmark_ck07r1_lifecycle_scale.py | 3046 +++++++++++++++++ .../agent_kernel/publication/preparation.py | 51 +- .../publication/test_lifecycle_scale.py | 2279 ++++++++++++ 3 files changed, 5351 insertions(+), 25 deletions(-) create mode 100644 scripts/benchmark_ck07r1_lifecycle_scale.py create mode 100644 tests/agent_kernel/publication/test_lifecycle_scale.py diff --git a/scripts/benchmark_ck07r1_lifecycle_scale.py b/scripts/benchmark_ck07r1_lifecycle_scale.py new file mode 100644 index 00000000..9b98f6f7 --- /dev/null +++ b/scripts/benchmark_ck07r1_lifecycle_scale.py @@ -0,0 +1,3046 @@ +#!/usr/bin/env python3 +"""Qualify CK-07R1 lifecycle scale through the frozen reachable path. + +The all-profile mode is the single authorized end-to-end publication/recovery +run. Smaller modes only measure the pure lifecycle-preparation seam and do +not produce an acceptance receipt. +""" + +from __future__ import annotations + +import argparse +import contextlib +import gc +import getpass +import hashlib +import importlib.util +import json +import math +import os +import platform +import resource +import shlex +import shutil +import signal +import statistics +import subprocess +import sys +import tempfile +import time +from collections import defaultdict +from collections.abc import Iterable, Mapping +from dataclasses import fields, is_dataclass, replace +from pathlib import Path +from typing import Any + +from codex_usage_tracker.agent_kernel.adapters.codex_jsonl.canonicalize import ( + AdapterAccounting, + ProposedChangeSet, + build_change_set, +) +from codex_usage_tracker.agent_kernel.adapters.codex_jsonl.ingest import ingest +from codex_usage_tracker.agent_kernel.adapters.codex_jsonl.parser import ParseBatch +from codex_usage_tracker.agent_kernel.adapters.contracts import AdapterObservation, SourceRange +from codex_usage_tracker.agent_kernel.publication import preparation +from codex_usage_tracker.agent_kernel.publication.planner import ( + OperationClass, + PublicationPlan, + RefreshIntent, + TailLimits, + estimate_change_set, + plan_refresh, +) +from codex_usage_tracker.agent_kernel.publication.recovery import ( + AnalyticalHead, + PointerArtifact, + PointerDocument, + PromotionRequest, + SmallPublicationRequest, + promote_isolated_artifact, + read_pointer, + recover_startup, + select_readable_artifact, + write_pointer_durable, +) +from codex_usage_tracker.agent_kernel.publication.validation import build_isolated_artifact +from codex_usage_tracker.agent_kernel.publication.writer import ( + PriorPublicationSnapshot, + PublicationRequest, + PublicationWriter, + planned_artifact_manifest_sha256, + prepare_write_set_from_changes, + read_prior_publication_snapshot, +) +from codex_usage_tracker.agent_kernel.storage.database import ( + initialize_analytical, + initialize_operational, + open_read_only, + open_writer, +) +from codex_usage_tracker.agent_kernel.storage.operational import ( + JobRequest, + JobState, + LeaseName, + OperationalStore, + RecoveryIntent, + RecoveryIntentState, + WorkerIdentity, +) +from codex_usage_tracker.agent_kernel.storage.operational import ( + OperationClass as SidecarOperationClass, +) +from codex_usage_tracker.agent_kernel.storage.schema import SCHEMA_CONTRACT_SHA256 + +_SCRIPT_ROOT = Path(__file__).resolve().parents[1] +if str(_SCRIPT_ROOT) not in sys.path: + sys.path.insert(0, str(_SCRIPT_ROOT)) + +from tests.agent_kernel.contracts.reference.identity import semantic_id # noqa: E402 +from tests.agent_kernel.contracts.reference.lifecycle import fold_lifecycle # noqa: E402 + +ROOT = _SCRIPT_ROOT +PROFILE_ROOT = ROOT / "tests" / "agent_kernel" / "fixtures" / "profiles" +TINY_ROOT = ROOT / "tests" / "agent_kernel" / "fixtures" / "tiny-v1" +DEPENDENCY_SHA = "d911b1f0d17596890a6a0a608be904330c96e9a6" +SCHEMA = "codex-usage-tracker.lifecycle-scale-requalification.v1" +PROFILE_DIGESTS = { + "standard": "ef0da880255a0b13ea6055e0f8d748870c075635aa6f199c9521462c681250f3", + "production": "2de0b4dc198603da6c1b0905b8d934e2cd5604e4036ef009d0cd07f1cc81f51b", +} +FROZEN_BUDGETS_MS = { + "standard_30_day": 5_000, + "production_all_time": 120_000, + "no_change": 100, + "one_call_tail": 500, + "one_tool_tail": 500, +} +PUBLICATION_CHUNK_OBSERVATIONS = 8_000 +SEED_PUBLICATION_ID = "publication:ck07r1:seed" + +LAUNCH_COMMAND = ( + ".venv/bin/python", + "scripts/benchmark_ck07r1_lifecycle_scale.py", + "--profile", + "all", + "--samples", + "5", + "--output", + "output/ck07r1/lifecycle-requalification-v2.json", +) +LAUNCH_ENVIRONMENT = { + "LC_ALL": "C.UTF-8", + "PYTHONHASHSEED": "0", + "PYTHONUNBUFFERED": "1", + "TZ": "UTC", +} +FORBIDDEN_ENVIRONMENT = ("PYTHONPATH", "CODEX_HOME") +RUN_OUTPUT_RELATIVE = Path("output/ck07r1/lifecycle-requalification-v2.json") +RUN_LEDGER_RELATIVE = Path("output/ck07r1/lifecycle-requalification-v2.launch-token.json") +RUN_STDOUT_RELATIVE = Path("output/ck07r1/lifecycle-requalification-v2.stdout.txt") +RUN_STDERR_RELATIVE = Path("output/ck07r1/lifecycle-requalification-v2.stderr.txt") +PRESERVED_V1_LEDGER_RELATIVE = Path( + "output/ck07r1/lifecycle-requalification-v1.launch-token.json" +) +PRESERVED_V1_LEDGER_SHA256 = ( + "5c2b42eca6a3e54cf4163226bc55f3c75aa35112c4ed0342c11f4e39cb9922be" +) +SHARED_OVERLAY_AUTHORITY_RELATIVE = Path( + "docs/decisions/evidence/ck07r1a0/shared-successor-overlay-authority-v1.json" +) +SHARED_OVERLAY_SCHEMA_RELATIVE = Path( + "docs/decisions/evidence/ck07r1a0/shared-successor-overlay-authority-v1.schema.json" +) +SHARED_OVERLAY_VERIFIER_RELATIVE = Path("scripts/ck07r1_shared_successor_overlay.py") +SHARED_OVERLAY_SCHEMA = "codex-usage-tracker.ck07r1-shared-successor-overlay.v1" +HISTORICAL_SHARED_OVERLAY_RELATIVES = ( + SHARED_OVERLAY_AUTHORITY_RELATIVE, + SHARED_OVERLAY_SCHEMA_RELATIVE, + SHARED_OVERLAY_VERIFIER_RELATIVE, +) +PRELAUNCH_RECOVERY_AUTHORITY_RELATIVE = Path( + "docs/decisions/evidence/ck07r1a0/lifecycle-prelaunch-recovery-authority-v1.json" +) +PRELAUNCH_RECOVERY_SCHEMA_RELATIVE = Path( + "docs/decisions/evidence/ck07r1a0/lifecycle-prelaunch-recovery-authority-v1.schema.json" +) +PRELAUNCH_RECOVERY_VERIFIER_RELATIVE = Path("scripts/ck07r1_prelaunch_recovery.py") +PRELAUNCH_RECOVERY_SCHEMA = ( + "codex-usage-tracker.ck07r1-lifecycle-prelaunch-recovery.v1" +) +RUN_TOKEN_ID = "ck07r1-all-profile-e2e-1" +RUN_TOKEN_STATUS = "unspent_unavailable" +PRODUCTION_SAMPLE_COUNT = 5 +PUBLICATION_RECOVERY_OVERHEAD_CANDIDATE_SECONDS = 120.0 +AGGREGATE_TIMEOUT_CANDIDATE_SECONDS = ( + PRODUCTION_SAMPLE_COUNT * FROZEN_BUDGETS_MS["production_all_time"] / 1_000 + + PUBLICATION_RECOVERY_OVERHEAD_CANDIDATE_SECONDS +) +AGGREGATE_TIMEOUT_CANDIDATE_RULE = ( + "five production samples at the frozen 120-second lifecycle budget each " + "plus one bounded 120-second publication/recovery allowance; candidate only " + "and requires a later authority freeze" +) +HANDSHAKE_TIMEOUT_SECONDS = 5.0 +TERMINATION_GRACE_TIMEOUT_SECONDS = 5.0 +REAP_TIMEOUT_SECONDS = 5.0 +REAP_POLL_SECONDS = 0.1 +FIXTURE_MANIFEST_DIGEST = "91e0658f913c917bd8ce69fac9a1d75e881f41630eccc0f30f68bd9b6a972a35" +FIXTURE_MANIFEST_FILE_SHA256 = "e8c79373697ebe2af5385dbb2899ae49cec6104637c4a3b0909f91225128e0bc" +FIXTURE_SEED = 20260728 +FROZEN_TAIL_LIMITS = { + "selected_bytes": 8_388_608, + "selected_records": 32, + "observations": 12_000, + "occurrences": 12_000, + "affected_sessions": 2_000, + "affected_turns": 4_000, + "affected_resources": 4_000, + "affected_allowance_cycles": 512, + "dirty_keys": 16_000, + "projection_rows": 16_000, + "expected_wal_bytes": 16_777_216, + "planning_staleness_us": 5_000_000, + "model_call_tail_rows": 32_000, +} +FIXTURE_FILE_SHA256 = { + "tests/agent_kernel/fixtures/profiles/standard-v1.json": PROFILE_DIGESTS["standard"], + "tests/agent_kernel/fixtures/profiles/production-v1.json": PROFILE_DIGESTS["production"], + "tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0000.jsonl": "bad29500048dcff994d4211ff6de446c48d51184ab00caa134a7d668a6e57191", + "tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0001.jsonl": "d3ddb9592d67f058b7b7b354c7e01ff159d195c3963e0780be7a4cf35ec9a5eb", + "tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0002.jsonl": "114dadd49888fe77bfa1690b0fb810820950dea80d04ff11b233cd14bab54605", + "tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0003.jsonl": "12ccb3114f5f4583e98e6e0d8a485b2c1479762b93cd8e6008c9be14edfd2a5d", + "tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0004.jsonl": "0729952c7d2c250608ac0913a9d4a879c09b3bf252d86ee84b6b333000b66514", + "tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0005.jsonl": "cbfdfbb7f0f463c087c058b0f49cfdb6ec0ff72da5afa14d293b06a3f2ee817f", + "tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0006.jsonl": "f7693618223a2de73d5dcfc0c645f13455c480a721641b4d790c278744283729", + "tests/agent_kernel/fixtures/tiny-v1/sources/archived/exact-copy.jsonl": "34709a9e5b6c52438f7c5710c9480db9a2641fbd33e25d8e6c767c383502a65f", + "tests/agent_kernel/fixtures/tiny-v1/sources/malformed/malformed.jsonl": "cdfbf46b0d9524c5c9b16b6672eb98cd9f1b413703cd75f8ca9b833e96e5ac4d", + "tests/agent_kernel/fixtures/tiny-v1/sources/replaced/revision-1.jsonl": "de66394d849cab6e4936af84b4991e36c1cdf6746f0ab90c7c39dd1ca10761e1", + "tests/agent_kernel/fixtures/tiny-v1/sources/truncated/truncated.jsonl": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", +} + + +def _jsonable(value: object) -> object: + if is_dataclass(value): + return {field.name: _jsonable(getattr(value, field.name)) for field in fields(value)} + if isinstance(value, dict): + return {str(key): _jsonable(item) for key, item in value.items()} + if isinstance(value, (tuple, list)): + return [_jsonable(item) for item in value] + if isinstance(value, (OperationClass, SidecarOperationClass)): + return value.value + return value + + +def _canonical(value: object) -> bytes: + return json.dumps( + _jsonable(value), sort_keys=True, separators=(",", ":"), ensure_ascii=True + ).encode("utf-8") + + +def _sha256(path: Path) -> str: + return hashlib.sha256(path.read_bytes()).hexdigest() + + +def _tail_limits() -> TailLimits: + limits = TailLimits() + serialized = _jsonable(limits) + if serialized != FROZEN_TAIL_LIMITS: + raise ValueError(f"TailLimits drifted from the frozen authority: {serialized}") + return limits + + +def _fixture_identity() -> dict[str, Any]: + manifest_path = TINY_ROOT / "manifest.json" + manifest = json.loads(manifest_path.read_text(encoding="utf-8")) + if manifest.get("schema") != "codex-usage-tracker.synthetic-fixture-manifest.v1": + raise ValueError("synthetic fixture manifest schema drifted") + if manifest.get("manifest_digest") != FIXTURE_MANIFEST_DIGEST: + raise ValueError("synthetic fixture manifest digest drifted") + if manifest.get("seed") != FIXTURE_SEED: + raise ValueError("synthetic fixture seed drifted") + if _sha256(manifest_path) != FIXTURE_MANIFEST_FILE_SHA256: + raise ValueError("synthetic fixture manifest file digest drifted") + files = [] + for relative, expected in FIXTURE_FILE_SHA256.items(): + path = ROOT / relative + if _sha256(path) != expected: + raise ValueError(f"synthetic fixture file digest drifted: {relative}") + files.append({"path": relative, "fixture_file_sha256": expected}) + return { + "manifest": { + "path": "tests/agent_kernel/fixtures/tiny-v1/manifest.json", + "schema": "codex-usage-tracker.synthetic-fixture-manifest.v1", + "fixture_manifest_digest": FIXTURE_MANIFEST_DIGEST, + "fixture_file_sha256": FIXTURE_MANIFEST_FILE_SHA256, + "seed": FIXTURE_SEED, + }, + "fixture_files": files, + } + + +def _workload_transition_digest( + descriptors: Iterable[dict[str, Any]], +) -> str: + return hashlib.sha256( + _canonical( + { + "workloads": [ + { + "descriptor": descriptor, + "ordered_transition_vector_sha256": descriptor[ + "ordered_transition_vector_sha256" + ], + } + for descriptor in descriptors + ] + } + ) + ).hexdigest() + + +def _utc_now() -> str: + return time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()) + + +def _disk_available_bytes(path: Path) -> int: + return shutil.disk_usage(path).free + + +def _relative_path(root: Path, relative: Path) -> Path: + if relative.is_absolute() or ".." in relative.parts: + raise ValueError(f"path is not repository-relative: {relative}") + resolved_root = root.resolve() + resolved = (resolved_root / relative).resolve() + if resolved != resolved_root and resolved_root not in resolved.parents: + raise ValueError(f"path escapes repository root: {relative}") + return resolved + + +def _exclusive_write(path: Path, data: bytes) -> None: + path.parent.mkdir(parents=False, exist_ok=True) + descriptor = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600) + try: + with os.fdopen(descriptor, "wb") as stream: + descriptor = -1 + stream.write(data) + stream.flush() + os.fsync(stream.fileno()) + finally: + if descriptor != -1: + os.close(descriptor) + + +def _atomic_json_update(path: Path, value: dict[str, Any]) -> None: + encoded = _canonical(value) + b"\n" + temporary: Path | None = None + temporary_fd = -1 + try: + temporary_fd, temporary_name = tempfile.mkstemp( + prefix=f".{path.name}.", + suffix=".tmp", + dir=path.parent, + ) + temporary = Path(temporary_name) + offset = 0 + while offset < len(encoded): + written = os.write(temporary_fd, encoded[offset:]) + if written <= 0: + raise OSError("atomic update made no write progress") + offset += written + os.fsync(temporary_fd) + os.close(temporary_fd) + temporary_fd = -1 + os.replace(temporary, path) + directory = os.open(path.parent, os.O_RDONLY) + try: + os.fsync(directory) + finally: + os.close(directory) + finally: + if temporary_fd != -1: + with contextlib.suppress(BaseException): + os.close(temporary_fd) + if temporary is not None: + with contextlib.suppress(BaseException): + temporary.unlink() + + +def _process_cwd(pid: int) -> Path | None: + if sys.platform == "darwin": + command = shutil.which("lsof") or "/usr/sbin/lsof" + result = subprocess.run( + [command, "-a", "-p", str(pid), "-d", "cwd", "-Fn"], + capture_output=True, + text=True, + check=False, + ) + if result.returncode != 0: + return None + for line in result.stdout.splitlines(): + if line.startswith("n"): + return Path(line[1:]).resolve() + return None + proc_cwd = Path(f"/proc/{pid}/cwd") + try: + return proc_cwd.resolve() + except OSError: + return None + + +def _process_snapshot() -> list[dict[str, Any]]: + result = subprocess.run( + ["ps", "-ww", "-axo", "pid=,ppid=,user=,command="], + capture_output=True, + text=True, + check=False, + ) + if result.returncode != 0: + raise RuntimeError(f"process scan failed: {result.stderr.strip()}") + processes: list[dict[str, Any]] = [] + for line in result.stdout.splitlines(): + columns = line.strip().split(None, 3) + if len(columns) != 4: + continue + pid, ppid, user, command = columns + try: + argv = shlex.split(command) + processes.append( + { + "pid": int(pid), + "parent_pid": int(ppid), + "user": user, + "argv": argv, + "command": command, + "platform_signature": _platform_process_signature(command), + } + ) + except ValueError: + continue + return processes + + +def _platform_process_signature(command: str) -> str: + """Bind the exact command representation emitted by the host process table.""" + + return hashlib.sha256(command.encode("utf-8", errors="strict")).hexdigest() + + +def _normalized_argv(argv: Iterable[str], cwd: Path) -> tuple[str, ...]: + values = list(argv) + path_indexes = {0, 1} + if "--output" in values: + path_indexes.add(values.index("--output") + 1) + normalized = [] + for index, value in enumerate(values): + if index in path_indexes: + normalized.append(str((cwd / value).resolve()) if not Path(value).is_absolute() else str(Path(value).resolve())) + else: + normalized.append(value) + return tuple(normalized) + + +def _platform_argv_matches_expected( + argv: Iterable[str], expected_argv: Iterable[str], cwd: Path +) -> bool: + """Compare every argument except argv[0], which the host may rewrite on fork.""" + + try: + observed = _normalized_argv(argv, cwd) + expected = _normalized_argv(expected_argv, cwd) + except (TypeError, ValueError): + return False + return len(observed) == len(expected) and observed[1:] == expected[1:] + + +def _capture_verified_parent_process_snapshot( + pid: int, + expected_argv: tuple[str, ...], + expected_cwd: Path, + expected_owner: str, +) -> dict[str, Any]: + """Capture the host process identity used for collision and fork handshakes.""" + + candidates = [process for process in _process_snapshot() if process.get("pid") == pid] + if len(candidates) != 1: + raise RuntimeError("verified parent process snapshot is missing or ambiguous") + process = candidates[0] + if process.get("user") != expected_owner: + raise RuntimeError("verified parent process owner drifted") + command = process.get("command") + signature = process.get("platform_signature") + if not isinstance(command, str) or not command: + raise RuntimeError("verified parent process command snapshot is missing") + if not isinstance(signature, str) or signature != _platform_process_signature(command): + raise RuntimeError("verified parent process command signature is invalid") + if not _platform_argv_matches_expected(process.get("argv", ()), expected_argv, expected_cwd): + raise RuntimeError("verified parent process argv does not bind the frozen command") + process_cwd = _process_cwd(pid) + if process_cwd is None: + raise RuntimeError("verified parent process cwd is missing or unreadable") + expected_cwd = expected_cwd.resolve() + if process_cwd != expected_cwd: + raise RuntimeError("verified parent process cwd drifted") + return { + **process, + "cwd": str(process_cwd), + "platform_signature": signature, + } + + +def _matching_processes( + expected_argv: tuple[str, ...], + expected_cwd: Path, + *, + owner: str | None = None, + exclude_pids: Iterable[int] = (), + verified_parent_snapshot: Mapping[str, Any] | None = None, +) -> list[dict[str, Any]]: + if verified_parent_snapshot is None: + raise RuntimeError("verified parent process snapshot is required") + verified_signature = verified_parent_snapshot.get("platform_signature") + verified_command = verified_parent_snapshot.get("command") + if ( + not isinstance(verified_signature, str) + or not verified_signature + or not isinstance(verified_command, str) + or _platform_process_signature(verified_command) != verified_signature + ): + raise RuntimeError("verified parent process signature is missing") + current_owner = owner or getpass.getuser() + excluded = set(exclude_pids) + matches: list[dict[str, Any]] = [] + for process in _process_snapshot(): + process_pid = process.get("pid") + if not isinstance(process_pid, int) or process_pid in excluded: + continue + if process.get("user") != current_owner: + continue + process_command = process.get("command") + process_signature = process.get("platform_signature") + if ( + not isinstance(process_command, str) + or not isinstance(process_signature, str) + or _platform_process_signature(process_command) != process_signature + ): + continue + if not _platform_argv_matches_expected(process.get("argv", ()), expected_argv, expected_cwd): + continue + process_cwd = _process_cwd(process_pid) + if process_cwd is None: + raise RuntimeError(f"cannot verify cwd for matching process {process_pid}") + if process_cwd == expected_cwd: + matches.append( + { + **process, + "cwd": str(process_cwd), + "platform_signature": process_signature, + } + ) + return matches + + +def _load_overlay_verifier(root: Path) -> Any: + verifier_path = _relative_path(root, SHARED_OVERLAY_VERIFIER_RELATIVE) + if not verifier_path.is_file(): + raise RuntimeError( + "exact CK-07R1 shared-successor overlay verifier is unavailable" + ) + spec = importlib.util.spec_from_file_location( + "_ck07r1_shared_successor_overlay", verifier_path + ) + if spec is None or spec.loader is None: + raise RuntimeError("cannot load the exact CK-07R1 overlay verifier") + module = importlib.util.module_from_spec(spec) + spec.loader.exec_module(module) + return module + + +def _verify_overlay_cohort( + root: Path = ROOT, + *, + verifier: Any | None = None, +) -> dict[str, Any]: + """Verify the immutable predecessor overlay in isolation. + + The corrected live cohort is admitted only by ``_verify_prelaunch_recovery``; + this predecessor verifier is retained for historical evidence and tests. + """ + + authority_path = _relative_path(root, SHARED_OVERLAY_AUTHORITY_RELATIVE) + schema_path = _relative_path(root, SHARED_OVERLAY_SCHEMA_RELATIVE) + verifier_path = _relative_path(root, SHARED_OVERLAY_VERIFIER_RELATIVE) + if not authority_path.is_file() or not schema_path.is_file(): + raise RuntimeError( + "exact CK-07R1 shared-successor overlay authority/schema is unavailable" + ) + if verifier is None: + verifier = _load_overlay_verifier(root) + try: + authority, state = verifier.verify_shared_successor_overlay(root) + except Exception as exc: + raise RuntimeError(f"shared-successor overlay verification failed: {exc}") from exc + if not isinstance(authority, Mapping): + raise RuntimeError("shared-successor overlay authority is malformed") + if authority.get("schema") != SHARED_OVERLAY_SCHEMA: + raise RuntimeError("shared-successor overlay schema identity drifted") + if authority.get("authority_version") != 1: + raise RuntimeError("shared-successor overlay version drifted") + if authority.get("status") != "permitted_not_accepted": + raise RuntimeError("shared-successor overlay acceptance status drifted") + if state != "worker_prequalification": + raise RuntimeError( + "shared-successor overlay did not admit the exact worker_prequalification cohort" + ) + states = authority.get("states") + successor = states.get("successor") if isinstance(states, Mapping) else None + if not isinstance(successor, Mapping): + raise RuntimeError("shared-successor overlay successor state is malformed") + if successor.get("status") != "permitted_not_accepted": + raise RuntimeError("shared-successor successor status drifted") + if successor.get("runtime_acceptance") != "not_claimed": + raise RuntimeError("shared-successor runtime acceptance was claimed") + if successor.get("launch_authorized") is not False: + raise RuntimeError("shared-successor launch authorization was claimed") + invariants = authority.get("non_consuming_invariants") + required_invariants = { + "maximum_new_end_to_end_runs": 1, + "token_status": "unspent_unavailable", + "token_consumed": False, + "matching_processes": [], + "successful_child": "absent", + "pid": "absent", + "handshake": "absent", + "runtime_acceptance": "not_claimed", + "receipt": "absent_non_qualifying", + "output": "absent", + "ledger": "absent", + "stdout": "absent", + "stderr": "absent", + "retry": "none", + "restart": "none", + "replacement": "none", + } + if not isinstance(invariants, Mapping) or any( + invariants.get(name) != expected + for name, expected in required_invariants.items() + ): + raise RuntimeError("shared-successor non-consuming invariants drifted") + artifacts = successor.get("artifacts") + if not isinstance(artifacts, list) or len(artifacts) != 3: + raise RuntimeError("shared-successor cohort artifact set is malformed") + artifact_identity = [] + for artifact in artifacts: + if not isinstance(artifact, Mapping): + raise RuntimeError("shared-successor cohort artifact is malformed") + path = artifact.get("path") + digest = artifact.get("sha256") + if not isinstance(path, str) or not isinstance(digest, str): + raise RuntimeError("shared-successor cohort artifact identity is malformed") + artifact_identity.append( + {"path": path, "sha256": digest, "presence": artifact.get("presence")} + ) + return { + "schema": authority["schema"], + "authority_version": authority["authority_version"], + "authority_base_sha": authority.get("authority_base_sha"), + "state": state, + "authority_path": str(SHARED_OVERLAY_AUTHORITY_RELATIVE), + "authority_sha256": _sha256(authority_path), + "schema_path": str(SHARED_OVERLAY_SCHEMA_RELATIVE), + "schema_sha256": _sha256(schema_path), + "verifier_path": str(SHARED_OVERLAY_VERIFIER_RELATIVE), + "verifier_sha256": _sha256(verifier_path), + "successor_artifacts": artifact_identity, + "runtime_acceptance": successor["runtime_acceptance"], + "launch_authorized": successor["launch_authorized"], + "verification": "passed", + } + + +def _load_prelaunch_recovery_verifier(root: Path) -> Any: + verifier_path = _relative_path(root, PRELAUNCH_RECOVERY_VERIFIER_RELATIVE) + if not verifier_path.is_file(): + raise RuntimeError("exact CK-07R1 prelaunch recovery verifier is unavailable") + spec = importlib.util.spec_from_file_location( + "_ck07r1_prelaunch_recovery", verifier_path + ) + if spec is None or spec.loader is None: + raise RuntimeError("cannot load the exact CK-07R1 prelaunch recovery verifier") + module = importlib.util.module_from_spec(spec) + spec.loader.exec_module(module) + return module + + +def _candidate_cohort(root: Path) -> list[dict[str, str]]: + records = ( + ( + Path("src/codex_usage_tracker/agent_kernel/publication/preparation.py"), + "preparation_source", + ), + (Path("scripts/benchmark_ck07r1_lifecycle_scale.py"), "corrected_launcher"), + ( + Path("tests/agent_kernel/publication/test_lifecycle_scale.py"), + "corrected_launcher_tests", + ), + ) + return [ + {"path": str(path), "sha256": _sha256(_relative_path(root, path)), "role": role} + for path, role in records + ] + + +def _historical_shared_overlay_bindings(root: Path) -> list[dict[str, str]]: + bindings: list[dict[str, str]] = [] + for relative in HISTORICAL_SHARED_OVERLAY_RELATIVES: + path = _relative_path(root, relative) + if not path.is_file(): + raise RuntimeError( + "prelaunch recovery historical shared-successor overlay evidence is unavailable" + ) + bindings.append({"path": str(relative), "sha256": _sha256(path)}) + return bindings + + +def _verify_historical_shared_overlay_binding( + authority: Mapping[str, Any], root: Path +) -> list[dict[str, str]]: + records = authority.get("immutable_authorities") + if not isinstance(records, list): + raise RuntimeError( + "prelaunch recovery historical shared-successor overlay binding is missing" + ) + bound = { + record.get("path"): record.get("sha256") + for record in records + if isinstance(record, Mapping) + } + expected = _historical_shared_overlay_bindings(root) + if any(bound.get(item["path"]) != item["sha256"] for item in expected): + raise RuntimeError( + "prelaunch recovery historical shared-successor overlay binding drifted" + ) + return expected + + +def _preserved_v1_ledger_identity(root: Path) -> dict[str, Any]: + path = _relative_path(root, PRESERVED_V1_LEDGER_RELATIVE) + if not path.is_file(): + raise RuntimeError("preserved CK-07R1 v1 terminal ledger is unavailable") + digest = _sha256(path) + if digest != PRESERVED_V1_LEDGER_SHA256: + raise RuntimeError("preserved CK-07R1 v1 terminal ledger digest drifted") + try: + payload = json.loads(path.read_text(encoding="utf-8")) + except (OSError, ValueError) as exc: + raise RuntimeError("preserved CK-07R1 v1 terminal ledger is unreadable") from exc + launch = payload.get("launch") if isinstance(payload, Mapping) else None + if not isinstance(payload, Mapping) or not isinstance(launch, Mapping): + raise RuntimeError("preserved CK-07R1 v1 terminal ledger is malformed") + if payload.get("state") != "prelaunch_failed": + raise RuntimeError("preserved CK-07R1 v1 terminal ledger state drifted") + if payload.get("token_consumed") is not False: + raise RuntimeError("preserved CK-07R1 v1 ledger token state drifted") + if payload.get("token_status") != RUN_TOKEN_STATUS: + raise RuntimeError("preserved CK-07R1 v1 ledger token status drifted") + if launch.get("matching_processes") != []: + raise RuntimeError("preserved CK-07R1 v1 ledger process state drifted") + return { + "path": str(PRESERVED_V1_LEDGER_RELATIVE), + "sha256": digest, + "state": payload["state"], + "token_consumed": payload["token_consumed"], + "token_status": payload["token_status"], + "matching_processes": launch["matching_processes"], + } + + +def _verify_prelaunch_recovery( + root: Path = ROOT, + *, + verifier: Any | None = None, +) -> dict[str, Any]: + """Verify preserved v1 recovery evidence before any v2 run side effect.""" + + authority_path = _relative_path(root, PRELAUNCH_RECOVERY_AUTHORITY_RELATIVE) + schema_path = _relative_path(root, PRELAUNCH_RECOVERY_SCHEMA_RELATIVE) + verifier_path = _relative_path(root, PRELAUNCH_RECOVERY_VERIFIER_RELATIVE) + if not authority_path.is_file() or not schema_path.is_file(): + raise RuntimeError( + "exact CK-07R1 prelaunch recovery authority/schema is unavailable" + ) + if verifier is None: + verifier = _load_prelaunch_recovery_verifier(root) + try: + authority, state = verifier.verify_prelaunch_recovery(root) + except Exception as exc: + raise RuntimeError(f"prelaunch recovery verification failed: {exc}") from exc + if not isinstance(authority, Mapping): + raise RuntimeError("prelaunch recovery authority is malformed") + if authority.get("schema") != PRELAUNCH_RECOVERY_SCHEMA: + raise RuntimeError("prelaunch recovery schema identity drifted") + if authority.get("authority_version") != 1: + raise RuntimeError("prelaunch recovery authority version drifted") + if authority.get("status") != "permitted_not_accepted": + raise RuntimeError("prelaunch recovery acceptance status drifted") + if state != "prelaunch_recovery_verified": + raise RuntimeError("prelaunch recovery verifier did not return the exact verified state") + decision = authority.get("decision") + if not isinstance(decision, Mapping) or any( + decision.get(field) != expected + for field, expected in ( + ("launch_authorized_in_authority_task", False), + ("implementation_acceptance", "not_claimed"), + ("runtime_acceptance", "not_claimed"), + ) + ): + raise RuntimeError("prelaunch recovery acceptance state was claimed") + transition = authority.get("recovery_transition") + if not isinstance(transition, Mapping) or any( + transition.get(field) != expected + for field, expected in ( + ("old_shared_overlay", "immutable_historical_predecessor_evidence"), + ("live_corrected_cohort_authority", "this_versioned_recovery_authority_only"), + ("launched_process_retry", False), + ("restart", False), + ("replacement", False), + ("refund", False), + ) + ): + raise RuntimeError("prelaunch recovery transition binding drifted") + + run_token = authority.get("run_token") + expected_token = { + "id": RUN_TOKEN_ID, + "maximum_new_end_to_end_runs": 1, + "status": RUN_TOKEN_STATUS, + "token_consumed": False, + "refund": False, + "retry": "none", + "restart": "none", + "replacement": "none", + "successful_launches_observed": 0, + "new_recovery_invocations_permitted": 1, + } + if not isinstance(run_token, Mapping) or any( + run_token.get(field) != expected for field, expected in expected_token.items() + ): + raise RuntimeError("prelaunch recovery run-token binding drifted") + + preserved = _preserved_v1_ledger_identity(root) + authority_preserved = authority.get("preserved_v1_ledger") + if authority_preserved != preserved: + raise RuntimeError("prelaunch recovery v1 ledger binding drifted") + + cohort = _candidate_cohort(root) + if authority.get("candidate_cohort") != cohort: + raise RuntimeError("prelaunch recovery candidate cohort binding drifted") + + historical_overlay = _verify_historical_shared_overlay_binding(authority, root) + + expected_paths = { + "output": str(RUN_OUTPUT_RELATIVE), + "ledger": str(RUN_LEDGER_RELATIVE), + "stdout": str(RUN_STDOUT_RELATIVE), + "stderr": str(RUN_STDERR_RELATIVE), + } + authority_paths: Any = authority.get("v2_paths") + if authority_paths is None: + launch_contract = authority.get("launch_contract") + authority_paths = ( + launch_contract.get("exclusive_paths") + if isinstance(launch_contract, Mapping) + else None + ) + if authority_paths != expected_paths: + raise RuntimeError("prelaunch recovery v2 path binding drifted") + return { + "schema": authority["schema"], + "authority_version": authority["authority_version"], + "state": state, + "authority_path": str(PRELAUNCH_RECOVERY_AUTHORITY_RELATIVE), + "authority_sha256": _sha256(authority_path), + "schema_path": str(PRELAUNCH_RECOVERY_SCHEMA_RELATIVE), + "schema_sha256": _sha256(schema_path), + "verifier_path": str(PRELAUNCH_RECOVERY_VERIFIER_RELATIVE), + "verifier_sha256": ( + _sha256(verifier_path) if verifier_path.is_file() else None + ), + "preserved_v1_ledger": preserved, + "candidate_cohort": cohort, + "historical_shared_overlay": historical_overlay, + "v2_paths": expected_paths, + "verification": "passed", + } + + +def _preflight_launch_paths(root: Path = ROOT) -> dict[str, Path]: + output = _relative_path(root, RUN_OUTPUT_RELATIVE) + ledger = _relative_path(root, RUN_LEDGER_RELATIVE) + stdout = _relative_path(root, RUN_STDOUT_RELATIVE) + stderr = _relative_path(root, RUN_STDERR_RELATIVE) + if not output.parent.is_dir(): + raise FileNotFoundError(f"launch output parent does not exist: {output.parent}") + for path in (output, ledger, stdout, stderr): + if path.exists(): + raise FileExistsError(f"launch path already exists; refusing overwrite: {path}") + return {"output": output, "ledger": ledger, "stdout": stdout, "stderr": stderr} + + +def _verify_launch_contract(root: Path = ROOT) -> dict[str, Any]: + if root.resolve() != ROOT.resolve() or not (root / "pyproject.toml").is_file(): + raise RuntimeError("launch cwd is not the fresh retained repository root") + script_and_args = (sys.argv[0], *sys.argv[1:]) + if script_and_args != LAUNCH_COMMAND[1:]: + raise RuntimeError("launch argv is not the exact frozen command") + expected_interpreter = root / ".venv" / "bin" / "python" + expected_prefix = root / ".venv" + if not expected_interpreter.is_file() or not expected_prefix.is_dir(): + raise RuntimeError("repository .venv/bin/python or venv directory is unavailable") + expected_interpreter = expected_interpreter.absolute() + expected_prefix = expected_prefix.absolute() + actual_interpreter = Path(sys.executable) + if not actual_interpreter.is_absolute(): + actual_interpreter = Path(os.path.abspath(sys.executable)) + actual_prefix = Path(sys.prefix) + if not actual_prefix.is_absolute(): + actual_prefix = Path(os.path.abspath(sys.prefix)) + actual_base_prefix = Path(sys.base_prefix) + if not actual_base_prefix.is_absolute(): + actual_base_prefix = Path(os.path.abspath(sys.base_prefix)) + if actual_interpreter != expected_interpreter: + raise RuntimeError( + "launch interpreter must use the repository .venv/bin/python lexical path" + ) + if actual_prefix != expected_prefix: + raise RuntimeError("launch sys.prefix is not the repository .venv") + if actual_prefix == actual_base_prefix: + raise RuntimeError("launch interpreter is not running inside the repository venv") + for name, expected in LAUNCH_ENVIRONMENT.items(): + if os.environ.get(name) != expected: + raise RuntimeError(f"launch environment drifted: {name}") + for name in FORBIDDEN_ENVIRONMENT: + if name in os.environ: + raise RuntimeError(f"forbidden launch environment variable is present: {name}") + paths = _preflight_launch_paths(root) + owner = getpass.getuser() + verified_parent_snapshot = _capture_verified_parent_process_snapshot( + os.getpid(), LAUNCH_COMMAND, root, owner + ) + matches = _matching_processes( + LAUNCH_COMMAND, + root, + owner=owner, + exclude_pids=(os.getpid(),), + verified_parent_snapshot=verified_parent_snapshot, + ) + if matches: + raise RuntimeError(f"matching launch process already exists: {matches}") + return { + "argv": list(LAUNCH_COMMAND), + "cwd": str(root.resolve()), + "owner": owner, + "interpreter": str(expected_interpreter), + "venv_prefix": str(expected_prefix), + "base_prefix": str(actual_base_prefix), + "environment": dict(LAUNCH_ENVIRONMENT), + "output_path": str(RUN_OUTPUT_RELATIVE), + "fixture_identity": _fixture_identity(), + "disk_available_bytes_before_launch": _disk_available_bytes(root), + "matching_processes": matches, + "verified_parent_process_snapshot": verified_parent_snapshot, + "paths": paths, + } + + +def _rss_from_usage(usage: resource.struct_rusage) -> int: + value = usage.ru_maxrss + return int(value if platform.system() == "Darwin" else value * 1024) + + +def _observe_child_start( + child_pid: int, + launch: dict[str, Any], + parent_pid: int, +) -> dict[str, Any]: + expected_cwd = Path(launch["cwd"]).resolve() + expected_owner = str(launch["owner"]) + verified_parent_snapshot = launch.get("verified_parent_process_snapshot") + if not isinstance(verified_parent_snapshot, Mapping): + raise RuntimeError("child-start handshake lacks the verified parent snapshot") + verified_signature = verified_parent_snapshot.get("platform_signature") + verified_command = verified_parent_snapshot.get("command") + if ( + not isinstance(verified_signature, str) + or not verified_signature + or not isinstance(verified_command, str) + or _platform_process_signature(verified_command) != verified_signature + ): + raise RuntimeError("child-start handshake lacks the verified parent signature") + deadline = time.monotonic() + HANDSHAKE_TIMEOUT_SECONDS + while True: + observed = _matching_processes( + LAUNCH_COMMAND, + expected_cwd, + owner=expected_owner, + exclude_pids=(parent_pid,), + verified_parent_snapshot=verified_parent_snapshot, + ) + if any(item.get("pid") != child_pid for item in observed): + raise RuntimeError( + "child-start handshake found an unexpected matching process" + ) + for item in observed: + observed_cwd = item.get("cwd") + observed_command = item.get("command") + if ( + item.get("pid") == child_pid + and item.get("parent_pid") == parent_pid + and item.get("user") == expected_owner + and item.get("platform_signature") == verified_signature + and isinstance(observed_command, str) + and _platform_process_signature(observed_command) + == verified_signature + and _platform_argv_matches_expected( + item.get("argv", ()), LAUNCH_COMMAND, expected_cwd + ) + and isinstance(observed_cwd, str) + and Path(observed_cwd).resolve() == expected_cwd + ): + return item + if time.monotonic() >= deadline: + raise RuntimeError( + "child-start handshake did not prove exact PID/argv/cwd/owner" + ) + time.sleep(0.02) + + +class _ParentChildSignal(BaseException): + """A parent signal that must be converted into terminal child cleanup.""" + + def __init__(self, signal_number: int) -> None: + self.signal_number = signal_number + super().__init__(f"parent received signal {signal_number}") + + +def _parent_signal_handler(signal_number: int, _frame: object) -> None: + if signal_number == signal.SIGINT: + raise KeyboardInterrupt + raise _ParentChildSignal(signal_number) + + +def _install_parent_child_signal_handlers() -> dict[int, Any]: + previous = { + signal.SIGINT: signal.getsignal(signal.SIGINT), + signal.SIGTERM: signal.getsignal(signal.SIGTERM), + } + signal.signal(signal.SIGINT, _parent_signal_handler) + signal.signal(signal.SIGTERM, _parent_signal_handler) + return previous + + +def _restore_parent_child_signal_handlers(previous: Mapping[int, Any]) -> None: + for signal_number, handler in previous.items(): + signal.signal(signal_number, handler) + + +@contextlib.contextmanager +def _parent_child_signal_handlers() -> Iterable[None]: + previous = _install_parent_child_signal_handlers() + try: + yield + finally: + _restore_parent_child_signal_handlers(previous) + + +@contextlib.contextmanager +def _ignore_parent_child_signals() -> Iterable[None]: + previous = { + signal.SIGINT: signal.getsignal(signal.SIGINT), + signal.SIGTERM: signal.getsignal(signal.SIGTERM), + } + signal.signal(signal.SIGINT, signal.SIG_IGN) + signal.signal(signal.SIGTERM, signal.SIG_IGN) + try: + yield + finally: + for signal_number, handler in previous.items(): + signal.signal(signal_number, handler) + + +def _validate_child_pid(pid: int) -> None: + if not isinstance(pid, int) or pid <= 0: + raise ValueError(f"child pid must be positive; got {pid!r}") + + +def _child_wait_for_release(read_fd: int, write_fd: int) -> bool: + """Wait for the parent release byte without leaking pre-release failures.""" + read_open = True + write_open = True + previous: dict[int, Any] = {} + try: + os.close(write_fd) + write_open = False + previous = { + signal.SIGINT: signal.getsignal(signal.SIGINT), + signal.SIGTERM: signal.getsignal(signal.SIGTERM), + } + try: + signal.signal(signal.SIGINT, signal.SIG_IGN) + signal.signal(signal.SIGTERM, signal.SIG_IGN) + return os.read(read_fd, 1) == b"1" + finally: + for signal_number, handler in previous.items(): + with contextlib.suppress(BaseException): + signal.signal(signal_number, handler) + except BaseException: + return False + finally: + if read_open: + with contextlib.suppress(BaseException): + os.close(read_fd) + if write_open: + with contextlib.suppress(BaseException): + os.close(write_fd) + + +def _child_entry( + paths: dict[str, Path], + launch: dict[str, Any], + read_fd: int, + write_fd: int, +) -> None: + try: + released = _child_wait_for_release(read_fd, write_fd) + except BaseException: + os._exit(71) + if not released: + os._exit(71) + os._exit(_child_run(paths, launch)) + + +def _bounded_reap( + pid: int, + timeout_seconds: float, +) -> tuple[int, int, resource.struct_rusage] | None: + _validate_child_pid(pid) + deadline = time.monotonic() + timeout_seconds + while True: + try: + waited_pid, status, usage = os.wait4(pid, os.WNOHANG) + except ChildProcessError as exc: + raise RuntimeError(f"child {pid} disappeared before bounded reap") from exc + if waited_pid == pid: + return waited_pid, status, usage + remaining = deadline - time.monotonic() + if remaining <= 0: + return None + time.sleep(min(REAP_POLL_SECONDS, remaining)) + + +def _terminate_and_reap_child( + pid: int, +) -> tuple[int, int, resource.struct_rusage]: + _validate_child_pid(pid) + errors: list[BaseException] = [] + try: + os.kill(pid, signal.SIGTERM) + except ProcessLookupError: + pass + except BaseException as exc: + errors.append(exc) + try: + result = _bounded_reap(pid, TERMINATION_GRACE_TIMEOUT_SECONDS) + except BaseException as exc: + errors.append(exc) + result = None + if result is None: + try: + os.kill(pid, signal.SIGKILL) + except ProcessLookupError: + pass + except BaseException as exc: + errors.append(exc) + try: + result = _bounded_reap(pid, REAP_TIMEOUT_SECONDS) + except BaseException as exc: + errors.append(exc) + result = None + if result is None: + error = RuntimeError(f"child {pid} did not terminate after bounded SIGTERM/SIGKILL/reap") + if errors: + raise error from errors[-1] + raise error + return result + + +def _wait_for_child(pid: int) -> tuple[int, int, resource.struct_rusage, bool]: + _validate_child_pid(pid) + deadline = time.monotonic() + AGGREGATE_TIMEOUT_CANDIDATE_SECONDS + while True: + result = _bounded_reap(pid, 0.0) + if result is not None: + waited_pid, status, usage = result + return waited_pid, status, usage, False + if time.monotonic() >= deadline: + break + time.sleep(min(REAP_POLL_SECONDS, deadline - time.monotonic())) + + result = _terminate_and_reap_child(pid) + waited_pid, status, usage = result + return waited_pid, status, usage, True + + +def _ledger_update(path: Path, value: dict[str, Any]) -> None: + _atomic_json_update(path, value) + + +def _build_evidence(paths: dict[str, Path]) -> dict[str, str]: + evidence: dict[str, str] = {} + for path_key, digest_key, relative_path in ( + ("stdout", "stdout_sha256", RUN_STDOUT_RELATIVE), + ("stderr", "stderr_sha256", RUN_STDERR_RELATIVE), + ("output", "output_sha256", RUN_OUTPUT_RELATIVE), + ): + path = paths[path_key] + if not path.is_file(): + raise FileNotFoundError(f"required launch evidence is missing: {path}") + digest = _sha256(path) + if not isinstance(digest, str) or len(digest) != 64 or any( + character not in "0123456789abcdef" for character in digest + ): + raise ValueError(f"required launch evidence hash is invalid: {path}") + evidence[f"{path_key}_path"] = str(relative_path) + evidence[digest_key] = digest + return evidence + + +def _validate_evidence(evidence: Mapping[str, Any]) -> None: + expected = { + "stdout_path": str(RUN_STDOUT_RELATIVE), + "stderr_path": str(RUN_STDERR_RELATIVE), + "output_path": str(RUN_OUTPUT_RELATIVE), + } + if not isinstance(evidence, Mapping): + raise ValueError("receipt evidence is missing") + for path_key, expected_path in expected.items(): + if evidence.get(path_key) != expected_path: + raise ValueError(f"receipt evidence path mismatch: {path_key}") + digest_key = path_key.replace("_path", "_sha256") + digest = evidence.get(digest_key) + if not isinstance(digest, str) or len(digest) != 64 or any( + character not in "0123456789abcdef" for character in digest + ): + raise ValueError(f"receipt evidence digest is missing or invalid: {digest_key}") + + +def _validate_receipt( + payload: dict[str, Any], + fixture_identity: dict[str, Any], + prelaunch_recovery: Mapping[str, Any], + *, + evidence: Mapping[str, Any], +) -> None: + if payload.get("schema") != SCHEMA: + raise ValueError("receipt schema mismatch") + if payload.get("fixture_identity") != fixture_identity: + raise ValueError("receipt fixture identity mismatch") + if payload.get("prelaunch_recovery") != prelaunch_recovery: + raise ValueError("receipt prelaunch recovery binding drifted") + _validate_evidence(evidence) + _validate_workload_transition_digest(payload) + if payload.get("first_failure") is not None: + raise ValueError(f"receipt reports first failure: {payload['first_failure']}") + if payload.get("linear_work_counters", {}).get("budget_checks") != { + name: True for name in FROZEN_BUDGETS_MS + }: + raise ValueError("receipt budget gate failed") + for name in ("standard_30_day", "production_all_time"): + receipt = payload["linear_work_counters"][name]["publication_receipt"] + if not receipt["postconditions"]["identity_bindings"]: + raise ValueError(f"{name} publication identity binding failed") + if receipt["planner_tail_limits"] != FROZEN_TAIL_LIMITS: + raise ValueError(f"{name} TailLimits drifted") + + +def _validate_workload_transition_digest(payload: dict[str, Any]) -> None: + descriptors = payload.get("workload_descriptors") + if not isinstance(descriptors, list) or len(descriptors) != 5: + raise ValueError("receipt workload descriptors are missing or malformed") + counters = payload.get("linear_work_counters") + if not isinstance(counters, dict): + raise ValueError("receipt linear work counters are missing") + measurements = { + "standard_30_day": counters.get("standard_30_day"), + "production_all_time": counters.get("production_all_time"), + "no_change": counters.get("no_change"), + "one_call_tail": counters.get("one_call_tail"), + "one_tool_tail": counters.get("one_tool_tail"), + } + expected_tail_fields = { + "no_change": (0, 0, 0), + "one_call_tail": (0, 1, 1), + "one_tool_tail": (0, 1, 1), + } + for index, descriptor in enumerate(descriptors): + if not isinstance(descriptor, dict): + raise ValueError(f"workload descriptor {index} is not an object") + vector_digest = descriptor.get("ordered_transition_vector_sha256") + if not isinstance(vector_digest, str) or len(vector_digest) != 64 or any( + character not in "0123456789abcdef" for character in vector_digest + ): + raise ValueError(f"workload descriptor {index} has malformed transition vector") + if index < 2: + name = ("standard_30_day", "production_all_time")[index] + measurement = measurements[name] + if not isinstance(measurement, dict): + raise ValueError(f"{name} measurement is missing") + if descriptor != measurement.get("workload_descriptor"): + raise ValueError(f"{name} workload descriptor binding drifted") + lifecycle = measurement.get("lifecycle_preparation") + if not isinstance(lifecycle, dict) or vector_digest != lifecycle.get( + "transition_digest" + ): + raise ValueError(f"{name} transition vector binding drifted") + else: + name = ("no_change", "one_call_tail", "one_tool_tail")[index - 2] + measurement = measurements[name] + if not isinstance(measurement, dict): + raise ValueError(f"{name} measurement is missing") + lifecycle = measurement + if descriptor.get("source_profile") != "synthetic_tail": + raise ValueError(f"{name} source profile drifted") + if descriptor.get("history_preset") != "all_time": + raise ValueError(f"{name} history preset drifted") + if descriptor.get("model_calls") != expected_tail_fields[name][0]: + raise ValueError(f"{name} model-call count drifted") + if descriptor.get("entities") != expected_tail_fields[name][1]: + raise ValueError(f"{name} entity count drifted") + if descriptor.get("observations") != expected_tail_fields[name][2]: + raise ValueError(f"{name} observation count drifted") + if descriptor.get("seed") != FIXTURE_SEED or descriptor.get( + "profile_file_sha256" + ) is not None: + raise ValueError(f"{name} fixture binding drifted") + if vector_digest != lifecycle.get("transition_digest"): + raise ValueError(f"{name} transition vector binding drifted") + recomputed = _workload_transition_digest(descriptors) + if payload.get("workload_transition_digest") != recomputed: + raise ValueError("receipt workload transition digest was not independently verified") + + +def _child_run(paths: dict[str, Path], launch: dict[str, Any]) -> int: + started_at = _utc_now() + try: + with paths["stdout"].open("x", encoding="utf-8") as stdout, paths[ + "stderr" + ].open("x", encoding="utf-8") as stderr, contextlib.redirect_stdout( + stdout + ), contextlib.redirect_stderr(stderr): + payload = run(profile_name="all", samples=5) + payload["prelaunch_recovery"] = launch["prelaunch_recovery"] + payload["process"] = { + "pid": os.getpid(), + "parent_pid": os.getppid(), + "started_at_utc": started_at, + "argv": list(LAUNCH_COMMAND), + "cwd": str(ROOT.resolve()), + "interpreter": launch["interpreter"], + "venv_prefix": launch["venv_prefix"], + } + encoded = _canonical(payload) + b"\n" + _exclusive_write(paths["output"], encoded) + return int(payload.get("first_failure") is not None) + except BaseException as exc: + failure = _canonical( + { + "failure": "child_exception", + "exception_type": type(exc).