From 8e772eadcbdee11289eb2eac887ffc15b864587c Mon Sep 17 00:00:00 2001 From: Chris R Date: Tue, 3 Nov 2026 01:15:15 +1100 Subject: [PATCH] V03: implement authenticated prefix entry with bounded source custody Conditional U6.2 source and twelve new owned-fixture methods only; no original runtime qualification. --- .../ADAPTER.json | 25 + .../ARTIFACTS.json | 291 ++ .../LICENSE | 201 + .../NOTICE.md | 7 + .../POLICY-CHECKPOINT.json | 47 + .../README.md | 52 + .../SOURCE-GRAPH-v1.json | 3751 +++++++++++++++++ .../SOURCE-ORIGIN.json | 426 ++ .../SOURCES.json | 18 + .../TASK.json | 60 + .../VERIFY.json | 32 + .../evidence/AUTHOR-BOOKKEEPING-v1.json | 19 + .../evidence/AUTHOR-FREEZE-v1.json | 123 + .../evidence/NEW-TESTS-normal-v1.txt | 14 + .../evidence/NEW-TESTS-normal-v2.txt | 17 + .../evidence/NEW-TESTS-optimized-v1.txt | 14 + .../evidence/NEW-TESTS-optimized-v2.txt | 17 + .../evidence/RECONSTRUCTION-v1.json | 8 + .../evidence/REPAIR-WINDOW-v1.json | 30 + .../evidence/SOURCE-CLOSE-v1.json | 71 + .../SOURCE-CUTOFF-OBSERVATION-v1.json | 99 + .../evidence/review-caller-source-v1.json | 69 + .../evidence/review-caller-source-v1.md | 26 + .../evidence/review-caller-source-v2.json | 73 + .../evidence/review-caller-source-v2.md | 14 + ...view-loader-initial-reconstruction-v1.json | 14 + .../evidence/review-loader-source-v1.json | 57 + .../evidence/review-loader-source-v1.md | 11 + .../evidence/review-loader-source-v2.json | 83 + .../evidence/review-loader-source-v2.md | 13 + .../fixtures/test_bootstrap_new_v1.py | 103 + .../history/after-self-correction-35b.py.txt | 192 + ...-draft-VERIFIED-RECONSTRUCTION-d751.py.txt | 200 + .../history/pre-canonical-pair-a8b7.py.txt | 363 ++ .../history/pre-ctypes-75a.py.txt | 363 ++ .../history/reviewed-entry-75a.py.txt | 363 ++ .../history/reviewed-entry-final-b783.py.txt | 365 ++ .../history/reviewed-tests-9796.py.txt | 84 + .../history/reviewed-tests-final-19c1.py.txt | 103 + .../implementation/predecessor_entry.py | 365 ++ .../prerequisites/PINS-v1.json | 284 ++ .../prerequisites/epoch_copy_v5.py.txt | 1897 +++++++++ .../prerequisites/epoch_parent_v5.py.txt | 466 ++ .../prerequisites/epoch_schema_v5.py.txt | 676 +++ .../prerequisites/epoch_stop_v5.py.txt | 184 + .../prerequisites/group01_evidence_v1.py.txt | 256 ++ .../group01_original_predicates_v1.py.txt | 366 ++ .../h25_parent_supervisor.py.txt | 475 +++ .../original_build_provenance_v5.py.txt | 247 ++ .../prerequisites/parent_closure_v1.py.txt | 271 ++ .../prerequisites/parent_completion_v1.py.txt | 880 ++++ .../prerequisites/parent_domain_v1.py.txt | 532 +++ .../v03_integrated_constructor_v2.py.txt | 133 + .../v03_prefix_derivation_v1.py.txt | 99 + .../v03_prefix_supervisor_v1.py.txt | 830 ++++ .../v03_source_refusal_observer_v1.py.txt | 290 ++ .../h25-v03-authenticated-prefix-entry/run.py | 91 + .../verify.py | 84 + 58 files changed, 16244 insertions(+) create mode 100644 research/h25-v03-authenticated-prefix-entry/ADAPTER.json create mode 100644 research/h25-v03-authenticated-prefix-entry/ARTIFACTS.json create mode 100644 research/h25-v03-authenticated-prefix-entry/LICENSE create mode 100644 research/h25-v03-authenticated-prefix-entry/NOTICE.md create mode 100644 research/h25-v03-authenticated-prefix-entry/POLICY-CHECKPOINT.json create mode 100644 research/h25-v03-authenticated-prefix-entry/README.md create mode 100644 research/h25-v03-authenticated-prefix-entry/SOURCE-GRAPH-v1.json create mode 100644 research/h25-v03-authenticated-prefix-entry/SOURCE-ORIGIN.json create mode 100644 research/h25-v03-authenticated-prefix-entry/SOURCES.json create mode 100644 research/h25-v03-authenticated-prefix-entry/TASK.json create mode 100644 research/h25-v03-authenticated-prefix-entry/VERIFY.json create mode 100644 research/h25-v03-authenticated-prefix-entry/evidence/AUTHOR-BOOKKEEPING-v1.json create mode 100644 research/h25-v03-authenticated-prefix-entry/evidence/AUTHOR-FREEZE-v1.json create mode 100644 research/h25-v03-authenticated-prefix-entry/evidence/NEW-TESTS-normal-v1.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/evidence/NEW-TESTS-normal-v2.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/evidence/NEW-TESTS-optimized-v1.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/evidence/NEW-TESTS-optimized-v2.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/evidence/RECONSTRUCTION-v1.json create mode 100644 research/h25-v03-authenticated-prefix-entry/evidence/REPAIR-WINDOW-v1.json create mode 100644 research/h25-v03-authenticated-prefix-entry/evidence/SOURCE-CLOSE-v1.json create mode 100644 research/h25-v03-authenticated-prefix-entry/evidence/SOURCE-CUTOFF-OBSERVATION-v1.json create mode 100644 research/h25-v03-authenticated-prefix-entry/evidence/review-caller-source-v1.json create mode 100644 research/h25-v03-authenticated-prefix-entry/evidence/review-caller-source-v1.md create mode 100644 research/h25-v03-authenticated-prefix-entry/evidence/review-caller-source-v2.json create mode 100644 research/h25-v03-authenticated-prefix-entry/evidence/review-caller-source-v2.md create mode 100644 research/h25-v03-authenticated-prefix-entry/evidence/review-loader-initial-reconstruction-v1.json create mode 100644 research/h25-v03-authenticated-prefix-entry/evidence/review-loader-source-v1.json create mode 100644 research/h25-v03-authenticated-prefix-entry/evidence/review-loader-source-v1.md create mode 100644 research/h25-v03-authenticated-prefix-entry/evidence/review-loader-source-v2.json create mode 100644 research/h25-v03-authenticated-prefix-entry/evidence/review-loader-source-v2.md create mode 100644 research/h25-v03-authenticated-prefix-entry/fixtures/test_bootstrap_new_v1.py create mode 100644 research/h25-v03-authenticated-prefix-entry/history/after-self-correction-35b.py.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/history/initial-draft-VERIFIED-RECONSTRUCTION-d751.py.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/history/pre-canonical-pair-a8b7.py.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/history/pre-ctypes-75a.py.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/history/reviewed-entry-75a.py.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/history/reviewed-entry-final-b783.py.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/history/reviewed-tests-9796.py.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/history/reviewed-tests-final-19c1.py.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/implementation/predecessor_entry.py create mode 100644 research/h25-v03-authenticated-prefix-entry/prerequisites/PINS-v1.json create mode 100644 research/h25-v03-authenticated-prefix-entry/prerequisites/epoch_copy_v5.py.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/prerequisites/epoch_parent_v5.py.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/prerequisites/epoch_schema_v5.py.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/prerequisites/epoch_stop_v5.py.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/prerequisites/group01_evidence_v1.py.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/prerequisites/group01_original_predicates_v1.py.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/prerequisites/h25_parent_supervisor.py.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/prerequisites/original_build_provenance_v5.py.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/prerequisites/parent_closure_v1.py.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/prerequisites/parent_completion_v1.py.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/prerequisites/parent_domain_v1.py.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/prerequisites/v03_integrated_constructor_v2.py.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/prerequisites/v03_prefix_derivation_v1.py.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/prerequisites/v03_prefix_supervisor_v1.py.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/prerequisites/v03_source_refusal_observer_v1.py.txt create mode 100644 research/h25-v03-authenticated-prefix-entry/run.py create mode 100644 research/h25-v03-authenticated-prefix-entry/verify.py diff --git a/research/h25-v03-authenticated-prefix-entry/ADAPTER.json b/research/h25-v03-authenticated-prefix-entry/ADAPTER.json new file mode 100644 index 0000000000..d62631a8ba --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/ADAPTER.json @@ -0,0 +1,25 @@ +{ + "schema": "authenticated-entry-fixture-path-adapter-v2", + "entry_bytes_unchanged": true, + "fixture_file_bytes_unchanged": true, + "pre_import_binding": "Only module-level BASE initializer AST value becomes Path(package); needed because frozen fixture imports NEW entry at module top.", + "post_import_bindings": { + "BASE": "fresh owned temporary root outside packet, containing exact graph copy and fixture temp directory", + "Path": "translate only15exact historical graph copy_path strings to committed package-local inert copies; other calls use real pathlib.Path" + }, + "entry_Path_builtins_functions_and_globals_unchanged": true, + "all_fixture_FunctionDef_ClassDef_assertion_AST_unchanged": true, + "all_twelve_original_fixture_methods_retained": true, + "original_source_loaded_only_as_bytes_AST": true, + "main_entry_operation_caller_original_runtime_executed": false, + "outputs": "Outside publishable packet; ordinary temporary fixture cleanup is not runtime rollback", + "rejected_initial_adapter": "Exact initial wrapper/manifest/docs/receipt preserved outside packet under rejected-adapter-v1 before repair", + "fail_closed_paths": "Exact fifteen historical strings translate only with no extra parts. All other calls require one exact canonical absolute string contained in explicit actual PACKAGE or fresh scratch roots; unknown host paths, extra parts, relative/dot spellings refused.", + "manual_boundary_controls": { + "all_exact_mappings": 15, + "known_path_with_extra_parts_refusals": 15, + "unknown_outside_or_dot_paths_refusals": 4, + "fresh_owned_positive": 1 + }, + "scope": "Path routing for the unchanged frozen fixture only; no filesystem sandbox/runtime authority claim" +} diff --git a/research/h25-v03-authenticated-prefix-entry/ARTIFACTS.json b/research/h25-v03-authenticated-prefix-entry/ARTIFACTS.json new file mode 100644 index 0000000000..4702e92158 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/ARTIFACTS.json @@ -0,0 +1,291 @@ +{ + "files": [ + { + "bytes": 1721, + "path": "ADAPTER.json", + "sha256": "f3acdd2e9564cd1c2dfe2c87bcc30dc1a94080ecfebccc856a7fbc0d0014bab0" + }, + { + "bytes": 11357, + "path": "LICENSE", + "sha256": "c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4" + }, + { + "bytes": 1083, + "path": "NOTICE.md", + "sha256": "beb6e4bb1176e794e4f248ea016701899a0168ae321299ecbcc4a7276ce006d1" + }, + { + "bytes": 1774, + "path": "POLICY-CHECKPOINT.json", + "sha256": "75b0dd3ad9c45bdcfd0b5aeea2ad7478be21b1aeff24dd01301a23fca240c906" + }, + { + "bytes": 9728, + "path": "README.md", + "sha256": "ba975a90bd09ab7388d17878da0b00b178e27f5393e33d1d0b7d82f8822f3817" + }, + { + "bytes": 132763, + "path": "SOURCE-GRAPH-v1.json", + "sha256": "f999a6bfc9ac9048b248d9b029b7676ba04dea5c559228d5286e49d269ca3597" + }, + { + "bytes": 21705, + "path": "SOURCE-ORIGIN.json", + "sha256": "04432b8b362091a477da5b26217ea3c117ade1e728d4a5060b3d55cf391ff1d4" + }, + { + "bytes": 584, + "path": "SOURCES.json", + "sha256": "911ffe8b456c49ccd19ee42c8e21b226a56dacba515e857300aa28cc1db87be7" + }, + { + "bytes": 4128, + "path": "TASK.json", + "sha256": "eb4a4722e9dc1179d3e0914fc64bc332b47803b3dc9a1147983d9ce491989c80" + }, + { + "bytes": 758, + "path": "VERIFY.json", + "sha256": "38e1aab35a749d7830512efe0de97c4dbedc7dc7a525f709497e30502ead1a26" + }, + { + "bytes": 867, + "path": "evidence/AUTHOR-BOOKKEEPING-v1.json", + "sha256": "e2088fd85f57dba85ea375b52af492cff6950469a1e5adedb584efdfd802b287" + }, + { + "bytes": 5794, + "path": "evidence/AUTHOR-FREEZE-v1.json", + "sha256": "2c304f8810a17549e97a0a565a3e0a74dbde3f7f753d0942dad050e8feb8b2c4" + }, + { + "bytes": 1128, + "path": "evidence/NEW-TESTS-normal-v1.txt", + "sha256": "46036065bfa1157fa14ce4f93c047ddec3fc20291fa6e6fb1e67ea6f2a7f3fd7" + }, + { + "bytes": 1541, + "path": "evidence/NEW-TESTS-normal-v2.txt", + "sha256": "67746245de08aa4cce869305d1d173a97b0f13c23408783a90e1b4967558ceee" + }, + { + "bytes": 1128, + "path": "evidence/NEW-TESTS-optimized-v1.txt", + "sha256": "63e13e6ef1d5e8195b465e6869cb2d4ecaa7838b61272630d8360dee8899bd9d" + }, + { + "bytes": 1541, + "path": "evidence/NEW-TESTS-optimized-v2.txt", + "sha256": "c26d90b490e14525b65fdf40255171b107c7b9e65eddab428c3d5f27e688fc3e" + }, + { + "bytes": 431, + "path": "evidence/RECONSTRUCTION-v1.json", + "sha256": "342322dae633116c337cdacf0fa5d288b05cd7636c6264e73aaf32f6fdb15616" + }, + { + "bytes": 1576, + "path": "evidence/REPAIR-WINDOW-v1.json", + "sha256": "1aae26a3f68e8774fe4deae3231172b92cdc14d859559b8ec655957605e81144" + }, + { + "bytes": 2599, + "path": "evidence/SOURCE-CLOSE-v1.json", + "sha256": "7cac80142264ca41f80be6fa7ea4a0b268cd2ce6c44ff2755f0cb3294c59fd9b" + }, + { + "bytes": 3494, + "path": "evidence/SOURCE-CUTOFF-OBSERVATION-v1.json", + "sha256": "5ef3dc17be7b3e08d49e9e442073952854a7a1f2fd810c34ed6e6f0b373c65f3" + }, + { + "bytes": 2629, + "path": "evidence/review-caller-source-v1.json", + "sha256": "3355a2f1275daa31cb35d26f1fb87e305b645920cd4c1369a185ac3b7f436c16" + }, + { + "bytes": 4044, + "path": "evidence/review-caller-source-v1.md", + "sha256": "899bff22642c6dc1f4b3ce903066d77b5fecf447dba53d14e035e4f05a323bf1" + }, + { + "bytes": 4061, + "path": "evidence/review-caller-source-v2.json", + "sha256": "37c9f79c9f836fa14ea88d1ae5790b2ce350361699e848f35e2faebe6549c8b6" + }, + { + "bytes": 3650, + "path": "evidence/review-caller-source-v2.md", + "sha256": "6fd0b3f5c47ffe81ccd362a526f37c15d18d762b0c5f0464977f93fac18d89b2" + }, + { + "bytes": 11197, + "path": "evidence/review-loader-initial-reconstruction-v1.json", + "sha256": "072e74893f0e512e7025b5d2756b09e05a87811286dc870139139561062a5efa" + }, + { + "bytes": 3430, + "path": "evidence/review-loader-source-v1.json", + "sha256": "dd63a381f2feef9a5a2b265754b4d8102672e429c0843a2052adcfd9f10e5962" + }, + { + "bytes": 1680, + "path": "evidence/review-loader-source-v1.md", + "sha256": "ba94ab04608fccc387c6178e7dade9df1868e2c43902f9ae8aa076550414b837" + }, + { + "bytes": 5562, + "path": "evidence/review-loader-source-v2.json", + "sha256": "7ed7ef8896abdaab443473038992f652a5054f43c4ea41a0f0aa0f028079b799" + }, + { + "bytes": 2374, + "path": "evidence/review-loader-source-v2.md", + "sha256": "f7a78a3b44892e20eae7154e048cf42ed25bd189a1192b4d45191e75c8cc0ec0" + }, + { + "bytes": 6532, + "path": "fixtures/test_bootstrap_new_v1.py", + "sha256": "19c1b08d4daeaf0c2d40357b0e117fcb2ca2f632f627e290fe7442abf49b3504" + }, + { + "bytes": 9247, + "path": "history/after-self-correction-35b.py.txt", + "sha256": "35b99508cbc4b686f18b29ecd1458c21f4139ffd0a8cc62a774a49570e20c10f" + }, + { + "bytes": 9950, + "path": "history/initial-draft-VERIFIED-RECONSTRUCTION-d751.py.txt", + "sha256": "d7512ffe6c9ee2b7a51b98672032fd14f50f5d47e193131873ea426a47f25cbd" + }, + { + "bytes": 21773, + "path": "history/pre-canonical-pair-a8b7.py.txt", + "sha256": "a8b78c852fe653bfe9ef7b594f5efe1f8021b1128c662e54fb4fea7800b702d5" + }, + { + "bytes": 21764, + "path": "history/pre-ctypes-75a.py.txt", + "sha256": "75a08c0a5ea2ed80373fbd91d2a8cb53b2b131d9ef1bcab74ccb69d191cb2a56" + }, + { + "bytes": 21764, + "path": "history/reviewed-entry-75a.py.txt", + "sha256": "75a08c0a5ea2ed80373fbd91d2a8cb53b2b131d9ef1bcab74ccb69d191cb2a56" + }, + { + "bytes": 21857, + "path": "history/reviewed-entry-final-b783.py.txt", + "sha256": "b783c6812a6295069456cfb4187d4e09bb7acbcb20fffd76e0c10267f90c1201" + }, + { + "bytes": 5094, + "path": "history/reviewed-tests-9796.py.txt", + "sha256": "9796386f813ccece7199b1795a9b5d34469eeea001021aeda3ac49e796c33e2f" + }, + { + "bytes": 6532, + "path": "history/reviewed-tests-final-19c1.py.txt", + "sha256": "19c1b08d4daeaf0c2d40357b0e117fcb2ca2f632f627e290fe7442abf49b3504" + }, + { + "bytes": 21857, + "path": "implementation/predecessor_entry.py", + "sha256": "b783c6812a6295069456cfb4187d4e09bb7acbcb20fffd76e0c10267f90c1201" + }, + { + "bytes": 13934, + "path": "prerequisites/PINS-v1.json", + "sha256": "f20555d87ab5b0f1bed28461f2b435773607ffaf87f5c4ba21414844f44fd1d6" + }, + { + "bytes": 82957, + "path": "prerequisites/epoch_copy_v5.py.txt", + "sha256": "4f459d0336d59975df787c24373e18dad4044c3a24137392e890115f811b3211" + }, + { + "bytes": 26833, + "path": "prerequisites/epoch_parent_v5.py.txt", + "sha256": "058059912144863a4b2bfe4fc9ffc5233b4ab20ee5a7355bde66f4d3f6f28712" + }, + { + "bytes": 30668, + "path": "prerequisites/epoch_schema_v5.py.txt", + "sha256": "b89a789654be87bde40a47300f4d9702dce2b90e6ab3be9a2025f6d8041b3e9a" + }, + { + "bytes": 8205, + "path": "prerequisites/epoch_stop_v5.py.txt", + "sha256": "5b10c9d72dd0e646652a73b6ffe9ba870762d6bc2f7432bc6b06571a1b7d2a6f" + }, + { + "bytes": 15610, + "path": "prerequisites/group01_evidence_v1.py.txt", + "sha256": "05ec6a63c57340ba929aea1fab71b096efc143e099346640f6def41310bd3e25" + }, + { + "bytes": 23224, + "path": "prerequisites/group01_original_predicates_v1.py.txt", + "sha256": "fb9e6e11b39b76ab8652c546fd76c06d662ea4116376abcc2a6267bb4783dbfd" + }, + { + "bytes": 23047, + "path": "prerequisites/h25_parent_supervisor.py.txt", + "sha256": "cfb09a18dd10b597cc6d5a8139ee769bef679bc44ae029329755e3d97b055075" + }, + { + "bytes": 16024, + "path": "prerequisites/original_build_provenance_v5.py.txt", + "sha256": "bd5ffd9a1c221e0945527fc8fa8d0ad4eb36b9a8884503451c1b6b12d00007ea" + }, + { + "bytes": 13463, + "path": "prerequisites/parent_closure_v1.py.txt", + "sha256": "a15424f14baa3d484fe04bfbe7e449c32561c866dbaca2c1b5f646dfb377ed1f" + }, + { + "bytes": 54168, + "path": "prerequisites/parent_completion_v1.py.txt", + "sha256": "d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5" + }, + { + "bytes": 23942, + "path": "prerequisites/parent_domain_v1.py.txt", + "sha256": "a51264289803b4b17bb262f2460ddd4ed72500aaa21e5eb80fa2db4583689361" + }, + { + "bytes": 6111, + "path": "prerequisites/v03_integrated_constructor_v2.py.txt", + "sha256": "a80a60b390bc60e9bc434b79cda5ae6db88e4f0c6c7436de9adfe1f48a2045b1" + }, + { + "bytes": 3830, + "path": "prerequisites/v03_prefix_derivation_v1.py.txt", + "sha256": "1ed813148c10d5fbd3cd6781d51eca650a347eda7a6323f581d740e6ea9cb6e2" + }, + { + "bytes": 