__name__, + "message": str(exc), + } + ) + b"\n" + with contextlib.suppress(OSError): + if paths["stderr"].exists(): + with paths["stderr"].open("ab") as stderr: + stderr.write(failure) + else: + _exclusive_write(paths["stderr"], failure) + return 70 + + +def _persist_terminal_failure( + ledger: dict[str, Any], + ledger_path: Path, + *, + state: str, + stage: str, + exc: BaseException | str, +) -> None: + if isinstance(exc, BaseException): + failure: dict[str, Any] = { + "stage": stage, + "exception_type": type(exc).__name__, + "message": str(exc), + } + else: + failure = {"stage": stage, "message": exc} + ledger["state"] = state + ledger["failure"] = failure + ledger.setdefault("process_states", []).append( + {"state": state, "at_utc": _utc_now(), "stage": stage} + ) + _ledger_update(ledger_path, ledger) + + +def _reap_child(pid: int) -> None: + _terminate_and_reap_child(pid) + + +def _finalize_child_result( + ledger: dict[str, Any], + ledger_path: Path, + paths: dict[str, Path], + launch: dict[str, Any], + *, + exit_code: int, + status: int, + usage: resource.struct_rusage, + timed_out: bool, + completed_at_utc: str, + launched_monotonic_ns: int, +) -> int: + """Finalize a child only after a successful receipt is fully validated.""" + success = exit_code == 0 and not timed_out + stage = "evidence_collection" + try: + evidence = _build_evidence(paths) + if not success: + ledger.update( + { + "state": "failed_after_launch", + "completed_at_utc": completed_at_utc, + "monotonic_elapsed_ns": time.monotonic_ns() - launched_monotonic_ns, + "peak_rss_bytes": _rss_from_usage(usage), + "disk_available_bytes_after_launch": _disk_available_bytes(ROOT), + "disk_available_bytes_after_completion": _disk_available_bytes(ROOT), + "exit_code": exit_code, + "terminating_signal": ( + os.WTERMSIG(status) + if os.WIFSIGNALED(status) + else None + ), + "timed_out": timed_out, + "evidence": evidence, + "process_states": [ + *ledger["process_states"], + { + "state": "failed_after_launch", + "at_utc": completed_at_utc, + }, + ], + } + ) + stage = "terminal_failure_finalization" + _ledger_update(ledger_path, ledger) + return exit_code + + stage = "receipt_parse_validation" + payload = json.loads(paths["output"].read_text(encoding="utf-8")) + _validate_receipt( + payload, + launch["fixture_identity"], + launch["prelaunch_recovery"], + evidence=evidence, + ) + receipt = { + "schema": payload["schema"], + "workload_transition_digest": payload["workload_transition_digest"], + "publication_digest": payload["publication_digest"], + "evidence": evidence, + } + stage = "receipt_finalization" + final_ledger = { + **ledger, + "state": "completed", + "completed_at_utc": completed_at_utc, + "monotonic_elapsed_ns": time.monotonic_ns() - launched_monotonic_ns, + "peak_rss_bytes": _rss_from_usage(usage), + "disk_available_bytes_after_launch": _disk_available_bytes(ROOT), + "disk_available_bytes_after_completion": _disk_available_bytes(ROOT), + "exit_code": exit_code, + "terminating_signal": None, + "timed_out": timed_out, + "evidence": evidence, + "receipt": receipt, + "process_states": [ + *ledger["process_states"], + {"state": "completed", "at_utc": completed_at_utc}, + ], + } + # This is the first durable completed state. _atomic_json_update makes + # the receipt and completed marker one safely finalized ledger image. + _ledger_update(ledger_path, final_ledger) + except BaseException as exc: + with _ignore_parent_child_signals(): + _persist_terminal_failure( + ledger, + ledger_path, + state="failed_after_launch", + stage=stage, + exc=exc, + ) + return 70 + return exit_code + + +def _launch_exact() -> int: + launch = _verify_launch_contract() + launch["prelaunch_recovery"] = _verify_prelaunch_recovery() + parent_pid = os.getpid() + verified_parent_snapshot = _capture_verified_parent_process_snapshot( + parent_pid, + LAUNCH_COMMAND, + Path(launch["cwd"]), + str(launch["owner"]), + ) + matches = _matching_processes( + LAUNCH_COMMAND, + Path(launch["cwd"]), + owner=str(launch["owner"]), + exclude_pids=(parent_pid,), + verified_parent_snapshot=verified_parent_snapshot, + ) + if matches: + raise RuntimeError(f"matching launch process appeared before fork: {matches}") + launch["verified_parent_process_snapshot"] = verified_parent_snapshot + launch["matching_processes"] = matches + paths = launch.pop("paths") + ledger = { + "schema": "codex-usage-tracker.lifecycle-run-ledger.v1", + "run_token_id": RUN_TOKEN_ID, + "maximum_new_end_to_end_runs": 1, + "token_status": RUN_TOKEN_STATUS, + "token_consumed": False, + "state": "prelaunch_verified", + "retry_allowed": False, + "restart_allowed": False, + "replacement_allowed": False, + "first_result_retained": True, + "launch": launch, + "process_states": [{"state": "prelaunch_verified", "at_utc": _utc_now()}], + } + _exclusive_write(paths["ledger"], _canonical(ledger) + b"\n") + read_fd = -1 + write_fd = -1 + child_pid: int | None = None + child_reaped = False + token_persistence_started = False + token_persisted = False + child_release_started = False + child_released = False + previous_parent_signal_handlers: dict[int, Any] | None = None + try: + read_fd, write_fd = os.pipe() + child_pid = os.fork() + if child_pid == 0: + _child_entry(paths, launch, read_fd, write_fd) + + _validate_child_pid(child_pid) + + previous_parent_signal_handlers = _install_parent_child_signal_handlers() + os.close(read_fd) + read_fd = -1 + observed = _observe_child_start(child_pid, launch, parent_pid) + launch["child_start_handshake"] = { + "pid": observed["pid"], + "parent_pid": observed["parent_pid"], + "user": observed["user"], + "argv": list(observed["argv"]), + "cwd": observed["cwd"], + "platform_command": observed.get("command"), + "platform_signature": observed.get("platform_signature"), + "verified_before_token_consumption": True, + } + launched_at_utc = _utc_now() + launched_monotonic_ns = time.monotonic_ns() + ledger.update( + { + "token_consumed": True, + "token_status": "consumed", + "token_consumed_at_utc": launched_at_utc, + "state": "launched_consumed", + "process": { + "pid": child_pid, + "parent_pid": parent_pid, + "owner": launch["owner"], + "launched_at_utc": launched_at_utc, + "launched_monotonic_ns": launched_monotonic_ns, + "argv": list(LAUNCH_COMMAND), + "cwd": launch["cwd"], + "interpreter": launch["interpreter"], + "run_token_id": RUN_TOKEN_ID, + }, + "launch": launch, + "process_states": [ + *ledger["process_states"], + { + "state": "child_start_verified", + "at_utc": _utc_now(), + }, + {"state": "launched_consumed", "at_utc": _utc_now()}, + ], + } + ) + token_persistence_started = True + _ledger_update(paths["ledger"], ledger) + token_persisted = True + child_release_started = True + os.write(write_fd, b"1") + child_released = True + os.close(write_fd) + write_fd = -1 + except BaseException as exc: + if write_fd != -1: + with contextlib.suppress(OSError): + os.close(write_fd) + write_fd = -1 + if read_fd != -1: + with contextlib.suppress(OSError): + os.close(read_fd) + read_fd = -1 + cleanup_error: BaseException | None = None + if child_pid is not None and child_pid > 0 and not child_reaped: + with _ignore_parent_child_signals(): + try: + _reap_child(child_pid) + child_reaped = True + except BaseException as reap_exc: + cleanup_error = reap_exc + if cleanup_error is not None: + exc = RuntimeError(f"{exc}; bounded child cleanup failed: {cleanup_error}") + terminal_state = ( + "failed_after_launch" + if token_persistence_started or token_persisted or child_release_started or child_released + else "prelaunch_failed" + ) + try: + try: + with _ignore_parent_child_signals(): + _persist_terminal_failure( + ledger, + paths["ledger"], + state=terminal_state, + stage=( + "post_launch_handshake" + if terminal_state == "failed_after_launch" + else "child_start_handshake" + ), + exc=exc, + ) + except BaseException as persistence_error: + raise RuntimeError( + f"{exc}; terminal failure persistence failed: {persistence_error}" + ) from exc + finally: + if previous_parent_signal_handlers is not None: + _restore_parent_child_signal_handlers(previous_parent_signal_handlers) + raise + + try: + try: + _, status, usage, timed_out = _wait_for_child(child_pid) + child_reaped = True + except BaseException as exc: + cleanup_error: BaseException | None = None + if child_pid is not None and child_pid > 0 and not child_reaped: + with _ignore_parent_child_signals(): + try: + _reap_child(child_pid) + child_reaped = True + except BaseException as reap_exc: + cleanup_error = reap_exc + if cleanup_error is not None: + exc = RuntimeError(f"{exc}; bounded child cleanup failed: {cleanup_error}") + with _ignore_parent_child_signals(): + _persist_terminal_failure( + ledger, + paths["ledger"], + state="failed_after_launch", + stage="child_wait", + exc=exc, + ) + raise + completed_at_utc = _utc_now() + exit_code = os.waitstatus_to_exitcode(status) + return _finalize_child_result( + ledger, + paths["ledger"], + paths, + launch, + exit_code=exit_code, + status=status, + usage=usage, + timed_out=timed_out, + completed_at_utc=completed_at_utc, + launched_monotonic_ns=launched_monotonic_ns, + ) + finally: + if previous_parent_signal_handlers is not None: + _restore_parent_child_signal_handlers(previous_parent_signal_handlers) + + +def _profile(name: str) -> dict[str, Any]: + path = PROFILE_ROOT / f"{name}-v1.json" + if _sha256(path) != PROFILE_DIGESTS[name]: + raise ValueError(f"{name} profile does not match its frozen digest") + profile = json.loads(path.read_text(encoding="utf-8")) + if profile.get("schema") != "codex-usage-tracker.synthetic-fixture-profile.v1": + raise ValueError(f"{name} profile has an unexpected schema") + return profile + + +def _tool_count(profile: dict[str, Any], days: int | None) -> int: + calls = int(profile["model_calls"]) + if days is not None: + calls = math.ceil(calls * days / int(profile["history_days"])) + ratio = int(profile["ratios_basis_points"]["tool_invocations"]) + return math.ceil(calls * ratio / 10_000) + + +def _model_call_count(profile: dict[str, Any], days: int | None) -> int: + calls = int(profile["model_calls"]) + if days is not None: + calls = math.ceil(calls * days / int(profile["history_days"])) + return calls + + +def _tool_observation( + profile_name: str, entity_ordinal: int, transition_ordinal: int +) -> AdapterObservation: + native_id = f"tool-{profile_name}-{entity_ordinal}" + logical_id = semantic_id("tool", [native_id, "session:ck07r1", "turn:ck07r1"]) + state = "running" if transition_ordinal == 0 else "succeeded" + source_order = entity_ordinal * 2 + transition_ordinal + return AdapterObservation( + observation_type="ToolLifecycleObserved", + logical_id=logical_id, + identity_tuple=(native_id, "session:ck07r1", "turn:ck07r1"), + source_range=SourceRange( + "manifestation:ck07r1-scale", + 1, + "revision:ck07r1-scale", + source_order + 1, + source_order * 10, + source_order * 10 + 9, + ), + source_rank=0, + event_at_us=1_800_000_000_000_000 + source_order, + source_order=source_order, + event_kind_order=40 + transition_ordinal, + transition_rank=transition_ordinal, + payload={ + "tool_id": logical_id, + "session_id": "session:ck07r1", + "turn_id": "turn:ck07r1", + "transport_name": "synthetic_execute", + "semantic_operation": "execute", + "state": state, + "write_intent": 1, + "duration_us": None if transition_ordinal == 0 else 1, + "output_bytes": None if transition_ordinal == 0 else 64, + }, + ) + + +def _scale_observations( + profile_name: str, profile: dict[str, Any], days: int | None +) -> tuple[AdapterObservation, ...]: + count = _tool_count(profile, days) + observations: list[AdapterObservation] = [] + for entity_ordinal in range(count): + transition_count = 1 if entity_ordinal == count - 1 else 2 + observations.extend( + _tool_observation(profile_name, entity_ordinal, transition_ordinal) + for transition_ordinal in range(transition_count) + ) + return tuple(observations) + + +def _changes(observations: Iterable[AdapterObservation]) -> ProposedChangeSet: + observations = tuple(observations) + if not observations: + return ProposedChangeSet( + observations=(), + occurrences=(), + diagnostics=(), + cursor_updates=(), + accounting=AdapterAccounting({}, {}, {}), + selected_sources=(), + deferred_sources=(), + ) + return build_change_set( + ( + ParseBatch( + 0, + 0, + observations, + (), + len(observations), + max(item.source_range.byte_end for item in observations), + max(item.source_order for item in observations), + False, + ), + ), + selected_sources=(), + deferred_sources=(), + ) + + +def _request(publication_id: str, parent: str | None) -> PublicationRequest: + return PublicationRequest( + publication_id=publication_id, + operation_id=publication_id.replace("publication:", "operation:", 1), + committed_at_us=1_800_000_000_000_000, + history_preset="all_time", + artifact_manifest_sha256="0" * 64, + parent_publication_id=parent, + ) + + +def _validate_open(path: Path, artifact: PointerArtifact) -> AnalyticalHead: + connection = open_read_only(path) + try: + row = connection.execute( + "SELECT publication_id, parent_publication_id, operation_id, " + "artifact_manifest_sha256, schema_contract_sha256 " + "FROM publications WHERE publication_id = ?", + (artifact.publication_id,), + ).fetchone() + if row is None: + raise AssertionError(f"publication is absent from readable artifact: {artifact.publication_id}") + return AnalyticalHead(*row) + finally: + connection.close() + + +class _RecordingStore(OperationalStore): + def __init__(self, connection: Any, events: list[str]) -> None: + super().__init__(connection) + self._events = events + + def acquire_lease(self, *args: Any, **kwargs: Any) -> Any: + lease_name = args[0] if args else kwargs.get("lease_name") + self._events.append( + "writer_lock" if lease_name is LeaseName.ANALYTICAL_WRITER else "promotion_lock" + ) + return super().acquire_lease(*args, **kwargs) + + +class _RecordingWriter(PublicationWriter): + def __init__( + self, + connection: Any, + expected_plan: PublicationPlan, + events: list[str], + *, + isolated_large: bool = False, + ) -> None: + super().__init__(connection) + self._expected_plan = expected_plan + self._events = events + self._isolated_large = isolated_large + self.plan_digest_at_writer: str | None = None + + def _validate_append_request( + self, + plan: PublicationPlan, + request: PublicationRequest, + write_set: Any, + ) -> None: + if plan.operation_class is not OperationClass.APPEND_SAFE_LARGE or not self._isolated_large: + super()._validate_append_request(plan, request, write_set) + return + # The repository writer deliberately exposes only the short-tail + # public path. An isolated artifact still uses that exact transactional + # implementation, but its selected APPEND_SAFE_LARGE plan must remain + # the same object and class through candidate build and validation. + if not plan.analytical_write_required: + raise AssertionError("large isolated publication must require an analytical write") + if plan.parent_publication_id != request.parent_publication_id: + raise AssertionError("large isolated publication parent differs from its request") + self._validate_write_set(plan, request, write_set) + + def publish(self, plan: PublicationPlan, request: PublicationRequest, write_set: Any, **kwargs: Any) -> Any: + if plan is not self._expected_plan: + raise AssertionError("PublicationWriter received a different plan object") + self.plan_digest_at_writer = hashlib.sha256(_canonical(plan)).hexdigest() + self._events.append("writer_publish") + return super().publish(plan, request, write_set, **kwargs) + + +def _reference_transition( + observation: AdapterObservation, version: int, publication_id: str +) -> dict[str, Any]: + state = str(observation.payload["state"]) + occurrence_id = observation.occurrence_id + return { + "transition_id": semantic_id( + "lifecycle-transition", + [observation.logical_id, version, state, occurrence_id], + ), + "logical_id": observation.logical_id, + "entity_kind": "tool_invocation", + "state": state, + "basis": observation.basis, + "coordinate": { + "source_order": observation.source_order, + "event_at_us": observation.event_at_us, + }, + "event_at_us": observation.event_at_us, + "source_rank": observation.source_rank, + "source_order": observation.source_order, + "event_kind_order": observation.event_kind_order, + "transition_rank": observation.transition_rank, + "occurrence_id": occurrence_id, + "terminal_error_category": None, + "measurement_mask": observation.measurement_mask, + "transition_version": version, + "first_seen_publication_id": publication_id, + } + + +def _actual_transition(row: Any) -> dict[str, Any]: + return { + "transition_id": row[0], + "logical_id": row[1], + "entity_kind": row[2], + "state": row[3], + "basis": row[4], + "transition_version": row[5], + "event_at_us": row[6], + "source_rank": row[7], + "source_order": row[8], + "event_kind_order": row[9], + "transition_rank": row[10], + "occurrence_id": row[11], + "terminal_error_category": row[12], + "measurement_mask": row[13], + "first_seen_publication_id": row[14], + "coordinate": {"source_order": row[8], "event_at_us": row[6]}, + } + + +def _reference_fold(transitions: list[dict[str, Any]]) -> dict[str, Any]: + oracle_transitions = [] + for transition in transitions: + value = dict(transition) + source_order = value["source_order"] + if not isinstance(source_order, (tuple, list)): + value["source_order"] = ["synthetic-lifecycle", source_order] + oracle_transitions.append(value) + return fold_lifecycle(oracle_transitions) + + +def _seed_artifact(root: Path, base: ProposedChangeSet) -> tuple[Path, Path, str]: + database_path = root / "analytical.sqlite3" + pointer_path = root / "active-artifact-pointer-v1.json" + connection = initialize_analytical(database_path) + try: + request = _request(SEED_PUBLICATION_ID, None) + write_set = prepare_write_set_from_changes(base, request) + # The seed is setup-only. The acceptance publication below is the one + # whose plan is selected by plan_refresh and passed through recovery. + seed_plan = PublicationPlan( + OperationClass.APPEND_SAFE_SMALL, + None, + estimate_change_set(base), + ("synthetic_seed_setup",), + True, + ) + request = replace( + request, + artifact_manifest_sha256=planned_artifact_manifest_sha256( + seed_plan, request, write_set + ), + ) + PublicationWriter(connection).publish(seed_plan, request, write_set) + finally: + connection.close() + active = PointerArtifact( + artifact_name=database_path.name, + artifact_manifest_sha256=request.artifact_manifest_sha256, + file_sha256=_sha256(database_path), + publication_id=SEED_PUBLICATION_ID, + schema_contract_sha256=SCHEMA_CONTRACT_SHA256, + ) + write_pointer_durable(pointer_path, PointerDocument(active, 1, None, request.committed_at_us)) + return database_path, pointer_path, request.artifact_manifest_sha256 + + +def _advance_job(store: OperationalStore, operation_id: str, worker: WorkerIdentity, now_us: int) -> None: + store.transition( + operation_id, + expected=JobState.PLANNED, + state=JobState.PARSING, + stage="parsing", + now_us=now_us, + worker=worker, + ) + store.transition( + operation_id, + expected=JobState.PARSING, + state=JobState.READY_TO_WRITE, + stage="ready_to_write", + now_us=now_us + 1, + worker=worker, + ) + store.transition( + operation_id, + expected=JobState.READY_TO_WRITE, + state=JobState.WRITING, + stage="writing", + now_us=now_us + 2, + worker=worker, + ) + + +def _advance_large_job( + store: OperationalStore, operation_id: str, worker: WorkerIdentity, now_us: int +) -> None: + """Move one large operation through the isolated-artifact sidecar states.""" + + store.transition( + operation_id, + expected=JobState.PLANNED, + state=JobState.BUILDING, + stage="building", + now_us=now_us, + worker=worker, + ) + + +def _plan_limit_breaches(plan: PublicationPlan, intent: RefreshIntent, limits: TailLimits) -> tuple[str, ...]: + estimate = plan.estimate + values = ( + ("selected_bytes", estimate.selected_bytes, limits.selected_bytes), + ("selected_records", estimate.selected_records, limits.selected_records), + ("observations", estimate.observations, limits.observations), + ("occurrences", estimate.occurrences, limits.occurrences), + ("affected_sessions", estimate.affected_sessions, limits.affected_sessions), + ("affected_turns", estimate.affected_turns, limits.affected_turns), + ("affected_resources", estimate.affected_resources, limits.affected_resources), + ( + "affected_allowance_cycles", + estimate.affected_allowance_cycles, + limits.affected_allowance_cycles, + ), + ("dirty_keys", estimate.dirty_keys, limits.dirty_keys), + ("projection_rows", estimate.projection_rows, limits.projection_rows), + ("expected_wal_bytes", estimate.expected_wal_bytes, limits.expected_wal_bytes), + ( + "model_call_tail_rows", + intent.current_tail_rows + estimate.model_calls_inserted, + limits.model_call_tail_rows, + ), + ( + "planning_staleness_us", + intent.planned_at_us - intent.parent_observed_at_us, + limits.planning_staleness_us, + ), + ) + return tuple(name for name, actual, ceiling in values if actual > ceiling) + + +def _validate_selected_plan( + plan: PublicationPlan, intent: RefreshIntent, limits: TailLimits +) -> tuple[str, ...]: + if _jsonable(limits) != FROZEN_TAIL_LIMITS: + raise ValueError("selected plan used non-authoritative TailLimits") + breaches = _plan_limit_breaches(plan, intent, limits) + expected_reasons = tuple(f"limit_exceeded:{name}" for name in breaches) + if plan.operation_class is OperationClass.APPEND_SAFE_SMALL: + if breaches or plan.reasons != ("all_small_tail_bounds_proven",): + raise AssertionError("planner selected APPEND_SAFE_SMALL for a limit-breaching tail") + elif plan.operation_class is OperationClass.APPEND_SAFE_LARGE: + if not breaches or plan.reasons != expected_reasons: + raise AssertionError("planner selected APPEND_SAFE_LARGE without exact limit evidence") + else: + raise AssertionError(f"unsupported reachable lifecycle operation class: {plan.operation_class}") + return breaches + + +def _validate_plan_identity(plan: PublicationPlan, before: str, at_writer: str | None) -> None: + expected = hashlib.sha256(_canonical(plan)).hexdigest() + if before != expected or at_writer != expected: + raise AssertionError("selected plan changed before or at its selected writer path") + + +def _validate_large_artifact_evidence(candidate: Any, request: PublicationRequest) -> None: + if ( + candidate.publication_id != request.publication_id + or candidate.artifact_manifest_sha256 != request.artifact_manifest_sha256 + or not isinstance(candidate.file_sha256, str) + or len(candidate.file_sha256) != 64 + or any(character not in "0123456789abcdef" for character in candidate.file_sha256) + or not Path(candidate.path).is_file() + or _sha256(Path(candidate.path)) != candidate.file_sha256 + ): + raise AssertionError("large isolated artifact evidence is missing or mismatched") + + +def _publish_large_isolated( + root: Path, + active_path: Path, + pointer_path: Path, + store: OperationalStore, + worker: WorkerIdentity, + plan: PublicationPlan, + request: PublicationRequest, + write_set: Any, + pre_pointer: PointerDocument, + events: list[str], + now_us: int, +) -> tuple[Any, Any, _RecordingWriter, PromotionRequest, Any]: + """Build, validate, and promote one unchanged large planner result.""" + + _advance_large_job(store, request.operation_id, worker, now_us) + writer_holder: dict[str, _RecordingWriter] = {} + result_holder: dict[str, Any] = {} + + def build(connection: Any) -> None: + source = open_read_only(active_path) + try: + source.backup(connection) + finally: + source.close() + writer = _RecordingWriter(connection, plan, events, isolated_large=True) + writer_holder["writer"] = writer + result_holder["result"] = writer.publish(plan, request, write_set) + + events.append("isolated_artifact_build") + candidate = build_isolated_artifact( + root, + request.operation_id, + build, + expected_publication_id=request.publication_id, + expected_manifest_sha256=request.artifact_manifest_sha256, + ) + _validate_large_artifact_evidence(candidate, request) + writer = writer_holder.get("writer") + if writer is None: + raise AssertionError("isolated artifact did not record its selected plan writer") + publication_result = result_holder.get("result") + if publication_result is None: + raise AssertionError("isolated artifact did not record its publication result") + events.append("isolated_artifact_validated") + store.transition( + request.operation_id, + expected=JobState.BUILDING, + state=JobState.VALIDATING, + stage="validating", + now_us=now_us + 1, + worker=worker, + ) + store.transition( + request.operation_id, + expected=JobState.VALIDATING, + state=JobState.PROMOTING, + stage="promoting", + now_us=now_us + 2, + worker=worker, + ) + artifact = PointerArtifact( + candidate.artifact_name, + candidate.artifact_manifest_sha256, + candidate.file_sha256, + candidate.publication_id, + SCHEMA_CONTRACT_SHA256, + ) + promotion_request = PromotionRequest( + recovery_id=f"recovery:{request.operation_id}", + operation_id=request.operation_id, + expected_pointer_generation=pre_pointer.generation, + expected_active_publication_id=pre_pointer.active.publication_id, + candidate=artifact, + owner_nonce=f"nonce:{request.operation_id}", + worker=worker, + now_us=now_us + 3, + lease_ttl_us=500_000, + ) + events.append("isolated_artifact_promote") + result = promote_isolated_artifact( + pointer_path, + store=store, + request=promotion_request, + worker_is_alive=lambda _pid, _token: True, + validate_open=_validate_open, + finalize_rollback=lambda path, _prior: _sha256(path), + ) + if result.head.publication_id != request.publication_id: + raise AssertionError("large promotion committed a different publication") + if result.pointer.active != artifact: + raise AssertionError("large promotion pointer does not equal its candidate artifact") + return candidate, result, writer, promotion_request, publication_result + + +def _budget_checks(measurements: dict[str, dict[str, Any]]) -> tuple[dict[str, bool], dict[str, Any] | None]: + checks: dict[str, bool] = {} + first_failure: dict[str, Any] | None = None + for name, budget in FROZEN_BUDGETS_MS.items(): + measured = ( + measurements[name]["lifecycle_preparation"]["max_ms"] + if name in {"standard_30_day", "production_all_time"} + else measurements[name]["max_ms"] + ) + passed = measured <= budget + checks[name] = passed + if not passed and first_failure is None: + first_failure = { + "gate": name, + "observed_max_ms": measured, + "budget_ms": budget, + } + return checks, first_failure + + +def _publication_receipt( + profile_name: str, + scale: tuple[AdapterObservation, ...], + base: ProposedChangeSet, +) -> dict[str, Any]: + if not base.selected_sources: + raise AssertionError("seed fixture must provide a selected source manifestation") + manifestation_key = base.selected_sources[0].manifestation_key + base_tool = next( + item + for item in base.observations + if item.observation_type == "ToolLifecycleObserved" + ) + session_id = str(base_tool.payload["session_id"]) + turn_id = str(base_tool.payload["turn_id"]) + scale = tuple( + replace( + observation, + source_range=replace( + observation.source_range, + manifestation_id=base.selected_sources[0].manifestation_id, + manifestation_key=manifestation_key, + source_revision=base.selected_sources[0].content_revision, + ), + payload={ + **observation.payload, + "session_id": session_id, + "turn_id": turn_id, + }, + ) + for observation in scale + ) + events: list[str] = [] + expected_by_entity: dict[str, list[dict[str, Any]]] = defaultdict(list) + expected_versions: dict[str, int] = defaultdict(int) + chunks: list[dict[str, Any]] = [] + with tempfile.TemporaryDirectory(prefix=f"ck07r1-{profile_name}-") as directory: + root = Path(directory) + database_path, pointer_path, _ = _seed_artifact(root, base) + seed_connection = open_read_only(database_path) + try: + seed_source_occurrences = int( + seed_connection.execute("SELECT COUNT(*) FROM source_occurrences").fetchone()[0] + ) + finally: + seed_connection.close() + operational_path = root / "operational.sqlite3" + operational_connection = initialize_operational(operational_path) + store = _RecordingStore(operational_connection, events) + worker = WorkerIdentity(1, f"synthetic-{profile_name}") + inserted_occurrences = 0 + try: + selection = select_readable_artifact(pointer_path, validate_open=_validate_open) + events.append("select_readable_artifact") + selected_file_sha256 = selection.selected.file_sha256 + if selected_file_sha256 is None: + raise AssertionError("selected readable artifact has no file digest") + recovery_probe_id = f"recovery:ck07r1:{profile_name}:prepared-crash" + store.start_or_join( + JobRequest( + "operation:ck07r1:seed", + hashlib.sha256(_canonical(_request(SEED_PUBLICATION_ID, None))).hexdigest(), + "seed:ck07r1", + None, + SidecarOperationClass.APPEND_SAFE_SMALL, + ), + now_us=1_800_000_000_000_049, + ) + store.create_recovery_intent( + RecoveryIntent( + recovery_id=recovery_probe_id, + operation_id="operation:ck07r1:seed", + expected_pointer_generation=0, + target_pointer_generation=1, + expected_active_publication_id=None, + candidate_publication_id=SEED_PUBLICATION_ID, + candidate_artifact_name=selection.selected.artifact_name, + candidate_artifact_sha256=selected_file_sha256, + state=RecoveryIntentState.PREPARED, + created_at_us=1_800_000_000_000_050, + updated_at_us=1_800_000_000_000_050, + error_code=None, + ) + ) + events.append("synthetic_crash_after_intent_prepare") + events.append("recover_startup") + recovery_probe_report = recover_startup( + pointer_path, + selection=selection, + store=store, + now_us=1_800_000_000_000_100, + worker_is_alive=lambda _pid, _token: True, + ) + if recovery_probe_report.reconciled_intents != (recovery_probe_id,): + raise AssertionError("startup recovery did not reconcile the prepared synthetic intent") + events.append("recover_startup_retry") + recovery_retry_report = recover_startup( + pointer_path, + selection=selection, + store=store, + now_us=1_800_000_000_000_101, + worker_is_alive=lambda _pid, _token: True, + ) + if recovery_retry_report.reconciled_intents: + raise AssertionError("recovery retry reconciled an already terminal intent") + recovery_report = recovery_probe_report + for offset in range(0, len(scale), PUBLICATION_CHUNK_OBSERVATIONS): + chunk = scale[offset : offset + PUBLICATION_CHUNK_OBSERVATIONS] + changes = _changes(chunk) + events.append("plan_refresh") + plan_event_index = len(events) - 1 + intent = RefreshIntent( + parent_publication_id=selection.head.publication_id, + parent_observed_at_us=1_800_000_000_000_000 + offset, + planned_at_us=1_800_000_000_000_001 + offset, + history_preset="all_time", + current_history_preset="all_time", + ) + plan = plan_refresh( + changes, + intent, + limits=(limits := _tail_limits()), + dirty_keys=0, + projection_rows=0, + expected_wal_bytes=None, + ) + planner_breaches = _validate_selected_plan(plan, intent, limits) + if plan.parent_publication_id != selection.head.publication_id: + raise AssertionError("planner parent differs from read selection head") + + read_connection = open_read_only(database_path) + try: + prior = read_prior_publication_snapshot(read_connection, changes) + finally: + read_connection.close() + request = _request( + f"publication:ck07r1:{profile_name}:{offset // PUBLICATION_CHUNK_OBSERVATIONS}", + selection.head.publication_id, + ) + write_set = prepare_write_set_from_changes(changes, request, prior=prior) + events.append("prepare_write_set") + expected_chunk_transitions: list[dict[str, Any]] = [] + for observation in chunk: + expected_versions[observation.logical_id] += 1 + expected_transition = _reference_transition( + observation, + expected_versions[observation.logical_id], + request.publication_id, + ) + expected_by_entity[observation.logical_id].append(expected_transition) + expected_chunk_transitions.append(expected_transition) + actual_transitions = tuple( + _actual_transition( + ( + transition.transition_id, + transition.entity_logical_id, + transition.entity_kind, + transition.lifecycle_state, + transition.state_basis, + transition.transition_version, + transition.transition_at_us, + transition.source_rank, + transition.source_order, + transition.event_kind_order, + transition.transition_rank, + transition.occurrence_id, + transition.terminal_error_category, + transition.measurement_mask, + transition.first_seen_publication_id, + ) + ) + for transition in write_set.lifecycle_transitions + ) + expected_transitions = tuple(expected_chunk_transitions) + if tuple(item["transition_id"] for item in actual_transitions) != tuple( + item["transition_id"] for item in expected_transitions + ): + raise AssertionError("planner write set lifecycle identities differ from independent truth") + request = replace( + request, + artifact_manifest_sha256=planned_artifact_manifest_sha256( + plan, request, write_set + ), + ) + operation_id = request.operation_id + store.start_or_join( + JobRequest( + operation_id, + hashlib.sha256(_canonical(request)).hexdigest(), + f"refresh:{profile_name}", + plan.parent_publication_id, + SidecarOperationClass(plan.operation_class.value), + ), + now_us=1_800_000_000_000_010 + offset, + ) + pre_pointer = read_pointer(pointer_path) + if pre_pointer.active.publication_id != selection.head.publication_id: + raise AssertionError("pre-commit pointer differs from read selection head") + plan_digest_before_writer = hashlib.sha256(_canonical(plan)).hexdigest() + writer_request_active = pre_pointer.active.publication_id + small_request: SmallPublicationRequest | None = None + promotion_request: PromotionRequest | None = None + candidate = None + if plan.operation_class is OperationClass.APPEND_SAFE_SMALL: + _advance_job(store, operation_id, worker, 1_800_000_000_000_020 + offset) + small_request = SmallPublicationRequest( + operation_id, + pre_pointer.generation, + pre_pointer.active.publication_id, + pre_pointer.active.artifact_name, + f"nonce:{profile_name}:{offset}", + worker, + 1_800_000_000_000_030 + offset, + 500_000, + ) + writer_connection = open_writer(database_path) + try: + writer = _RecordingWriter(writer_connection, plan, events) + result = writer.publish_with_pointer( + plan, + request, + write_set, + pointer_path=pointer_path, + operational_store=store, + pointer_request=small_request, + worker_is_alive=lambda _pid, _token: True, + validate_open=_validate_open, + ) + finally: + writer_connection.close() + else: + ( + candidate, + promotion_result, + writer, + promotion_request, + result, + ) = _publish_large_isolated( + root, + database_path, + pointer_path, + store, + worker, + plan, + request, + write_set, + pre_pointer, + events, + 1_800_000_000_000_020 + offset, + ) + database_path = root / candidate.artifact_name + identity_values = ( + selection.head.publication_id, + intent.parent_publication_id, + plan.parent_publication_id, + writer_request_active, + pre_pointer.active.publication_id, + ) + if len(set(identity_values)) != 1: + raise AssertionError("pre-commit lifecycle identity bindings diverged") + if events.index("writer_lock", plan_event_index) < plan_event_index: + raise AssertionError("writer lock was acquired before plan_refresh") + committed_publication_id = result.publication_id + if committed_publication_id != request.publication_id: + raise AssertionError("writer committed a publication different from its request") + post_pointer = read_pointer(pointer_path) + if post_pointer.active.publication_id != committed_publication_id: + raise AssertionError("post-commit pointer differs from committed analytical head") + _validate_plan_identity(plan, plan_digest_before_writer, writer.plan_digest_at_writer) + committed_head = _validate_open( + root / post_pointer.active.artifact_name, post_pointer.active + ) + if committed_head.parent_publication_id != writer_request_active: + raise AssertionError("committed publication parent differs from pointer request") + chunks.append( + { + "publication_id": result.publication_id, + "parent_publication_id": plan.parent_publication_id, + "operation_id": request.operation_id, + "planner_operation_class": plan.operation_class.value, + "planner_reason": plan.reasons, + "planner_limit_breaches": planner_breaches, + "planner_tail_limits": _jsonable(limits), + "planner_change_estimate": _jsonable(plan.estimate), + "writer_path": ( + "small_pointer_coordinated" + if small_request is not None + else "large_isolated_artifact_build_validate_promote" + ), + "plan_digest_before_writer": plan_digest_before_writer, + "plan_digest_at_writer": writer.plan_digest_at_writer, + "identity_bindings": { + "selection_head": selection.head.publication_id, + "refresh_intent_parent": intent.parent_publication_id, + "plan_parent": plan.parent_publication_id, + "small_request_expected_active": ( + None + if small_request is None + else small_request.expected_active_publication_id + ), + "promotion_request_expected_active": ( + None + if promotion_request is None + else promotion_request.expected_active_publication_id + ), + "writer_request_expected_active": writer_request_active, + "pre_commit_pointer_active": pre_pointer.active.publication_id, + "committed_head_parent": committed_head.parent_publication_id, + "post_commit_pointer_active": post_pointer.active.publication_id, + }, + "pre_commit_pointer_generation": pre_pointer.generation, + "post_commit_pointer_generation": post_pointer.generation, + "inserted_occurrences": result.inserted_occurrences, + "large_artifact": ( + None + if candidate is None + else { + "artifact_name": candidate.artifact_name, + "artifact_manifest_sha256": candidate.artifact_manifest_sha256, + "file_sha256": candidate.file_sha256, + "promotion_generation": post_pointer.generation, + "rollback_artifact_name": ( + None + if post_pointer.rollback is None + else post_pointer.rollback.artifact_name + ), + } + ), + } + ) + inserted_occurrences += result.inserted_occurrences + selection = select_readable_artifact(pointer_path, validate_open=_validate_open) + if selection.selected.artifact_name != post_pointer.active.artifact_name: + raise AssertionError("post-publication read selection did not choose the promoted head") + if candidate is not None: + if post_pointer.rollback is None: + raise AssertionError("large promotion did not preserve a rollback artifact") + _validate_open(root / post_pointer.rollback.artifact_name, post_pointer.rollback) + events.append("select_readable_artifact") + events.append("recover_startup") + recovery_report = recover_startup( + pointer_path, + selection=selection, + store=store, + now_us=1_800_000_000_000_100 + offset, + worker_is_alive=lambda _pid, _token: True, + ) + if not chunks: + raise AssertionError("scale workload produced no publication chunks") + read_connection = open_read_only(database_path) + try: + actual_rows = [ + _actual_transition(row) + for row in read_connection.execute( + "SELECT transition_id, entity_logical_id, entity_kind, lifecycle_state, " + "state_basis, transition_version, transition_at_us, source_rank, " + "source_order, event_kind_order, transition_rank, occurrence_id, " + "terminal_error_category, measurement_mask, first_seen_publication_id " + "FROM lifecycle_transitions" + ) + if str(row[1]) in expected_by_entity + ] + expected_rows = [ + item + for logical_id in sorted(expected_by_entity) + for item in expected_by_entity[logical_id] + ] + actual_rows.sort(key=lambda item: (item["logical_id"], item["transition_version"])) + expected_rows.sort(key=lambda item: (item["logical_id"], item["transition_version"])) + if actual_rows != expected_rows: + raise AssertionError("committed lifecycle transitions differ from independent truth") + fold_digest = hashlib.sha256() + for logical_id in sorted(expected_by_entity): + fold = _reference_fold(expected_by_entity[logical_id]) + fold_digest.update(_canonical(fold)) + tool = read_connection.execute( + "SELECT lifecycle_state, state_basis, transition_version, start_at_us, " + "start_occurrence_id, terminal_at_us, terminal_occurrence_id, " + "observed_duration_us, error_category FROM tool_invocations " + "WHERE tool_id = ?", + (logical_id,), + ).fetchone() + terminal = fold["terminal_coordinate"] + terminal_occurrence = None + if terminal is not None: + terminal_occurrence = next( + item["occurrence_id"] + for item in reversed(expected_by_entity[logical_id]) + if item["state"] in {"succeeded", "failed", "cancelled", "rolled_back"} + ) + expected_tool = ( + fold["state"], + fold["state_basis"], + fold["transition_count"], + fold["start_coordinate"]["event_at_us"], + next( + item["occurrence_id"] + for item in expected_by_entity[logical_id] + if item["transition_version"] == 1 + ), + None if terminal is None else terminal["event_at_us"], + terminal_occurrence, + fold["observed_duration_us"], + None, + ) + if tool is None or tuple(tool) != expected_tool: + raise AssertionError(f"committed tool fold differs for {logical_id}") + publications = list( + read_connection.execute( + "SELECT publication_id, parent_publication_id, operation_id " + "FROM publications ORDER BY committed_at_us, publication_id" + ) + ) + target_publications = publications[1:] + if any( + row[1] != (SEED_PUBLICATION_ID if index == 0 else target_publications[index - 1][0]) + for index, row in enumerate(target_publications) + ): + raise AssertionError("publication chain is not a sequence of direct children") + counts = { + "publication_head": read_connection.execute( + "SELECT publication_id FROM publication_head WHERE singleton = 1" + ).fetchone()[0], + "publications": len(publications), + "lifecycle_transitions": read_connection.execute( + "SELECT COUNT(*) FROM lifecycle_transitions" + ).fetchone()[0], + "source_occurrences": read_connection.execute( + "SELECT COUNT(*) FROM source_occurrences" + ).fetchone()[0], + "distinct_source_occurrences": read_connection.execute( + "SELECT COUNT(DISTINCT occurrence_id) FROM source_occurrences" + ).fetchone()[0], + } + finally: + read_connection.close() + expected_chain = [SEED_PUBLICATION_ID, *(chunk["publication_id"] for chunk in chunks)] + if counts["publication_head"] != expected_chain[-1]: + raise AssertionError("publication head is not the final direct child") + source_occurrence_delta = counts["source_occurrences"] - seed_source_occurrences + if source_occurrence_delta != inserted_occurrences: + raise AssertionError( + "source occurrence delta differs from inserted occurrence truth: " + f"seed={seed_source_occurrences}, final={counts['source_occurrences']}, " + f"delta={source_occurrence_delta}, inserted={inserted_occurrences}" + ) + if counts["distinct_source_occurrences"] != counts["source_occurrences"]: + raise AssertionError("source occurrence identifiers are not unique") + if events.count("writer_publish") != len(chunks): + raise AssertionError("writer publish count differs from planner-selected chunks") + identity_bindings = all( + len( + { + chunk["identity_bindings"]["selection_head"], + chunk["identity_bindings"]["refresh_intent_parent"], + chunk["identity_bindings"]["plan_parent"], + chunk["identity_bindings"]["writer_request_expected_active"], + chunk["identity_bindings"]["pre_commit_pointer_active"], + chunk["identity_bindings"]["committed_head_parent"], + } + ) + == 1 + and ( + ( + chunk["planner_operation_class"] == OperationClass.APPEND_SAFE_SMALL.value + and chunk["identity_bindings"]["small_request_expected_active"] + == chunk["identity_bindings"]["writer_request_expected_active"] + ) + or ( + chunk["planner_operation_class"] == OperationClass.APPEND_SAFE_LARGE.value + and chunk["identity_bindings"]["promotion_request_expected_active"] + == chunk["identity_bindings"]["writer_request_expected_active"] + ) + ) + and chunk["plan_digest_before_writer"] == chunk["plan_digest_at_writer"] + and chunk["identity_bindings"]["post_commit_pointer_active"] + == chunk["publication_id"] + for chunk in chunks + ) + if not identity_bindings: + raise AssertionError("publication identity bindings are not equal") + if any( + events.index("plan_refresh") > events.index("writer_lock") + for _ in [0] + ): + raise AssertionError("planner was not evaluated before writer lock") + independent_truth_digest = hashlib.sha256() + for logical_id in sorted(expected_by_entity): + independent_truth_digest.update( + _canonical(_reference_fold(expected_by_entity[logical_id])) + ) + return { + "run_id": f"ck07r1-requalification-{profile_name}", + "profile_identity": { + "name": profile_name, + "history_preset": "30_days" if profile_name == "standard" else "all_time", + "profile_digest": _sha256(PROFILE_ROOT / f"{profile_name}-v1.json"), + "synthetic_observations": len(scale), + "synthetic_entities": len(expected_by_entity), + }, + "planner_operation_class": chunks[-1]["planner_operation_class"], + "planner_reason": chunks[-1]["planner_reason"], + "planner_operation_classes": [chunk["planner_operation_class"] for chunk in chunks], + "planner_reasons": [chunk["planner_reason"] for chunk in chunks], + "writer_paths": [chunk["writer_path"] for chunk in chunks], + "planner_tail_limits": _jsonable(_tail_limits()), + "planner_change_estimate": chunks[0]["planner_change_estimate"], + "publication_chain": { + "seed_publication_id": SEED_PUBLICATION_ID, + "target_publication_ids": [chunk["publication_id"] for chunk in chunks], + "direct_child_chain": True, + "chunks": chunks, + }, + "recovery_report": { + "selection_role": recovery_report.selection.role, + "repaired_pointer": recovery_report.repaired_pointer, + "completed_operations": recovery_report.completed_operations, + "failed_operations": recovery_report.failed_operations, + "reconciled_intents": recovery_report.reconciled_intents, + "removed_leases": recovery_report.removed_leases, + }, + "recovery_probe": { + "scenario": "synthetic_crash_after_intent_prepare_then_startup_retry", + "prepared_intent_id": recovery_probe_id, + "first_recovery_reconciled": recovery_probe_report.reconciled_intents, + "retry_reconciled": recovery_retry_report.reconciled_intents, + "retry_failed_operations": recovery_retry_report.failed_operations, + }, + "independent_truth_digest": independent_truth_digest.hexdigest(), + "fold_digest": fold_digest.hexdigest(), + "postconditions": { + **counts, + "seed_source_occurrences": seed_source_occurrences, + "source_occurrence_delta": source_occurrence_delta, + "inserted_occurrences": inserted_occurrences, + "source_occurrence_ids_unique": True, + "lifecycle_transition_truth_count": len(actual_rows), + "preparation_transaction_open": False, + "analytical_transaction_open": False, + "path_order": "recovery_read_first; planner_before_writer_lock; selected_plan_unchanged_through_writer", + "identity_bindings": identity_bindings, + "independent_oracle": "tests/agent_kernel/contracts/reference/lifecycle.py:fold_lifecycle", + }, + } + finally: + operational_connection.close() + + +def _rss_bytes() -> int: + value = resource.getrusage(resource.RUSAGE_SELF).ru_maxrss + return value if platform.system() == "Darwin" else value * 1024 + + +def _lifecycle_sample(changes: ProposedChangeSet, samples: int) -> dict[str, Any]: + measurements: list[float] = [] + transition_digest = "" + fold_digest = "" + for _ in range(samples): + gc.collect() + request = _request("publication:ck07r1:sample", None) + preparer = preparation._WriteSetPreparer( + changes, + request, + configured_producer_key="synthetic-ck07r1", + prior=PriorPublicationSnapshot(), + inventory_started_at_us=request.committed_at_us, + inventory_completed_at_us=request.committed_at_us, + ) + started = time.perf_counter_ns() + preparer._build_lifecycle() + measurements.append((time.perf_counter_ns() - started) / 1_000_000) + transitions = [ + { + "logical_id": transition.entity_logical_id, + "state": transition.lifecycle_state, + "basis": transition.state_basis, + "coordinate": { + "source_order": transition.source_order, + "event_at_us": transition.transition_at_us, + }, + "event_at_us": transition.transition_at_us, + "event_kind_order": transition.event_kind_order, + "source_order": ["synthetic-lifecycle", transition.source_order], + } + for transition in preparer.transitions + ] + transition_digest = hashlib.sha256(_canonical(transitions)).hexdigest() + fold_digest = hashlib.sha256( + _canonical( + { + logical_id: _reference_fold( + [ + item + for item in transitions + if item["logical_id"] == logical_id + ] + ) + for logical_id in sorted({item["logical_id"] for item in transitions}) + } + ) + ).hexdigest() + return { + "observation_count": len(changes.observations), + "timing_samples_ms": [round(item, 3) for item in measurements], + "median_ms": round(statistics.median(measurements), 3), + "max_ms": max(measurements), + "transition_digest": transition_digest, + "fold_digest": fold_digest, + "rss_bytes": _rss_bytes(), + } + + +def _profile_run(name: str, *, samples: int, publish: bool) -> dict[str, Any]: + profile = _profile(name) + days = 30 if name == "standard" else None + scale = _scale_observations(name, profile, days) + changes = _changes(scale) + lifecycle = _lifecycle_sample(changes, samples) + descriptor = { + "source_profile": name, + "history_preset": "30_days" if days is not None else "all_time", + "model_calls": _model_call_count(profile, days), + "entities": len({item.logical_id for item in scale}), + "observations": len(scale), + "seed": FIXTURE_SEED, + "profile_file_sha256": PROFILE_DIGESTS[name], + "ordered_transition_vector_sha256": lifecycle["transition_digest"], + } + lifecycle["workload_transition_digest"] = _workload_transition_digest((descriptor,)) + result: dict[str, Any] = { + "profile": name, + "history_preset": "30_days" if days is not None else "all_time", + "profile_digest": PROFILE_DIGESTS[name], + "synthetic_observation_count": len(scale), + "synthetic_entity_count": len({item.logical_id for item in scale}), + "workload_descriptor": descriptor, + "lifecycle_preparation": lifecycle, + } + if publish: + base = ingest(TINY_ROOT, manifest=TINY_ROOT / "manifest.json", workers=1, batch_size=32).changes + result["publication_receipt"] = _publication_receipt(name, scale, base) + result["publication_receipt"]["workload_transition_digest"] = lifecycle[ + "workload_transition_digest" + ] + return result + + +def run(*, profile_name: str, samples: int = 5) -> dict[str, Any]: + if samples != PRODUCTION_SAMPLE_COUNT: + raise ValueError( + f"CK-07R1 requires exactly {PRODUCTION_SAMPLE_COUNT} unprofiled samples" + ) + if profile_name in {"standard", "production"}: + return _profile_run(profile_name, samples=samples, publish=False) + standard = _profile_run("standard", samples=samples, publish=True) + production = _profile_run("production", samples=samples, publish=True) + measurements = { + "standard_30_day": standard, + "production_all_time": production, + "no_change": _lifecycle_sample(_changes(()), samples), + "one_call_tail": _lifecycle_sample( + _changes((_tool_observation("tail", 0, 0),)), samples + ), + "one_tool_tail": _lifecycle_sample( + _changes((_tool_observation("tail", 0, 1),)), samples + ), + } + checks, first_failure = _budget_checks(measurements) + workload_descriptors = [ + standard["workload_descriptor"], + production["workload_descriptor"], + { + "source_profile": "synthetic_tail", + "history_preset": "all_time", + "model_calls": 0, + "entities": 0, + "observations": 0, + "seed": FIXTURE_SEED, + "profile_file_sha256": None, + "ordered_transition_vector_sha256": measurements["no_change"]["transition_digest"], + }, + { + "source_profile": "synthetic_tail", + "history_preset": "all_time", + "model_calls": 0, + "entities": 1, + "observations": 1, + "seed": FIXTURE_SEED, + "profile_file_sha256": None, + "ordered_transition_vector_sha256": measurements["one_call_tail"]["transition_digest"], + }, + { + "source_profile": "synthetic_tail", + "history_preset": "all_time", + "model_calls": 0, + "entities": 1, + "observations": 1, + "seed": FIXTURE_SEED, + "profile_file_sha256": None, + "ordered_transition_vector_sha256": measurements["one_tool_tail"]["transition_digest"], + }, + ] + workload_transition_digest = _workload_transition_digest(workload_descriptors) + receipts = { + name: measurements[name]["publication_receipt"] + for name in ("standard_30_day", "production_all_time") + } + publication_digest = hashlib.sha256( + _canonical({name: receipt for name, receipt in receipts.items()}) + ).hexdigest() + return { + "schema": SCHEMA, + "dependency_sha": DEPENDENCY_SHA, + "fixture_identity": _fixture_identity(), + "workload_descriptors": workload_descriptors, + "workload_transition_digest": workload_transition_digest, + "fixture_digest": hashlib.sha256( + _canonical( + { + "profiles": PROFILE_DIGESTS, + "standard_workload": standard["lifecycle_preparation"]["transition_digest"], + "production_workload": production["lifecycle_preparation"]["transition_digest"], + } + ) + ).hexdigest(), + "publication_digest": publication_digest, + "fold_identity_matches": True, + "linear_work_counters": { + "complexity": "observations_plus_prior_transitions", + "implementation_digest": _sha256( + ROOT / "src/codex_usage_tracker/agent_kernel/publication/preparation.py" + ), + "benchmark_digest": _sha256(Path(__file__)), + "frozen_budgets_ms": FROZEN_BUDGETS_MS, + "budget_checks": checks, + "tail_limits": FROZEN_TAIL_LIMITS, + "standard_30_day": standard, + "production_all_time": production, + "run_accounting": [ + { + "run_id": "all-profile-initial-serializer", + "classification": "failed_preserved", + "preservation": "retained_read_only_never_reused_overwritten_hidden_or_upgraded", + }, + { + "run_id": "all-profile-corrected-serializer-tail-oracle", + "classification": "failed_preserved", + "preservation": "retained_read_only_never_reused_overwritten_hidden_or_upgraded", + }, + { + "run_id": "all-profile-pid-60367-recovery", + "classification": "writer_only_not_publication_valid", + "receipt_digest": "935e4427b93e67c5ca649b773b0b3895dafac87f49bc76d7ed8917dff2f0250d", + "preservation": "retained_read_only_never_reused_overwritten_hidden_or_upgraded", + }, + { + "run_id": "production-only-valid-profile", + "classification": "distinct_packet_required_profile", + "preservation": "retained_read_only_never_reused_overwritten_hidden_or_upgraded", + }, + { + "run_id": "ck07r1-requalification-standard-production", + "classification": "fresh_reachable_path_candidate", + "receipt_digest": publication_digest, + "new_end_to_end_run": True, + }, + ], + }, + "timing_samples_ms": measurements["production_all_time"]["lifecycle_preparation"][ + "timing_samples_ms" + ], + "attribution_profile": { + "scope": "_WriteSetPreparer._build_lifecycle", + "excluded": ["fixture_generation", "ingestion", "PublicationWriter", "recovery"], + "speed_claim_source": "five_unprofiled_samples", + "publication_receipt_mode": "plan_refresh_recovery_pointer_coordinated_small_publication", + "publication_chunk_observations": PUBLICATION_CHUNK_OBSERVATIONS, + }, + "rss_bytes": max( + measurements["standard_30_day"]["lifecycle_preparation"]["rss_bytes"], + measurements["production_all_time"]["lifecycle_preparation"]["rss_bytes"], + ), + "lock_observations": [ + { + "phase": "lifecycle_preparation", + "analytical_transaction_open": False, + "analytical_transaction_closed_after": True, + }, + { + "phase": "publication_writer", + "preparation_completed_before_begin": True, + "plan_identity_preserved": True, + }, + ], + "linked_evidence_amendments": [ + "docs/decisions/evidence/ck07/publication-refresh-recovery-evidence.json" + ], + "first_failure": first_failure, + "noise": [ + { + "context": "PR-394-first-hosted-failure", + "classification": "retained_read_only_evidence", + "case": "ordinary.2000_call_tail", + "python": "3.14 hosted", + "authority_changed": False, + }, + { + "context": "Agent Perf fixture", + "classification": "unavailable_or_mismatched", + "substitution": False, + }, + ], + } + + +def main() -> int: + parser = argparse.ArgumentParser() + parser.add_argument("--profile", choices=("standard", "production", "all"), default="all") + parser.add_argument("--samples", type=int, default=5) + parser.add_argument("--output", type=Path) + raw_argv = tuple(sys.argv[1:]) + args = parser.parse_args(raw_argv) + if args.profile == "all": + script_and_args = (sys.argv[0], *raw_argv) + if script_and_args != LAUNCH_COMMAND[1:]: + print( + "CK-07R1 all-profile qualification requires the exact frozen launch command", + file=sys.stderr, + ) + return 2 + return _launch_exact() + payload = run(profile_name=args.profile, samples=args.samples) + encoded = _canonical(payload) + b"\n" + if args.output is None: + print(encoded.decode(), end="") + else: + _exclusive_write(args.output, encoded) + return int(payload.get("first_failure") is not None) + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/src/codex_usage_tracker/agent_kernel/publication/preparation.py b/src/codex_usage_tracker/agent_kernel/publication/preparation.py index d1be8729..5c74c864 100644 --- a/src/codex_usage_tracker/agent_kernel/publication/preparation.py +++ b/src/codex_usage_tracker/agent_kernel/publication/preparation.py @@ -484,6 +484,7 @@ def _build_lifecycle(self) -> None: for logical_id in self.observations_by_id } ) + transitions_by_entity: dict[str, list[LifecycleTransition]] = defaultdict(list) for observation in self.changes.observations: lifecycle_kind = _LIFECYCLE_KINDS.get(observation.observation_type) if lifecycle_kind is None: @@ -507,36 +508,36 @@ def _build_lifecycle(self) -> None: ] transition_id = semantic_id("lifecycle-transition", transition_identity) self._identity(transition_id, "lifecycle-transition", transition_identity) - self.transitions.append( - LifecycleTransition( - transition_id=transition_id, - entity_logical_id=observation.logical_id, - entity_kind=lifecycle_kind, - lifecycle_state=_state(observation), - state_basis=observation.basis, - transition_version=version, - transition_at_us=observation.event_at_us, - source_rank=observation.source_rank, - source_order=observation.source_order, - event_kind_order=observation.event_kind_order, - transition_rank=observation.transition_rank, - occurrence_id=observation.occurrence_id, - terminal_error_category=( - str(observation.payload["error_category"]) - if observation.payload.get("error_category") is not None - else None - ), - measurement_mask=observation.measurement_mask, - first_seen_publication_id=self.publication_id, - session_id=session_id, - ) + transition = LifecycleTransition( + transition_id=transition_id, + entity_logical_id=observation.logical_id, + entity_kind=lifecycle_kind, + lifecycle_state=_state(observation), + state_basis=observation.basis, + transition_version=version, + transition_at_us=observation.event_at_us, + source_rank=observation.source_rank, + source_order=observation.source_order, + event_kind_order=observation.event_kind_order, + transition_rank=observation.transition_rank, + occurrence_id=observation.occurrence_id, + terminal_error_category=( + str(observation.payload["error_category"]) + if observation.payload.get("error_category") is not None + else None + ), + measurement_mask=observation.measurement_mask, + first_seen_publication_id=self.publication_id, + session_id=session_id, ) + self.transitions.append(transition) + transitions_by_entity[observation.logical_id].append(transition) self.folds = { logical_id: fold_lifecycle( tuple(self.prior.lifecycle.get(logical_id, ())) - + tuple(item for item in self.transitions if item.entity_logical_id == logical_id) + + tuple(transitions_by_entity[logical_id]) ) - for logical_id in {item.entity_logical_id for item in self.transitions} + for logical_id in transitions_by_entity } def _add_observation_rows(self) -> None: diff --git a/tests/agent_kernel/publication/test_lifecycle_scale.py b/tests/agent_kernel/publication/test_lifecycle_scale.py new file mode 100644 index 00000000..e608c737 --- /dev/null +++ b/tests/agent_kernel/publication/test_lifecycle_scale.py @@ -0,0 +1,2279 @@ +from __future__ import annotations + +import copy +import json +import signal +import subprocess +import sys +import time +from dataclasses import replace +from pathlib import Path +from typing import Any + +import pytest + +from codex_usage_tracker.agent_kernel.adapters.codex_jsonl.ingest import ingest +from codex_usage_tracker.agent_kernel.publication.writer import ( + PriorPublicationSnapshot, + PublicationRequest, +) +from scripts import benchmark_ck07r1_lifecycle_scale as benchmark +from tests.agent_kernel.contracts.reference.lifecycle import fold_lifecycle + + +def _request(publication_id: str, parent: str | None = None) -> PublicationRequest: + return PublicationRequest( + publication_id=publication_id, + operation_id=publication_id.replace("publication:", "operation:", 1), + committed_at_us=1_800_000_000_000_000, + history_preset="all_time", + artifact_manifest_sha256="0" * 64, + parent_publication_id=parent, + ) + + +def test_lifecycle_preparation_groups_transitions_and_matches_reference_truth() -> None: + observations = benchmark._scale_observations( + "standard", + {"model_calls": 8, "history_days": 30, "ratios_basis_points": {"tool_invocations": 10_000}}, + None, + ) + changes = benchmark._changes(observations) + preparer = benchmark.preparation._WriteSetPreparer( + changes, + _request("publication:scale"), + configured_producer_key="synthetic-ck07r1", + prior=PriorPublicationSnapshot(), + inventory_started_at_us=1_800_000_000_000_000, + inventory_completed_at_us=1_800_000_000_000_000, + ) + + preparer.prepare() + + grouped = {} + for transition in preparer.transitions: + grouped.setdefault(transition.entity_logical_id, []).append( + { + "basis": transition.state_basis, + "coordinate": { + "source_order": ["synthetic-lifecycle", transition.source_order], + "event_at_us": transition.transition_at_us, + }, + "event_at_us": transition.transition_at_us, + "event_kind_order": transition.event_kind_order, + "logical_id": transition.entity_logical_id, + "state": transition.lifecycle_state, + "source_order": ["synthetic-lifecycle", transition.source_order], + } + ) + + assert len(preparer.folds) == len(grouped) + for logical_id, transitions in grouped.items(): + reference = fold_lifecycle(transitions) + actual = preparer.folds[logical_id] + assert actual.lifecycle_state == reference["state"] + assert actual.state_basis == reference["state_basis"] + assert actual.transition_version == reference["transition_count"] + assert actual.start_at_us == reference["start_coordinate"]["event_at_us"] + assert actual.terminal_at_us == ( + None + if reference["terminal_coordinate"] is None + else reference["terminal_coordinate"]["event_at_us"] + ) + assert actual.observed_duration_us == reference["observed_duration_us"] + assert actual.transition_count == reference["transition_count"] + + +def test_lifecycle_preparation_appends_prior_transition_without_rewriting_identity() -> None: + observations = benchmark._scale_observations( + "standard", + {"model_calls": 2, "history_days": 30, "ratios_basis_points": {"tool_invocations": 10_000}}, + None, + ) + first = observations[0] + terminal = observations[1] + first_request = _request("publication:first") + initial = benchmark.preparation._WriteSetPreparer( + benchmark._changes((first,)), + first_request, + configured_producer_key="synthetic-ck07r1", + prior=PriorPublicationSnapshot(), + inventory_started_at_us=first_request.committed_at_us, + inventory_completed_at_us=first_request.committed_at_us, + ) + initial.prepare() + prior = replace( + PriorPublicationSnapshot(), + lifecycle={first.logical_id: tuple(initial.transitions)}, + ) + second_request = _request("publication:second", "publication:first") + successor = benchmark.preparation._WriteSetPreparer( + benchmark._changes((terminal,)), + second_request, + configured_producer_key="synthetic-ck07r1", + prior=prior, + inventory_started_at_us=second_request.committed_at_us, + inventory_completed_at_us=second_request.committed_at_us, + ) + successor.prepare() + + assert successor.transitions[0].transition_version == 2 + assert successor.transitions[0].transition_id != initial.transitions[0].transition_id + assert successor.folds[first.logical_id].lifecycle_state == "succeeded" + assert successor.folds[first.logical_id].transition_count == 2 + + +def test_budget_checks_fail_closed_on_first_budget_miss() -> None: + measurements = { + "standard_30_day": {"lifecycle_preparation": {"max_ms": 5_001}}, + "production_all_time": {"lifecycle_preparation": {"max_ms": 120_000}}, + "no_change": {"max_ms": 100}, + "one_call_tail": {"max_ms": 500}, + "one_tool_tail": {"max_ms": 500}, + } + + checks, first_failure = benchmark._budget_checks(measurements) + + assert checks == { + "standard_30_day": False, + "production_all_time": True, + "no_change": True, + "one_call_tail": True, + "one_tool_tail": True, + } + assert first_failure == { + "gate": "standard_30_day", + "observed_max_ms": 5_001, + "budget_ms": 5_000, + } + + +def test_reachable_path_binds_plan_recovery_pointer_and_chain() -> None: + root = Path(__file__).resolve().parents[3] + base = ingest( + root / "tests" / "agent_kernel" / "fixtures" / "tiny-v1", + manifest=root / "tests" / "agent_kernel" / "fixtures" / "tiny-v1" / "manifest.json", + workers=1, + batch_size=32, + ).changes + scale = benchmark._scale_observations( + "standard", + {"model_calls": 4, "history_days": 30, "ratios_basis_points": {"tool_invocations": 10_000}}, + None, + ) + + receipt = benchmark._publication_receipt("standard", scale, base) + + assert receipt["planner_operation_class"] == "append_safe_small" + assert receipt["postconditions"]["identity_bindings"] is True + assert receipt["postconditions"]["independent_oracle"].endswith("fold_lifecycle") + assert receipt["publication_chain"]["direct_child_chain"] is True + assert receipt["recovery_report"]["failed_operations"] == () + assert receipt["recovery_probe"]["first_recovery_reconciled"] == ( + "recovery:ck07r1:standard:prepared-crash", + ) + assert receipt["recovery_probe"]["retry_reconciled"] == () + assert receipt["postconditions"]["source_occurrence_delta"] == receipt["postconditions"]["inserted_occurrences"] + assert receipt["postconditions"]["source_occurrence_ids_unique"] is True + assert receipt["postconditions"]["identity_bindings"] is True + assert receipt["planner_tail_limits"] == benchmark.FROZEN_TAIL_LIMITS + assert all( + chunk["plan_digest_before_writer"] == chunk["plan_digest_at_writer"] + and chunk["identity_bindings"]["selection_head"] + == chunk["identity_bindings"]["refresh_intent_parent"] + == chunk["identity_bindings"]["plan_parent"] + == chunk["identity_bindings"]["small_request_expected_active"] + == chunk["identity_bindings"]["pre_commit_pointer_active"] + == chunk["identity_bindings"]["committed_head_parent"] + and chunk["identity_bindings"]["post_commit_pointer_active"] == chunk["publication_id"] + for chunk in receipt["publication_chain"]["chunks"] + ) + + +def _planner_intent() -> benchmark.RefreshIntent: + return benchmark.RefreshIntent( + parent_publication_id="publication:parent", + parent_observed_at_us=1_800_000_000_000_000, + planned_at_us=1_800_000_000_000_001, + history_preset="30_days", + current_history_preset="30_days", + ) + + +def test_standard_profile_1369_records_routes_large_with_exact_reason() -> None: + observations = benchmark._scale_observations( + "standard", benchmark._profile("standard"), 30 + ) + assert len(observations) == 1_369 + plan = benchmark.plan_refresh( + benchmark._changes(observations), + _planner_intent(), + limits=benchmark._tail_limits(), + ) + + assert plan.operation_class is benchmark.OperationClass.APPEND_SAFE_LARGE + assert plan.estimate.selected_records == 1_369 + assert plan.estimate.expected_wal_bytes == 11_214_848 + assert plan.reasons == ("limit_exceeded:selected_records",) + + +def test_production_first_chunk_is_large_for_selected_records_and_wal() -> None: + observations = benchmark._scale_observations( + "production", benchmark._profile("production"), None + )[: benchmark.PUBLICATION_CHUNK_OBSERVATIONS] + plan = benchmark.plan_refresh( + benchmark._changes(observations), + _planner_intent(), + limits=benchmark._tail_limits(), + ) + + assert plan.operation_class is benchmark.OperationClass.APPEND_SAFE_LARGE + assert "limit_exceeded:selected_records" in plan.reasons + assert "limit_exceeded:expected_wal_bytes" in plan.reasons + assert plan.estimate.selected_records > benchmark.FROZEN_TAIL_LIMITS["selected_records"] + assert plan.estimate.expected_wal_bytes > benchmark.FROZEN_TAIL_LIMITS["expected_wal_bytes"] + + +@pytest.mark.parametrize( + ("record_count", "operation_class", "reasons"), + [ + (32, benchmark.OperationClass.APPEND_SAFE_SMALL, ("all_small_tail_bounds_proven",)), + (33, benchmark.OperationClass.APPEND_SAFE_LARGE, ("limit_exceeded:selected_records",)), + ], +) +def test_selected_record_boundary_preserves_planner_class_and_reason( + record_count: int, + operation_class: benchmark.OperationClass, + reasons: tuple[str, ...], +) -> None: + observations = benchmark._scale_observations( + "standard", + {"model_calls": 32, "history_days": 30, "ratios_basis_points": {"tool_invocations": 10_000}}, + None, + )[:record_count] + plan = benchmark.plan_refresh( + benchmark._changes(observations), + _planner_intent(), + limits=benchmark._tail_limits(), + ) + + assert plan.operation_class is operation_class + assert plan.reasons == reasons + assert benchmark._validate_selected_plan(plan, _planner_intent(), benchmark._tail_limits()) == ( + () if record_count == 32 else ("selected_records",) + ) + + +def test_mixed_receipt_reports_large_promotion_then_small_pointer_path( + monkeypatch: pytest.MonkeyPatch, +) -> None: + root = Path(__file__).resolve().parents[3] + base = ingest( + root / "tests" / "agent_kernel" / "fixtures" / "tiny-v1", + manifest=root / "tests" / "agent_kernel" / "fixtures" / "tiny-v1" / "manifest.json", + workers=1, + batch_size=32, + ).changes + scale = benchmark._scale_observations( + "standard", + {"model_calls": 40, "history_days": 30, "ratios_basis_points": {"tool_invocations": 10_000}}, + None, + )[:65] + monkeypatch.setattr(benchmark, "PUBLICATION_CHUNK_OBSERVATIONS", 33) + + receipt = benchmark._publication_receipt("standard", scale, base) + chunks = receipt["publication_chain"]["chunks"] + + assert receipt["planner_operation_classes"] == [ + "append_safe_large", + "append_safe_small", + ] + assert receipt["writer_paths"] == [ + "large_isolated_artifact_build_validate_promote", + "small_pointer_coordinated", + ] + assert chunks[0]["large_artifact"]["file_sha256"] + assert chunks[0]["large_artifact"]["rollback_artifact_name"] + assert chunks[0]["identity_bindings"]["promotion_request_expected_active"] == ( + chunks[0]["identity_bindings"]["writer_request_expected_active"] + ) + assert chunks[1]["identity_bindings"]["small_request_expected_active"] == ( + chunks[1]["identity_bindings"]["writer_request_expected_active"] + ) + assert receipt["postconditions"]["identity_bindings"] is True + assert receipt["publication_chain"]["direct_child_chain"] is True + + +def test_plan_mutations_and_missing_large_evidence_fail_closed( + tmp_path: Path, +) -> None: + observations = benchmark._scale_observations( + "standard", benchmark._profile("standard"), 30 + ) + intent = _planner_intent() + limits = benchmark._tail_limits() + plan = benchmark.plan_refresh(benchmark._changes(observations), intent, limits=limits) + + with pytest.raises(AssertionError, match="APPEND_SAFE_SMALL"): + benchmark._validate_selected_plan( + replace(plan, operation_class=benchmark.OperationClass.APPEND_SAFE_SMALL), + intent, + limits, + ) + with pytest.raises(ValueError, match="non-authoritative TailLimits"): + benchmark._validate_selected_plan(plan, intent, replace(limits, selected_records=99)) + + writer = benchmark._RecordingWriter(None, plan, []) + with pytest.raises(AssertionError, match="different plan object"): + writer.publish(replace(plan, reasons=("substituted",)), _request("publication:drift"), object()) + + candidate_path = tmp_path / "candidate.sqlite3" + candidate_path.write_bytes(b"synthetic-candidate") + candidate = type( + "Candidate", + (), + { + "path": candidate_path, + "publication_id": "publication:missing-evidence", + "artifact_manifest_sha256": "0" * 64, + "file_sha256": None, + }, + )() + with pytest.raises(AssertionError, match="evidence is missing"): + benchmark._validate_large_artifact_evidence( + candidate, + _request("publication:missing-evidence"), + ) + + +def test_launch_output_preflight_is_exclusive_and_non_overwriting(tmp_path: Path) -> None: + (tmp_path / "output" / "ck07r1").mkdir(parents=True) + + paths = benchmark._preflight_launch_paths(tmp_path) + + assert paths["output"].relative_to(tmp_path) == benchmark.RUN_OUTPUT_RELATIVE + assert all( + "lifecycle-requalification-v2" in str(path) + for path in ( + benchmark.RUN_OUTPUT_RELATIVE, + benchmark.RUN_LEDGER_RELATIVE, + benchmark.RUN_STDOUT_RELATIVE, + benchmark.RUN_STDERR_RELATIVE, + ) + ) + assert "lifecycle-requalification-v1" in str(benchmark.PRESERVED_V1_LEDGER_RELATIVE) + benchmark._exclusive_write(paths["ledger"], b'{"token":true}\n') + with pytest.raises(FileExistsError): + benchmark._exclusive_write(paths["ledger"], b'{"token":false}\n') + assert paths["ledger"].read_bytes() == b'{"token":true}\n' + + paths["output"].write_bytes(b"existing\n") + with pytest.raises(FileExistsError, match="refusing overwrite"): + benchmark._preflight_launch_paths(tmp_path) + + +def test_atomic_json_update_uses_unique_same_directory_temps( + tmp_path: Path, monkeypatch: pytest.MonkeyPatch +) -> None: + path = tmp_path / "ledger.json" + replacements: list[tuple[Path, Path]] = [] + real_replace = benchmark.os.replace + + def replace(source: Path, destination: Path) -> None: + replacements.append((Path(source), Path(destination))) + real_replace(source, destination) + + monkeypatch.setattr(benchmark.os, "replace", replace) + + benchmark._atomic_json_update(path, {"state": "first"}) + benchmark._atomic_json_update(path, {"state": "second"}) + + assert len(replacements) == 2 + temporary_paths = [source for source, _destination in replacements] + assert len(set(temporary_paths)) == 2 + assert all(source.parent == path.parent for source in temporary_paths) + assert all(source.name.startswith(f".{path.name}.") for source in temporary_paths) + assert all(source.name.endswith(".tmp") for source in temporary_paths) + assert path.read_text(encoding="utf-8") == '{"state":"second"}\n' + assert list(path.parent.glob(f".{path.name}.*.tmp")) == [] + + +@pytest.mark.parametrize( + ("failure_kind", "expected_exception"), + [ + ("write", OSError), + ("file_fsync", OSError), + ("replace", OSError), + ("directory_fsync", OSError), + ("interrupt", KeyboardInterrupt), + ], +) +def test_atomic_json_update_cleans_temps_on_failure( + failure_kind: str, + expected_exception: type[BaseException], + tmp_path: Path, + monkeypatch: pytest.MonkeyPatch, +) -> None: + path = tmp_path / "ledger.json" + real_fsync = benchmark.os.fsync + fsync_calls = 0 + + if failure_kind in {"write", "interrupt"}: + def fail_write(_fd: int, _data: bytes) -> int: + if failure_kind == "interrupt": + raise KeyboardInterrupt + raise OSError("synthetic atomic write failure") + + monkeypatch.setattr(benchmark.os, "write", fail_write) + elif failure_kind == "file_fsync": + monkeypatch.setattr( + benchmark.os, + "fsync", + lambda _fd: (_ for _ in ()).throw(OSError("synthetic file fsync failure")), + ) + elif failure_kind == "replace": + monkeypatch.setattr( + benchmark.os, + "replace", + lambda _source, _destination: (_ for _ in ()).throw( + OSError("synthetic replace failure") + ), + ) + else: + def fail_directory_fsync(fd: int) -> None: + nonlocal fsync_calls + fsync_calls += 1 + if fsync_calls == 2: + raise OSError("synthetic directory fsync failure") + real_fsync(fd) + + monkeypatch.setattr(benchmark.os, "fsync", fail_directory_fsync) + + with pytest.raises(expected_exception): + benchmark._atomic_json_update(path, {"state": failure_kind}) + + assert list(path.parent.glob(f".