36954, + "path": "prerequisites/v03_prefix_supervisor_v1.py.txt", + "sha256": "f97b07d4a5f461d4134a2bdf4cfcc28da12acc7e7144c18f6cc0a017cdee86f6" + }, + { + "bytes": 14205, + "path": "prerequisites/v03_source_refusal_observer_v1.py.txt", + "sha256": "abf25690d3bee4a9783ee504567c29f7fb47da670e0ec95f57cb5944bf57264f" + }, + { + "bytes": 5045, + "path": "run.py", + "sha256": "a1264e6ac33afffc313d0ed3fc069fd282620550b84b7de87d1b7586a71985ea" + }, + { + "bytes": 5311, + "path": "verify.py", + "sha256": "57161e1e90b031d50e2f43864c66cadc163a27814bc76f085ce6fe14dbb90bfd" + } + ], + "schema": "authenticated-entry-export-artifacts-v2", + "scope": "Exact packet bytes including historical whitespace, excluding ARTIFACTS itself; accepted conditional U6.2 source only; publication path adapter v2" +} diff --git a/research/h25-v03-authenticated-prefix-entry/LICENSE b/research/h25-v03-authenticated-prefix-entry/LICENSE new file mode 100644 index 0000000000..261eeb9e9f --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/research/h25-v03-authenticated-prefix-entry/NOTICE.md b/research/h25-v03-authenticated-prefix-entry/NOTICE.md new file mode 100644 index 0000000000..be541737d9 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/NOTICE.md @@ -0,0 +1,7 @@ +# Attribution and licenses + +Chris R / Clear1nsight, with substantial ChatGPT Pro / OpenAI Codex / GPT-6.1 Sol Max source consultation, authored entry, independent agent review and publication preparation. Preserve original source authors, PR6321 / PR6029 / PR5864 lineage, unpaidmoon with Cursor/Grok at PR6339, and Douglas Colkitt's native/circuit/verification and research-package lineage. + +New package glue and authored code are Apache-2.0 under the included repository LICENSE. Inert original/project inputs and historical snapshots retain complete raw bytes and notices, including EOF blank lines and known whitespace. Inclusion replaces no source-specific notice. No compiler/native binaries, runtime image or private consultation transcript is included. + +Independent agent PASS is scoped conditional entry source review. It supplies no human/proof-kernel credential, genuine approval, full-bootstrap/caller/preparer acceptance or original scientific/runtime qualification. Failed versions, verified-reconstruction labels, rawsnapshot gaps and late bookkeeping remain visible. diff --git a/research/h25-v03-authenticated-prefix-entry/POLICY-CHECKPOINT.json b/research/h25-v03-authenticated-prefix-entry/POLICY-CHECKPOINT.json new file mode 100644 index 0000000000..c12faa0453 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/POLICY-CHECKPOINT.json @@ -0,0 +1,47 @@ +{ + "authority": "Canonical7c49unchanged per parent13:33UTC refresh; exact previously pinned stored policy bytes reused", + "base_commit": "7c49fe32c55de02c2c873655c804b16e4c3fef0a", + "historical_skill_pointer": "626e936... is historical discovery only", + "nearest_overlap": { + "PR6370": "e144f3b0a440fd33efdcfa4e0bd1af059dfd4fb3", + "other_predecessors": [ + "PR6368", + "PR6369" + ] + }, + "network": false, + "observed_utc": "2026-11-02T13:46:40.251603+00:00", + "overlap": "Accepted conditional U6.2 entry source only, distinct from U6.1 PR6370 source inputs and unaccepted caller90a/unwritten preparer", + "policy": [ + { + "base_commit": "7c49fe32c55de02c2c873655c804b16e4c3fef0a", + "bytes": 5963, + "path": "AGENTS.md", + "sha256": "fbee67ab9e0ae4629a35fd9dba69c8f7e29e4a15392eb2d0f75d8768ffb65f40" + }, + { + "base_commit": "7c49fe32c55de02c2c873655c804b16e4c3fef0a", + "bytes": 7505, + "path": "CONTRIBUTING.md", + "sha256": "fcd1a8d0e52342a23b8ffa9e905e85ccc539fb084145ef016dfc93cedfb3d924" + }, + { + "base_commit": "7c49fe32c55de02c2c873655c804b16e4c3fef0a", + "bytes": 30730, + "path": "docs/research/agent-procedure.md", + "sha256": "8367063f9f2d48543415451e026f83224ea962b28801bea6904e6e425ed023e4" + }, + { + "base_commit": "7c49fe32c55de02c2c873655c804b16e4c3fef0a", + "bytes": 21310, + "path": "docs/research/research-package-guide.md", + "sha256": "5e3aa8b2ce657f943ef5fd187473a01a92a7073ef7e05b30affa08979daa2c6e" + }, + { + "base_commit": "7c49fe32c55de02c2c873655c804b16e4c3fef0a", + "bytes": 1505, + "path": ".github/pull_request_template.md", + "sha256": "6fffbdcc80d32daa5d6940b21f4c0e61df7e5f588a120374269ff28dac26c562" + } + ] +} diff --git a/research/h25-v03-authenticated-prefix-entry/README.md b/research/h25-v03-authenticated-prefix-entry/README.md new file mode 100644 index 0000000000..faf10d7c77 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/README.md @@ -0,0 +1,52 @@ +# Authenticated V03 prefix entry: accepted conditional U6.2 source + +This package preserves the independently accepted **U6.2 entry component** and exactly 12 frozen NEW pure/owned-file tests. It is a separate incremental source contribution after U6.1. It does not contain an accepted complete bootstrap: the separate caller90a retains its copied-support call-cap gap, the actual P/Q/M/JOBS/STAGE preparer is unwritten, and U6.3/U6.4 remain unaccepted. No original runtime, full entry main/entry_operation or caller route is executed by this package. + +## Frozen component and accepted scope + +`implementation/predecessor_entry.py` is 21,857 bytes SHA256 `b783c6812a6295069456cfb4187d4e09bb7acbcb20fffd76e0c10267f90c1201`. The exact fixture is 6,532 bytes SHA256 `19c1b08d4daeaf0c2d40357b0e117fcb2ca2f632f627e290fe7442abf49b3504`. Both retain every original byte, algorithm, assertion and test body. The final independent entry review is `7ed7ef8896abdaab443473038992f652a5054f43c4ea41a0f0aa0f028079b799`; the separate caller partial review is `37c9f79c9f836fa14ea88d1ae5790b2ce350361699e848f35e2faebe6549c8b6`. + +The accepted source implements a conditional retained-byte entry/loader for the exact 15-module selection: authenticate/retain all source buffers before first body, refuse ambient selected names, construct actual fresh ModuleType objects, preserve real builtins, use exact policy filenames/dont_inherit/actual optimization, and publish/initialize dependencies in the reviewed order. Its new Owner retains acquired descriptor slots, partial buffers and raw primary/secondary errors, burns the attempt and quarantines uncertainty. Exact cap/type/path checks and 8192-read/4096-or-8192-write-call bounds remain in source. The original T0/OS/interpreter/stdlib premise and all genuine approvals remain separate. + +Authentic gate data is installed only at the accepted names before the one real make_prefix_owner/run_prefix sequence. The actual source would retain/verify the returned observation before writing a bounded exclusive science/receipt.json DATA bridge with completion/runtime/enclosing-parent-exit fields false. Those full operations are conditional source only and are not fixture-run. No public fake capability or original completion credential is created. + +The twelve-method replay imports only the NEW entry with its main guard inactive. It executes newly authored literal toy modules and fresh owned-file I/O/fault injection, not the original 15 modules. It covers actual retained module identity/real builtins, all-source hashing before any body, missing dependency/ambient-name refusals, terminal partial initialization, raw primary+secondary-close identity, zero foreign-metaclass callbacks, cap/path/duplicate-JSON controls, actual 15-source hash/AST/import-order data, invalid-mode refusal, exact gate names in fresh synthetic modules and exclusive real-identity writes. Synthetic gate/owner/module data is not genuine source/native/runtime authority. + +## Cold layout and path-only adapter + +All 15 exact original/project inputs and the frozen f999a6 graph/PINS are retained under prerequisites/. They are inert `.py.txt`, hashed and parsed only. PINS still describes the separate four outer references, but those outer files are unnecessary for these twelve methods and are not live replay inputs. SOURCE-ORIGIN.json maps included paths and explicitly qualifies omitted historical references. + +The fixture imports the new entry at module top using its historical BASE path, and its actual graph test calls Path on 15 historical absolute copy_path values. `run.py` therefore binds only paths: it replaces the module-level BASE initializer in an in-memory fixture AST before the new entry import; every FunctionDef/class/assertion AST remains identical. It then binds fixture BASE to a fresh temporary layout outside the packet and fixture Path to translate only the 15 exact historical copy paths, with no extra path parts. Other calls must be canonical absolute paths under the explicit current package or fresh scratch root; unknown host paths are refused. The entry module itself is loaded from the unchanged package file with real standard builtins/Path. No new core globals, algorithm or assertions are substituted. The initial publication adapter allowed an unsafe host-path fallback; its exact wrapper/manifest/docs/receipt were saved outside the packet before this adapter-only correction. Boundary controls check all 15 mappings, all 15 extra-part refusals, four unknown/dot-path refusals and one owned-path positive. The original source unit remains closed. Temporary file fixtures and graph copies live outside the publishable packet and are removed by their ordinary fixture cleanup; no runtime rollback claim follows. + +From the repository root with standard-library Python 3.12: + +```sh +python3.12 -B scripts/research_package.py --package research/h25-v03-authenticated-prefix-entry --check-only +python3.12 -B scripts/research_package.py --package research/h25-v03-authenticated-prefix-entry +``` + +VERIFY.json runs archive/preservation/graph byte checks and exactly the same 12 NEW methods in normal and optimized Python with 30-second bounds. No original body/function/test is compiled, imported or executed. Main, entry_operation, caller, native installer, Popen/domain, compiler, namespace and target workloads remain unrun. All live replay inputs are local, so VERIFY.inputs is empty. ARTIFACTS.json binds every file except itself. Final-manifest cold-copy outputs are outside the packet and recorded in the export receipt; no count drift is hidden by regenerating a manifest after the cold check. + +## Rejections, gaps and late bookkeeping + +All retained failed entry versions and observed fixture versions are inert under history/. The initial 9,950-byte d751 draft is explicitly **verified inverse reconstruction**, not a direct saved copy. The 35b self-correction, a8b7 pre-canonical-pair, 75a pre-ctypes and final b783 direct snapshots are preserved. The observed 20,308-byte 81de intermediate was overwritten before a raw snapshot; that gap remains disclosed rather than reconstructed without evidence. The initial/final source reviews and reconstruction records preserve the defects and corrections. + +Source/fixture edits stopped at 13:35:31 UTC, with the sole 13:20:31–13:35:31 repair clock. Parent enforcement/bookkeeping at 13:22:33, author freeze at 13:36:18 and bookkeeping at 13:37:58 were late and remain labelled; nothing is backdated. SOURCE-CLOSE-v1.json SHA256 `7cac80142264ca41f80be6fa7ea4a0b268cd2ce6c44ff2755f0cb3294c59fd9b` closes Unit06 partial with U6.1/U6.2 accepted, fixed 2-of-4 local denominator, U6.3/U6.4 unaccepted. The initial AUTHOR-FREEZE pending-review language remains historical alongside the later explicit acceptance. + +Caller 90a bytes/support are omitted from this accepted route. Frozen caller review metadata records its unresolved call-cap discrepancy; no preparer source is present or fabricated. Both require distinct future authorized work. Copied EOF blank lines and known whitespace are preserved as exact historical bytes. An unstaged git diff check does not validate untracked packet content; the archive check authenticates raw package bytes, and parent must run actual committed-byte preflight after commit. + +## Scope, pause and costs + +The original T0/native/source/stage/command/funding/execution approvals, current installed policy/manifest identities, complete C05 determinant/channel inventory, C07 immutable interval, actual 48/512 capture/resource fit, canonical history and genuine enclosing-parent exit remain open. Source review and finite fixture success are not human/proof-kernel credentials, runtime admission or complete bootstrap qualification. + +Full C05=false; full V03=false; runtime_qualified=false; original activity credit added=0. Original 43.5% / 22 of 49 and all denominators remain unchanged. All previous source clocks remain closed; this publication does not extend or reopen Unit06 or the paused app goal. Genuine original gates remain unconfigured/unadmitted. Physical, preparation, review, publication and final costs remain OPEN_NOT_ZERO. + +## Open next questions + +The next distinct source operation is a complete actual P/Q/M/JOBS/STAGE preparer, followed by a corrected caller and independently reviewed composition. It must consume real original schemas and genuine independent inputs, preserve acyclic finalization, actual custody/lock/history/resource operations and all excluded-byte costs, and supply a complete operation bill. TASK.json records the first step and blockers. This export does not implement or authorize that operation. + +## Provenance, overlap and credit + +Canonical base/policy is 7c49fe32c55de02c2c873655c804b16e4c3fef0a, freshly reported unchanged by parent at 13:33 UTC. Nearest source-input contribution is [PR6370](https://github.com/CrocSwap/integer-mult-bounds/pull/6370), exact head `e144f3b0a440fd33efdcfa4e0bd1af059dfd4fb3`; adjacent source increments are PR6368/6369. These are scope/identity pointers, not a refreshed hosted-check or novelty claim. Exact policy hashes are in POLICY-CHECKPOINT.json. SOURCES.json pins only historical task/card provenance; copied source byte availability is not full original Git history. + +Chris R / Clear1nsight with substantial Pro/Codex/Sol Max assistance and independent agent review. Preserve original authors, PR6321/6029/5864, unpaidmoon Cursor/Grok PR6339 and Douglas Colkitt's lineage. New glue/authored code is Apache-2.0, with original notices retained; see NOTICE.md and LICENSE. Private Pro chat/prompt/response, full workspace and protected runtime records are excluded; report hashes/paths remain documentary context only. diff --git a/research/h25-v03-authenticated-prefix-entry/SOURCE-GRAPH-v1.json b/research/h25-v03-authenticated-prefix-entry/SOURCE-GRAPH-v1.json new file mode 100644 index 0000000000..a8622b2db9 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/SOURCE-GRAPH-v1.json @@ -0,0 +1,3751 @@ +{ + "T0_premise": "exact original already-trusted system stdlib boundary; no fabricated per-body startup authentication or stronger universal self-authentication claim", + "actual_receiver_capture_fit": false, + "actual_runtime_initialization_or_admission": false, + "costs": "OPEN_NOT_ZERO", + "deferred_native_supplement": { + "call_line": 161, + "function": "install_subreaper", + "import_line": 157, + "module": "h25_parent_supervisor", + "operation": "import ctypes then ctypes.CDLL(LIBC,use_errno=True); exact original native supplement and actual readback remain future admitted operations, not granted by generic T0 label" + }, + "each_static_names_plus8_le512": true, + "frozen_utc": "2026-11-02T13:04:40.246800+00:00", + "full_C05": false, + "full_V03": false, + "historical_receiver_map": { + "path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/publication-audit-v1/research/h25-c05-v03-parent-interface-audit/evidence/RECEIVER-SOURCE-MAP.json", + "sha256": "532733f4d78fc327f00851f33e1db20ae8ef34fd904fc56327d44a4ebea11067" + }, + "import_edges": { + "epoch_copy_v5": [ + "epoch_schema_v5" + ], + "epoch_parent_v5": [ + "epoch_copy_v5", + "epoch_schema_v5", + "epoch_stop_v5" + ], + "epoch_schema_v5": [], + "epoch_stop_v5": [ + "epoch_copy_v5", + "epoch_schema_v5" + ], + "group01_evidence_v1": [ + "epoch_copy_v5", + "epoch_schema_v5", + "group01_original_predicates_v1", + "original_build_provenance_v5", + "parent_closure_v1" + ], + "group01_original_predicates_v1": [ + "epoch_schema_v5" + ], + "h25_parent_supervisor": [], + "original_build_provenance_v5": [ + "epoch_copy_v5", + "epoch_schema_v5" + ], + "parent_closure_v1": [ + "epoch_copy_v5", + "epoch_schema_v5" + ], + "parent_completion_v1": [ + "epoch_copy_v5", + "epoch_parent_v5", + "epoch_schema_v5", + "group01_evidence_v1", + "parent_closure_v1", + "parent_domain_v1" + ], + "parent_domain_v1": [ + "epoch_schema_v5" + ], + "v03_integrated_constructor_v2": [], + "v03_prefix_derivation_v1": [ + "v03_integrated_constructor_v2" + ], + "v03_prefix_supervisor_v1": [ + "epoch_copy_v5", + "epoch_schema_v5", + "group01_evidence_v1", + "parent_closure_v1", + "parent_completion_v1", + "parent_domain_v1", + "v03_prefix_derivation_v1" + ], + "v03_source_refusal_observer_v1": [] + }, + "initial_selected_roots": [ + "v03_prefix_supervisor_v1", + "v03_prefix_derivation_v1", + "v03_integrated_constructor_v2", + "v03_source_refusal_observer_v1", + "epoch_schema_v5", + "epoch_copy_v5", + "parent_domain_v1", + "parent_closure_v1", + "parent_completion_v1", + "group01_evidence_v1", + "h25_parent_supervisor" + ], + "missing_sources": [], + "module_initialization_cycles": [], + "module_initialization_findings": [ + { + "effect": "os.sysconf('SC_PAGE_SIZE') is a real import-time OS/native query; not executed here and must be included in future initialization/resource bill.", + "line": 23, + "module": "parent_domain_v1" + }, + { + "effect": "T0 dataclass(frozen=True,slots=True) executes at definition; requires actual constructed module registered under exact __name__; generated methods belong to unchanged T0/dataclasses premise.", + "line": 24, + "module": "epoch_parent_v5" + }, + { + "effect": "Reads slot getters from completed ParentCompletion class; epoch_parent must finish before parent_completion captures epoch entries.", + "line": 62, + "module": "epoch_parent_v5" + }, + { + "effect": "Constructs real EpochStop instance for retained quarantine sentinel; class definition precedes this construction.", + "line": 405, + "module": "epoch_schema_v5" + }, + { + "effect": "Snapshots sys.modules and actual module objects; must never use ambient selected project names as expected identities. Original source globals/dataclass/descriptor captures are meaningful initialization.", + "line": 42, + "module": "parent_closure_v1" + }, + { + "effect": "Captures epoch entry and ParentEpoch/ParentCompletion method/class identities at module top level; import order is semantic, not a caller-supplied arbitrary chain.", + "line": 49, + "module": "parent_completion_v1" + } + ], + "modules": [ + { + "bytes": 82957, + "copy_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/epoch_copy_v5.py.txt", + "dynamic_sites": [], + "imports": [ + { + "alias": "hashlib", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 2, + "member": null, + "module": "hashlib", + "scope": "module" + }, + { + "alias": "os", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 3, + "member": null, + "module": "os", + "scope": "module" + }, + { + "alias": "stat", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 4, + "member": null, + "module": "stat", + "scope": "module" + }, + { + "alias": "schema", + "classification": "selected_project", + "deferred": false, + "line": 5, + "member": null, + "module": "epoch_schema_v5", + "scope": "module" + } + ], + "independent_pin_basis": "Unit05 frozen author receipt v2 + source-close pin", + "initialization_calls": [], + "module": "epoch_copy_v5", + "module_initialization": [ + { + "kind": "Expr", + "line": 1, + "source": "\"\"\"Bounded exclusive copy source with opaque error ownership; never executed here.