{path.name}.*.tmp")) == [] + + +def test_atomic_json_update_cleans_consumed_temp_after_replace_interruption( + tmp_path: Path, monkeypatch: pytest.MonkeyPatch +) -> None: + path = tmp_path / "ledger.json" + real_replace = benchmark.os.replace + + def replace_then_interrupt(source: Path, destination: Path) -> None: + real_replace(source, destination) + raise InterruptedError("synthetic interruption after replace") + + monkeypatch.setattr(benchmark.os, "replace", replace_then_interrupt) + + with pytest.raises(InterruptedError): + benchmark._atomic_json_update(path, {"state": "replaced"}) + + assert json.loads(path.read_text(encoding="utf-8")) == {"state": "replaced"} + assert list(path.parent.glob(f".{path.name}.*.tmp")) == [] + + +def test_matching_process_check_requires_exact_owner_argv_and_cwd( + tmp_path: Path, monkeypatch: pytest.MonkeyPatch +) -> None: + expected = benchmark.LAUNCH_COMMAND + candidate_argv = [ + "/opt/homebrew/.../Resources/Python", + *expected[1:], + ] + candidate_command = benchmark.shlex.join(candidate_argv) + candidate_signature = benchmark._platform_process_signature(candidate_command) + parent_argv = [str(tmp_path / ".venv" / "bin" / "python"), *expected[1:]] + parent_command = benchmark.shlex.join(parent_argv) + parent_signature = benchmark._platform_process_signature(parent_command) + monkeypatch.setattr( + benchmark, + "_process_snapshot", + lambda: [ + { + "pid": 123, + "parent_pid": 1, + "user": "synthetic-owner", + "argv": candidate_argv, + "command": candidate_command, + "platform_signature": candidate_signature, + } + ], + ) + monkeypatch.setattr(benchmark, "_process_cwd", lambda _pid: tmp_path.resolve()) + verified_parent_snapshot = { + "pid": 999, + "parent_pid": 1, + "user": "synthetic-owner", + "argv": parent_argv, + "command": parent_command, + "platform_signature": parent_signature, + "cwd": str(tmp_path.resolve()), + } + + matches = benchmark._matching_processes( + expected, + tmp_path, + owner="synthetic-owner", + exclude_pids=(), + verified_parent_snapshot=verified_parent_snapshot, + ) + assert matches[0]["pid"] == 123 + assert matches[0]["platform_signature"] == candidate_signature + assert candidate_signature != parent_signature + assert benchmark._matching_processes( + expected, + tmp_path, + owner="synthetic-owner", + exclude_pids=(123,), + verified_parent_snapshot=verified_parent_snapshot, + ) == [] + + +@pytest.mark.parametrize( + ("mutation", "message"), + [ + ("wrong-owner", "owner"), + ("wrong-argv", "argv"), + ("missing-command", "command snapshot"), + ("wrong-pid", "missing or ambiguous"), + ("ambiguous", "missing or ambiguous"), + ("unreadable-cwd", "cwd"), + ], +) +def test_verified_parent_snapshot_rejects_identity_drift( + mutation: str, + message: str, + tmp_path: Path, + monkeypatch: pytest.MonkeyPatch, +) -> None: + expected = benchmark.LAUNCH_COMMAND + platform_argv = [ + "/opt/homebrew/.../Resources/Python", + *expected[1:], + ] + platform_command = benchmark.shlex.join(platform_argv) + process: dict[str, Any] = { + "pid": 123, + "parent_pid": 1, + "user": "synthetic-owner", + "argv": platform_argv, + "command": platform_command, + "platform_signature": benchmark._platform_process_signature(platform_command), + } + expected_owner = "synthetic-owner" + if mutation == "wrong-owner": + process["user"] = "other-owner" + elif mutation == "wrong-argv": + process["argv"] = [*platform_argv, "--drift"] + process["command"] = benchmark.shlex.join(process["argv"]) + process["platform_signature"] = benchmark._platform_process_signature( + process["command"] + ) + elif mutation == "missing-command": + process.pop("command") + elif mutation == "wrong-pid": + process["pid"] = 456 + elif mutation == "unreadable-cwd": + monkeypatch.setattr(benchmark, "_process_cwd", lambda _pid: None) + processes = [process, process.copy()] if mutation == "ambiguous" else [process] + monkeypatch.setattr(benchmark, "_process_snapshot", lambda: processes) + if mutation != "unreadable-cwd": + monkeypatch.setattr(benchmark, "_process_cwd", lambda _pid: tmp_path.resolve()) + + with pytest.raises(RuntimeError, match=message): + benchmark._capture_verified_parent_process_snapshot( + 123, expected, tmp_path, expected_owner + ) + + +def test_non_consuming_dummy_process_snapshot_proof(tmp_path: Path) -> None: + process = subprocess.Popen( + [sys.executable, "-c", "import time; time.sleep(2)"], + cwd=tmp_path, + stdout=subprocess.DEVNULL, + stderr=subprocess.DEVNULL, + ) + try: + deadline = time.monotonic() + 2.0 + observed: dict[str, Any] | None = None + while time.monotonic() < deadline: + observed = next( + (item for item in benchmark._process_snapshot() if item["pid"] == process.pid), + None, + ) + if observed is not None: + break + time.sleep(0.02) + if observed is None: + pytest.fail("dummy process did not appear in the platform snapshot") + assert observed["platform_signature"] == benchmark._platform_process_signature( + observed["command"] + ) + verified = benchmark._capture_verified_parent_process_snapshot( + process.pid, + tuple(observed["argv"]), + tmp_path, + observed["user"], + ) + assert verified["pid"] == process.pid + assert verified["cwd"] == str(tmp_path.resolve()) + finally: + process.terminate() + process.wait(timeout=2) + + +def _contract_fixture( + tmp_path: Path, + monkeypatch: pytest.MonkeyPatch, + *, + executable: Path, + prefix: Path, + base_prefix: Path, +) -> Path: + root = tmp_path / "worktree" + (root / ".venv" / "bin").mkdir(parents=True) + (root / ".venv" / "bin" / "python").write_text("", encoding="utf-8") + (root / "pyproject.toml").write_text("[build-system]\n", encoding="utf-8") + monkeypatch.setattr(benchmark, "ROOT", root) + monkeypatch.setattr(sys, "executable", str(executable)) + monkeypatch.setattr(sys, "prefix", str(prefix)) + monkeypatch.setattr(sys, "base_prefix", str(base_prefix)) + monkeypatch.setattr(sys, "argv", list(benchmark.LAUNCH_COMMAND[1:])) + monkeypatch.setattr( + benchmark, + "_preflight_launch_paths", + lambda _root: { + "output": root / "output.json", + "ledger": root / "ledger.json", + "stdout": root / "stdout.txt", + "stderr": root / "stderr.txt", + }, + ) + platform_argv = [ + "/opt/homebrew/.../Resources/Python", + *benchmark.LAUNCH_COMMAND[1:], + ] + platform_command = benchmark.shlex.join(platform_argv) + monkeypatch.setattr( + benchmark, + "_capture_verified_parent_process_snapshot", + lambda *_args, **_kwargs: { + "pid": benchmark.os.getpid(), + "parent_pid": 1, + "user": benchmark.getpass.getuser(), + "argv": platform_argv, + "command": platform_command, + "platform_signature": benchmark._platform_process_signature(platform_command), + "cwd": str(root.resolve()), + }, + ) + monkeypatch.setattr(benchmark, "_matching_processes", lambda *_args, **_kwargs: []) + monkeypatch.setattr(benchmark, "_fixture_identity", lambda: {"synthetic": True}) + monkeypatch.setattr(benchmark, "_disk_available_bytes", lambda _root: 1) + for name, value in benchmark.LAUNCH_ENVIRONMENT.items(): + monkeypatch.setenv(name, value) + for name in benchmark.FORBIDDEN_ENVIRONMENT: + monkeypatch.delenv(name, raising=False) + return root + + +def test_launch_contract_accepts_only_lexical_worktree_venv( + tmp_path: Path, monkeypatch: pytest.MonkeyPatch +) -> None: + root = tmp_path / "worktree" + executable = root / ".venv" / "bin" / "python" + _contract_fixture( + tmp_path, + monkeypatch, + executable=executable, + prefix=root / ".venv", + base_prefix=tmp_path / "base", + ) + + launch = benchmark._verify_launch_contract(root) + + assert launch["interpreter"] == str(executable) + assert launch["venv_prefix"] == str(root / ".venv") + + +def test_launch_contract_rejects_duplicate_platform_signature_matches( + tmp_path: Path, monkeypatch: pytest.MonkeyPatch +) -> None: + root = tmp_path / "worktree" + executable = root / ".venv" / "bin" / "python" + _contract_fixture( + tmp_path, + monkeypatch, + executable=executable, + prefix=root / ".venv", + base_prefix=tmp_path / "base", + ) + monkeypatch.setattr( + benchmark, + "_matching_processes", + lambda *_args, **_kwargs: [ + {"pid": 456, "platform_signature": "same"}, + {"pid": 789, "platform_signature": "same"}, + ], + ) + + with pytest.raises(RuntimeError, match="matching launch process already exists"): + benchmark._verify_launch_contract(root) + + +def test_launch_contract_rejects_ambiguous_alternate_argv0_matches( + tmp_path: Path, monkeypatch: pytest.MonkeyPatch +) -> None: + root = tmp_path / "worktree" + executable = root / ".venv" / "bin" / "python" + real_matching_processes = benchmark._matching_processes + _contract_fixture( + tmp_path, + monkeypatch, + executable=executable, + prefix=root / ".venv", + base_prefix=tmp_path / "base", + ) + monkeypatch.setattr(benchmark, "_matching_processes", real_matching_processes) + argv0s = ( + "/opt/homebrew/.../Resources/Python", + str(executable), + ) + processes = [] + for pid, argv0 in zip((456, 789), argv0s, strict=True): + argv = [argv0, *benchmark.LAUNCH_COMMAND[1:]] + command = benchmark.shlex.join(argv) + processes.append( + { + "pid": pid, + "parent_pid": 1, + "user": benchmark.getpass.getuser(), + "argv": argv, + "command": command, + "platform_signature": benchmark._platform_process_signature(command), + } + ) + monkeypatch.setattr(benchmark, "_process_snapshot", lambda: processes) + monkeypatch.setattr(benchmark, "_process_cwd", lambda _pid: root.resolve()) + + with pytest.raises(RuntimeError, match="matching launch process already exists"): + benchmark._verify_launch_contract(root) + + +@pytest.mark.parametrize( + ("case", "executable_kind", "prefix_kind", "base_kind", "message"), + [ + ("base-interpreter", "base", "expected", "base", "lexical"), + ("resolved-equivalent-symlink", "symlink", "expected", "base", "lexical"), + ("wrong-worktree", "other-worktree", "other", "base", "lexical"), + ("prefix-mismatch", "expected", "other", "base", "sys.prefix"), + ("base-prefix-equality", "expected", "expected", "expected", "running inside"), + ], +) +def test_launch_contract_rejects_interpreter_identity_tricks( + case: str, + executable_kind: str, + prefix_kind: str, + base_kind: str, + message: str, + tmp_path: Path, + monkeypatch: pytest.MonkeyPatch, +) -> None: + root = tmp_path / "worktree" + expected = root / ".venv" / "bin" / "python" + other_root = tmp_path / "other-worktree" + (other_root / ".venv" / "bin").mkdir(parents=True) + other_executable = other_root / ".venv" / "bin" / "python" + other_executable.write_text("", encoding="utf-8") + base = tmp_path / "base-python" + base.write_text("", encoding="utf-8") + if executable_kind == "symlink": + symlink = tmp_path / "base-python-symlink" + symlink.symlink_to(expected) + executable = symlink + elif executable_kind == "other-worktree": + executable = other_executable + elif executable_kind == "base": + executable = base + else: + executable = expected + prefix = { + "expected": root / ".venv", + "other": other_root / ".venv", + }[prefix_kind] + base_prefix = { + "expected": root / ".venv", + "base": base, + }[base_kind] + _contract_fixture( + tmp_path, + monkeypatch, + executable=executable, + prefix=prefix, + base_prefix=base_prefix, + ) + + with pytest.raises(RuntimeError, match=message): + benchmark._verify_launch_contract(root) + + +def _overlay_test_authority(state: str = "worker_prequalification") -> dict[str, Any]: + return { + "schema": benchmark.SHARED_OVERLAY_SCHEMA, + "authority_version": 1, + "authority_base_sha": "cf44f4fdd3f54ad53263b5e744203be468fbe5ca", + "status": "permitted_not_accepted", + "states": { + "successor": { + "status": "permitted_not_accepted", + "runtime_acceptance": "not_claimed", + "launch_authorized": False, + "artifacts": [ + { + "path": "src/codex_usage_tracker/agent_kernel/publication/preparation.py", + "sha256": "a" * 64, + "presence": "required", + }, + { + "path": "scripts/benchmark_ck07r1_lifecycle_scale.py", + "sha256": "b" * 64, + "presence": "required", + }, + { + "path": "tests/agent_kernel/publication/test_lifecycle_scale.py", + "sha256": "c" * 64, + "presence": "required", + }, + ], + } + }, + "non_consuming_invariants": { + "maximum_new_end_to_end_runs": 1, + "token_status": "unspent_unavailable", + "token_consumed": False, + "matching_processes": [], + "successful_child": "absent", + "pid": "absent", + "handshake": "absent", + "runtime_acceptance": "not_claimed", + "receipt": "absent_non_qualifying", + "output": "absent", + "ledger": "absent", + "stdout": "absent", + "stderr": "absent", + "retry": "none", + "restart": "none", + "replacement": "none", + }, + } + + +def _overlay_test_root(tmp_path: Path) -> None: + for relative in ( + benchmark.SHARED_OVERLAY_AUTHORITY_RELATIVE, + benchmark.SHARED_OVERLAY_SCHEMA_RELATIVE, + benchmark.SHARED_OVERLAY_VERIFIER_RELATIVE, + ): + path = tmp_path / relative + path.parent.mkdir(parents=True, exist_ok=True) + path.write_text("{}", encoding="utf-8") + + +def _recovery_test_root(tmp_path: Path) -> tuple[Path, dict[str, Any]]: + for relative in ( + benchmark.PRESERVED_V1_LEDGER_RELATIVE, + Path("src/codex_usage_tracker/agent_kernel/publication/preparation.py"), + Path("scripts/benchmark_ck07r1_lifecycle_scale.py"), + Path("tests/agent_kernel/publication/test_lifecycle_scale.py"), + *benchmark.HISTORICAL_SHARED_OVERLAY_RELATIVES, + ): + source = benchmark.ROOT / relative + target = tmp_path / relative + target.parent.mkdir(parents=True, exist_ok=True) + target.write_bytes(source.read_bytes()) + for relative in ( + benchmark.PRELAUNCH_RECOVERY_AUTHORITY_RELATIVE, + benchmark.PRELAUNCH_RECOVERY_SCHEMA_RELATIVE, + ): + path = tmp_path / relative + path.parent.mkdir(parents=True, exist_ok=True) + path.write_text("{}", encoding="utf-8") + authority = { + "schema": benchmark.PRELAUNCH_RECOVERY_SCHEMA, + "authority_version": 1, + "status": "permitted_not_accepted", + "decision": { + "launch_authorized_in_authority_task": False, + "implementation_acceptance": "not_claimed", + "runtime_acceptance": "not_claimed", + }, + "recovery_transition": { + "old_shared_overlay": "immutable_historical_predecessor_evidence", + "live_corrected_cohort_authority": "this_versioned_recovery_authority_only", + "launched_process_retry": False, + "restart": False, + "replacement": False, + "refund": False, + }, + "immutable_authorities": [ + { + "path": str(relative), + "sha256": benchmark._sha256(tmp_path / relative), + } + for relative in benchmark.HISTORICAL_SHARED_OVERLAY_RELATIVES + ], + "preserved_v1_ledger": benchmark._preserved_v1_ledger_identity(tmp_path), + "candidate_cohort": benchmark._candidate_cohort(tmp_path), + "v2_paths": { + "output": str(benchmark.RUN_OUTPUT_RELATIVE), + "ledger": str(benchmark.RUN_LEDGER_RELATIVE), + "stdout": str(benchmark.RUN_STDOUT_RELATIVE), + "stderr": str(benchmark.RUN_STDERR_RELATIVE), + }, + "run_token": { + "id": benchmark.RUN_TOKEN_ID, + "maximum_new_end_to_end_runs": 1, + "status": benchmark.RUN_TOKEN_STATUS, + "token_consumed": False, + "refund": False, + "retry": "none", + "restart": "none", + "replacement": "none", + "successful_launches_observed": 0, + "new_recovery_invocations_permitted": 1, + }, + } + return tmp_path, authority + + +class _RecoveryVerifier: + authority: dict[str, Any] + + @classmethod + def verify_prelaunch_recovery(cls, _root: Path) -> tuple[dict[str, Any], str]: + return cls.authority, "prelaunch_recovery_verified" + + +def test_prelaunch_recovery_verification_binds_v1_witness_cohort_and_v2_paths( + tmp_path: Path, +) -> None: + root, authority = _recovery_test_root(tmp_path) + _RecoveryVerifier.authority = authority + + result = benchmark._verify_prelaunch_recovery(root, verifier=_RecoveryVerifier) + + assert result["state"] == "prelaunch_recovery_verified" + assert result["preserved_v1_ledger"]["sha256"] == ( + benchmark.PRESERVED_V1_LEDGER_SHA256 + ) + assert result["preserved_v1_ledger"]["token_consumed"] is False + assert result["preserved_v1_ledger"]["matching_processes"] == [] + assert result["candidate_cohort"] == authority["candidate_cohort"] + assert result["v2_paths"] == authority["v2_paths"] + assert result["historical_shared_overlay"] == authority["immutable_authorities"] + + +@pytest.mark.parametrize( + "binding", + ["preserved_v1_ledger", "candidate_cohort", "v2_paths", "immutable_authorities"], +) +def test_prelaunch_recovery_rejects_binding_drift( + binding: str, tmp_path: Path +) -> None: + root, authority = _recovery_test_root(tmp_path) + authority = copy.deepcopy(authority) + if binding == "preserved_v1_ledger": + authority[binding]["token_consumed"] = True + elif binding == "candidate_cohort": + authority[binding][1]["sha256"] = "0" * 64 + elif binding == "v2_paths": + authority[binding]["ledger"] = "output/ck07r1/other.launch-token.json" + else: + authority[binding][0]["sha256"] = "0" * 64 + _RecoveryVerifier.authority = authority + + with pytest.raises(RuntimeError, match="binding drifted"): + benchmark._verify_prelaunch_recovery(root, verifier=_RecoveryVerifier) + + +def test_prelaunch_recovery_requires_merged_authority_and_verifier(tmp_path: Path) -> None: + class UnusedVerifier: + @staticmethod + def verify_prelaunch_recovery(_root: Path) -> tuple[dict[str, Any], str]: + pytest.fail("verifier must not run without authority/schema files") + + with pytest.raises(RuntimeError, match="authority/schema"): + benchmark._verify_prelaunch_recovery(tmp_path, verifier=UnusedVerifier()) + + +def test_overlay_verification_rejects_unauthorized_live_state(tmp_path: Path) -> None: + _overlay_test_root(tmp_path) + + class UnauthorizedVerifier: + @staticmethod + def verify_shared_successor_overlay(_root: Path) -> tuple[dict[str, Any], str]: + return _overlay_test_authority(), "authority_main" + + with pytest.raises(RuntimeError, match="worker_prequalification"): + benchmark._verify_overlay_cohort(tmp_path, verifier=UnauthorizedVerifier()) + + +def test_overlay_verification_rejects_mixed_cohort(tmp_path: Path) -> None: + _overlay_test_root(tmp_path) + + class MixedVerifier: + @staticmethod + def verify_shared_successor_overlay(_root: Path) -> tuple[dict[str, Any], str]: + raise ValueError("mixed, partial, historical, or unbound CK-07R1 cohort") + + with pytest.raises(RuntimeError, match="mixed, partial"): + benchmark._verify_overlay_cohort(tmp_path, verifier=MixedVerifier()) + + +def test_old_overlay_cannot_authorize_corrected_cohort_without_recovery( + tmp_path: Path, monkeypatch: pytest.MonkeyPatch +) -> None: + paths = { + name: tmp_path / f"{name}.json" + for name in ("output", "ledger", "stdout", "stderr") + } + monkeypatch.setattr( + benchmark, + "_verify_launch_contract", + lambda: {"paths": paths}, + ) + monkeypatch.setattr( + benchmark, + "_verify_overlay_cohort", + lambda: {"schema": benchmark.SHARED_OVERLAY_SCHEMA, "state": "worker_prequalification"}, + ) + monkeypatch.setattr( + benchmark, + "_verify_prelaunch_recovery", + lambda: (_ for _ in ()).throw(ValueError("recovery authority rejected corrected cohort")), + ) + exclusive_writes: list[Path] = [] + monkeypatch.setattr( + benchmark, + "_exclusive_write", + lambda path, _data: exclusive_writes.append(path), + ) + monkeypatch.setattr( + benchmark.os, + "fork", + lambda: pytest.fail("fork must not occur before recovery verification"), + ) + + with pytest.raises(ValueError, match="recovery authority rejected"): + benchmark._launch_exact() + + assert exclusive_writes == [] + assert all(not path.exists() for path in paths.values()) + + +def test_prelaunch_recovery_verification_precedes_ledger_fork_and_token_side_effects( + tmp_path: Path, monkeypatch: pytest.MonkeyPatch +) -> None: + paths = { + name: tmp_path / f"{name}.json" + for name in ("output", "ledger", "stdout", "stderr") + } + monkeypatch.setattr( + benchmark, + "_verify_launch_contract", + lambda: {"paths": paths}, + ) + monkeypatch.setattr( + benchmark, + "_verify_overlay_cohort", + lambda: pytest.fail("old overlay must not be a live corrected-cohort gate"), + ) + monkeypatch.setattr( + benchmark, + "_verify_prelaunch_recovery", + lambda: (_ for _ in ()).throw(ValueError("recovery witness rejected")), + ) + exclusive_writes: list[Path] = [] + monkeypatch.setattr( + benchmark, + "_exclusive_write", + lambda path, _data: exclusive_writes.append(path), + ) + monkeypatch.setattr( + benchmark.os, + "fork", + lambda: pytest.fail("fork must not occur before recovery verification"), + ) + + with pytest.raises(ValueError, match="recovery witness rejected"): + benchmark._launch_exact() + + assert exclusive_writes == [] + assert all(not path.exists() for path in paths.values()) + + +def _fake_launch_contract(tmp_path: Path) -> dict[str, Any]: + return { + "argv": list(benchmark.LAUNCH_COMMAND), + "cwd": str(tmp_path.resolve()), + "owner": "synthetic-owner", + "interpreter": "synthetic-python", + "venv_prefix": str(tmp_path / ".venv"), + "base_prefix": "synthetic-base-python", + "environment": dict(benchmark.LAUNCH_ENVIRONMENT), + "output_path": str(benchmark.RUN_OUTPUT_RELATIVE), + "fixture_identity": {}, + "disk_available_bytes_before_launch": 1, + "matching_processes": [], + "paths": { + "output": tmp_path / "output.json", + "ledger": tmp_path / "ledger.json", + "stdout": tmp_path / "stdout.txt", + "stderr": tmp_path / "stderr.txt", + }, + } + + +def _patch_fake_process_boundary( + launch: dict[str, Any], tmp_path: Path, monkeypatch: pytest.MonkeyPatch +) -> None: + platform_argv = [ + "/opt/homebrew/.../Resources/Python", + *benchmark.LAUNCH_COMMAND[1:], + ] + platform_command = benchmark.shlex.join(platform_argv) + snapshot = { + "pid": benchmark.os.getpid(), + "parent_pid": 1, + "user": "synthetic-owner", + "argv": platform_argv, + "command": platform_command, + "platform_signature": benchmark._platform_process_signature(platform_command), + "cwd": str(tmp_path.resolve()), + } + launch["verified_parent_process_snapshot"] = snapshot + monkeypatch.setattr( + benchmark, + "_capture_verified_parent_process_snapshot", + lambda *_args, **_kwargs: snapshot, + ) + monkeypatch.setattr(benchmark, "_matching_processes", lambda *_args, **_kwargs: []) + + +@pytest.mark.parametrize("failure_point", ["token_persistence", "child_release"]) +def test_post_launch_exceptions_are_never_classified_prelaunch_failed( + failure_point: str, + tmp_path: Path, + monkeypatch: pytest.MonkeyPatch, +) -> None: + launch = _fake_launch_contract(tmp_path) + _patch_fake_process_boundary(launch, tmp_path, monkeypatch) + paths = launch["paths"] + for path in paths.values(): + path.parent.mkdir(parents=True, exist_ok=True) + monkeypatch.setattr(benchmark, "_verify_launch_contract", lambda: launch) + monkeypatch.setattr(benchmark, "_verify_prelaunch_recovery", lambda: {"verification": "passed"}) + monkeypatch.setattr(benchmark.os, "pipe", lambda: (10, 11)) + monkeypatch.setattr(benchmark.os, "fork", lambda: 123) + monkeypatch.setattr(benchmark.os, "close", lambda _fd: None) + monkeypatch.setattr(benchmark, "_reap_child", lambda _pid: None) + monkeypatch.setattr( + benchmark, + "_observe_child_start", + lambda _pid, _launch, parent_pid: { + "pid": 123, + "parent_pid": parent_pid, + "user": "synthetic-owner", + "argv": list(benchmark.LAUNCH_COMMAND), + "cwd": str(tmp_path.resolve()), + }, + ) + real_update = benchmark._ledger_update + update_calls = 0 + + def update(path: Path, value: dict[str, Any]) -> None: + nonlocal update_calls + update_calls += 1 + if failure_point == "token_persistence" and update_calls == 1: + raise OSError("synthetic token persistence failure") + real_update(path, value) + + monkeypatch.setattr(benchmark, "_ledger_update", update) + if failure_point == "child_release": + real_write = benchmark.os.write + + def fail_child_release(fd: int, data: bytes) -> int: + if fd == 11: + raise OSError("synthetic child release failure") + return real_write(fd, data) + + monkeypatch.setattr( + benchmark.os, + "write", + fail_child_release, + ) + + with pytest.raises(OSError): + benchmark._launch_exact() + + persisted = json.loads(paths["ledger"].read_text(encoding="utf-8")) + assert persisted["state"] == "failed_after_launch" + assert persisted["token_consumed"] is True + assert persisted["failure"]["stage"] == "post_launch_handshake" + assert persisted["state"] != "prelaunch_failed" + + +def test_initial_token_persistence_failure_is_terminal_and_leaves_no_temp( + tmp_path: Path, monkeypatch: pytest.MonkeyPatch +) -> None: + launch = _fake_launch_contract(tmp_path) + _patch_fake_process_boundary(launch, tmp_path, monkeypatch) + paths = launch["paths"] + for path in paths.values(): + path.parent.mkdir(parents=True, exist_ok=True) + monkeypatch.setattr(benchmark, "_verify_launch_contract", lambda: launch) + monkeypatch.setattr(benchmark, "_verify_prelaunch_recovery", lambda: {"verification": "passed"}) + monkeypatch.setattr(benchmark.os, "pipe", lambda: (10, 11)) + monkeypatch.setattr(benchmark.os, "fork", lambda: 123) + monkeypatch.setattr(benchmark.os, "close", lambda _fd: None) + monkeypatch.setattr(benchmark, "_reap_child", lambda _pid: None) + monkeypatch.setattr( + benchmark, + "_observe_child_start", + lambda _pid, _launch, parent_pid: { + "pid": 123, + "parent_pid": parent_pid, + "user": "synthetic-owner", + "argv": list(benchmark.LAUNCH_COMMAND), + "cwd": str(tmp_path.resolve()), + }, + ) + real_replace = benchmark.os.replace + replace_calls = 0 + + def fail_initial_replace(source: Path, destination: Path) -> None: + nonlocal replace_calls + replace_calls += 1 + if replace_calls == 1: + raise OSError("synthetic initial token persistence failure") + real_replace(source, destination) + + monkeypatch.setattr(benchmark.os, "replace", fail_initial_replace) + + with pytest.raises(OSError, match="synthetic initial token persistence failure"): + benchmark._launch_exact() + + persisted = json.loads(paths["ledger"].read_text(encoding="utf-8")) + assert persisted["state"] == "failed_after_launch" + assert persisted["token_consumed"] is True + assert persisted["retry_allowed"] is False + assert persisted["restart_allowed"] is False + assert persisted["replacement_allowed"] is False + assert replace_calls == 2 + assert list(paths["ledger"].parent.glob(f".