\"\"\"" + }, + { + "kind": "Import", + "line": 2, + "source": "import hashlib" + }, + { + "kind": "Import", + "line": 3, + "source": "import os" + }, + { + "kind": "Import", + "line": 4, + "source": "import stat" + }, + { + "kind": "Import", + "line": 5, + "source": "import epoch_schema_v5 as schema" + }, + { + "kind": "Assign", + "line": 7, + "source": "COPY_CONFIGURATION = None" + }, + { + "kind": "Assign", + "line": 8, + "source": "COPY_EXECUTION_APPROVAL = None" + }, + { + "kind": "Assign", + "line": 9, + "source": "COPY_FUNDING = None" + }, + { + "kind": "Assign", + "line": 10, + "source": "_TYPE, _LEN = type, len" + }, + { + "kind": "Assign", + "line": 11, + "source": "_OPEN, _CLOSE, _READ, _WRITE = os.open, os.close, os.read, os.write" + }, + { + "kind": "Assign", + "line": 12, + "source": "_FSTAT, _STAT, _LSEEK, _FSYNC = os.fstat, os.stat, os.lseek, os.fsync" + }, + { + "kind": "Assign", + "line": 13, + "source": "_SCANDIR, _STAT_RESULT = os.scandir, os.stat_result" + } + ], + "namespace_bound_actual_capture_proven": false, + "sha256": "4f459d0336d59975df787c24373e18dad4044c3a24137392e890115f811b3211", + "source_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/epoch_copy_v5.py", + "static_names_plus8_import_metadata": 38, + "static_namespace_name_count": 30, + "static_namespace_names": [ + "COPY_CONFIGURATION", + "COPY_EXECUTION_APPROVAL", + "COPY_FUNDING", + "_CLOSE", + "_FSTAT", + "_FSYNC", + "_LEN", + "_LSEEK", + "_OPEN", + "_READ", + "_SCANDIR", + "_STAT", + "_STAT_RESULT", + "_TYPE", + "_WRITE", + "_fd", + "_gate", + "_hash_fd", + "_identity", + "_parent", + "copy_once", + "hashlib", + "inspect", + "os", + "read_verified", + "require_entries", + "schema", + "stat", + "verify", + "write_once" + ] + }, + { + "bytes": 26833, + "copy_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/epoch_parent_v5.py.txt", + "dynamic_sites": [], + "imports": [ + { + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "level": 0, + "line": 10, + "members": [ + { + "alias": "dataclass", + "name": "dataclass" + } + ], + "module": "dataclasses", + "scope": "module" + }, + { + "alias": "schema", + "classification": "selected_project", + "deferred": false, + "line": 11, + "member": null, + "module": "epoch_schema_v5", + "scope": "module" + }, + { + "alias": "copying", + "classification": "selected_project", + "deferred": false, + "line": 12, + "member": null, + "module": "epoch_copy_v5", + "scope": "module" + }, + { + "alias": "stopping", + "classification": "selected_project", + "deferred": false, + "line": 13, + "member": null, + "module": "epoch_stop_v5", + "scope": "module" + } + ], + "independent_pin_basis": "historically independent receiver source map", + "initialization_calls": [ + { + "callee": "set", + "line": 19, + "source": "set()" + }, + { + "callee": "dataclass", + "line": 24, + "source": "dataclass(frozen=True, slots=True)" + }, + { + "callee": "tuple", + "line": 62, + "source": "tuple(ParentCompletion.__dict__[name].__get__ for name in _COMPLETION_FIELDS)" + } + ], + "module": "epoch_parent_v5", + "module_initialization": [ + { + "kind": "Expr", + "line": 1, + "source": "\"\"\"Parent-only single-attempt epoch source; no execution authority is configured.\n\nParent authority and run tickets are identity capabilities in the trusted parent\nprocess. They are never serialized or sent to a child. This is not a Python\nsandbox against code already executing inside that trusted parent. The future\nsource-fixed supervisor must authenticate original compiler/terminal/raw data\nbefore submitting a completion; a child JSON object or saved PASS is not that\ncall. The missing supervisor adapter is an explicit independent-review blocker.\n\"\"\"" + }, + { + "kind": "ImportFrom", + "line": 10, + "source": "from dataclasses import dataclass" + }, + { + "kind": "Import", + "line": 11, + "source": "import epoch_schema_v5 as schema" + }, + { + "kind": "Import", + "line": 12, + "source": "import epoch_copy_v5 as copying" + }, + { + "kind": "Import", + "line": 13, + "source": "import epoch_stop_v5 as stopping" + }, + { + "kind": "Assign", + "line": 15, + "source": "CONFIGURATION = None" + }, + { + "kind": "Assign", + "line": 16, + "source": "SOURCE_REVIEW = None" + }, + { + "kind": "Assign", + "line": 17, + "source": "EXECUTION_APPROVAL = None" + }, + { + "kind": "Assign", + "line": 18, + "source": "FUNDING = None" + }, + { + "kind": "Assign", + "line": 19, + "source": "_RESERVED_EPOCHS = set()" + }, + { + "kind": "Assign", + "line": 20, + "source": "_PARENT_OWNERS = []" + }, + { + "kind": "Assign", + "line": 21, + "source": "_TYPE = type" + }, + { + "bases": [], + "body_execution": "class body and method defaults/decorators execute; methods not called", + "decorators": [ + "dataclass(frozen=True, slots=True)" + ], + "kind": "class_definition", + "line": 25, + "name": "ParentCompletion" + }, + { + "kind": "Assign", + "line": 58, + "source": "_COMPLETION_FIELDS = ('producer_ticket', 'checker_sha256', 'observation_sha256', 'generation', 'mode',\n 'producer_role', 'process_id', 'process_start_ticks', 'direct_child_reaped', 'whole_process_domain_closed',\n 'own_in_process_obligations_authenticated', 'original_attempts_and_logs_authenticated',\n 'final_source_custody_authenticated', 'returned_groups_captured')" + }, + { + "kind": "Assign", + "line": 62, + "source": "_COMPLETION_GETTERS = tuple(ParentCompletion.__dict__[name].__get__ for name in _COMPLETION_FIELDS)" + }, + { + "kind": "Assign", + "line": 107, + "source": "_STATE_KEYS = ('_authority', '_bytes', '_children', '_copies', '_directory', '_epoch_id', '_error_owner', '_failure_fallback', '_generations', '_intent_file', '_manifest', '_manifest_file', '_mode', '_occupied_inodes', '_occupied_paths', '_plans', '_processes', '_producers', '_state', '_stop', '_tickets')" + }, + { + "bases": [], + "body_execution": "class body and method defaults/decorators execute; methods not called", + "decorators": [], + "kind": "class_definition", + "line": 172, + "name": "ParentEpoch" + } + ], + "namespace_bound_actual_capture_proven": false, + "sha256": "058059912144863a4b2bfe4fc9ffc5233b4ab20ee5a7355bde66f4d3f6f28712", + "source_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/h25-data-handling-20261028/areas/field-negative-epoch-v5/epoch_parent_v5.py", + "static_names_plus8_import_metadata": 33, + "static_namespace_name_count": 25, + "static_namespace_names": [ + "CONFIGURATION", + "EXECUTION_APPROVAL", + "FUNDING", + "ParentCompletion", + "ParentEpoch", + "SOURCE_REVIEW", + "_COMPLETION_FIELDS", + "_COMPLETION_GETTERS", + "_PARENT_OWNERS", + "_RESERVED_EPOCHS", + "_STATE_KEYS", + "_TYPE", + "_clone", + "_completion_values", + "_constructor_identity", + "_entry_state", + "_failed_state", + "_gate", + "_plan", + "_registered_parent", + "_registry", + "copying", + "dataclass", + "schema", + "stopping" + ] + }, + { + "bytes": 30668, + "copy_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/epoch_schema_v5.py.txt", + "dynamic_sites": [], + "imports": [ + { + "alias": "hashlib", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 7, + "member": null, + "module": "hashlib", + "scope": "module" + }, + { + "alias": "json", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 8, + "member": null, + "module": "json", + "scope": "module" + }, + { + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "level": 0, + "line": 628, + "members": [ + { + "alias": "_FUNCTION_TYPE", + "name": "FunctionType" + }, + { + "alias": "_CELL_TYPE", + "name": "CellType" + } + ], + "module": "types", + "scope": "module" + } + ], + "independent_pin_basis": "Unit05 frozen author receipt v2 + source-close pin", + "initialization_calls": [ + { + "callee": "tuple", + "line": 404, + "source": "tuple(range(1, 257))" + }, + { + "callee": "range", + "line": 404, + "source": "range(1, 257)" + }, + { + "callee": "EpochStop", + "line": 405, + "source": "EpochStop('epoch IO quarantined; parent teardown required')" + }, + { + "callee": "tuple", + "line": 629, + "source": "tuple(_FUNCTION_TYPE.__dict__[name].__get__ for name in\n ('__code__', '__globals__', '__defaults__', '__kwdefaults__', '__closure__', '__annotations__', '__dict__'))" + } + ], + "module": "epoch_schema_v5", + "module_initialization": [ + { + "kind": "Expr", + "line": 1, + "source": "\"\"\"Finite negative-only data records. No import/load/compile/runtime authority.\n\nSource draft: no target execution has been authorized. These functions are not\nrun during source checks. Every caller must be a separately reviewed fixed\nparent/child source; JSON never creates a parent capability.\n\"\"\"" + }, + { + "kind": "Import", + "line": 7, + "source": "import hashlib" + }, + { + "kind": "Import", + "line": 8, + "source": "import json" + }, + { + "kind": "Assign", + "line": 10, + "source": "SCHEMA = 'h25-negative-build-epoch-v3'" + }, + { + "kind": "Assign", + "line": 11, + "source": "CLAIM_SCHEMA = 'h25-negative-import-claim-v3'" + }, + { + "kind": "Assign", + "line": 12, + "source": "ROLES = ('production', 'watcher', 'bounds', 'pyinit_failure', 'exec_failure')" + }, + { + "kind": "Assign", + "line": 13, + "source": "PRODUCERS = ('group01', 'failure_variants')" + }, + { + "kind": "Assign", + "line": 14, + "source": "GROUPS = ('02', '03', '04', '07', '08', '09', '10', '11', '12', '13', '14', '15', '16')" + }, + { + "kind": "Assign", + "line": 15, + "source": "PROFILE_KEYS = ('source_manifest_sha256', 'project_headers_sha256', 'system_headers_sha256',\n 'compiler_link_sha256', 'link_profile_sha256')" + }, + { + "kind": "Assign", + "line": 17, + "source": "LAUNCH_KEYS = ('configuration_sha256', 'root_sha256', 'stage_sha256', 'command_sha256',\n 'startup_tcb_sha256', 'expected_history_sha256')" + }, + { + "kind": "Assign", + "line": 19, + "source": "FILE_BYTES = 64 * 1024 * 1024" + }, + { + "kind": "Assign", + "line": 20, + "source": "RECORD_BYTES = 1024 * 1024" + }, + { + "kind": "Assign", + "line": 21, + "source": "RAW_RESULT_BYTES = 4 * 1024 * 1024" + }, + { + "kind": "Assign", + "line": 22, + "source": "LOG_BYTES = 2 * 1024 * 1024" + }, + { + "kind": "Assign", + "line": 23, + "source": "JOURNAL_BYTES = 3 * 65536" + }, + { + "kind": "Assign", + "line": 24, + "source": "CHUNK_BYTES = 65536" + }, + { + "kind": "Assign", + "line": 25, + "source": "PATH_BYTES = 4096" + }, + { + "kind": "Assign", + "line": 26, + "source": "MAX_PATH_COMPONENTS = 64" + }, + { + "kind": "Assign", + "line": 27, + "source": "MAX_READ_CALLS = 8192" + }, + { + "kind": "Assign", + "line": 28, + "source": "MAX_WRITE_CALLS = 8192" + }, + { + "kind": "Assign", + "line": 29, + "source": "MAX_RECORD_WRITE_CALLS = 4096" + }, + { + "kind": "Assign", + "line": 30, + "source": "MAX_PRIVATE_COPIES = 41" + }, + { + "kind": "Assign", + "line": 31, + "source": "MAX_EXPORTS = 5" + }, + { + "kind": "Assign", + "line": 32, + "source": "MAX_EPOCH_FILE_BYTES = 46 * FILE_BYTES" + }, + { + "kind": "Assign", + "line": 33, + "source": "IDENTITY_KEYS = ('device', 'inode', 'mode', 'links', 'uid', 'gid', 'size', 'mtime_ns', 'ctime_ns')" + }, + { + "kind": "Assign", + "line": 38, + "source": "_TYPE, _LEN = type, len" + }, + { + "kind": "Assign", + "line": 39, + "source": "_DICT, _LIST, _TUPLE, _STR, _INT, _BOOL, _BYTES = dict, list, tuple, str, int, bool, bytes" + }, + { + "kind": "Assign", + "line": 40, + "source": "MAX_RECORD_KEYS = 256" + }, + { + "kind": "Assign", + "line": 41, + "source": "MAX_SEQUENCE = 256" + }, + { + "kind": "Assign", + "line": 42, + "source": "MAX_WIRE_NODES = 8192" + }, + { + "kind": "Assign", + "line": 43, + "source": "MAX_WIRE_DEPTH = 24" + }, + { + "kind": "Assign", + "line": 44, + "source": "MAX_WIRE_TEXT = 8192" + }, + { + "kind": "Assign", + "line": 45, + "source": "MAX_WIRE_TEXT_TOTAL = 512 * 1024" + }, + { + "bases": [ + "RuntimeError" + ], + "body_execution": "class body and method defaults/decorators execute; methods not called", + "decorators": [], + "kind": "class_definition", + "line": 48, + "name": "EpochStop" + }, + { + "kind": "Assign", + "line": 387, + "source": "ERROR_SLOTS = 64" + }, + { + "kind": "Assign", + "line": 388, + "source": "CASE_SLOTS = 64" + }, + { + "kind": "Assign", + "line": 389, + "source": "MAX_ERROR_ARGS = 2" + }, + { + "kind": "Assign", + "line": 390, + "source": "MAX_ERROR_ARG_CHARS = 256" + }, + { + "kind": "Assign", + "line": 391, + "source": "MAX_SECONDARY_PROJECTIONS = 6" + }, + { + "kind": "Assign", + "line": 392, + "source": "_BASE_ARGS_GET = BaseException.args.__get__" + }, + { + "kind": "Assign", + "line": 393, + "source": "_NATIVE_ERROR_LABELS = (\n (EpochStop, 'EPOCH_STOP'), (RuntimeError, 'RUNTIME_ERROR'),\n (ValueError, 'VALUE_ERROR'), (TypeError, 'TYPE_ERROR'),\n (OSError, 'OS_ERROR'), (FileNotFoundError, 'FILE_NOT_FOUND'),\n (PermissionError, 'PERMISSION_ERROR'), (InterruptedError, 'INTERRUPTED_ERROR'),\n (BlockingIOError, 'BLOCKING_IO_ERROR'), (MemoryError, 'MEMORY_ERROR'),\n (KeyboardInterrupt, 'KEYBOARD_INTERRUPT'), (SystemExit, 'SYSTEM_EXIT'),\n (OverflowError, 'OVERFLOW_ERROR'), (RecursionError, 'RECURSION_ERROR'),\n (UnicodeDecodeError, 'UNICODE_DECODE_ERROR'))" + }, + { + "kind": "Assign", + "line": 404, + "source": "CUSTODY_SUCCESSORS = tuple(range(1, 257))" + }, + { + "kind": "Assign", + "line": 405, + "source": "IO_QUARANTINE_ERROR = EpochStop('epoch IO quarantined; parent teardown required')" + }, + { + "bases": [], + "body_execution": "class body and method defaults/decorators execute; methods not called", + "decorators": [], + "kind": "class_definition", + "line": 408, + "name": "ErrorOwner" + }, + { + "kind": "Assign", + "line": 412, + "source": "_OWNER_GET = ErrorOwner._state.__get__" + }, + { + "kind": "Assign", + "line": 413, + "source": "_OWNER_SET = ErrorOwner._state.__set__" + }, + { + "kind": "Assign", + "line": 414, + "source": "_OBJECT_NEW = object.__new__" + }, + { + "kind": "ImportFrom", + "line": 628, + "source": "from types import FunctionType as _FUNCTION_TYPE, CellType as _CELL_TYPE" + }, + { + "kind": "Assign", + "line": 629, + "source": "_FUNCTION_GETTERS = tuple(_FUNCTION_TYPE.__dict__[name].__get__ for name in\n ('__code__', '__globals__', '__defaults__', '__kwdefaults__', '__closure__', '__annotations__', '__dict__'))" + }, + { + "kind": "Assign", + "line": 631, + "source": "_CELL_GET = _CELL_TYPE.cell_contents.__get__" + } + ], + "namespace_bound_actual_capture_proven": false, + "sha256": "b89a789654be87bde40a47300f4d9702dce2b90e6ab3be9a2025f6d8041b3e9a", + "source_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/epoch_schema_v5.py", + "static_names_plus8_import_metadata": 105, + "static_namespace_name_count": 97, + "static_namespace_names": [ + "CASE_SLOTS", + "CHUNK_BYTES", + "CLAIM_SCHEMA", + "CUSTODY_SUCCESSORS", + "ERROR_SLOTS", + "EpochStop", + "ErrorOwner", + "FILE_BYTES", + "GROUPS", + "IDENTITY_KEYS", + "IO_QUARANTINE_ERROR", + "JOURNAL_BYTES", + "LAUNCH_KEYS", + "LOG_BYTES", + "MAX_EPOCH_FILE_BYTES", + "MAX_ERROR_ARGS", + "MAX_ERROR_ARG_CHARS", + "MAX_EXPORTS", + "MAX_PATH_COMPONENTS", + "MAX_PRIVATE_COPIES", + "MAX_READ_CALLS", + "MAX_RECORD_KEYS", + "MAX_RECORD_WRITE_CALLS", + "MAX_SECONDARY_PROJECTIONS", + "MAX_SEQUENCE", + "MAX_WIRE_DEPTH", + "MAX_WIRE_NODES", + "MAX_WIRE_TEXT", + "MAX_WIRE_TEXT_TOTAL", + "MAX_WRITE_CALLS", + "PATH_BYTES", + "PRODUCERS", + "PROFILE_KEYS", + "RAW_RESULT_BYTES", + "RECORD_BYTES", + "ROLES", + "SCHEMA", + "_BASE_ARGS_GET", + "_BOOL", + "_BYTES", + "_CELL_GET", + "_CELL_TYPE", + "_DICT", + "_FUNCTION_GETTERS", + "_FUNCTION_TYPE", + "_INT", + "_LEN", + "_LIST", + "_NATIVE_ERROR_LABELS", + "_OBJECT_NEW", + "_OWNER_GET", + "_OWNER_SET", + "_STR", + "_TUPLE", + "_TYPE", + "_pairs", + "_plain", + "_reject_constant", + "blob", + "boolean", + "build", + "canonical", + "capture_original_function", + "case_slot", + "check_original_function", + "choice", + "claim", + "close_attempt", + "close_confirmed", + "decode", + "digest", + "epoch", + "error_snapshot", + "exact", + "hashlib", + "imported_inputs", + "inode", + "integer", + "json", + "label", + "launch", + "make_error_owner", + "need", + "owner_state", + "path", + "plain_copy", + "prepare_case_shadow", + "producer", + "profile", + "project_error", + "record_case", + "required_roles", + "retain_primary", + "retain_secondary", + "sequence", + "sha", + "text" + ] + }, + { + "bytes": 8205, + "copy_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/epoch_stop_v5.py.txt", + "dynamic_sites": [], + "imports": [ + { + "alias": "schema", + "classification": "selected_project", + "deferred": false, + "line": 6, + "member": null, + "module": "epoch_schema_v5", + "scope": "module" + }, + { + "alias": "copying", + "classification": "selected_project", + "deferred": false, + "line": 7, + "member": null, + "module": "epoch_copy_v5", + "scope": "module" + } + ], + "independent_pin_basis": "historically independent receiver source map", + "initialization_calls": [], + "module": "epoch_stop_v5", + "module_initialization": [ + { + "kind": "Expr", + "line": 1, + "source": "\"\"\"Opaque error evidence and original-source-admitted per-case raw capture.\n\nSource only. Registry/factory provenance must be established by the authenticated\nRoot before adverse work. There is no arbitrary supplied callback or retry path.\n\"\"\"" + }, + { + "kind": "Import", + "line": 6, + "source": "import epoch_schema_v5 as schema" + }, + { + "kind": "Import", + "line": 7, + "source": "import epoch_copy_v5 as copying" + }, + { + "kind": "Assign", + "line": 9, + "source": "STOP_CONFIGURATION = None" + }, + { + "kind": "Assign", + "line": 10, + "source": "STOP_EXECUTION_APPROVAL = None" + }, + { + "kind": "Assign", + "line": 11, + "source": "STOP_FUNDING = None" + }, + { + "kind": "Assign", + "line": 12, + "source": "STOP_BYTES = 65536" + }, + { + "kind": "Assign", + "line": 13, + "source": "_TYPE, _LEN = type, len" + }, + { + "kind": "Assign", + "line": 14, + "source": "_SINK_REGISTRY = []" + } + ], + "namespace_bound_actual_capture_proven": false, + "sha256": "5b10c9d72dd0e646652a73b6ffe9ba870762d6bc2f7432bc6b06571a1b7d2a6f", + "source_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/h25-data-handling-20261028/areas/field-negative-epoch-v5/epoch_stop_v5.py", + "static_names_plus8_import_metadata": 22, + "static_namespace_name_count": 14, + "static_namespace_names": [ + "STOP_BYTES", + "STOP_CONFIGURATION", + "STOP_EXECUTION_APPROVAL", + "STOP_FUNDING", + "_LEN", + "_SINK_REGISTRY", + "_TYPE", + "_gate", + "capture_case", + "check_raw_sink", + "copying", + "make_raw_sink", + "retain_stop", + "schema" + ] + }, + { + "bytes": 15610, + "copy_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/group01_evidence_v1.py.txt", + "dynamic_sites": [], + "imports": [ + { + "alias": "json", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 8, + "member": null, + "module": "json", + "scope": "module" + }, + { + "alias": "math", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 9, + "member": null, + "module": "math", + "scope": "module" + }, + { + "alias": "schema", + "classification": "selected_project", + "deferred": false, + "line": 10, + "member": null, + "module": "epoch_schema_v5", + "scope": "module" + }, + { + "alias": "copying", + "classification": "selected_project", + "deferred": false, + "line": 11, + "member": null, + "module": "epoch_copy_v5", + "scope": "module" + }, + { + "alias": "original_build", + "classification": "selected_project", + "deferred": false, + "line": 12, + "member": null, + "module": "original_build_provenance_v5", + "scope": "module" + }, + { + "alias": "closure", + "classification": "selected_project", + "deferred": false, + "line": 13, + "member": null, + "module": "parent_closure_v1", + "scope": "module" + }, + { + "alias": "original_predicates", + "classification": "selected_project", + "deferred": false, + "line": 14, + "member": null, + "module": "group01_original_predicates_v1", + "scope": "module" + } + ], + "independent_pin_basis": "Unit05 frozen author receipt v2 + source-close pin", + "initialization_calls": [], + "module": "group01_evidence_v1", + "module_initialization": [ + { + "kind": "Expr", + "line": 1, + "source": "\"\"\"Parent data replay of the exact unchanged Group01 finite producer route.\n\nAll arguments come from the owning parent registry and independently frozen\nprelaunch plan. A parsed status never establishes process ownership, native\ncorrectness or historical source continuity. Those are separate original\nsource/runtime and owned-domain obligations. No function was executed here.\n\"\"\"" + }, + { + "kind": "Import", + "line": 8, + "source": "import json" + }, + { + "kind": "Import", + "line": 9, + "source": "import math" + }, + { + "kind": "Import", + "line": 10, + "source": "import epoch_schema_v5 as schema" + }, + { + "kind": "Import", + "line": 11, + "source": "import epoch_copy_v5 as copying" + }, + { + "kind": "Import", + "line": 12, + "source": "import original_build_provenance_v5 as original_build" + }, + { + "kind": "Import", + "line": 13, + "source": "import parent_closure_v1 as closure" + }, + { + "kind": "Import", + "line": 14, + "source": "import group01_original_predicates_v1 as original_predicates" + }, + { + "kind": "Assign", + "line": 16, + "source": "_TYPE, _LEN = type, len" + }, + { + "kind": "Assign", + "line": 17, + "source": "GROUP_ORDER = ('native', 'transport', 'collector', 'pure_initial', 'pure_extended',\n 'pure_combined', 'root_model', 'sink_close_model', 'projection_model', 'aggregate')" + }, + { + "kind": "Assign", + "line": 19, + "source": "GROUP_KEYS = ('native', 'transport', 'collector', 'elf', 'providers', 'elf_extended')" + }, + { + "kind": "Assign", + "line": 20, + "source": "MAX_JSON_NODES = 200000" + }, + { + "kind": "Assign", + "line": 21, + "source": "MAX_JSON_BYTES = 4 * 1024 * 1024" + }, + { + "kind": "Assign", + "line": 22, + "source": "FINITE_KEYS = ('status', 'lanes', 'data_handling', 'data_source_custody', 'optimized',\n 'original_controls', 'new_controls', 'new_source_custody', 'driver_sha256',\n 'initial_native_tcb', 'initial_native_tcb_restoration', 'native_packet',\n 'reference_driver_sha256', 'phases')" + } + ], + "namespace_bound_actual_capture_proven": false, + "sha256": "05ec6a63c57340ba929aea1fab71b096efc143e099346640f6def41310bd3e25", + "source_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/group01_evidence_v1.py", + "static_names_plus8_import_metadata": 32, + "static_namespace_name_count": 24, + "static_namespace_names": [ + "FINITE_KEYS", + "GROUP_KEYS", + "GROUP_ORDER", + "MAX_JSON_BYTES", + "MAX_JSON_NODES", + "_LEN", + "_TYPE", + "_captured_call", + "_legacy_controls", + "_pairs", + "_plain", + "_read", + "_reject", + "authenticate_group01", + "closure", + "copying", + "decode", + "encode", + "json", + "math", + "original_build", + "original_predicates", + "same_json", + "schema" + ] + }, + { + "bytes": 23224, + "copy_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/group01_original_predicates_v1.py.txt", + "dynamic_sites": [], + "imports": [ + { + "classification": "selected_project", + "deferred": false, + "level": 0, + "line": 7, + "members": [ + { + "alias": "need", + "name": "need" + } + ], + "module": "epoch_schema_v5", + "scope": "module" + } + ], + "independent_pin_basis": "historically independent receiver source map", + "initialization_calls": [], + "module": "group01_original_predicates_v1", + "module_initialization": [ + { + "kind": "Expr", + "line": 1, + "source": "\"\"\"Source-derived original receipt predicates; no controls are executed here.\n\nThe exact original _check_controls body is retained, with only an explicit\nchild optimization integer and literal native status expansion. This\nreplays the existing result predicates, not the underlying native tests.\n\"\"\"" + }, + { + "kind": "ImportFrom", + "line": 7, + "source": "from epoch_schema_v5 import need" + }, + { + "kind": "Assign", + "line": 9, + "source": "EXPECTED_CACHE_TRANSCRIPT_RECORDS = 155" + }, + { + "kind": "Assign", + "line": 11, + "source": "EXPECTED_V7_CONSUMER_CASES = ('source-before-native', 'source-before-trace', 'builtin-before-native', 'builtin-shadow-and-key-cleanup', 'row-calling-environment-full-and-light', 'row-key-first-error-and-cleanup', 'actual-row-native-observation', 'cold-_code_named-code', 'cold-_code_named-defaults', 'cold-_code_named-globals', 'cold-_check_factory_environment-code', 'cold-_check_factory_environment-defaults', 'cold-_check_factory_environment-globals', 'final-class-__init__-code', 'final-class-__init__-defaults', 'final-class-__init__-closure', 'final-class-check-code', 'final-class-check-defaults', 'final-class-check-closure', 'final-class-check_backend-code', 'final-class-check_backend-defaults', 'final-class-check_backend-closure', 'unregistered-final-subclass', 'restored-final-class-binds')" + }, + { + "kind": "Assign", + "line": 13, + "source": "EXPECTED_V8_CALLER_CASES = ('cold-dispatcher-code', 'cold-dispatcher-defaults', 'cold-dispatcher-kwdefaults', 'cold-dispatcher-closure', 'runtime-dispatcher-code', 'runtime-dispatcher-defaults', 'runtime-dispatcher-kwdefaults', 'runtime-dispatcher-closure', 'runtime-collector-code', 'runtime-collector-defaults', 'runtime-collector-kwdefaults', 'runtime-collector-closure')" + }, + { + "kind": "Assign", + "line": 15, + "source": "EXPECTED_AUTHORITY_CONTROL_CASES = ('A1-authority-entry-and-helper-fields', 'A2-caller-dispatcher-fields', 'A3-every-owned-module-helper', 'A4-registered-product-methods-and-closure-helpers', 'A5-foreign-key-failure-disposal', 'A6-runtime-child-dispatcher-and-helper-fields')" + }, + { + "kind": "Assign", + "line": 17, + "source": "_CONTROL_CONTRACT = {'cache_counts': {'binding_rejections': 12,\n 'cases': 29,\n 'requests': 71,\n 'source_admission_rejections': 2,\n 'tamper_rejections': 1,\n 'unsupported_rejections': 2},\n 'construction_normal_names': ['complete-constructor-h8',\n 'complete-constructor-h9',\n 'exact-add-0',\n 'exact-add-1',\n 'exact-add-2',\n 'exact-add-3',\n 'exact-add-4',\n 'exact-add-5',\n 'exact-add-6',\n 'exact-add-7',\n 'exact-add-8',\n 'exact-add-9',\n 'exact-add-10',\n 'overlap-assertion-matching-mode',\n 'negative-index',\n 'index-outside',\n 'none-index',\n 'float-index',\n 'bool-index',\n 'unhashable-kind',\n 'mask-callback',\n 'index-callback',\n 'kind-callback',\n 'support-callback',\n 'lookup-callback',\n 'unarmed-construction-remains-incremental',\n 'retired-complete-index-and-private-snapshot',\n 'resumed-run-loses-frozen-tail-qualification',\n 'resumed-duplicate-restores-same-dictionary',\n 'reinitialized-run-loses-qualification-h8',\n 'retired-object-literal-reinitialization-h8',\n 'reinitialized-run-loses-qualification-h9',\n 'retired-object-literal-reinitialization-h9',\n 'reinitialized-run-loses-qualification-h7',\n 'retired-object-literal-reinitialization-h7',\n 'resumption-restores-original-index-after-graph-edits',\n 'lookup-entry-mutation',\n 'lookup-replacement',\n 'snapshot-binding',\n 'double-finalize',\n 'wrong-finalizer',\n 'factory-rejects-changed-original-add',\n 'factory-rejects-source-builtin-shadow',\n 'seal-rejects-late-add-replacement',\n 'scope-cannot-be-rearmed',\n 'hook-bearing-constructor-trace',\n 'hook-bearing-constructor-profile',\n 'hook-bearing-constructor-gc',\n 'hook-bearing-constructor-thread',\n 'hook-bearing-constructor-signal',\n 'hook-bearing-constructor-monitoring',\n 'invalid-dimension-original-assertion',\n 'malformed-complete-index-before-clear',\n 'generic-subclass-add-fallback',\n 'factory-rejects-original-defaults',\n 'factory-rejects-original-code',\n 'factory-rejects-original-helper',\n 'factory-rejects-original-descriptor',\n 'owner-rejects-changed-wrapper-defaults',\n 'public-total-helper-restores-before-add',\n 'p1-original-authentication-and-final-wrapper-composition'],\n 'construction_optimized_names': ['complete-constructor-h8',\n 'complete-constructor-h9',\n 'exact-add-0',\n 'exact-add-1',\n 'exact-add-2',\n 'exact-add-3',\n 'exact-add-4',\n 'exact-add-5',\n 'exact-add-6',\n 'exact-add-7',\n 'exact-add-8',\n 'exact-add-9',\n 'exact-add-10',\n 'overlap-assertion-matching-mode',\n 'negative-index',\n 'index-outside',\n 'none-index',\n 'float-index',\n 'bool-index',\n 'unhashable-kind',\n 'mask-callback',\n 'index-callback',\n 'kind-callback',\n 'support-callback',\n 'lookup-callback',\n 'unarmed-construction-remains-incremental',\n 'retired-complete-index-and-private-snapshot',\n 'resumed-run-loses-frozen-tail-qualification',\n 'resumed-duplicate-restores-same-dictionary',\n 'reinitialized-run-loses-qualification-h8',\n 'retired-object-literal-reinitialization-h8',\n 'reinitialized-run-loses-qualification-h9',\n 'retired-object-literal-reinitialization-h9',\n 'reinitialized-run-loses-qualification-h7',\n 'retired-object-literal-reinitialization-h7',\n 'resumption-restores-original-index-after-graph-edits',\n 'lookup-entry-mutation',\n 'lookup-replacement',\n 'snapshot-binding',\n 'double-finalize',\n 'wrong-finalizer',\n 'factory-rejects-changed-original-add',\n 'factory-rejects-source-builtin-shadow',\n 'seal-rejects-late-add-replacement',\n 'scope-cannot-be-rearmed',\n 'hook-bearing-constructor-trace',\n 'hook-bearing-constructor-profile',\n 'hook-bearing-constructor-gc',\n 'hook-bearing-constructor-thread',\n 'hook-bearing-constructor-signal',\n 'hook-bearing-constructor-monitoring',\n 'malformed-complete-index-before-clear',\n 'generic-subclass-add-fallback',\n 'factory-rejects-original-defaults',\n 'factory-rejects-original-code',\n 'factory-rejects-original-helper',\n 'factory-rejects-original-descriptor',\n 'owner-rejects-changed-wrapper-defaults',\n 'public-total-helper-restores-before-add',\n 'p1-original-authentication-and-final-wrapper-composition'],\n 'inventory_cases': [['valid', 'value'],\n ['list-pins', 'value'],\n ['wrong-digest', 'error'],\n ['missing', 'error'],\n ['extra', 'error'],\n ['extra-nonexact', 'value'],\n ['symlink', 'error'],\n ['root-symlink', 'error'],\n ['changed-mode', 'value'],\n ['fresh-call-after-mutation', 'error'],\n ['restored', 'value']],\n 'rank_guard_mutation_names': ['__code__',\n '__defaults__',\n '__kwdefaults__',\n '_LEN',\n '_GET',\n '_MAX_ENTRIES',\n 'make_row_interner',\n 'make_runtime_guard',\n 'builtin/len',\n 'builtin/int',\n 'cell/exact_int',\n 'cell/exact_tuple',\n 'cell/exact_type',\n 'cell/get',\n 'cell/length',\n 'cell/max_entries',\n 'cell/max_rows',\n 'cell/max_value',\n 'cell/missing',\n 'cell/table',\n 'empty-cell'],\n 'serialization_names': ['ordinary',\n 'empty',\n 'rows-1',\n 'rows-1023',\n 'rows-1024',\n 'rows-1025',\n 'rows-2048',\n 'byte-bound-169',\n 'byte-bound-170',\n 'byte-bound-171',\n 'scalars-unicode-wide',\n 'wide-unlimited',\n 'wide-digit-error',\n 'interned-rank-rows',\n 'depth-30',\n 'depth-33',\n 'circular',\n 'callback-list',\n 'callback-dict',\n 'callback-error',\n 'int-subclass',\n 'unsupported-object',\n 'malformed-result',\n 'malformed-witness',\n 'malformed-rank',\n 'nonstring-supported-keys',\n 'expected-result_sha256',\n 'expected-exact_witness_sha256',\n 'expected-rank_trace_sha256',\n 'expected-rank_call_count',\n 'expected-rank_distinct_matrix_count',\n 'failure-stage_create',\n 'failure-stage_open',\n 'failure-stage_write',\n 'failure-stage_flush',\n 'failure-stage_after_close',\n 'failure-stage_hash',\n 'failure-final_open-result.json',\n 'failure-final_write-result.json',\n 'failure-final_flush-result.json',\n 'failure-final_after_close-result.json',\n 'failure-final_open-witness.json',\n 'failure-final_write-witness.json',\n 'failure-final_flush-witness.json',\n 'failure-final_after_close-witness.json',\n 'failure-final_open-rank-trace.json',\n 'failure-final_write-rank-trace.json',\n 'failure-final_flush-rank-trace.json',\n 'failure-final_after_close-rank-trace.json',\n 'short-final-0',\n 'short-final-1',\n 'copy-corrupt-content',\n 'stage-mutated-size',\n 'copy-read-error',\n 'copy-hash-error',\n 'cleanup-unlink-error',\n 'cleanup-rmdir-error',\n 'primary-plus-close-error',\n 'primary-plus-manifest-error',\n 'drift-reference_global',\n 'drift-json_default',\n 'drift-expected_value',\n 'drift-effective_builtin',\n 'drift-json_global_shadow',\n 'drift-keyword_default',\n 'exit-json-drift',\n 'fallback-exit-json-drift',\n 'existing-finals',\n 'state-mutation-between-writes',\n 'path-subclass-fallback']}" + }, + { + "kind": "Assign", + "line": 247, + "source": "DATA_CONTROL_STATUS = {\n 'construction': 'PASS',\n 'serialization': 'SERIALIZATION_FINITE_PASS',\n 'cache_validity': 'PASS',\n 'cold_authority': 'PASS',\n 'rank_metadata': 'AREA6_METADATA_HELPER_CONTROLS_PASS',\n 'rank_native': 'NATIVE_OBSERVATION_DIFFERENTIAL_CONTROLS_PASS',\n 'inventory': 'INVENTORY_DIFFERENTIAL_CONTROLS_PASS',\n 'combined_composition': 'BOUNDED_COMBINED_COMPOSITION_PASS',\n 'cache_reference_v3': 'PASS',\n 'native_initial_tcb': 'NATIVE_INITIAL_TCB_CONTROLS_PASS',\n **{'native_probe': 'NATIVE_METADATA_CONTROLS_PASS', 'bootstrap_preload': 'BOOTSTRAP_PRELOAD_CONTROLS_PASS', 'bootstrap_late': 'BOOTSTRAP_LATE_CONTROL_PASS', 'native_metadata': 'PASS', 'native_fields': 'SOURCE_CONTROL_OBSERVATIONS_COMPLETE_RUNTIME_GATE_OPEN'},\n}" + } + ], + "namespace_bound_actual_capture_proven": false, + "sha256": "fb9e6e11b39b76ab8652c546fd76c06d662ea4116376abcc2a6267bb4783dbfd", + "source_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/h25-data-handling-20261028/areas/field-parent-completion-v2/group01_original_predicates_v1.py", + "static_names_plus8_import_metadata": 16, + "static_namespace_name_count": 8, + "static_namespace_names": [ + "DATA_CONTROL_STATUS", + "EXPECTED_AUTHORITY_CONTROL_CASES", + "EXPECTED_CACHE_TRANSCRIPT_RECORDS", + "EXPECTED_V7_CONSUMER_CASES", + "EXPECTED_V8_CALLER_CASES", + "_CONTROL_CONTRACT", + "check_original_control_union", + "need" + ] + }, + { + "bytes": 23047, + "copy_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/h25_parent_supervisor.py.txt", + "dynamic_sites": [ + { + "callee": "ctypes.CDLL", + "deferred": true, + "line": 161, + "scope": "module.install_subreaper", + "source": "ctypes.CDLL(LIBC, use_errno=True)" + } + ], + "imports": [ + { + "alias": "fcntl", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 8, + "member": null, + "module": "fcntl", + "scope": "module" + }, + { + "alias": "hashlib", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 9, + "member": null, + "module": "hashlib", + "scope": "module" + }, + { + "alias": "json", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 10, + "member": null, + "module": "json", + "scope": "module" + }, + { + "alias": "os", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 11, + "member": null, + "module": "os", + "scope": "module" + }, + { + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "level": 0, + "line": 12, + "members": [ + { + "alias": "Path", + "name": "Path" + } + ], + "module": "pathlib", + "scope": "module" + }, + { + "alias": "resource", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 13, + "member": null, + "module": "resource", + "scope": "module" + }, + { + "alias": "signal", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 14, + "member": null, + "module": "signal", + "scope": "module" + }, + { + "alias": "stat", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 15, + "member": null, + "module": "stat", + "scope": "module" + }, + { + "alias": "subprocess", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 16, + "member": null, + "module": "subprocess", + "scope": "module" + }, + { + "alias": "sys", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 17, + "member": null, + "module": "sys", + "scope": "module" + }, + { + "alias": "time", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 18, + "member": null, + "module": "time", + "scope": "module" + }, + { + "alias": "ctypes", + "classification": "deferred_stdlib_T0_or_original_native_supplement", + "deferred": true, + "line": 157, + "member": null, + "module": "ctypes", + "scope": "module.install_subreaper" + } + ], + "independent_pin_basis": "Unit05 frozen author receipt v2 + source-close pin", + "initialization_calls": [], + "module": "h25_parent_supervisor", + "module_initialization": [ + { + "kind": "Expr", + "line": 1, + "source": "\"\"\"Parent-only bounded process supervision; imports no candidate implementation.