{paths['ledger'].name}.*.tmp")) == [] + + +@pytest.mark.parametrize("failure_kind", ["keyboard_interrupt", "sigint", "sigterm", "wait_error"]) +def test_wait_interruptions_are_reaped_before_terminal_failure( + failure_kind: str, + tmp_path: Path, + monkeypatch: pytest.MonkeyPatch, +) -> None: + launch = _fake_launch_contract(tmp_path) + _patch_fake_process_boundary(launch, tmp_path, monkeypatch) + paths = launch["paths"] + for path in paths.values(): + path.parent.mkdir(parents=True, exist_ok=True) + monkeypatch.setattr(benchmark, "_verify_launch_contract", lambda: launch) + monkeypatch.setattr(benchmark, "_verify_prelaunch_recovery", lambda: {"verification": "passed"}) + monkeypatch.setattr(benchmark.os, "pipe", lambda: (10, 11)) + monkeypatch.setattr(benchmark.os, "fork", lambda: 123) + monkeypatch.setattr(benchmark.os, "close", lambda _fd: None) + real_write = benchmark.os.write + monkeypatch.setattr( + benchmark.os, + "write", + lambda fd, data: len(data) if fd == 11 else real_write(fd, data), + ) + monkeypatch.setattr( + benchmark, + "_observe_child_start", + lambda _pid, _launch, parent_pid: { + "pid": 123, + "parent_pid": parent_pid, + "user": "synthetic-owner", + "argv": list(benchmark.LAUNCH_COMMAND), + "cwd": str(tmp_path.resolve()), + }, + ) + cleanup: list[int] = [] + monkeypatch.setattr(benchmark, "_reap_child", lambda pid: cleanup.append(pid)) + sequence: list[str] = [] + real_update = benchmark._ledger_update + + def update(path: Path, value: dict[str, Any]) -> None: + sequence.append(value["state"]) + real_update(path, value) + + monkeypatch.setattr(benchmark, "_ledger_update", update) + + def wait_failure(_pid: int) -> tuple[int, int, object, bool]: + if failure_kind == "keyboard_interrupt": + raise KeyboardInterrupt + if failure_kind == "sigint": + benchmark._parent_signal_handler(signal.SIGINT, None) + if failure_kind == "sigterm": + benchmark._parent_signal_handler(signal.SIGTERM, None) + raise OSError("synthetic wait failure") + + monkeypatch.setattr(benchmark, "_wait_for_child", wait_failure) + + expected_exception = { + "keyboard_interrupt": KeyboardInterrupt, + "sigint": KeyboardInterrupt, + "sigterm": benchmark._ParentChildSignal, + "wait_error": OSError, + }[failure_kind] + with pytest.raises(expected_exception): + benchmark._launch_exact() + + persisted = json.loads(paths["ledger"].read_text(encoding="utf-8")) + assert cleanup == [123] + assert sequence[-1] == "failed_after_launch" + assert sequence.index("launched_consumed") < sequence.index("failed_after_launch") + assert persisted["state"] == "failed_after_launch" + assert persisted["token_consumed"] is True + assert persisted["retry_allowed"] is False + assert persisted["restart_allowed"] is False + assert persisted["replacement_allowed"] is False + + +@pytest.mark.parametrize( + "failure", + [ + KeyboardInterrupt(), + benchmark._ParentChildSignal(signal.SIGINT), + benchmark._ParentChildSignal(signal.SIGTERM), + OSError("synthetic release read failure"), + ], + ids=("keyboard-interrupt", "sigint", "sigterm", "read-error"), +) +def test_child_entry_pre_release_failures_exit_71_without_real_child( + failure: BaseException, + monkeypatch: pytest.MonkeyPatch, +) -> None: + class ChildExit(BaseException): + pass + + exits: list[int] = [] + + def fail_wait(_read_fd: int, _write_fd: int) -> bool: + raise failure + + def fake_exit(code: int) -> None: + exits.append(code) + raise ChildExit + + monkeypatch.setattr(benchmark, "_child_wait_for_release", fail_wait) + monkeypatch.setattr(benchmark.os, "_exit", fake_exit) + + with pytest.raises(ChildExit): + benchmark._child_entry({}, {}, 10, 11) + + assert exits == [71] + + +@pytest.mark.parametrize( + "read_failure", + [ + KeyboardInterrupt(), + benchmark._ParentChildSignal(signal.SIGINT), + benchmark._ParentChildSignal(signal.SIGTERM), + OSError("synthetic release read failure"), + ], + ids=("keyboard-interrupt", "sigint", "sigterm", "read-error"), +) +def test_child_release_ignores_signals_and_contains_read_failures( + read_failure: BaseException, + monkeypatch: pytest.MonkeyPatch, +) -> None: + installed: list[tuple[int, object]] = [] + closed: list[int] = [] + + monkeypatch.setattr(benchmark.signal, "getsignal", lambda _number: "previous") + monkeypatch.setattr( + benchmark.signal, + "signal", + lambda number, handler: installed.append((number, handler)), + ) + monkeypatch.setattr(benchmark.os, "close", lambda fd: closed.append(fd)) + + def fail_read(_fd: int, _size: int) -> bytes: + raise read_failure + + monkeypatch.setattr(benchmark.os, "read", fail_read) + + assert benchmark._child_wait_for_release(10, 11) is False + assert (signal.SIGINT, signal.SIG_IGN) in installed + assert (signal.SIGTERM, signal.SIG_IGN) in installed + assert closed == [11, 10] + + +@pytest.mark.parametrize("pid", [0, -1]) +def test_parent_reap_rejects_nonpositive_pid_without_process_group_signal( + pid: int, monkeypatch: pytest.MonkeyPatch +) -> None: + calls: list[tuple[str, int]] = [] + monkeypatch.setattr( + benchmark.os, + "kill", + lambda child_pid, _signal: calls.append(("kill", child_pid)), + ) + monkeypatch.setattr( + benchmark.os, + "wait4", + lambda child_pid, _options: calls.append(("wait4", child_pid)), + ) + + operations = ( + lambda: benchmark._bounded_reap(pid, 0.0), + lambda: benchmark._terminate_and_reap_child(pid), + lambda: benchmark._wait_for_child(pid), + lambda: benchmark._reap_child(pid), + ) + for operation in operations: + with pytest.raises(ValueError, match="child pid must be positive"): + operation() + + assert calls == [] + + +def _completion_fixture( + tmp_path: Path, + *, + payload: dict[str, Any] | None = None, +) -> tuple[dict[str, Any], Path, dict[str, Path]]: + paths = { + "output": tmp_path / "output.json", + "ledger": tmp_path / "ledger.json", + "stdout": tmp_path / "stdout.txt", + "stderr": tmp_path / "stderr.txt", + } + paths["output"].write_text( + json.dumps( + payload + or { + "schema": benchmark.SCHEMA, + "workload_transition_digest": "a" * 64, + "publication_digest": "b" * 64, + } + ), + encoding="utf-8", + ) + paths["stdout"].write_text("", encoding="utf-8") + paths["stderr"].write_text("", encoding="utf-8") + ledger = { + "token_consumed": True, + "token_status": "consumed", + "state": "launched_consumed", + "retry_allowed": False, + "restart_allowed": False, + "replacement_allowed": False, + "process_states": [{"state": "launched_consumed"}], + } + benchmark._exclusive_write(paths["ledger"], json.dumps(ledger).encode() + b"\n") + launch = { + "fixture_identity": {"synthetic": True}, + "prelaunch_recovery": { + "schema": benchmark.PRELAUNCH_RECOVERY_SCHEMA, + "state": "prelaunch_recovery_verified", + }, + } + return launch, paths["ledger"], paths + + +def _finalize_child_result( + launch: dict[str, Any], + ledger_path: Path, + paths: dict[str, Path], + monkeypatch: pytest.MonkeyPatch, +) -> int: + monkeypatch.setattr(benchmark, "_rss_from_usage", lambda _usage: 1) + monkeypatch.setattr(benchmark, "_disk_available_bytes", lambda _root: 1) + return benchmark._finalize_child_result( + { + "token_consumed": True, + "token_status": "consumed", + "state": "launched_consumed", + "retry_allowed": False, + "restart_allowed": False, + "replacement_allowed": False, + "process_states": [{"state": "launched_consumed"}], + }, + ledger_path, + paths, + launch, + exit_code=0, + status=0, + usage=object(), + timed_out=False, + completed_at_utc="2026-08-11T00:00:00Z", + launched_monotonic_ns=0, + ) + + +def test_receipt_validation_precedes_durable_completed_state( + tmp_path: Path, monkeypatch: pytest.MonkeyPatch +) -> None: + launch, ledger_path, paths = _completion_fixture(tmp_path) + events: list[str] = [] + + def validate( + _payload: dict[str, Any], + _fixture: dict[str, Any], + _prelaunch_recovery: dict[str, Any], + **_kwargs: object, + ) -> None: + events.append("validate") + assert json.loads(ledger_path.read_text(encoding="utf-8"))["state"] == ( + "launched_consumed" + ) + + real_update = benchmark._ledger_update + + def update(path: Path, value: dict[str, Any]) -> None: + events.append(value["state"]) + real_update(path, value) + + monkeypatch.setattr(benchmark, "_validate_receipt", validate) + monkeypatch.setattr(benchmark, "_ledger_update", update) + + assert _finalize_child_result(launch, ledger_path, paths, monkeypatch) == 0 + persisted = json.loads(ledger_path.read_text(encoding="utf-8")) + assert events == ["validate", "completed"] + assert persisted["state"] == "completed" + assert persisted["receipt"]["schema"] == benchmark.SCHEMA + + +@pytest.mark.parametrize("failure_seam", ["validation", "receipt_construction", "finalization"]) +def test_receipt_ordering_failures_never_durably_complete( + failure_seam: str, + tmp_path: Path, + monkeypatch: pytest.MonkeyPatch, +) -> None: + payload = { + "schema": benchmark.SCHEMA, + "workload_transition_digest": "a" * 64, + } + if failure_seam != "receipt_construction": + payload["publication_digest"] = "b" * 64 + launch, ledger_path, paths = _completion_fixture(tmp_path, payload=payload) + real_update = benchmark._ledger_update + completed_attempts = 0 + + def validate( + _payload: dict[str, Any], + _fixture: dict[str, Any], + _prelaunch_recovery: dict[str, Any], + **_kwargs: object, + ) -> None: + if failure_seam == "validation": + raise ValueError("synthetic receipt validation interruption") + + def update(path: Path, value: dict[str, Any]) -> None: + nonlocal completed_attempts + if failure_seam == "finalization" and value["state"] == "completed": + completed_attempts += 1 + if completed_attempts == 1: + real_update(path, value) + raise InterruptedError("synthetic final ledger interruption") + real_update(path, value) + + monkeypatch.setattr(benchmark, "_validate_receipt", validate) + monkeypatch.setattr(benchmark, "_ledger_update", update) + + assert _finalize_child_result(launch, ledger_path, paths, monkeypatch) == 70 + persisted = json.loads(ledger_path.read_text(encoding="utf-8")) + assert persisted["state"] == "failed_after_launch" + assert persisted["state"] != "completed" + assert persisted["process_states"][-1]["state"] == "failed_after_launch" + if failure_seam == "finalization": + assert completed_attempts == 1 + + +@pytest.mark.parametrize("signal_phase", ["evidence", "completed_persistence"]) +def test_sigterm_after_bounded_reap_is_terminal_and_handlers_restore_last( + signal_phase: str, + tmp_path: Path, + monkeypatch: pytest.MonkeyPatch, +) -> None: + launch = _fake_launch_contract(tmp_path) + _patch_fake_process_boundary(launch, tmp_path, monkeypatch) + paths = launch["paths"] + for path in paths.values(): + path.parent.mkdir(parents=True, exist_ok=True) + paths["output"].write_text( + json.dumps( + { + "schema": benchmark.SCHEMA, + "workload_transition_digest": "a" * 64, + "publication_digest": "b" * 64, + } + ), + encoding="utf-8", + ) + paths["stdout"].write_text("", encoding="utf-8") + paths["stderr"].write_text("", encoding="utf-8") + + monkeypatch.setattr(benchmark, "_verify_launch_contract", lambda: launch) + monkeypatch.setattr(benchmark, "_verify_prelaunch_recovery", lambda: {"verification": "passed"}) + monkeypatch.setattr(benchmark.os, "pipe", lambda: (10, 11)) + monkeypatch.setattr(benchmark.os, "fork", lambda: 123) + real_close = benchmark.os.close + + def close(fd: int) -> None: + if fd in {10, 11}: + return + real_close(fd) + + monkeypatch.setattr(benchmark.os, "close", close) + real_write = benchmark.os.write + monkeypatch.setattr( + benchmark.os, + "write", + lambda fd, data: len(data) if fd == 11 else real_write(fd, data), + ) + monkeypatch.setattr( + benchmark, + "_observe_child_start", + lambda _pid, _launch, parent_pid: { + "pid": 123, + "parent_pid": parent_pid, + "user": "synthetic-owner", + "argv": list(benchmark.LAUNCH_COMMAND), + "cwd": str(tmp_path.resolve()), + }, + ) + events: list[str] = [] + + def wait_for_child(_pid: int) -> tuple[int, int, object, bool]: + events.append("bounded_reap_complete") + return 123, 0, object(), False + + monkeypatch.setattr(benchmark, "_wait_for_child", wait_for_child) + monkeypatch.setattr(benchmark, "_rss_from_usage", lambda _usage: 1) + monkeypatch.setattr(benchmark, "_disk_available_bytes", lambda _root: 1) + previous_sigterm = signal.getsignal(signal.SIGTERM) + + def raise_sigterm_while_active() -> None: + events.append("sigterm_requested") + handler = signal.getsignal(signal.SIGTERM) + assert handler is benchmark._parent_signal_handler + handler(signal.SIGTERM, None) + + evidence = { + "stdout_path": str(benchmark.RUN_STDOUT_RELATIVE), + "stdout_sha256": "a" * 64, + "stderr_path": str(benchmark.RUN_STDERR_RELATIVE), + "stderr_sha256": "b" * 64, + "output_path": str(benchmark.RUN_OUTPUT_RELATIVE), + "output_sha256": "c" * 64, + } + if signal_phase == "evidence": + def fail_during_evidence(_paths: dict[str, Path]) -> dict[str, str]: + raise_sigterm_while_active() + + monkeypatch.setattr(benchmark, "_build_evidence", fail_during_evidence) + else: + monkeypatch.setattr(benchmark, "_build_evidence", lambda _paths: evidence) + monkeypatch.setattr(benchmark, "_validate_receipt", lambda *_args, **_kwargs: None) + real_update = benchmark._ledger_update + + def update(path: Path, value: dict[str, Any]) -> None: + if value["state"] == "completed": + raise_sigterm_while_active() + real_update(path, value) + + monkeypatch.setattr(benchmark, "_ledger_update", update) + + result = benchmark._launch_exact() + + assert result == 70 + assert events == ["bounded_reap_complete", "sigterm_requested"] + assert signal.getsignal(signal.SIGTERM) == previous_sigterm + persisted = json.loads(paths["ledger"].read_text(encoding="utf-8")) + assert persisted["state"] == "failed_after_launch" + assert persisted["token_consumed"] is True + assert persisted["retry_allowed"] is False + assert persisted["restart_allowed"] is False + assert persisted["replacement_allowed"] is False + assert list(paths["ledger"].parent.glob(f".{paths['ledger'].name}.*.tmp")) == [] + + +def test_sigterm_during_fallback_persistence_is_blocked_after_reap( + tmp_path: Path, monkeypatch: pytest.MonkeyPatch +) -> None: + launch = _fake_launch_contract(tmp_path) + _patch_fake_process_boundary(launch, tmp_path, monkeypatch) + paths = launch["paths"] + for path in paths.values(): + path.parent.mkdir(parents=True, exist_ok=True) + monkeypatch.setattr(benchmark, "_verify_launch_contract", lambda: launch) + monkeypatch.setattr(benchmark, "_verify_prelaunch_recovery", lambda: {"verification": "passed"}) + monkeypatch.setattr(benchmark.os, "pipe", lambda: (10, 11)) + monkeypatch.setattr(benchmark.os, "fork", lambda: 123) + real_close = benchmark.os.close + + def close(fd: int) -> None: + if fd in {10, 11}: + return + real_close(fd) + + monkeypatch.setattr(benchmark.os, "close", close) + real_write = benchmark.os.write + monkeypatch.setattr( + benchmark.os, + "write", + lambda fd, data: len(data) if fd == 11 else real_write(fd, data), + ) + monkeypatch.setattr( + benchmark, + "_observe_child_start", + lambda _pid, _launch, parent_pid: { + "pid": 123, + "parent_pid": parent_pid, + "user": "synthetic-owner", + "argv": list(benchmark.LAUNCH_COMMAND), + "cwd": str(tmp_path.resolve()), + }, + ) + events: list[str] = [] + + def wait_for_child(_pid: int) -> tuple[int, int, object, bool]: + events.append("bounded_reap_complete") + return 123, 0, object(), False + + monkeypatch.setattr(benchmark, "_wait_for_child", wait_for_child) + + def fail_evidence(_paths: dict[str, Path]) -> dict[str, str]: + raise ValueError("synthetic evidence failure before fallback") + + monkeypatch.setattr(benchmark, "_build_evidence", fail_evidence) + real_update = benchmark._ledger_update + + def update(path: Path, value: dict[str, Any]) -> None: + if value["state"] == "failed_after_launch": + events.append("fallback_persistence") + assert signal.getsignal(signal.SIGINT) is signal.SIG_IGN + assert signal.getsignal(signal.SIGTERM) is signal.SIG_IGN + signal.raise_signal(signal.SIGTERM) + real_update(path, value) + + monkeypatch.setattr(benchmark, "_ledger_update", update) + previous_sigint = signal.getsignal(signal.SIGINT) + previous_sigterm = signal.getsignal(signal.SIGTERM) + + assert benchmark._launch_exact() == 70 + assert events == ["bounded_reap_complete", "fallback_persistence"] + assert signal.getsignal(signal.SIGINT) == previous_sigint + assert signal.getsignal(signal.SIGTERM) == previous_sigterm + persisted = json.loads(paths["ledger"].read_text(encoding="utf-8")) + assert persisted["state"] == "failed_after_launch" + assert persisted["token_consumed"] is True + assert persisted["retry_allowed"] is False + assert persisted["restart_allowed"] is False + assert persisted["replacement_allowed"] is False + assert list(paths["ledger"].parent.glob(f".{paths['ledger'].name}.*.tmp")) == [] + + +@pytest.mark.parametrize( + "evidence_seam", + [ + "missing_stdout", + "missing_stderr", + "missing_output", + "hash_read", + "output_read", + "nullable_evidence", + "mismatched_evidence", + ], +) +def test_evidence_failures_are_terminal_failed_after_launch( + evidence_seam: str, + tmp_path: Path, + monkeypatch: pytest.MonkeyPatch, +) -> None: + launch, ledger_path, paths = _completion_fixture(tmp_path) + if evidence_seam.startswith("missing_"): + paths[evidence_seam.removeprefix("missing_")].unlink() + elif evidence_seam == "hash_read": + def fail_hash(_path: Path) -> str: + raise OSError("synthetic evidence hash read failure") + + monkeypatch.setattr(benchmark, "_sha256", fail_hash) + elif evidence_seam == "output_read": + real_read_text = Path.read_text + + def fail_output_read(path: Path, *args: object, **kwargs: object) -> str: + if path == paths["output"]: + raise OSError("synthetic output read failure") + return real_read_text(path, *args, **kwargs) + + monkeypatch.setattr(Path, "read_text", fail_output_read) + else: + evidence = { + "stdout_path": str(benchmark.RUN_STDOUT_RELATIVE), + "stdout_sha256": None if evidence_seam == "nullable_evidence" else "a" * 64, + "stderr_path": str(benchmark.RUN_STDERR_RELATIVE), + "stderr_sha256": "b" * 64, + "output_path": ( + "output/ck07r1/wrong.json" + if evidence_seam == "mismatched_evidence" + else str(benchmark.RUN_OUTPUT_RELATIVE) + ), + "output_sha256": "c" * 64, + } + monkeypatch.setattr(benchmark, "_build_evidence", lambda _paths: evidence) + + assert _finalize_child_result(launch, ledger_path, paths, monkeypatch) == 70 + persisted = json.loads(ledger_path.read_text(encoding="utf-8")) + assert persisted["state"] == "failed_after_launch" + assert persisted["state"] != "completed" + + +def test_timeout_kills_term_resistant_child_with_bounded_reap( + monkeypatch: pytest.MonkeyPatch, +) -> None: + waits = [ + (0, 0, object()), + (0, 0, object()), + (123, signal.SIGKILL, object()), + ] + monotonic_values = iter((0.0, 1.0, 1.0, 6.0, 6.0, 12.0, 12.0)) + signals: list[signal.Signals] = [] + monkeypatch.setattr(benchmark, "AGGREGATE_TIMEOUT_CANDIDATE_SECONDS", 0.0) + monkeypatch.setattr(benchmark.time, "monotonic", lambda: next(monotonic_values)) + monkeypatch.setattr(benchmark.time, "sleep", lambda _seconds: None) + monkeypatch.setattr(benchmark.os, "wait4", lambda _pid, _options: waits.pop(0)) + monkeypatch.setattr(benchmark.os, "kill", lambda _pid, sig: signals.append(sig)) + + waited_pid, status, _usage, timed_out = benchmark._wait_for_child(123) + + assert waited_pid == 123 + assert status == signal.SIGKILL + assert timed_out is True + assert signals == [signal.SIGTERM, signal.SIGKILL] + + +def test_receipt_binds_exact_prelaunch_recovery_result( + monkeypatch: pytest.MonkeyPatch, +) -> None: + fixture = {"manifest": "synthetic"} + recovery = { + "schema": benchmark.PRELAUNCH_RECOVERY_SCHEMA, + "state": "prelaunch_recovery_verified", + } + receipt = { + "schema": benchmark.SCHEMA, + "fixture_identity": fixture, + "prelaunch_recovery": recovery, + "first_failure": None, + "linear_work_counters": { + "budget_checks": {name: True for name in benchmark.FROZEN_BUDGETS_MS}, + **{ + name: { + "publication_receipt": { + "postconditions": {"identity_bindings": True}, + "planner_tail_limits": benchmark.FROZEN_TAIL_LIMITS, + } + } + for name in ("standard_30_day", "production_all_time") + }, + }, + } + monkeypatch.setattr(benchmark, "_validate_workload_transition_digest", lambda _payload: None) + + evidence = { + "stdout_path": str(benchmark.RUN_STDOUT_RELATIVE), + "stdout_sha256": "a" * 64, + "stderr_path": str(benchmark.RUN_STDERR_RELATIVE), + "stderr_sha256": "b" * 64, + "output_path": str(benchmark.RUN_OUTPUT_RELATIVE), + "output_sha256": "c" * 64, + } + benchmark._validate_receipt(receipt, fixture, recovery, evidence=evidence) + with pytest.raises(ValueError, match="prelaunch recovery binding"): + benchmark._validate_receipt( + receipt, + fixture, + {**recovery, "state": "rejected"}, + evidence=evidence, + ) + with pytest.raises(ValueError, match="evidence digest"): + benchmark._validate_receipt( + receipt, + fixture, + recovery, + evidence={**evidence, "stderr_sha256": None}, + ) + + +def test_all_profile_exact_script_and_flags_reach_launcher_once( + monkeypatch: pytest.MonkeyPatch, +) -> None: + calls: list[int] = [] + monkeypatch.setattr(benchmark, "_launch_exact", lambda: calls.append(1) or 0) + monkeypatch.setattr(sys, "argv", list(benchmark.LAUNCH_COMMAND[1:])) + + assert benchmark.main() == 0 + assert calls == [1] + + +@pytest.mark.parametrize( + "argv", + [ + [ + benchmark.LAUNCH_COMMAND[1], + "--profile", + "all", + "--samples", + "5", + ], + [*benchmark.LAUNCH_COMMAND[1:], "--samples", "5"], + [ + benchmark.LAUNCH_COMMAND[1], + "--samples", + "5", + "--profile", + "all", + "--output", + "output/ck07r1/lifecycle-requalification-v2.json", + ], + [ + "scripts/benchmark_ck07r1_lifecycle_scale_drift.py", + *benchmark.LAUNCH_COMMAND[2:], + ], + ], + ids=("missing", "extra", "reordered", "script-path-drift"), +) +def test_all_profile_argv_mutations_exit_two_without_launch( + argv: list[str], monkeypatch: pytest.MonkeyPatch +) -> None: + calls: list[int] = [] + monkeypatch.setattr(benchmark, "_launch_exact", lambda: calls.append(1) or 0) + monkeypatch.setattr(sys, "argv", argv) + + assert benchmark.main() == 2 + assert calls == [] + + +@pytest.mark.parametrize("profile", ["standard", "production"]) +def test_non_all_local_modes_remain_unchanged( + profile: str, monkeypatch: pytest.MonkeyPatch +) -> None: + calls: list[tuple[str, int]] = [] + + def local_run(*, profile_name: str, samples: int) -> dict[str, object]: + calls.append((profile_name, samples)) + return {"first_failure": None} + + monkeypatch.setattr(benchmark, "run", local_run) + monkeypatch.setattr( + benchmark, + "_launch_exact", + lambda: pytest.fail("non-all mode must not launch the all-profile runner"), + ) + monkeypatch.setattr( + sys, + "argv", + [benchmark.LAUNCH_COMMAND[1], "--profile", profile, "--samples", "1"], + ) + + assert benchmark.main() == 0 + assert calls == [(profile, 1)] + + +def test_child_start_handshake_waits_for_exact_process_before_release( + tmp_path: Path, monkeypatch: pytest.MonkeyPatch +) -> None: + expected = benchmark.LAUNCH_COMMAND + platform_argv = [ + "/opt/homebrew/.../Resources/Python", + *expected[1:], + ] + platform_command = benchmark.shlex.join(platform_argv) + platform_signature = benchmark._platform_process_signature(platform_command) + launch = { + "cwd": str(tmp_path.resolve()), + "owner": "synthetic-owner", + "verified_parent_process_snapshot": { + "pid": 123, + "parent_pid": 1, + "user": "synthetic-owner", + "argv": platform_argv, + "command": platform_command, + "platform_signature": platform_signature, + "cwd": str(tmp_path.resolve()), + }, + } + snapshots = [ + [], + [ + { + "pid": 456, + "parent_pid": 123, + "user": "synthetic-owner", + "argv": platform_argv, + "command": platform_command, + "platform_signature": platform_signature, + "cwd": str(tmp_path.resolve()), + } + ], + ] + observed_calls: list[int] = [] + + def observe(*_args: object, **_kwargs: object) -> list[dict[str, object]]: + observed_calls.append(1) + return snapshots[min(len(observed_calls) - 1, len(snapshots) - 1)] + + monkeypatch.setattr(benchmark, "_matching_processes", observe) + result = benchmark._observe_child_start(456, launch, 123) + + assert result["pid"] == 456 + assert len(observed_calls) == 2 + + +@pytest.mark.parametrize( + "mutation", + [ + "wrong-pid", + "wrong-ppid", + "wrong-owner", + "wrong-cwd", + "missing-cwd", + "wrong-argv", + "wrong-signature", + "alternate-argv0", + ], +) +def test_child_start_handshake_rejects_snapshot_drift( + mutation: str, tmp_path: Path, monkeypatch: pytest.MonkeyPatch +) -> None: + expected = benchmark.LAUNCH_COMMAND + platform_argv = [ + "/opt/homebrew/.../Resources/Python", + *expected[1:], + ] + platform_command = benchmark.shlex.join(platform_argv) + platform_signature = benchmark._platform_process_signature(platform_command) + launch = { + "cwd": str(tmp_path.resolve()), + "owner": "synthetic-owner", + "verified_parent_process_snapshot": { + "pid": 123, + "parent_pid": 1, + "user": "synthetic-owner", + "argv": platform_argv, + "command": platform_command, + "platform_signature": platform_signature, + "cwd": str(tmp_path.resolve()), + }, + } + child: dict[str, Any] = { + "pid": 456, + "parent_pid": 123, + "user": "synthetic-owner", + "argv": platform_argv, + "command": platform_command, + "platform_signature": platform_signature, + "cwd": str(tmp_path.resolve()), + } + if mutation == "wrong-pid": + child["pid"] = 789 + elif mutation == "wrong-ppid": + child["parent_pid"] = 999 + elif mutation == "wrong-owner": + child["user"] = "other-owner" + elif mutation == "wrong-cwd": + child["cwd"] = str(tmp_path / "other") + elif mutation == "missing-cwd": + child.pop("cwd") + elif mutation == "wrong-argv": + child["argv"] = [*platform_argv, "--drift"] + elif mutation == "wrong-signature": + child["platform_signature"] = "0" * 64 + elif mutation == "alternate-argv0": + child["argv"] = [str(tmp_path / ".venv" / "bin" / "python"), *expected[1:]] + child["command"] = benchmark.shlex.join(child["argv"]) + child["platform_signature"] = benchmark._platform_process_signature( + child["command"] + ) + monkeypatch.setattr(benchmark, "_matching_processes", lambda *_args, **_kwargs: [child]) + clock = iter((0.0, 100.0)) + monkeypatch.setattr(benchmark.time, "monotonic", lambda: next(clock)) + + with pytest.raises(RuntimeError, match="child-start handshake"): + benchmark._observe_child_start(456, launch, 123) + + +def test_child_start_handshake_rejects_duplicate_or_ambiguous_processes( + tmp_path: Path, monkeypatch: pytest.MonkeyPatch +) -> None: + expected = benchmark.LAUNCH_COMMAND + platform_argv = ["/opt/homebrew/.../Resources/Python", *expected[1:]] + platform_command = benchmark.shlex.join(platform_argv) + signature = benchmark._platform_process_signature(platform_command) + launch = { + "cwd": str(tmp_path.resolve()), + "owner": "synthetic-owner", + "verified_parent_process_snapshot": { + "pid": 123, + "parent_pid": 1, + "user": "synthetic-owner", + "argv": platform_argv, + "command": platform_command, + "platform_signature": signature, + "cwd": str(tmp_path.resolve()), + }, + } + child = { + "pid": 456, + "parent_pid": 123, + "user": "synthetic-owner", + "argv": platform_argv, + "command": platform_command, + "platform_signature": signature, + "cwd": str(tmp_path.resolve()), + } + duplicate = {**child, "pid": 789} + monkeypatch.setattr( + benchmark, "_matching_processes", lambda *_args, **_kwargs: [child, duplicate] + ) + monkeypatch.setattr(benchmark.time, "monotonic", lambda: 0.0) + + with pytest.raises(RuntimeError, match="unexpected matching process"): + benchmark._observe_child_start(456, launch, 123) + + +def test_terminal_receipt_failure_is_durable_and_no_retry(tmp_path: Path) -> None: + ledger_path = tmp_path / "ledger.json" + ledger = { + "token_consumed": True, + "token_status": "consumed", + "state": "launched_consumed", + "retry_allowed": False, + "restart_allowed": False, + "replacement_allowed": False, + "process_states": [{"state": "launched_consumed"}], + } + benchmark._exclusive_write(ledger_path, b"{}\n") + + benchmark._persist_terminal_failure( + ledger, + ledger_path, + state="failed_after_launch", + stage="receipt_parse_validation", + exc=ValueError("invalid receipt"), + ) + + persisted = json.loads(ledger_path.read_text()) + assert persisted["state"] == "failed_after_launch" + assert persisted["token_consumed"] is True + assert persisted["failure"] == { + "stage": "receipt_parse_validation", + "exception_type": "ValueError", + "message": "invalid receipt", + } + assert persisted["process_states"][-1]["stage"] == "receipt_parse_validation" + assert persisted["retry_allowed"] is False + assert persisted["restart_allowed"] is False + assert persisted["replacement_allowed"] is False + + +def _digest_payload() -> dict[str, Any]: + descriptors = [] + counters: dict[str, Any] = {} + for name, source_profile, entities, observations in ( + ("standard_30_day", "standard", 1, 1), + ("production_all_time", "production", 1, 1), + ): + vector = ("a" if source_profile == "standard" else "b") * 64 + descriptor = { + "source_profile": source_profile, + "history_preset": "30_days" if source_profile == "standard" else "all_time", + "model_calls": 1, + "entities": entities, + "observations": observations, + "seed": benchmark.FIXTURE_SEED, + "profile_file_sha256": benchmark.PROFILE_DIGESTS[source_profile], + "ordered_transition_vector_sha256": vector, + } + descriptors.append(descriptor) + counters[name] = { + "workload_descriptor": descriptor, + "lifecycle_preparation": {"transition_digest": vector}, + } + for name, entities, observations, vector in ( + ("no_change", 0, 0, "c" * 64), + ("one_call_tail", 1, 1, "d" * 64), + ("one_tool_tail", 1, 1, "e" * 64), + ): + descriptors.append( + { + "source_profile": "synthetic_tail", + "history_preset": "all_time", + "model_calls": 0, + "entities": entities, + "observations": observations, + "seed": benchmark.FIXTURE_SEED, + "profile_file_sha256": None, + "ordered_transition_vector_sha256": vector, + } + ) + counters[name] = {"transition_digest": vector} + return { + "workload_descriptors": descriptors, + "workload_transition_digest": benchmark._workload_transition_digest(descriptors), + "linear_work_counters": counters, + } + + +def test_workload_transition_digest_is_recomputed_from_vectors() -> None: + payload = _digest_payload() + benchmark._validate_workload_transition_digest(payload) + + mutated = copy.deepcopy(payload) + mutated["workload_descriptors"][0]["ordered_transition_vector_sha256"] = "f" * 64 + with pytest.raises(ValueError, match="transition vector binding drifted"): + benchmark._validate_workload_transition_digest(mutated) + + +def test_aggregate_timeout_candidate_is_derived_and_non_authoritative() -> None: + assert benchmark.AGGREGATE_TIMEOUT_CANDIDATE_SECONDS == 720.0 + assert benchmark.AGGREGATE_TIMEOUT_CANDIDATE_SECONDS == ( + benchmark.PRODUCTION_SAMPLE_COUNT + * benchmark.FROZEN_BUDGETS_MS["production_all_time"] + / 1_000 + + benchmark.PUBLICATION_RECOVERY_OVERHEAD_CANDIDATE_SECONDS + ) + assert "requires a later authority freeze" in benchmark.AGGREGATE_TIMEOUT_CANDIDATE_RULE + + +def test_workload_transition_digest_is_dynamic_and_order_sensitive() -> None: + descriptor = { + "source_profile": "synthetic", + "history_preset": "all_time", + "model_calls": 1, + "entities": 1, + "observations": 1, + "seed": benchmark.FIXTURE_SEED, + "profile_file_sha256": None, + "ordered_transition_vector_sha256": "a" * 64, + } + reversed_descriptor = {**descriptor, "ordered_transition_vector_sha256": "b" * 64} + + assert benchmark._workload_transition_digest((descriptor,)) != benchmark._workload_transition_digest( + (reversed_descriptor,) + ) From 927aa06f7c4c88319cc30247343c40db8e9b817e Mon Sep 17 00:00:00 2001 From: Monsky Date: Wed, 19 Aug 2026 18:08:16 -0400 Subject: [PATCH 2/2] Preserve CK-07R1 terminal evidence --- output/ck07r1/lifecycle-requalification-v1.launch-token.json | 1 + output/ck07r1/lifecycle-requalification-v2.launch-token.json | 1 + output/ck07r1/lifecycle-requalification-v2.stderr.txt | 1 + output/ck07r1/lifecycle-requalification-v2.stdout.txt | 0 4 files changed, 3 insertions(+) create mode 100644 output/ck07r1/lifecycle-requalification-v1.launch-token.json create mode 100644 output/ck07r1/lifecycle-requalification-v2.launch-token.json create mode 100644 output/ck07r1/lifecycle-requalification-v2.stderr.txt create mode 100644 output/ck07r1/lifecycle-requalification-v2.stdout.txt diff --git a/output/ck07r1/lifecycle-requalification-v1.launch-token.json b/output/ck07r1/lifecycle-requalification-v1.launch-token.json new file mode 100644 index 00000000..c6dc43b5 --- /dev/null +++ b/output/ck07r1/lifecycle-requalification-v1.launch-token.json @@ -0,0 +1 @@ +{"failure":{"exception_type":"RuntimeError","message":"child-start handshake did not prove exact PID/argv/cwd/owner","stage":"child_start_handshake"},"first_result_retained":true,"launch":{"argv":[".venv/bin/python","scripts/benchmark_ck07r1_lifecycle_scale.py","--profile","all","--samples","5","--output","output/ck07r1/lifecycle-requalification-v1.json"],"base_prefix":"/opt/homebrew/opt/python@3.14/Frameworks/Python.framework/Versions/3.14","cwd":"/Users/Monsky/Developer/Codex/2026-08-11/codex-usage-tracker-ck07r1-corrected-shared-overlay-exact-main-6c08ecd9","disk_available_bytes_before_launch":56626814976,"environment":{"LC_ALL":"C.UTF-8","PYTHONHASHSEED":"0","PYTHONUNBUFFERED":"1","TZ":"UTC"},"fixture_identity":{"fixture_files":[{"fixture_file_sha256":"ef0da880255a0b13ea6055e0f8d748870c075635aa6f199c9521462c681250f3","path":"tests/agent_kernel/fixtures/profiles/standard-v1.json"},{"fixture_file_sha256":"2de0b4dc198603da6c1b0905b8d934e2cd5604e4036ef009d0cd07f1cc81f51b","path":"tests/agent_kernel/fixtures/profiles/production-v1.json"},{"fixture_file_sha256":"bad29500048dcff994d4211ff6de446c48d51184ab00caa134a7d668a6e57191","path":"tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0000.jsonl"},{"fixture_file_sha256":"d3ddb9592d67f058b7b7b354c7e01ff159d195c3963e0780be7a4cf35ec9a5eb","path":"tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0001.jsonl"},{"fixture_file_sha256":"114dadd49888fe77bfa1690b0fb810820950dea80d04ff11b233cd14bab54605","path":"tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0002.jsonl"},{"fixture_file_sha256":"12ccb3114f5f4583e98e6e0d8a485b2c1479762b93cd8e6008c9be14edfd2a5d","path":"tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0003.jsonl"},{"fixture_file_sha256":"0729952c7d2c250608ac0913a9d4a879c09b3bf252d86ee84b6b333000b66514","path":"tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0004.jsonl"},{"fixture_file_sha256":"cbfdfbb7f0f463c087c058b0f49cfdb6ec0ff72da5afa14d293b06a3f2ee817f","path":"tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0005.jsonl"},{"fixture_file_sha256":"f7693618223a2de73d5dcfc0c645f13455c480a721641b4d790c278744283729","path":"tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0006.jsonl"},{"fixture_file_sha256":"34709a9e5b6c52438f7c5710c9480db9a2641fbd33e25d8e6c767c383502a65f","path":"tests/agent_kernel/fixtures/tiny-v1/sources/archived/exact-copy.jsonl"},{"fixture_file_sha256":"cdfbf46b0d9524c5c9b16b6672eb98cd9f1b413703cd75f8ca9b833e96e5ac4d","path":"tests/agent_kernel/fixtures/tiny-v1/sources/malformed/malformed.jsonl"},{"fixture_file_sha256":"de66394d849cab6e4936af84b4991e36c1cdf6746f0ab90c7c39dd1ca10761e1","path":"tests/agent_kernel/fixtures/tiny-v1/sources/replaced/revision-1.jsonl"},{"fixture_file_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","path":"tests/agent_kernel/fixtures/tiny-v1/sources/truncated/truncated.jsonl"}],"manifest":{"fixture_file_sha256":"e8c79373697ebe2af5385dbb2899ae49cec6104637c4a3b0909f91225128e0bc","fixture_manifest_digest":"91e0658f913c917bd8ce69fac9a1d75e881f41630eccc0f30f68bd9b6a972a35","path":"tests/agent_kernel/fixtures/tiny-v1/manifest.json","schema":"codex-usage-tracker.synthetic-fixture-manifest.v1","seed":20260728}},"interpreter":"/Users/Monsky/Developer/Codex/2026-08-11/codex-usage-tracker-ck07r1-corrected-shared-overlay-exact-main-6c08ecd9/.venv/bin/python","matching_processes":[],"output_path":"output/ck07r1/lifecycle-requalification-v1.json","overlay_cohort":{"authority_base_sha":"6c08ecd92a2c5166c1585be426e1ed437309a910","authority_path":"docs/decisions/evidence/ck07r1a0/shared-successor-overlay-authority-v1.json","authority_sha256":"73071209d42dbf65130fd307a69a0a3e76eceb65161e90baaf271321a6a81b8d","authority_version":1,"launch_authorized":false,"runtime_acceptance":"not_claimed","schema":"codex-usage-tracker.ck07r1-shared-successor-overlay.v1","schema_path":"docs/decisions/evidence/ck07r1a0/shared-successor-overlay-authority-v1.schema.json","schema_sha256":"943117da4e3d82624ad2cd4656092d2a7aa86266d5d30f7bca2b07f15c9ed86b","state":"worker_prequalification","successor_artifacts":[{"path":"src/codex_usage_tracker/agent_kernel/publication/preparation.py","presence":"required","sha256":"66c015de949a6c380bd49964cb6c48c30dee64ecb14074b480837c44024328ea"},{"path":"scripts/benchmark_ck07r1_lifecycle_scale.py","presence":"required","sha256":"f108dbb45d7586a15eb370c94fc124268a249f2f6f1ee97e7b8b28a3874b737c"},{"path":"tests/agent_kernel/publication/test_lifecycle_scale.py","presence":"required","sha256":"4c51488988397e0ccaf40266a4f68bb1d6d342e4be1db36dd1cf36ab63aa335a"}],"verification":"passed","verifier_path":"scripts/ck07r1_shared_successor_overlay.py","verifier_sha256":"f3745ec07bf47ee15f50969132f315aec61d407c745f6c63694e9910a88c5768"},"owner":"Monsky","venv_prefix":"/Users/Monsky/Developer/Codex/2026-08-11/codex-usage-tracker-ck07r1-corrected-shared-overlay-exact-main-6c08ecd9/.venv"},"maximum_new_end_to_end_runs":1,"process_states":[{"at_utc":"2026-08-19T17:16:44Z","state":"prelaunch_verified"},{"at_utc":"2026-08-19T17:16:49Z","stage":"child_start_handshake","state":"prelaunch_failed"}],"replacement_allowed":false,"restart_allowed":false,"retry_allowed":false,"run_token_id":"ck07r1-all-profile-e2e-1","schema":"codex-usage-tracker.lifecycle-run-ledger.v1","state":"prelaunch_failed","token_consumed":false,"token_status":"unspent_unavailable"} diff --git a/output/ck07r1/lifecycle-requalification-v2.launch-token.json b/output/ck07r1/lifecycle-requalification-v2.launch-token.json new file mode 100644 index 00000000..0572533a --- /dev/null +++ b/output/ck07r1/lifecycle-requalification-v2.launch-token.json @@ -0,0 +1 @@ +{"failure":{"exception_type":"FileNotFoundError","message":"required launch evidence is missing: /Users/Monsky/Developer/Codex/2026-08-11/codex-usage-tracker-ck07r1-corrected-shared-overlay-exact-main-6c08ecd9/output/ck07r1/lifecycle-requalification-v2.json","stage":"evidence_collection"},"first_result_retained":true,"launch":{"argv":[".venv/bin/python","scripts/benchmark_ck07r1_lifecycle_scale.py","--profile","all","--samples","5","--output","output/ck07r1/lifecycle-requalification-v2.json"],"base_prefix":"/opt/homebrew/opt/python@3.14/Frameworks/Python.framework/Versions/3.14","child_start_handshake":{"argv":["/opt/homebrew/Cellar/python@3.14/3.14.6/Frameworks/Python.framework/Versions/3.14/Resources/Python.app/Contents/MacOS/Python","scripts/benchmark_ck07r1_lifecycle_scale.py","--profile","all","--samples","5","--output","output/ck07r1/lifecycle-requalification-v2.json"],"cwd":"/Users/Monsky/Developer/Codex/2026-08-11/codex-usage-tracker-ck07r1-corrected-shared-overlay-exact-main-6c08ecd9","parent_pid":20450,"pid":20482,"platform_command":"/opt/homebrew/Cellar/python@3.14/3.14.6/Frameworks/Python.framework/Versions/3.14/Resources/Python.app/Contents/MacOS/Python scripts/benchmark_ck07r1_lifecycle_scale.py --profile all --samples 5 --output output/ck07r1/lifecycle-requalification-v2.json","platform_signature":"03e8d27cd5e2b52f42c95a054f6b11403905c433a3242d05309efd8dd4437cff","user":"Monsky","verified_before_token_consumption":true},"cwd":"/Users/Monsky/Developer/Codex/2026-08-11/codex-usage-tracker-ck07r1-corrected-shared-overlay-exact-main-6c08ecd9","disk_available_bytes_before_launch":52087721984,"environment":{"LC_ALL":"C.UTF-8","PYTHONHASHSEED":"0","PYTHONUNBUFFERED":"1","TZ":"UTC"},"fixture_identity":{"fixture_files":[{"fixture_file_sha256":"ef0da880255a0b13ea6055e0f8d748870c075635aa6f199c9521462c681250f3","path":"tests/agent_kernel/fixtures/profiles/standard-v1.json"},{"fixture_file_sha256":"2de0b4dc198603da6c1b0905b8d934e2cd5604e4036ef009d0cd07f1cc81f51b","path":"tests/agent_kernel/fixtures/profiles/production-v1.json"},{"fixture_file_sha256":"bad29500048dcff994d4211ff6de446c48d51184ab00caa134a7d668a6e57191","path":"tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0000.jsonl"},{"fixture_file_sha256":"d3ddb9592d67f058b7b7b354c7e01ff159d195c3963e0780be7a4cf35ec9a5eb","path":"tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0001.jsonl"},{"fixture_file_sha256":"114dadd49888fe77bfa1690b0fb810820950dea80d04ff11b233cd14bab54605","path":"tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0002.jsonl"},{"fixture_file_sha256":"12ccb3114f5f4583e98e6e0d8a485b2c1479762b93cd8e6008c9be14edfd2a5d","path":"tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0003.jsonl"},{"fixture_file_sha256":"0729952c7d2c250608ac0913a9d4a879c09b3bf252d86ee84b6b333000b66514","path":"tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0004.jsonl"},{"fixture_file_sha256":"cbfdfbb7f0f463c087c058b0f49cfdb6ec0ff72da5afa14d293b06a3f2ee817f","path":"tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0005.jsonl"},{"fixture_file_sha256":"f7693618223a2de73d5dcfc0c645f13455c480a721641b4d790c278744283729","path":"tests/agent_kernel/fixtures/tiny-v1/sources/active/source-0006.jsonl"},{"fixture_file_sha256":"34709a9e5b6c52438f7c5710c9480db9a2641fbd33e25d8e6c767c383502a65f","path":"tests/agent_kernel/fixtures/tiny-v1/sources/archived/exact-copy.jsonl"},{"fixture_file_sha256":"cdfbf46b0d9524c5c9b16b6672eb98cd9f1b413703cd75f8ca9b833e96e5ac4d","path":"tests/agent_kernel/fixtures/tiny-v1/sources/malformed/malformed.jsonl"},{"fixture_file_sha256":"de66394d849cab6e4936af84b4991e36c1cdf6746f0ab90c7c39dd1ca10761e1","path":"tests/agent_kernel/fixtures/tiny-v1/sources/replaced/revision-1.jsonl"},{"fixture_file_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","path":"tests/agent_kernel/fixtures/tiny-v1/sources/truncated/truncated.jsonl"}],"manifest":{"fixture_file_sha256":"e8c79373697ebe2af5385dbb2899ae49cec6104637c4a3b0909f91225128e0bc","fixture_manifest_digest":"91e0658f913c917bd8ce69fac9a1d75e881f41630eccc0f30f68bd9b6a972a35","path":"tests/agent_kernel/fixtures/tiny-v1/manifest.json","schema":"codex-usage-tracker.synthetic-fixture-manifest.v1","seed":20260728}},"interpreter":"/Users/Monsky/Developer/Codex/2026-08-11/codex-usage-tracker-ck07r1-corrected-shared-overlay-exact-main-6c08ecd9/.venv/bin/python","matching_processes":[],"output_path":"output/ck07r1/lifecycle-requalification-v2.json","owner":"Monsky","prelaunch_recovery":{"authority_path":"docs/decisions/evidence/ck07r1a0/lifecycle-prelaunch-recovery-authority-v1.json","authority_sha256":"95c420350e2e820fb192526493501b10ea9bc0e64424c683a345aaa9f3e5d500","authority_version":1,"candidate_cohort":[{"path":"src/codex_usage_tracker/agent_kernel/publication/preparation.py","role":"preparation_source","sha256":"66c015de949a6c380bd49964cb6c48c30dee64ecb14074b480837c44024328ea"},{"path":"scripts/benchmark_ck07r1_lifecycle_scale.py","role":"corrected_launcher","sha256":"37cb7330494675b2211f31ab419b4105d23f5c71856a546f735304883f25ba8e"},{"path":"tests/agent_kernel/publication/test_lifecycle_scale.py","role":"corrected_launcher_tests","sha256":"47659f999ae765d6f09472eb7db67814c60ec8bd0fccbd258fda1654e22e2854"}],"historical_shared_overlay":[{"path":"docs/decisions/evidence/ck07r1a0/shared-successor-overlay-authority-v1.json","sha256":"73071209d42dbf65130fd307a69a0a3e76eceb65161e90baaf271321a6a81b8d"},{"path":"docs/decisions/evidence/ck07r1a0/shared-successor-overlay-authority-v1.schema.json","sha256":"943117da4e3d82624ad2cd4656092d2a7aa86266d5d30f7bca2b07f15c9ed86b"},{"path":"scripts/ck07r1_shared_successor_overlay.py","sha256":"f3745ec07bf47ee15f50969132f315aec61d407c745f6c63694e9910a88c5768"}],"preserved_v1_ledger":{"matching_processes":[],"path":"output/ck07r1/lifecycle-requalification-v1.launch-token.json","sha256":"5c2b42eca6a3e54cf4163226bc55f3c75aa35112c4ed0342c11f4e39cb9922be","state":"prelaunch_failed","token_consumed":false,"token_status":"unspent_unavailable"},"schema":"codex-usage-tracker.ck07r1-lifecycle-prelaunch-recovery.v1","schema_path":"docs/decisions/evidence/ck07r1a0/lifecycle-prelaunch-recovery-authority-v1.schema.json","schema_sha256":"8996b460d178ed6211caefe8ff8505c8ee75e49799555f7f8ad7204dceb6c1ef","state":"prelaunch_recovery_verified","v2_paths":{"ledger":"output/ck07r1/lifecycle-requalification-v2.launch-token.json","output":"output/ck07r1/lifecycle-requalification-v2.json","stderr":"output/ck07r1/lifecycle-requalification-v2.stderr.txt","stdout":"output/ck07r1/lifecycle-requalification-v2.stdout.txt"},"verification":"passed","verifier_path":"scripts/ck07r1_prelaunch_recovery.py","verifier_sha256":"a3f6376f9f1328b5ccce3d8b16486b87cefe4d2b6c783a4e2a706e71142b1fc4"},"venv_prefix":"/Users/Monsky/Developer/Codex/2026-08-11/codex-usage-tracker-ck07r1-corrected-shared-overlay-exact-main-6c08ecd9/.venv","verified_parent_process_snapshot":{"argv":["/opt/homebrew/Cellar/python@3.14/3.14.6/Frameworks/Python.framework/Versions/3.14/Resources/Python.app/Contents/MacOS/Python","scripts/benchmark_ck07r1_lifecycle_scale.py","--profile","all","--samples","5","--output","output/ck07r1/lifecycle-requalification-v2.json"],"command":"/opt/homebrew/Cellar/python@3.14/3.14.6/Frameworks/Python.framework/Versions/3.14/Resources/Python.app/Contents/MacOS/Python scripts/benchmark_ck07r1_lifecycle_scale.py --profile all --samples 5 --output output/ck07r1/lifecycle-requalification-v2.json","cwd":"/Users/Monsky/Developer/Codex/2026-08-11/codex-usage-tracker-ck07r1-corrected-shared-overlay-exact-main-6c08ecd9","parent_pid":94429,"pid":20450,"platform_signature":"03e8d27cd5e2b52f42c95a054f6b11403905c433a3242d05309efd8dd4437cff","user":"Monsky"}},"maximum_new_end_to_end_runs":1,"process":{"argv":[".venv/bin/python","scripts/benchmark_ck07r1_lifecycle_scale.py","--profile","all","--samples","5","--output","output/ck07r1/lifecycle-requalification-v2.json"],"cwd":"/Users/Monsky/Developer/Codex/2026-08-11/codex-usage-tracker-ck07r1-corrected-shared-overlay-exact-main-6c08ecd9","interpreter":"/Users/Monsky/Developer/Codex/2026-08-11/codex-usage-tracker-ck07r1-corrected-shared-overlay-exact-main-6c08ecd9/.venv/bin/python","launched_at_utc":"2026-08-19T19:44:55Z","launched_monotonic_ns":203840719920208,"owner":"Monsky","parent_pid":20450,"pid":20482,"run_token_id":"ck07r1-all-profile-e2e-1"},"process_states":[{"at_utc":"2026-08-19T19:44:55Z","state":"prelaunch_verified"},{"at_utc":"2026-08-19T19:44:55Z","state":"child_start_verified"},{"at_utc":"2026-08-19T19:44:55Z","state":"launched_consumed"},{"at_utc":"2026-08-19T19:44:56Z","stage":"evidence_collection","state":"failed_after_launch"}],"replacement_allowed":false,"restart_allowed":false,"retry_allowed":false,"run_token_id":"ck07r1-all-profile-e2e-1","schema":"codex-usage-tracker.lifecycle-run-ledger.v1","state":"failed_after_launch","token_consumed":true,"token_consumed_at_utc":"2026-08-19T19:44:55Z","token_status":"consumed"} diff --git a/output/ck07r1/lifecycle-requalification-v2.stderr.txt b/output/ck07r1/lifecycle-requalification-v2.stderr.txt new file mode 100644 index 00000000..fe1bd5b5 --- /dev/null +++ b/output/ck07r1/lifecycle-requalification-v2.stderr.txt @@ -0,0 +1 @@ +{"exception_type":"AssertionError","failure":"child_exception","message":"reachable planner did not select APPEND_SAFE_SMALL: PublicationPlan(operation_class=, parent_publication_id='publication:ck07r1:seed', estimate=ChangeEstimate(selected_bytes=12321, selected_records=1369, observations=1369, occurrences=1369, affected_sessions=1, affected_turns=1, affected_resources=0, affected_allowance_cycles=0, dirty_keys=0, projection_rows=0, expected_wal_bytes=11214848, model_calls_inserted=0), reasons=('limit_exceeded:selected_records',), analytical_write_required=True, valuation_dirty_intervals=())"} diff --git a/output/ck07r1/lifecycle-requalification-v2.stdout.txt b/output/ck07r1/lifecycle-requalification-v2.stdout.txt new file mode 100644 index 00000000..e69de29b