\n\nThe runtime caller must establish the trusted clean launcher before calling us.\nThis source was prepared without loading ctypes or running any control. The\nclosed single-threaded child domain is an explicit premise, not a hostile-fork\nsandbox. Numeric process IDs are never used as signal destinations.\n\"\"\"" + }, + { + "kind": "Import", + "line": 8, + "source": "import fcntl" + }, + { + "kind": "Import", + "line": 9, + "source": "import hashlib" + }, + { + "kind": "Import", + "line": 10, + "source": "import json" + }, + { + "kind": "Import", + "line": 11, + "source": "import os" + }, + { + "kind": "ImportFrom", + "line": 12, + "source": "from pathlib import Path" + }, + { + "kind": "Import", + "line": 13, + "source": "import resource" + }, + { + "kind": "Import", + "line": 14, + "source": "import signal" + }, + { + "kind": "Import", + "line": 15, + "source": "import stat" + }, + { + "kind": "Import", + "line": 16, + "source": "import subprocess" + }, + { + "kind": "Import", + "line": 17, + "source": "import sys" + }, + { + "kind": "Import", + "line": 18, + "source": "import time" + }, + { + "kind": "Assign", + "line": 20, + "source": "FLAGS = ('-S', '-s', '-P', '-B')" + }, + { + "kind": "Assign", + "line": 21, + "source": "ENV = {'PATH': '/usr/bin:/bin', 'PYTHONHASHSEED': '0', 'LANG': 'C.UTF-8',\n 'LC_ALL': 'C.UTF-8', 'TZ': 'UTC', 'PYTHONDONTWRITEBYTECODE': '1'}" + }, + { + "kind": "Assign", + "line": 23, + "source": "RUNNER_SHA = 'bd882e3dadb1b6aeaa63ee824f1a1c58f8ef2546b6840a2bffa46885a184d3eb'" + }, + { + "kind": "Assign", + "line": 24, + "source": "QUEUE_SHA = '1348a7b4d7cc1f9fef556f5e0abdaf04411a998afdcd574d7812c76ab37dcf68'" + }, + { + "kind": "Assign", + "line": 25, + "source": "TCB_SHA = '610492b3fc06baa0560175edc3ba27057de00d00b8fd3d58dbe55e5a371c042a'" + }, + { + "kind": "Assign", + "line": 26, + "source": "LIBC = '/usr/lib/x86_64-linux-gnu/libc.so.6'" + }, + { + "kind": "Assign", + "line": 27, + "source": "NATIVE_PINS = {\n LIBC: '3a15d66867d83762c7f2f1e37359cb8f6c5743edb369c65285cb0b1c4f7498bf',\n '/usr/lib/python3.12/lib-dynload/_ctypes.cpython-312-x86_64-linux-gnu.so': 'aad3e24f186e6c0a1c7efa8f16004f951f527db86f6451d30118657384a456c1',\n '/usr/lib/x86_64-linux-gnu/libffi.so.8.1.4': '00f593fe192f2851b8ce23b25cec2488d769beb5a8f63e8c9e563071e1075153',\n '/usr/lib/python3.12/ctypes/__init__.py': '0782592567ad71097198a3afe985ac3e2ea0b9b5e75452402c9460c89a86318a',\n '/usr/lib/python3.12/ctypes/_endian.py': 'c5d692bdce10dfee242752620061bab684633bc72445a3def484961ef1bdbf3a',\n}" + }, + { + "kind": "Assign", + "line": 34, + "source": "CHUNK = 65536" + }, + { + "kind": "Assign", + "line": 35, + "source": "LOG_CAP = 2 * 1024 * 1024" + }, + { + "kind": "Assign", + "line": 36, + "source": "META_CAP = 256 * 1024" + }, + { + "kind": "Assign", + "line": 37, + "source": "CLEANUP_SECONDS = 2.0" + }, + { + "bases": [ + "RuntimeError" + ], + "body_execution": "class body and method defaults/decorators execute; methods not called", + "decorators": [], + "kind": "class_definition", + "line": 211, + "name": "ExecutionDeadline" + }, + { + "bases": [], + "body_execution": "class body and method defaults/decorators execute; methods not called", + "decorators": [], + "kind": "class_definition", + "line": 219, + "name": "OwnedDomain" + } + ], + "namespace_bound_actual_capture_proven": false, + "sha256": "cfb09a18dd10b597cc6d5a8139ee769bef679bc44ae029329755e3d97b055075", + "source_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/h25_parent_supervisor.py", + "static_names_plus8_import_metadata": 51, + "static_namespace_name_count": 43, + "static_namespace_names": [ + "CHUNK", + "CLEANUP_SECONDS", + "ENV", + "ExecutionDeadline", + "FLAGS", + "LIBC", + "LOG_CAP", + "META_CAP", + "NATIVE_PINS", + "OwnedDomain", + "Path", + "QUEUE_SHA", + "RUNNER_SHA", + "TCB_SHA", + "budget", + "census", + "children_now", + "deadline_handler", + "fcntl", + "generation", + "hashlib", + "identity", + "install_subreaper", + "json", + "launch_contract", + "ledger", + "need", + "os", + "packet_unchanged", + "parent_lock", + "proc", + "read_json", + "reconcile_missing_receipt", + "resource", + "run_root", + "signal", + "stable_file", + "stat", + "stop_supplement", + "subprocess", + "sys", + "time", + "write_new" + ] + }, + { + "bytes": 16024, + "copy_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/original_build_provenance_v5.py.txt", + "dynamic_sites": [], + "imports": [ + { + "alias": "json", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 6, + "member": null, + "module": "json", + "scope": "module" + }, + { + "alias": "schema", + "classification": "selected_project", + "deferred": false, + "line": 7, + "member": null, + "module": "epoch_schema_v5", + "scope": "module" + }, + { + "alias": "copying", + "classification": "selected_project", + "deferred": false, + "line": 8, + "member": null, + "module": "epoch_copy_v5", + "scope": "module" + } + ], + "independent_pin_basis": "historically independent receiver source map", + "initialization_calls": [], + "module": "original_build_provenance_v5", + "module_initialization": [ + { + "kind": "Expr", + "line": 1, + "source": "\"\"\"Strict source-only parser for the unchanged original helper/triple protocol.\n\nNo function is invoked during source work. Independent parent launch, actual\nproducer PID/generation, source closure and whole-domain evidence remain required.\n\"\"\"" + }, + { + "kind": "Import", + "line": 6, + "source": "import json" + }, + { + "kind": "Import", + "line": 7, + "source": "import epoch_schema_v5 as schema" + }, + { + "kind": "Import", + "line": 8, + "source": "import epoch_copy_v5 as copying" + }, + { + "kind": "Assign", + "line": 10, + "source": "PARSER_CONFIGURATION = None" + }, + { + "kind": "Assign", + "line": 11, + "source": "PARSER_EXECUTION_APPROVAL = None" + }, + { + "kind": "Assign", + "line": 12, + "source": "PARSER_FUNDING = None" + }, + { + "kind": "Assign", + "line": 13, + "source": "_TYPE, _LEN = type, len" + }, + { + "kind": "Assign", + "line": 14, + "source": "ORIGINAL_HELPER_SHA256 = 'aa0a315110e031e19291970c9611fe5e0f91465fa20eaec51e81186099563f78'" + }, + { + "kind": "Assign", + "line": 15, + "source": "PRODUCTION_HEADERS = ('field_service_v1.h', 'field_loader_snapshot_v1.h')" + }, + { + "kind": "Assign", + "line": 16, + "source": "PRELAUNCH_KEYS = ('schema', 'status', 'command', 'timeout_seconds', 'context',\n 'stdout_path', 'stderr_path', 'attempt_path', 'journal_path', 'process_group_policy',\n 'operational_log_threshold_bytes', 'child_only_inherited_hard_file_limit_bytes',\n 'returncode', 'process_id', 'direct_child_reaped', 'spawn_entered', 'spawn_returned',\n 'descendant_termination_joined', 'failure_log_hashes_final')" + }, + { + "kind": "Assign", + "line": 21, + "source": "STARTED_KEYS = PRELAUNCH_KEYS + ('parent_file_limits_before', 'preexec_code_sha256', 'single_thread_before_spawn')" + }, + { + "kind": "Assign", + "line": 22, + "source": "FINAL_KEYS = STARTED_KEYS + ('logs', 'parent_file_limits_after')" + } + ], + "namespace_bound_actual_capture_proven": false, + "sha256": "bd5ffd9a1c221e0945527fc8fa8d0ad4eb36b9a8884503451c1b6b12d00007ea", + "source_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/h25-data-handling-20261028/areas/field-negative-epoch-v5/original_build_provenance_v5.py", + "static_names_plus8_import_metadata": 28, + "static_namespace_name_count": 20, + "static_namespace_names": [ + "FINAL_KEYS", + "ORIGINAL_HELPER_SHA256", + "PARSER_CONFIGURATION", + "PARSER_EXECUTION_APPROVAL", + "PARSER_FUNDING", + "PRELAUNCH_KEYS", + "PRODUCTION_HEADERS", + "STARTED_KEYS", + "_LEN", + "_TYPE", + "_census", + "_context", + "_decode_original", + "_event", + "_limits", + "_source_row", + "authenticate_original_build", + "copying", + "json", + "schema" + ] + }, + { + "bytes": 13463, + "copy_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/parent_closure_v1.py.txt", + "dynamic_sites": [ + { + "callee": "_COMPILE", + "deferred": true, + "line": 158, + "scope": "module.bind_receivers", + "source": "_COMPILE(raw, pin['path'], 'exec', dont_inherit=True, optimize=sys.flags.optimize)" + } + ], + "imports": [ + { + "alias": "ast", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 9, + "member": null, + "module": "ast", + "scope": "module" + }, + { + "alias": "builtins", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 10, + "member": null, + "module": "builtins", + "scope": "module" + }, + { + "alias": "__future__", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 11, + "member": null, + "module": "__future__", + "scope": "module" + }, + { + "alias": "copy", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 12, + "member": null, + "module": "copy", + "scope": "module" + }, + { + "alias": "dataclasses", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 13, + "member": null, + "module": "dataclasses", + "scope": "module" + }, + { + "alias": "fcntl", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 14, + "member": null, + "module": "fcntl", + "scope": "module" + }, + { + "alias": "gc", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 15, + "member": null, + "module": "gc", + "scope": "module" + }, + { + "alias": "hashlib", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 16, + "member": null, + "module": "hashlib", + "scope": "module" + }, + { + "alias": "json", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 17, + "member": null, + "module": "json", + "scope": "module" + }, + { + "alias": "marshal", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 18, + "member": null, + "module": "marshal", + "scope": "module" + }, + { + "alias": "math", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 19, + "member": null, + "module": "math", + "scope": "module" + }, + { + "alias": "os", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 20, + "member": null, + "module": "os", + "scope": "module" + }, + { + "alias": "pathlib", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 21, + "member": null, + "module": "pathlib", + "scope": "module" + }, + { + "alias": "posix", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 22, + "member": null, + "module": "posix", + "scope": "module" + }, + { + "alias": "resource", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 23, + "member": null, + "module": "resource", + "scope": "module" + }, + { + "alias": "signal", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 24, + "member": null, + "module": "signal", + "scope": "module" + }, + { + "alias": "struct", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 25, + "member": null, + "module": "struct", + "scope": "module" + }, + { + "alias": "subprocess", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 26, + "member": null, + "module": "subprocess", + "scope": "module" + }, + { + "alias": "sys", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 27, + "member": null, + "module": "sys", + "scope": "module" + }, + { + "alias": "time", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 28, + "member": null, + "module": "time", + "scope": "module" + }, + { + "alias": "types", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 29, + "member": null, + "module": "types", + "scope": "module" + }, + { + "alias": "schema", + "classification": "selected_project", + "deferred": false, + "line": 30, + "member": null, + "module": "epoch_schema_v5", + "scope": "module" + }, + { + "alias": "copying", + "classification": "selected_project", + "deferred": false, + "line": 31, + "member": null, + "module": "epoch_copy_v5", + "scope": "module" + } + ], + "independent_pin_basis": "Unit05 frozen author receipt v2 + source-close pin", + "initialization_calls": [ + { + "callee": "tuple", + "line": 35, + "source": "tuple(types.FunctionType.__dict__[name].__get__ for name in\n ('__code__', '__globals__', '__builtins__', '__defaults__', '__kwdefaults__', '__closure__', '__dict__'))" + }, + { + "callee": "tuple", + "line": 42, + "source": "tuple(sys.modules.items())" + }, + { + "callee": "sys.modules.items", + "line": 42, + "source": "sys.modules.items()" + }, + { + "callee": "_TYPE", + "line": 43, + "source": "_TYPE(name)" + }, + { + "callee": "_TYPE", + "line": 43, + "source": "_TYPE(module)" + } + ], + "module": "parent_closure_v1", + "module_initialization": [ + { + "kind": "Expr", + "line": 1, + "source": "\"\"\"Finite concrete receiver admission inside the original trusted parent.\n\nThis verifies pinned source, bytecode derived from those bytes without executing\nthem, concrete local import edges, and the current captured object graph. It is\nnot a new Python sandbox or proof of the initial OS/interpreter/native memory.\nThe original parent must load these exact modules through its admitted bootstrap\nbefore adverse input. No user supplied arbitrary checker is accepted.\n\"\"\"" + }, + { + "kind": "Import", + "line": 9, + "source": "import ast" + }, + { + "kind": "Import", + "line": 10, + "source": "import builtins" + }, + { + "kind": "Import", + "line": 11, + "source": "import __future__" + }, + { + "kind": "Import", + "line": 12, + "source": "import copy" + }, + { + "kind": "Import", + "line": 13, + "source": "import dataclasses" + }, + { + "kind": "Import", + "line": 14, + "source": "import fcntl" + }, + { + "kind": "Import", + "line": 15, + "source": "import gc" + }, + { + "kind": "Import", + "line": 16, + "source": "import hashlib" + }, + { + "kind": "Import", + "line": 17, + "source": "import json" + }, + { + "kind": "Import", + "line": 18, + "source": "import marshal" + }, + { + "kind": "Import", + "line": 19, + "source": "import math" + }, + { + "kind": "Import", + "line": 20, + "source": "import os" + }, + { + "kind": "Import", + "line": 21, + "source": "import pathlib" + }, + { + "kind": "Import", + "line": 22, + "source": "import posix" + }, + { + "kind": "Import", + "line": 23, + "source": "import resource" + }, + { + "kind": "Import", + "line": 24, + "source": "import signal" + }, + { + "kind": "Import", + "line": 25, + "source": "import struct" + }, + { + "kind": "Import", + "line": 26, + "source": "import subprocess" + }, + { + "kind": "Import", + "line": 27, + "source": "import sys" + }, + { + "kind": "Import", + "line": 28, + "source": "import time" + }, + { + "kind": "Import", + "line": 29, + "source": "import types" + }, + { + "kind": "Import", + "line": 30, + "source": "import epoch_schema_v5 as schema" + }, + { + "kind": "Import", + "line": 31, + "source": "import epoch_copy_v5 as copying" + }, + { + "kind": "Assign", + "line": 33, + "source": "_TYPE, _LEN, _COMPILE = type, len, compile" + }, + { + "kind": "Assign", + "line": 34, + "source": "_MODULE_DICT = types.ModuleType.__dict__['__dict__'].__get__" + }, + { + "kind": "Assign", + "line": 35, + "source": "_FUNCTION_GETTERS = tuple(types.FunctionType.__dict__[name].__get__ for name in\n ('__code__', '__globals__', '__builtins__', '__defaults__', '__kwdefaults__', '__closure__', '__dict__'))" + }, + { + "kind": "Assign", + "line": 37, + "source": "_CELL_GET = types.CellType.__dict__['cell_contents'].__get__" + }, + { + "kind": "Assign", + "line": 38, + "source": "_CLASS_DICT = type.__dict__['__dict__'].__get__" + }, + { + "kind": "Assign", + "line": 39, + "source": "_STATIC_FUNCTION = staticmethod.__dict__['__func__'].__get__" + }, + { + "kind": "Assign", + "line": 40, + "source": "_CLASS_FUNCTION = classmethod.__dict__['__func__'].__get__" + }, + { + "kind": "Assign", + "line": 41, + "source": "_SOURCE_RECEIVERS = []" + }, + { + "kind": "Assign", + "line": 42, + "source": "_STDLIB_MODULES = {name: module for name, module in tuple(sys.modules.items())\n if _TYPE(name) is str and _TYPE(module) is types.ModuleType}" + }, + { + "kind": "Assign", + "line": 44, + "source": "MAX_MODULES = 48" + }, + { + "kind": "Assign", + "line": 45, + "source": "MAX_GLOBALS = 512" + }, + { + "kind": "Assign", + "line": 50, + "source": "_MUTABLE_NAMES = {\n 'v03_prefix_supervisor_v1': ('_PREFIX', '_UNKNOWN_OWNER'),\n 'epoch_parent_v5': ('_RESERVED_EPOCHS', '_PARENT_OWNERS'),\n 'epoch_schema_v5': ('_ERROR_OWNERS',),\n 'epoch_stop_v5': ('_SINK_REGISTRY',),\n 'parent_domain_v1': ('_DOMAINS',),\n 'parent_completion_v1': ('_PARENTS', '_PROCESS'),\n 'parent_closure_v1': ('_SOURCE_RECEIVERS',),\n}" + }, + { + "kind": "Assign", + "line": 59, + "source": "_GATE_SUFFIXES = ('CONFIGURATION', 'SOURCE_REVIEW', 'EXECUTION_APPROVAL', 'FUNDING',\n 'STAGE_APPROVAL', 'COMMAND_APPROVAL', 'VALIDATION_EXECUTION')" + } + ], + "namespace_bound_actual_capture_proven": false, + "sha256": "a15424f14baa3d484fe04bfbe7e449c32561c866dbaca2c1b5f646dfb377ed1f", + "source_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_closure_v1.py", + "static_names_plus8_import_metadata": 56, + "static_namespace_name_count": 48, + "static_namespace_names": [ + "MAX_GLOBALS", + "MAX_MODULES", + "_CELL_GET", + "_CLASS_DICT", + "_CLASS_FUNCTION", + "_COMPILE", + "_FUNCTION_GETTERS", + "_GATE_SUFFIXES", + "_LEN", + "_MODULE_DICT", + "_MUTABLE_NAMES", + "_SOURCE_RECEIVERS", + "_STATIC_FUNCTION", + "_STDLIB_MODULES", + "_TYPE", + "__future__", + "_codes", + "_data", + "_function_check", + "_function_record", + "_namespace", + "_packet", + "_validate_code", + "ast", + "bind_receivers", + "builtins", + "check_receivers", + "copy", + "copying", + "dataclasses", + "fcntl", + "gc", + "hashlib", + "json", + "marshal", + "math", + "os", + "pathlib", + "posix", + "receiver", + "resource", + "schema", + "signal", + "struct", + "subprocess", + "sys", + "time", + "types" + ] + }, + { + "bytes": 54168, + "copy_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/parent_completion_v1.py.txt", + "dynamic_sites": [], + "imports": [ + { + "alias": "fcntl", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 10, + "member": null, + "module": "fcntl", + "scope": "module" + }, + { + "alias": "os", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 11, + "member": null, + "module": "os", + "scope": "module" + }, + { + "alias": "resource", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 12, + "member": null, + "module": "resource", + "scope": "module" + }, + { + "alias": "signal", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 13, + "member": null, + "module": "signal", + "scope": "module" + }, + { + "alias": "stat", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 14, + "member": null, + "module": "stat", + "scope": "module" + }, + { + "alias": "subprocess", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 15, + "member": null, + "module": "subprocess", + "scope": "module" + }, + { + "alias": "sys", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 16, + "member": null, + "module": "sys", + "scope": "module" + }, + { + "alias": "time", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 17, + "member": null, + "module": "time", + "scope": "module" + }, + { + "alias": "schema", + "classification": "selected_project", + "deferred": false, + "line": 18, + "member": null, + "module": "epoch_schema_v5", + "scope": "module" + }, + { + "alias": "copying", + "classification": "selected_project", + "deferred": false, + "line": 19, + "member": null, + "module": "epoch_copy_v5", + "scope": "module" + }, + { + "alias": "epoch", + "classification": "selected_project", + "deferred": false, + "line": 20, + "member": null, + "module": "epoch_parent_v5", + "scope": "module" + }, + { + "alias": "closure", + "classification": "selected_project", + "deferred": false, + "line": 21, + "member": null, + "module": "parent_closure_v1", + "scope": "module" + }, + { + "alias": "domain", + "classification": "selected_project", + "deferred": false, + "line": 22, + "member": null, + "module": "parent_domain_v1", + "scope": "module" + }, + { + "alias": "group01", + "classification": "selected_project", + "deferred": false, + "line": 23, + "member": null, + "module": "group01_evidence_v1", + "scope": "module" + }, + { + "classification": "deferred_stdlib_T0_or_original_native_supplement", + "deferred": true, + "level": 0, + "line": 496, + "members": [ + { + "alias": "Path", + "name": "Path" + } + ], + "module": "pathlib", + "scope": "module.make_parent" + } + ], + "independent_pin_basis": "Unit05 frozen author receipt v2 + source-close pin", + "initialization_calls": [], + "module": "parent_completion_v1", + "module_initialization": [ + { + "kind": "Expr", + "line": 1, + "source": "\"\"\"Source-only two-producer completion owner for one future guarded parent.\n\nNo configuration or execution gate is installed. The original trusted parent\nmust authenticate this source, its exact receiver closure and initial OS/runtime\nbefore importing it. Capabilities are process local. This component never\ninvokes run_guarded, a queue wrapper, a global ledger writer, or a child report\nas authority. The enclosing single orchestrator pays this entire component\nonce, including all child, validation, retention, failure and final-exit costs.\n\"\"\"" + }, + { + "kind": "Import", + "line": 10, + "source": "import fcntl" + }, + { + "kind": "Import", + "line": 11, + "source": "import os" + }, + { + "kind": "Import", + "line": 12, + "source": "import resource" + }, + { + "kind": "Import", + "line": 13, + "source": "import signal" + }, + { + "kind": "Import", + "line": 14, + "source": "import stat" + }, + { + "kind": "Import", + "line": 15, + "source": "import subprocess" + }, + { + "kind": "Import", + "line": 16, + "source": "import sys" + }, + { + "kind": "Import", + "line": 17, + "source": "import time" + }, + { + "kind": "Import", + "line": 18, + "source": "import epoch_schema_v5 as schema" + }, + { + "kind": "Import", + "line": 19, + "source": "import epoch_copy_v5 as copying" + }, + { + "kind": "Import", + "line": 20, + "source": "import epoch_parent_v5 as epoch" + }, + { + "kind": "Import", + "line": 21, + "source": "import parent_closure_v1 as closure" + }, + { + "kind": "Import", + "line": 22, + "source": "import parent_domain_v1 as domain" + }, + { + "kind": "Import", + "line": 23, + "source": "import group01_evidence_v1 as group01" + }, + { + "kind": "Assign", + "line": 25, + "source": "CONFIGURATION = None" + }, + { + "kind": "Assign", + "line": 26, + "source": "SOURCE_REVIEW = None" + }, + { + "kind": "Assign", + "line": 27, + "source": "STAGE_APPROVAL = None" + }, + { + "kind": "Assign", + "line": 28, + "source": "COMMAND_APPROVAL = None" + }, + { + "kind": "Assign", + "line": 29, + "source": "FUNDING = None" + }, + { + "kind": "Assign", + "line": 30, + "source": "EXECUTION_APPROVAL = None" + }, + { + "kind": "Assign", + "line": 32, + "source": "FLAGS = ('-S', '-s', '-P', '-B')" + }, + { + "kind": "Assign", + "line": 33, + "source": "ENV = {'PATH': '/usr/bin:/bin', 'PYTHONHASHSEED': '0', 'LANG': 'C.UTF-8',\n 'LC_ALL': 'C.UTF-8', 'TZ': 'UTC', 'PYTHONDONTWRITEBYTECODE': '1'}" + }, + { + "kind": "Assign", + "line": 35, + "source": "_TYPE, _LEN = type, len" + }, + { + "kind": "Assign", + "line": 36, + "source": "_OPEN, _CLOSE, _MKDIR, _STAT, _SCANDIR = os.open, os.close, os.mkdir, os.stat, os.scandir" + }, + { + "kind": "Assign", + "line": 37, + "source": "_POPEN = subprocess.Popen" + }, + { + "kind": "Assign", + "line": 38, + "source": "_CLOCK, _SLEEP = time.monotonic, time.sleep" + }, + { + "kind": "Assign", + "line": 39, + "source": "_SETRLIMIT, _GETRLIMIT = resource.setrlimit, resource.getrlimit" + }, + { + "kind": "Assign", + "line": 40, + "source": "_SETTIMER, _GETTIMER = signal.setitimer, signal.getitimer" + }, + { + "kind": "Assign", + "line": 41, + "source": "_SIGNAL, _GETSIGNAL = signal.signal, signal.getsignal" + }, + { + "kind": "Assign", + "line": 42, + "source": "_PARENTS = []" + }, + { + "kind": "Assign", + "line": 43, + "source": "_PROCESS = [None]" + }, + { + "kind": "Assign", + "line": 46, + "source": "_UNKNOWN_OWNER = {'quarantine': [False], 'pending': [False],\n 'iterator_uncertain': [False], 'primary': [None],\n 'native_errors': [None] * 4}" + }, + { + "kind": "Assign", + "line": 49, + "source": "_EPOCH_ENTRY = epoch._entry_state" + }, + { + "kind": "Assign", + "line": 50, + "source": "_EPOCH_RESERVE = epoch.ParentEpoch.reserve_producer" + }, + { + "kind": "Assign", + "line": 51, + "source": "_EPOCH_ACCEPT = epoch.ParentEpoch.accept_completed_producer" + }, + { + "kind": "Assign", + "line": 52, + "source": "_EPOCH_COMPLETION = epoch.ParentCompletion" + }, + { + "kind": "Assign", + "line": 53, + "source": "_EPOCH_COMMIT = epoch.ParentEpoch.commit_exports" + }, + { + "kind": "Assign", + "line": 54, + "source": "_EPOCH_CLOSE = epoch.ParentEpoch.close" + }, + { + "kind": "Assign", + "line": 55, + "source": "MAX_SOURCE_FILES = 8192" + }, + { + "kind": "Assign", + "line": 56, + "source": "MAX_STAGE_ENTRIES = 16384" + }, + { + "kind": "Assign", + "line": 57, + "source": "MAX_RAW_VARIANT_FILES = 64" + }, + { + "kind": "Assign", + "line": 58, + "source": "VARIANT_MODULE = 'variant_validation_v1'" + }, + { + "kind": "Assign", + "line": 59, + "source": "VARIANT_FUNCTION = 'validate_variant_producer'" + }, + { + "kind": "Assign", + "line": 60, + "source": "MAX_VARIANT_RAW_BYTES = 32 * 1024 * 1024" + }, + { + "kind": "Assign", + "line": 62, + "source": "VARIANT_FILES = ('initial-tcb.raw.json', 'initial-controls.raw.json', 'initial-restoration.raw.json', 'root-before.raw.json', 'preflight-before.raw.json', 'custody-before.raw.json', 'pyinit_failure/control.attempt.json', 'pyinit_failure/control.attempt.jsonl', 'pyinit_failure/control.stdout.raw', 'pyinit_failure/control.stderr.raw', 'pyinit_failure/helper-return.raw.json', 'pyinit_failure/build.json', 'pyinit_failure/_h25_dict_probe.cpython-312-x86_64-linux-gnu.so', 'pyinit_failure/elf.raw.json', 'exec_failure/control.attempt.json', 'exec_failure/control.attempt.jsonl', 'exec_failure/control.stdout.raw', 'exec_failure/control.stderr.raw', 'exec_failure/helper-return.raw.json', 'exec_failure/build.json', 'exec_failure/_h25_dict_probe.cpython-312-x86_64-linux-gnu.so', 'exec_failure/elf.raw.json', 'preflight-after.raw.json', 'custody-after.raw.json', 'root-after.raw.json', 'receipt.json')" + }, + { + "kind": "Assign", + "line": 63, + "source": "VARIANT_GROUPS = ('initial-tcb.raw.json', 'initial-controls.raw.json', 'initial-restoration.raw.json', 'root-before.raw.json', 'preflight-before.raw.json', 'custody-before.raw.json', 'pyinit_failure/helper-return.raw.json', 'pyinit_failure/elf.raw.json', 'exec_failure/helper-return.raw.json', 'exec_failure/elf.raw.json', 'preflight-after.raw.json', 'custody-after.raw.json', 'root-after.raw.json')" + }, + { + "kind": "Assign", + "line": 64, + "source": "REQUIRED_MODULES = (\n 'epoch_schema_v5', 'epoch_copy_v5', 'epoch_parent_v5', 'epoch_stop_v5',\n 'original_build_provenance_v5', 'h25_parent_supervisor', 'parent_closure_v1',\n 'parent_domain_v1', 'parent_completion_v1', 'group01_evidence_v1',\n 'group01_original_predicates_v1', 'receipt_contract_v1', 'native_field_controls_v1',\n 'transport_controls_v1', 'collector_controls_v1', 'elf_literal_fixture_v1',\n 'elf_controls_v1', 'provider_controls_v1', 'run_pure_controls_v1',\n 'elf_literal_fixture_v2', 'elf_extended_controls_v2', 'run_pure_controls_v2',\n 'restoration_contract_v1', 'loader_model_controls_v1', 'driver_model_body_sources_v3',\n 'root_model_body_sources_v3', 'loader_model_controls_v3', 'group_evidence_v5',\n 'close_model_controls_v5', 'projection_model_controls_v5', 'run_controls_v5',\n 'variant_validation_v1', 'sealed_elf_profile_v2')" + }, + { + "bases": [ + "RuntimeError" + ], + "body_execution": "class body and method defaults/decorators execute; methods not called", + "decorators": [], + "kind": "class_definition", + "line": 78, + "name": "ParentDeadline" + } + ], + "namespace_bound_actual_capture_proven": false, + "sha256": "d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5", + "source_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_completion_v1.py", + "static_names_plus8_import_metadata": 83, + "static_namespace_name_count": 75, + "static_namespace_names": [ + "COMMAND_APPROVAL", + "CONFIGURATION", + "ENV", + "EXECUTION_APPROVAL", + "FLAGS", + "FUNDING", + "MAX_RAW_VARIANT_FILES", + "MAX_SOURCE_FILES", + "MAX_STAGE_ENTRIES", + "MAX_VARIANT_RAW_BYTES", + "ParentDeadline", + "REQUIRED_MODULES", + "SOURCE_REVIEW", + "STAGE_APPROVAL", + "VARIANT_FILES", + "VARIANT_FUNCTION", + "VARIANT_GROUPS", + "VARIANT_MODULE", + "_CLOCK", + "_CLOSE", + "_EPOCH_ACCEPT", + "_EPOCH_CLOSE", + "_EPOCH_COMMIT", + "_EPOCH_COMPLETION", + "_EPOCH_ENTRY", + "_EPOCH_RESERVE", + "_GETRLIMIT", + "_GETSIGNAL", + "_GETTIMER", + "_LEN", + "_MKDIR", + "_OPEN", + "_PARENTS", + "_POPEN", + "_PROCESS", + "_SCANDIR", + "_SETRLIMIT", + "_SETTIMER", + "_SIGNAL", + "_SLEEP", + "_STAT", + "_TYPE", + "_UNKNOWN_OWNER", + "_alarm", + "_close_logs", + "_gate", + "_guard", + "_receiver_gate_values", + "_snapshot_sources", + "_source_custody_bytes", + "_stage", + "_state", + "_stop", + "_tree", + "_validate_plan", + "_variant", + "accept_producer", + "closure", + "commit_exports", + "copying", + "domain", + "epoch", + "fcntl", + "group01", + "make_parent", + "os", + "resource", + "run_producer", + "schema", + "signal", + "stat", + "stop_evidence", + "subprocess", + "sys", + "time" + ] + }, + { + "bytes": 23942, + "copy_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/parent_domain_v1.py.txt", + "dynamic_sites": [], + "imports": [ + { + "alias": "os", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 10, + "member": null, + "module": "os", + "scope": "module" + }, + { + "alias": "signal", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 11, + "member": null, + "module": "signal", + "scope": "module" + }, + { + "alias": "subprocess", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 12, + "member": null, + "module": "subprocess", + "scope": "module" + }, + { + "alias": "time", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 13, + "member": null, + "module": "time", + "scope": "module" + }, + { + "alias": "schema", + "classification": "selected_project", + "deferred": false, + "line": 14, + "member": null, + "module": "epoch_schema_v5", + "scope": "module" + } + ], + "independent_pin_basis": "Unit05 frozen author receipt v2 + source-close pin", + "initialization_calls": [ + { + "callee": "os.sysconf", + "line": 23, + "source": "os.sysconf('SC_PAGE_SIZE')" + } + ], + "module": "parent_domain_v1", + "module_initialization": [ + { + "kind": "Expr", + "line": 1, + "source": "\"\"\"Owned Linux child domains for one trusted, single-threaded parent process.\n\nSource proposal only. No target was imported or run during authoring. The\nexternal launcher must authenticate the OS, interpreter, system modules and\noriginal subreaper installer before importing this module. This is the original\nclosed child-domain premise, not a sandbox against hostile forking or a hostile\nhost. Acquisition/unwind ambiguity quarantines the parent; it never authorizes\nanother launch or a completion. The enclosing guard must observe parent exit.\n\"\"\"" + }, + { + "kind": "Import", + "line": 10, + "source": "import os" + }, + { + "kind": "Import", + "line": 11, + "source": "import signal" + }, + { + "kind": "Import", + "line": 12, + "source": "import subprocess" + }, + { + "kind": "Import", + "line": 13, + "source": "import time" + }, + { + "kind": "Import", + "line": 14, + "source": "import epoch_schema_v5 as schema" + }, + { + "kind": "Assign", + "line": 16, + "source": "_TYPE, _LEN = type, len" + }, + { + "kind": "Assign", + "line": 17, + "source": "_OPEN, _READ, _CLOSE = os.open, os.read, os.close" + }, + { + "kind": "Assign", + "line": 18, + "source": "_STAT = os.stat" + }, + { + "kind": "Assign", + "line": 19, + "source": "_SCANDIR, _GETPID, _GETPGRP, _GETSID = os.scandir, os.getpid, os.getpgrp, os.getsid" + }, + { + "kind": "Assign", + "line": 20, + "source": "_PIDFD_OPEN, _PIDFD_SIGNAL = os.pidfd_open, signal.pidfd_send_signal" + }, + { + "kind": "Assign", + "line": 21, + "source": "_WAITPID, _CLOCK, _SLEEP = os.waitpid, time.monotonic, time.sleep" + }, + { + "kind": "Assign", + "line": 22, + "source": "_POPEN, _POLL = subprocess.Popen, subprocess.Popen.poll" + }, + { + "kind": "Assign", + "line": 23, + "source": "_PAGE_BYTES = os.sysconf('SC_PAGE_SIZE')" + }, + { + "kind": "Assign", + "line": 24, + "source": "_DOMAINS = []" + }, + { + "kind": "Assign", + "line": 25, + "source": "MAX_GENERATIONS = 128" + }, + { + "kind": "Assign", + "line": 26, + "source": "MAX_PROC_ENTRIES = 131072" + }, + { + "kind": "Assign", + "line": 27, + "source": "MAX_PROC_BYTES = 8192" + }, + { + "kind": "Assign", + "line": 28, + "source": "CLEANUP_SECONDS = 2.0" + } + ], + "namespace_bound_actual_capture_proven": false, + "sha256": "a51264289803b4b17bb262f2460ddd4ed72500aaa21e5eb80fa2db4583689361", + "source_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/parent_domain_v1.py", + "static_names_plus8_import_metadata": 52, + "static_namespace_name_count": 44, + "static_namespace_names": [ + "CLEANUP_SECONDS", + "MAX_GENERATIONS", + "MAX_PROC_BYTES", + "MAX_PROC_ENTRIES", + "_CLOCK", + "_CLOSE", + "_DOMAINS", + "_GETPGRP", + "_GETPID", + "_GETSID", + "_LEN", + "_OPEN", + "_PAGE_BYTES", + "_PIDFD_OPEN", + "_PIDFD_SIGNAL", + "_POLL", + "_POPEN", + "_READ", + "_SCANDIR", + "_SLEEP", + "_STAT", + "_TYPE", + "_WAITPID", + "_add", + "_census", + "_fresh_acquisition", + "_kill", + "_opaque", + "_proc", + "_state", + "adopt_popen", + "create_domain", + "finish_domain", + "observe", + "os", + "poll_owned", + "prefix_exit1_terminal_facts", + "refresh_unknown_owner", + "schema", + "signal", + "stop_slots", + "subprocess", + "terminal_facts", + "time" + ] + }, + { + "bytes": 6111, + "copy_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/v03_integrated_constructor_v2.py.txt", + "dynamic_sites": [], + "imports": [ + { + "alias": "ast", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 7, + "member": null, + "module": "ast", + "scope": "module" + }, + { + "alias": "hashlib", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 8, + "member": null, + "module": "hashlib", + "scope": "module" + } + ], + "independent_pin_basis": "Unit05 frozen author receipt v2 + source-close pin", + "initialization_calls": [], + "module": "v03_integrated_constructor_v2", + "module_initialization": [ + { + "kind": "Expr", + "line": 1, + "source": "\"\"\"Pure authoring support for the proposed genuine-Root V03 prefix route.\n\nNo original module is imported or executed. Output is a source draft with\nall eight original admission/configuration literals still None. The selected\nprefix requires independent review as V03 source-gate coverage, and is not V01.\n\"\"\"" + }, + { + "kind": "Import", + "line": 7, + "source": "import ast" + }, + { + "kind": "Import", + "line": 8, + "source": "import hashlib" + }, + { + "kind": "Assign", + "line": 10, + "source": "ROOT_SHA = 'f5a2d33f2b4d3651f214156a0e7094c2bb516ce2d5ab7698d18c11f98f35dee0'" + }, + { + "kind": "Assign", + "line": 11, + "source": "PROVIDER_SHA = '9cbb7368f89e71d1e6cc46db5dc77efed3e03ed2a801c98c88fe316e4d9f3ef2'" + }, + { + "kind": "Assign", + "line": 12, + "source": "VARIANT_SHA = 'cdb1479253358508088f8aa0e1e92e6c75ffcc127e54552698598a02de061254'" + }, + { + "kind": "Assign", + "line": 13, + "source": "NATIVE_ENV = (\n (b'PATH', b'/usr/bin:/bin'),\n (b'PYTHONHASHSEED', b'0'),\n (b'LANG', b'C.UTF-8'),\n (b'LC_ALL', b'C.UTF-8'),\n (b'TZ', b'UTC'),\n (b'PYTHONDONTWRITEBYTECODE', b'1'),\n)" + }, + { + "kind": "Assign", + "line": 21, + "source": "GATES = ('VARIANT_CONFIGURATION', 'VARIANT_SOURCE_REVIEW',\n 'VARIANT_STAGE_ADMISSION', 'VARIANT_NATIVE_PROFILE',\n 'VARIANT_HEADER_ADMISSION', 'VARIANT_COMMAND_ADMISSION',\n 'VARIANT_FUNDING', 'VARIANT_EXECUTION')" + }, + { + "kind": "Assign", + "line": 25, + "source": "TAIL = b'''try:\n _variant_main()\nexcept BaseException as _variant_error:\n _VARIANT_TERMINAL_ERROR[0] = _variant_error\n raise\n'''" + }, + { + "kind": "Assign", + "line": 31, + "source": "CONTROL_TAIL = b'''_V03_RESULT = [None]\ntry:\n _V03_RESULT[0] = _v03_original_input_prefix()\n _vroot(_INITIAL_OUTPUT + '/v03-root-after.raw.json')\n _vraw(_INITIAL_OUTPUT + '/v03-input-result.raw.json', {\n 'schema': 'h25-v03-input-prefix-result-v1',\n 'status': 'ORIGINAL_INPUT_PREFIX_RETURNED',\n 'binding': _V03_RESULT[0],\n 'whole_variant_producer_completed': False,\n 'runtime_qualified': False})\nexcept BaseException as _v03_error:\n _VARIANT_TERMINAL_ERROR[0] = _v03_error\n # No diagnostic allocation or I/O after an inherited failure. The genuine\n # parent retains its raw stderr stream and owned terminal facts; absent or\n # incomplete evidence is STOP, never a successful negative control.\n raise\n'''" + } + ], + "namespace_bound_actual_capture_proven": false, + "sha256": "a80a60b390bc60e9bc434b79cda5ae6db88e4f0c6c7436de9adfe1f48a2045b1", + "source_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_integrated_constructor_v2.py", + "static_names_plus8_import_metadata": 21, + "static_namespace_name_count": 13, + "static_namespace_names": [ + "CONTROL_TAIL", + "GATES", + "NATIVE_ENV", + "PROVIDER_SHA", + "ROOT_SHA", + "TAIL", + "VARIANT_SHA", + "absolute", + "ast", + "build_control_driver", + "genuine_launch", + "hashlib", + "need" + ] + }, + { + "bytes": 3830, + "copy_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/v03_prefix_derivation_v1.py.txt", + "dynamic_sites": [], + "imports": [ + { + "alias": "ast", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 6, + "member": null, + "module": "ast", + "scope": "module" + }, + { + "classification": "selected_project", + "deferred": false, + "level": 0, + "line": 7, + "members": [ + { + "alias": "GATES", + "name": "GATES" + }, + { + "alias": "build_control_driver", + "name": "build_control_driver" + } + ], + "module": "v03_integrated_constructor_v2", + "scope": "module" + } + ], + "independent_pin_basis": "Unit05 frozen author receipt v2 + source-close pin", + "initialization_calls": [], + "module": "v03_prefix_derivation_v1", + "module_initialization": [ + { + "kind": "Expr", + "line": 1, + "source": "\"\"\"Verify only eight literal replacements in the exact reviewed V03 prefix.\n\nSource proposal, Apache-2.0. Preserve original authors and derivation notices.\nPinned gate-value DATA does not confer source/native/funding/runtime admission.\n\"\"\"" + }, + { + "kind": "Import", + "line": 6, + "source": "import ast" + }, + { + "kind": "ImportFrom", + "line": 7, + "source": "from v03_integrated_constructor_v2 import GATES, build_control_driver" + } + ], + "namespace_bound_actual_capture_proven": false, + "sha256": "1ed813148c10d5fbd3cd6781d51eca650a347eda7a6323f581d740e6ea9cb6e2", + "source_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_prefix_derivation_v1.py", + "static_names_plus8_import_metadata": 14, + "static_namespace_name_count": 6, + "static_namespace_names": [ + "GATES", + "_plain", + "_same", + "ast", + "build_control_driver", + "verify_configured_prefix" + ] + }, + { + "bytes": 36954, + "copy_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/v03_prefix_supervisor_v1.py.txt", + "dynamic_sites": [], + "imports": [ + { + "alias": "fcntl", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 12, + "member": null, + "module": "fcntl", + "scope": "module" + }, + { + "alias": "os", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 13, + "member": null, + "module": "os", + "scope": "module" + }, + { + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "level": 0, + "line": 14, + "members": [ + { + "alias": "Path", + "name": "Path" + } + ], + "module": "pathlib", + "scope": "module" + }, + { + "alias": "resource", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 15, + "member": null, + "module": "resource", + "scope": "module" + }, + { + "alias": "signal", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 16, + "member": null, + "module": "signal", + "scope": "module" + }, + { + "alias": "stat", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 17, + "member": null, + "module": "stat", + "scope": "module" + }, + { + "alias": "subprocess", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 18, + "member": null, + "module": "subprocess", + "scope": "module" + }, + { + "alias": "time", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 19, + "member": null, + "module": "time", + "scope": "module" + }, + { + "alias": "schema", + "classification": "selected_project", + "deferred": false, + "line": 21, + "member": null, + "module": "epoch_schema_v5", + "scope": "module" + }, + { + "alias": "copying", + "classification": "selected_project", + "deferred": false, + "line": 22, + "member": null, + "module": "epoch_copy_v5", + "scope": "module" + }, + { + "alias": "domain", + "classification": "selected_project", + "deferred": false, + "line": 23, + "member": null, + "module": "parent_domain_v1", + "scope": "module" + }, + { + "alias": "closure", + "classification": "selected_project", + "deferred": false, + "line": 24, + "member": null, + "module": "parent_closure_v1", + "scope": "module" + }, + { + "alias": "parent", + "classification": "selected_project", + "deferred": false, + "line": 25, + "member": null, + "module": "parent_completion_v1", + "scope": "module" + }, + { + "alias": "group01", + "classification": "selected_project", + "deferred": false, + "line": 26, + "member": null, + "module": "group01_evidence_v1", + "scope": "module" + }, + { + "alias": "derivation", + "classification": "selected_project", + "deferred": false, + "line": 27, + "member": null, + "module": "v03_prefix_derivation_v1", + "scope": "module" + } + ], + "independent_pin_basis": "Unit05 frozen author receipt v2 + source-close pin", + "initialization_calls": [], + "module": "v03_prefix_supervisor_v1", + "module_initialization": [ + { + "kind": "Expr", + "line": 1, + "source": "\"\"\"One non-minting genuine-Root V03 prefix observation per fresh parent.\n\nConditional source proposal, Apache-2.0. Derived from the recovered original\nparent/domain/closure/copy/supervisor sources. Preserve all original notices.\n\nThe enclosing trusted bootstrap must authenticate this source, its imports,\nconfigured selections and native/OS startup before import. C07 ancestor and\nimmutable-lifetime conditions remain actual external prerequisites.\n\nNo epoch is created, reserved, accepted, committed or completed here.\n\"\"\"" + }, + { + "kind": "Import", + "line": 12, + "source": "import fcntl" + }, + { + "kind": "Import", + "line": 13, + "source": "import os" + }, + { + "kind": "ImportFrom", + "line": 14, + "source": "from pathlib import Path" + }, + { + "kind": "Import", + "line": 15, + "source": "import resource" + }, + { + "kind": "Import", + "line": 16, + "source": "import signal" + }, + { + "kind": "Import", + "line": 17, + "source": "import stat" + }, + { + "kind": "Import", + "line": 18, + "source": "import subprocess" + }, + { + "kind": "Import", + "line": 19, + "source": "import time" + }, + { + "kind": "Import", + "line": 21, + "source": "import epoch_schema_v5 as schema" + }, + { + "kind": "Import", + "line": 22, + "source": "import epoch_copy_v5 as copying" + }, + { + "kind": "Import", + "line": 23, + "source": "import parent_domain_v1 as domain" + }, + { + "kind": "Import", + "line": 24, + "source": "import parent_closure_v1 as closure" + }, + { + "kind": "Import", + "line": 25, + "source": "import parent_completion_v1 as parent" + }, + { + "kind": "Import", + "line": 26, + "source": "import group01_evidence_v1 as group01" + }, + { + "kind": "Import", + "line": 27, + "source": "import v03_prefix_derivation_v1 as derivation" + }, + { + "kind": "Assign", + "line": 29, + "source": "CONFIGURATION = None" + }, + { + "kind": "Assign", + "line": 30, + "source": "SOURCE_REVIEW = None" + }, + { + "kind": "Assign", + "line": 31, + "source": "STAGE_APPROVAL = None" + }, + { + "kind": "Assign", + "line": 32, + "source": "COMMAND_APPROVAL = None" + }, + { + "kind": "Assign", + "line": 33, + "source": "FUNDING = None" + }, + { + "kind": "Assign", + "line": 34, + "source": "EXECUTION_APPROVAL = None" + }, + { + "kind": "Assign", + "line": 36, + "source": "ROOT_SHA = 'f5a2d33f2b4d3651f214156a0e7094c2bb516ce2d5ab7698d18c11f98f35dee0'" + }, + { + "kind": "Assign", + "line": 37, + "source": "PROVIDER_SHA = '9cbb7368f89e71d1e6cc46db5dc77efed3e03ed2a801c98c88fe316e4d9f3ef2'" + }, + { + "kind": "Assign", + "line": 38, + "source": "VARIANT_SHA = 'cdb1479253358508088f8aa0e1e92e6c75ffcc127e54552698598a02de061254'" + }, + { + "kind": "Assign", + "line": 39, + "source": "OBSERVER = 'v03_source_refusal_observer_v1'" + }, + { + "kind": "Assign", + "line": 40, + "source": "ENV = {'PATH': '/usr/bin:/bin', 'PYTHONHASHSEED': '0',\n 'LANG': 'C.UTF-8', 'LC_ALL': 'C.UTF-8', 'TZ': 'UTC',\n 'PYTHONDONTWRITEBYTECODE': '1'}" + }, + { + "kind": "Assign", + "line": 44, + "source": "_PID, _CLOCK, _FLOCK = os.getpid, time.monotonic, fcntl.flock" + }, + { + "kind": "Assign", + "line": 45, + "source": "_PREFIX = [False, None]" + }, + { + "kind": "Assign", + "line": 46, + "source": "_UNKNOWN_OWNER = {\n 'quarantine': [False], 'pending': [False],\n 'iterator_uncertain': [False], 'primary': [None],\n 'native_errors': [None] * 4,\n}" + }, + { + "kind": "Assign", + "line": 51, + "source": "_INITIAL = (\n 'initial-tcb.raw.json', 'initial-controls.raw.json',\n 'initial-restoration.raw.json',\n)" + }, + { + "kind": "Assign", + "line": 55, + "source": "_PREFLIGHT = _INITIAL + ('root-before.raw.json', 'preflight-before.raw.json')" + }, + { + "kind": "Assign", + "line": 56, + "source": "_CUSTODY = _PREFLIGHT + ('custody-before.raw.json',)" + }, + { + "kind": "Assign", + "line": 57, + "source": "_RETURNED = _CUSTODY + (\n 'v03-root-after.raw.json', 'v03-input-result.raw.json',\n)" + } + ], + "namespace_bound_actual_capture_proven": false, + "sha256": "f97b07d4a5f461d4134a2bdf4cfcc28da12acc7e7144c18f6cc0a017cdee86f6", + "source_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_prefix_supervisor_v1.py", + "static_names_plus8_import_metadata": 60, + "static_namespace_name_count": 52, + "static_namespace_names": [ + "COMMAND_APPROVAL", + "CONFIGURATION", + "ENV", + "EXECUTION_APPROVAL", + "FUNDING", + "OBSERVER", + "PROVIDER_SHA", + "Path", + "ROOT_SHA", + "SOURCE_REVIEW", + "STAGE_APPROVAL", + "VARIANT_SHA", + "_CLOCK", + "_CUSTODY", + "_FLOCK", + "_INITIAL", + "_PID", + "_PREFIX", + "_PREFLIGHT", + "_RETURNED", + "_UNKNOWN_OWNER", + "_capture", + "_census_output", + "_clean", + "_directory_identity", + "_expected_files", + "_gate_snapshot", + "_guard", + "_native_bindings", + "_record_bytes", + "_source_snapshot", + "_state", + "_supervise", + "_terminal", + "_validate_plan", + "closure", + "copying", + "derivation", + "domain", + "fcntl", + "group01", + "make_prefix_owner", + "os", + "parent", + "resource", + "run_prefix", + "schema", + "signal", + "stat", + "stop_evidence", + "subprocess", + "time" + ] + }, + { + "bytes": 14205, + "copy_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/v03_source_refusal_observer_v1.py.txt", + "dynamic_sites": [], + "imports": [ + { + "alias": "ast", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 8, + "member": null, + "module": "ast", + "scope": "module" + }, + { + "alias": "hashlib", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 9, + "member": null, + "module": "hashlib", + "scope": "module" + }, + { + "alias": "json", + "classification": "original_trusted_stdlib_T0", + "deferred": false, + "line": 10, + "member": null, + "module": "json", + "scope": "module" + } + ], + "independent_pin_basis": "Unit05 frozen author receipt v2 + source-close pin", + "initialization_calls": [], + "module": "v03_source_refusal_observer_v1", + "module_initialization": [ + { + "kind": "Expr", + "line": 1, + "source": "\"\"\"Pure source-location corroboration for parent-retained V03 stderr.\n\nThis does not establish ownership, currentness, admission, or even that a child\nran. The genuine parent must supply its complete retained raw stderr after\nactual owned termination, with independently authenticated driver/stage pins.\nNo result of this function by itself is a V03 PASS or a ParentCompletion.\n\"\"\"" + }, + { + "kind": "Import", + "line": 8, + "source": "import ast" + }, + { + "kind": "Import", + "line": 9, + "source": "import hashlib" + }, + { + "kind": "Import", + "line": 10, + "source": "import json" + }, + { + "kind": "Assign", + "line": 12, + "source": "COMPONENT_LOG_BYTES = 2 * 1024 * 1024" + }, + { + "kind": "Assign", + "line": 13, + "source": "COMPONENT_RECORD_BYTES = 1048576" + }, + { + "kind": "Assign", + "line": 14, + "source": "ROOT_COUNTERS = ('load_calls', 'native_creations', 'native_execs',\n 'activation_attempts', 'successful_bindings',\n 'deactivation_attempts', 'cleanup_failures',\n 'control_module_creations')" + }, + { + "kind": "Assign", + "line": 19, + "source": "MESSAGES = {\n '_vcheck_literal_sources': (\n 'Variant source role path differs',\n 'Variant reviewed source/header differs',\n 'Variant role file omitted from closure'),\n '_vcheck_custody': ('Variant current source closure differs',),\n '_v03_original_input_prefix': (\n 'Variant literal configuration differs',\n 'Variant original preflight differs'),\n}" + } + ], + "namespace_bound_actual_capture_proven": false, + "sha256": "abf25690d3bee4a9783ee504567c29f7fb47da670e0ec95f57cb5944bf57264f", + "source_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/implementation/v03_source_refusal_observer_v1.py", + "static_names_plus8_import_metadata": 25, + "static_namespace_name_count": 17, + "static_namespace_names": [ + "COMPONENT_LOG_BYTES", + "COMPONENT_RECORD_BYTES", + "MESSAGES", + "ROOT_COUNTERS", + "_decode", + "_executed_calls", + "_integer", + "_no_noninteger", + "_pairs", + "_tree", + "ast", + "corroborate_complete_refusal", + "corroborate_positive", + "corroborate_raw_refusal", + "hashlib", + "json", + "source_site" + ] + } + ], + "no_runtime_success_inferred_from_static_counts": true, + "old_units_reopened": false, + "original_modules_imported_or_executed": false, + "original_tests_or_native_or_Popen_or_compiler": false, + "outer_reference_inputs": [ + { + "bytes": 11548, + "caller_review_owner": "v03_source_route_review; outergraph separate", + "copy_path": "outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/run_reviewed_queue_v4.py.txt", + "imports_as_text": [ + { + "line": 7, + "source": "import hashlib" + }, + { + "line": 8, + "source": "import json" + }, + { + "line": 9, + "source": "import os" + }, + { + "line": 10, + "source": "import resource" + }, + { + "line": 11, + "source": "from pathlib import Path" + }, + { + "line": 12, + "source": "import subprocess" + }, + { + "line": 13, + "source": "import sys" + }, + { + "line": 14, + "source": "import time" + } + ], + "part_of_inner15_project_graph": false, + "sha256": "1348a7b4d7cc1f9fef556f5e0abdaf04411a998afdcd574d7812c76ab37dcf68", + "source_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/h25-data-handling-20261028/integration/run_reviewed_queue_v4.py" + }, + { + "bytes": 11023, + "caller_review_owner": "v03_source_route_review; outergraph separate", + "copy_path": "outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/run_queue4_subreaper.py.txt", + "imports_as_text": [ + { + "line": 7, + "source": "import argparse" + }, + { + "line": 8, + "source": "import hashlib" + }, + { + "line": 9, + "source": "import importlib.util" + }, + { + "line": 10, + "source": "import json" + }, + { + "line": 11, + "source": "from pathlib import Path" + }, + { + "line": 12, + "source": "import subprocess" + }, + { + "line": 13, + "source": "import sys" + }, + { + "line": 14, + "source": "import time" + } + ], + "part_of_inner15_project_graph": false, + "sha256": "ea4c07337ccc1865accfd1b1fe485d51057a04a49e4bfb5f10cc36dc92b5f9a8", + "source_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/h25-data-handling-20261028/execution-guards/build-log-queue-v2/run_queue4_subreaper.py" + }, + { + "bytes": 4935, + "caller_review_owner": "v03_source_route_review; outergraph separate", + "copy_path": "outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/NATIVE-INITIAL-TCB-v1.json", + "imports_as_text": [], + "part_of_inner15_project_graph": false, + "sha256": "610492b3fc06baa0560175edc3ba27057de00d00b8fd3d58dbe55e5a371c042a", + "source_path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/h25-data-handling-20261028/control/NATIVE-INITIAL-TCB-v1.json" + }, + { + "bytes": 15493, + "caller_review_owner": "v03_source_route_review; outergraph separate", + "copy_path": "outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/run_guarded_v3.py.txt", + "imports_as_text": [ + { + "line": 3, + "source": "import argparse" + }, + { + "line": 4, + "source": "import fcntl" + }, + { + "line": 5, + "source": "import hashlib" + }, + { + "line": 6, + "source": "import json" + }, + { + "line": 7, + "source": "import os" + }, + { + "line": 8, + "source": "from pathlib import Path" + }, + { + "line": 9, + "source": "import platform" + }, + { + "line": 10, + "source": "import resource" + }, + { + "line": 11, + "source": "import signal" + }, + { + "line": 12, + "source": "import stat" + }, + { + "line": 13, + "source": "import subprocess" + }, + { + "line": 14, + "source": "import sys" + }, + { + "line": 15, + "source": "import time" + } + ], + "part_of_inner15_project_graph": false, + "sha256": "bd882e3dadb1b6aeaa63ee824f1a1c58f8ef2546b6840a2bffa46885a184d3eb", + "source_path": "outputs/c05-v03-completion-20261102T055710Z/consultation/prerequisite-v7/run_guarded_v3.py.txt" + } + ], + "project_count_le48_static": true, + "project_module_count": 15, + "project_source_bytes": 379241, + "schema": "unit06-selected-project-source-graph-v1", + "scope": "actual active Unit05 inner project import/init closure; outer caller/runner references are separate", + "source_complete_for_explicit_project_imports": true, + "source_complete_scope": "Complete explicit static/latent Python project import closure for the exact selected Unit05 inner bodies; not a universal dynamic Python proof or final whole-entry/caller graph.", + "topological_initialization_order": [ + "epoch_schema_v5", + "h25_parent_supervisor", + "v03_integrated_constructor_v2", + "v03_source_refusal_observer_v1", + "epoch_copy_v5", + "group01_original_predicates_v1", + "parent_domain_v1", + "v03_prefix_derivation_v1", + "epoch_stop_v5", + "original_build_provenance_v5", + "parent_closure_v1", + "epoch_parent_v5", + "group01_evidence_v1", + "parent_completion_v1", + "v03_prefix_supervisor_v1" + ], + "trusted_stdlib_T0_names": [ + "__future__", + "ast", + "builtins", + "copy", + "ctypes", + "dataclasses", + "fcntl", + "gc", + "hashlib", + "json", + "marshal", + "math", + "os", + "pathlib", + "posix", + "resource", + "signal", + "stat", + "struct", + "subprocess", + "sys", + "time", + "types" + ], + "unit05_author_receipt": { + "matches_source_close": true, + "path": "/home/d3lerium/.codex/.chatgpt-projects/g-p-6ad5817fd84881918865926b6fd51453/outputs/c05-v03-completion-20261102T055710Z/unit05/AUTHOR-RECEIPT-v2.json", + "sha256": "9563e2b533ce5b06bf72911c2ad66ee389ef14119b423a7cd3309b521c4db02e" + } +} diff --git a/research/h25-v03-authenticated-prefix-entry/SOURCE-ORIGIN.json b/research/h25-v03-authenticated-prefix-entry/SOURCE-ORIGIN.json new file mode 100644 index 0000000000..c77e9e33f6 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/SOURCE-ORIGIN.json @@ -0,0 +1,426 @@ +{ + "adapter": "Frozen files byte-exact. Only in-memory module BASE initializer is path-rebound before new fixture top-level entry import; post-load fixture BASE/Path map owned scratch and15exact historical copy paths. Function/class/assertion AST unchanged; entry globals/algorithm unchanged. Repaired publication adapter refuses unknown host paths and extra-part calls; only exact15historical mappings or canonical absolute package/scratch-owned paths are allowed. Initial rejected wrapper is preserved outsidepacket.", + "all_live_inputs_package_local": true, + "base_commit": "7c49fe32c55de02c2c873655c804b16e4c3fef0a", + "copies": [ + { + "byte_exact": true, + "bytes": 21857, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/implementation/predecessor_entry.py", + "path": "implementation/predecessor_entry.py", + "scope": "exact accepted NEW entry or frozen12method NEW fixture; main/entry_operation never invoked", + "sha256": "b783c6812a6295069456cfb4187d4e09bb7acbcb20fffd76e0c10267f90c1201", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 6532, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/test_bootstrap_new_v1.py", + "path": "fixtures/test_bootstrap_new_v1.py", + "scope": "exact accepted NEW entry or frozen12method NEW fixture; main/entry_operation never invoked", + "sha256": "19c1b08d4daeaf0c2d40357b0e117fcb2ca2f632f627e290fe7442abf49b3504", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 132763, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/SOURCE-GRAPH-v1.json", + "path": "SOURCE-GRAPH-v1.json", + "scope": "exact U6.1 frozen source graph; data/AST only", + "sha256": "f999a6bfc9ac9048b248d9b029b7676ba04dea5c559228d5286e49d269ca3597", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 13934, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/PINS-v1.json", + "path": "prerequisites/PINS-v1.json", + "scope": "exact original inner/outer pins; only inner15 files needed for this replay", + "sha256": "f20555d87ab5b0f1bed28461f2b435773607ffaf87f5c4ba21414844f44fd1d6", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 82957, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/epoch_copy_v5.py.txt", + "path": "prerequisites/epoch_copy_v5.py.txt", + "scope": "original/project source inert bytes only; never compiled/imported/executed", + "sha256": "4f459d0336d59975df787c24373e18dad4044c3a24137392e890115f811b3211", + "trailing_LF_bytes": 0 + }, + { + "byte_exact": true, + "bytes": 26833, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/epoch_parent_v5.py.txt", + "path": "prerequisites/epoch_parent_v5.py.txt", + "scope": "original/project source inert bytes only; never compiled/imported/executed", + "sha256": "058059912144863a4b2bfe4fc9ffc5233b4ab20ee5a7355bde66f4d3f6f28712", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 30668, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/epoch_schema_v5.py.txt", + "path": "prerequisites/epoch_schema_v5.py.txt", + "scope": "original/project source inert bytes only; never compiled/imported/executed", + "sha256": "b89a789654be87bde40a47300f4d9702dce2b90e6ab3be9a2025f6d8041b3e9a", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 8205, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/epoch_stop_v5.py.txt", + "path": "prerequisites/epoch_stop_v5.py.txt", + "scope": "original/project source inert bytes only; never compiled/imported/executed", + "sha256": "5b10c9d72dd0e646652a73b6ffe9ba870762d6bc2f7432bc6b06571a1b7d2a6f", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 15610, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/group01_evidence_v1.py.txt", + "path": "prerequisites/group01_evidence_v1.py.txt", + "scope": "original/project source inert bytes only; never compiled/imported/executed", + "sha256": "05ec6a63c57340ba929aea1fab71b096efc143e099346640f6def41310bd3e25", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 23224, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/group01_original_predicates_v1.py.txt", + "path": "prerequisites/group01_original_predicates_v1.py.txt", + "scope": "original/project source inert bytes only; never compiled/imported/executed", + "sha256": "fb9e6e11b39b76ab8652c546fd76c06d662ea4116376abcc2a6267bb4783dbfd", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 23047, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/h25_parent_supervisor.py.txt", + "path": "prerequisites/h25_parent_supervisor.py.txt", + "scope": "original/project source inert bytes only; never compiled/imported/executed", + "sha256": "cfb09a18dd10b597cc6d5a8139ee769bef679bc44ae029329755e3d97b055075", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 16024, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/original_build_provenance_v5.py.txt", + "path": "prerequisites/original_build_provenance_v5.py.txt", + "scope": "original/project source inert bytes only; never compiled/imported/executed", + "sha256": "bd5ffd9a1c221e0945527fc8fa8d0ad4eb36b9a8884503451c1b6b12d00007ea", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 13463, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/parent_closure_v1.py.txt", + "path": "prerequisites/parent_closure_v1.py.txt", + "scope": "original/project source inert bytes only; never compiled/imported/executed", + "sha256": "a15424f14baa3d484fe04bfbe7e449c32561c866dbaca2c1b5f646dfb377ed1f", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 54168, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/parent_completion_v1.py.txt", + "path": "prerequisites/parent_completion_v1.py.txt", + "scope": "original/project source inert bytes only; never compiled/imported/executed", + "sha256": "d4ee1b7ce4a42b73261984ffb1b9ceb5bb0165223e04a253588f83b99f6981a5", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 23942, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/parent_domain_v1.py.txt", + "path": "prerequisites/parent_domain_v1.py.txt", + "scope": "original/project source inert bytes only; never compiled/imported/executed", + "sha256": "a51264289803b4b17bb262f2460ddd4ed72500aaa21e5eb80fa2db4583689361", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 6111, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/v03_integrated_constructor_v2.py.txt", + "path": "prerequisites/v03_integrated_constructor_v2.py.txt", + "scope": "original/project source inert bytes only; never compiled/imported/executed", + "sha256": "a80a60b390bc60e9bc434b79cda5ae6db88e4f0c6c7436de9adfe1f48a2045b1", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 3830, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/v03_prefix_derivation_v1.py.txt", + "path": "prerequisites/v03_prefix_derivation_v1.py.txt", + "scope": "original/project source inert bytes only; never compiled/imported/executed", + "sha256": "1ed813148c10d5fbd3cd6781d51eca650a347eda7a6323f581d740e6ea9cb6e2", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 36954, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/v03_prefix_supervisor_v1.py.txt", + "path": "prerequisites/v03_prefix_supervisor_v1.py.txt", + "scope": "original/project source inert bytes only; never compiled/imported/executed", + "sha256": "f97b07d4a5f461d4134a2bdf4cfcc28da12acc7e7144c18f6cc0a017cdee86f6", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 14205, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/prerequisites/v03_source_refusal_observer_v1.py.txt", + "path": "prerequisites/v03_source_refusal_observer_v1.py.txt", + "scope": "original/project source inert bytes only; never compiled/imported/executed", + "sha256": "abf25690d3bee4a9783ee504567c29f7fb47da670e0ec95f57cb5944bf57264f", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 2599, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/SOURCE-CLOSE-v1.json", + "path": "evidence/SOURCE-CLOSE-v1.json", + "scope": "frozen review/close/rejection/late-bookkeeping evidence; named omitted caller/other paths documentary", + "sha256": "7cac80142264ca41f80be6fa7ea4a0b268cd2ce6c44ff2755f0cb3294c59fd9b", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 5794, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/AUTHOR-FREEZE-v1.json", + "path": "evidence/AUTHOR-FREEZE-v1.json", + "scope": "frozen review/close/rejection/late-bookkeeping evidence; named omitted caller/other paths documentary", + "sha256": "2c304f8810a17549e97a0a565a3e0a74dbde3f7f753d0942dad050e8feb8b2c4", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 867, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/AUTHOR-BOOKKEEPING-v1.json", + "path": "evidence/AUTHOR-BOOKKEEPING-v1.json", + "scope": "frozen review/close/rejection/late-bookkeeping evidence; named omitted caller/other paths documentary", + "sha256": "e2088fd85f57dba85ea375b52af492cff6950469a1e5adedb584efdfd802b287", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 3494, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/SOURCE-CUTOFF-OBSERVATION-v1.json", + "path": "evidence/SOURCE-CUTOFF-OBSERVATION-v1.json", + "scope": "frozen review/close/rejection/late-bookkeeping evidence; named omitted caller/other paths documentary", + "sha256": "5ef3dc17be7b3e08d49e9e442073952854a7a1f2fd810c34ed6e6f0b373c65f3", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 1576, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/REPAIR-WINDOW-v1.json", + "path": "evidence/REPAIR-WINDOW-v1.json", + "scope": "frozen review/close/rejection/late-bookkeeping evidence; named omitted caller/other paths documentary", + "sha256": "1aae26a3f68e8774fe4deae3231172b92cdc14d859559b8ec655957605e81144", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 1680, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/review-loader-source-v1.md", + "path": "evidence/review-loader-source-v1.md", + "scope": "frozen review/close/rejection/late-bookkeeping evidence; named omitted caller/other paths documentary", + "sha256": "ba94ab04608fccc387c6178e7dade9df1868e2c43902f9ae8aa076550414b837", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 3430, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/review-loader-source-v1.json", + "path": "evidence/review-loader-source-v1.json", + "scope": "frozen review/close/rejection/late-bookkeeping evidence; named omitted caller/other paths documentary", + "sha256": "dd63a381f2feef9a5a2b265754b4d8102672e429c0843a2052adcfd9f10e5962", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 2374, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/review-loader-source-v2.md", + "path": "evidence/review-loader-source-v2.md", + "scope": "frozen review/close/rejection/late-bookkeeping evidence; named omitted caller/other paths documentary", + "sha256": "f7a78a3b44892e20eae7154e048cf42ed25bd189a1192b4d45191e75c8cc0ec0", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 5562, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/review-loader-source-v2.json", + "path": "evidence/review-loader-source-v2.json", + "scope": "frozen review/close/rejection/late-bookkeeping evidence; named omitted caller/other paths documentary", + "sha256": "7ed7ef8896abdaab443473038992f652a5054f43c4ea41a0f0aa0f028079b799", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 11197, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/review-loader-initial-reconstruction-v1.json", + "path": "evidence/review-loader-initial-reconstruction-v1.json", + "scope": "frozen review/close/rejection/late-bookkeeping evidence; named omitted caller/other paths documentary", + "sha256": "072e74893f0e512e7025b5d2756b09e05a87811286dc870139139561062a5efa", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 4044, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/review-caller-source-v1.md", + "path": "evidence/review-caller-source-v1.md", + "scope": "frozen review/close/rejection/late-bookkeeping evidence; named omitted caller/other paths documentary", + "sha256": "899bff22642c6dc1f4b3ce903066d77b5fecf447dba53d14e035e4f05a323bf1", + "trailing_LF_bytes": 2 + }, + { + "byte_exact": true, + "bytes": 2629, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/review-caller-source-v1.json", + "path": "evidence/review-caller-source-v1.json", + "scope": "frozen review/close/rejection/late-bookkeeping evidence; named omitted caller/other paths documentary", + "sha256": "3355a2f1275daa31cb35d26f1fb87e305b645920cd4c1369a185ac3b7f436c16", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 3650, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/review-caller-source-v2.md", + "path": "evidence/review-caller-source-v2.md", + "scope": "frozen review/close/rejection/late-bookkeeping evidence; named omitted caller/other paths documentary", + "sha256": "6fd0b3f5c47ffe81ccd362a526f37c15d18d762b0c5f0464977f93fac18d89b2", + "trailing_LF_bytes": 2 + }, + { + "byte_exact": true, + "bytes": 4061, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/review-caller-source-v2.json", + "path": "evidence/review-caller-source-v2.json", + "scope": "frozen review/close/rejection/late-bookkeeping evidence; named omitted caller/other paths documentary", + "sha256": "37c9f79c9f836fa14ea88d1ae5790b2ce350361699e848f35e2faebe6549c8b6", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 431, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/RECONSTRUCTION-v1.json", + "path": "evidence/RECONSTRUCTION-v1.json", + "scope": "frozen reconstruction label or author test log; historical finite scope", + "sha256": "342322dae633116c337cdacf0fa5d288b05cd7636c6264e73aaf32f6fdb15616", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 1128, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/NEW-TESTS-normal-v1.txt", + "path": "evidence/NEW-TESTS-normal-v1.txt", + "scope": "frozen reconstruction label or author test log; historical finite scope", + "sha256": "46036065bfa1157fa14ce4f93c047ddec3fc20291fa6e6fb1e67ea6f2a7f3fd7", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 1128, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/NEW-TESTS-optimized-v1.txt", + "path": "evidence/NEW-TESTS-optimized-v1.txt", + "scope": "frozen reconstruction label or author test log; historical finite scope", + "sha256": "63e13e6ef1d5e8195b465e6869cb2d4ecaa7838b61272630d8360dee8899bd9d", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 1541, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/NEW-TESTS-normal-v2.txt", + "path": "evidence/NEW-TESTS-normal-v2.txt", + "scope": "frozen reconstruction label or author test log; historical finite scope", + "sha256": "67746245de08aa4cce869305d1d173a97b0f13c23408783a90e1b4967558ceee", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 1541, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/NEW-TESTS-optimized-v2.txt", + "path": "evidence/NEW-TESTS-optimized-v2.txt", + "scope": "frozen reconstruction label or author test log; historical finite scope", + "sha256": "c26d90b490e14525b65fdf40255171b107c7b9e65eddab428c3d5f27e688fc3e", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 9247, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/repair-v1/predecessor_entry-observed-after-author-self-correction.py.txt", + "path": "history/after-self-correction-35b.py.txt", + "scope": "inert historical source snapshot; d751 explicitly verified reconstruction;81de rawsnapshot absent, not fabricated", + "sha256": "35b99508cbc4b686f18b29ecd1458c21f4139ffd0a8cc62a774a49570e20c10f", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 9950, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/initial-draft-VERIFIED-RECONSTRUCTION.py.txt", + "path": "history/initial-draft-VERIFIED-RECONSTRUCTION-d751.py.txt", + "scope": "inert historical source snapshot; d751 explicitly verified reconstruction;81de rawsnapshot absent, not fabricated", + "sha256": "d7512ffe6c9ee2b7a51b98672032fd14f50f5d47e193131873ea426a47f25cbd", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 21773, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/pre-canonical-pair-entry-v1.py.txt", + "path": "history/pre-canonical-pair-a8b7.py.txt", + "scope": "inert historical source snapshot; d751 explicitly verified reconstruction;81de rawsnapshot absent, not fabricated", + "sha256": "a8b78c852fe653bfe9ef7b594f5efe1f8021b1128c662e54fb4fea7800b702d5", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 21764, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/pre-ctypes-entry-v1.py.txt", + "path": "history/pre-ctypes-75a.py.txt", + "scope": "inert historical source snapshot; d751 explicitly verified reconstruction;81de rawsnapshot absent, not fabricated", + "sha256": "75a08c0a5ea2ed80373fbd91d2a8cb53b2b131d9ef1bcab74ccb69d191cb2a56", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 21764, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/review-loader-entry-observed-75a08c0a5ea2.py.txt", + "path": "history/reviewed-entry-75a.py.txt", + "scope": "inert historical source snapshot; d751 explicitly verified reconstruction;81de rawsnapshot absent, not fabricated", + "sha256": "75a08c0a5ea2ed80373fbd91d2a8cb53b2b131d9ef1bcab74ccb69d191cb2a56", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 21857, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/review-loader-entry-observed-b783c6812a62.py.txt", + "path": "history/reviewed-entry-final-b783.py.txt", + "scope": "inert historical source snapshot; d751 explicitly verified reconstruction;81de rawsnapshot absent, not fabricated", + "sha256": "b783c6812a6295069456cfb4187d4e09bb7acbcb20fffd76e0c10267f90c1201", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 5094, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/review-loader-tests-observed-9796386f813c.py.txt", + "path": "history/reviewed-tests-9796.py.txt", + "scope": "inert historical source snapshot; d751 explicitly verified reconstruction;81de rawsnapshot absent, not fabricated", + "sha256": "9796386f813ccece7199b1795a9b5d34469eeea001021aeda3ac49e796c33e2f", + "trailing_LF_bytes": 1 + }, + { + "byte_exact": true, + "bytes": 6532, + "from": "outputs/c05-v03-completion-20261102T055710Z/unit06/review-loader-tests-observed-19c1b08d4dae.py.txt", + "path": "history/reviewed-tests-final-19c1.py.txt", + "scope": "inert historical source snapshot; d751 explicitly verified reconstruction;81de rawsnapshot absent, not fabricated", + "sha256": "19c1b08d4daeaf0c2d40357b0e117fcb2ca2f632f627e290fe7442abf49b3504", + "trailing_LF_bytes": 1 + } + ], + "history": "Initial9950d751is verified reconstruction, not directcopy;35b/a8b7/75a/b783 and fixture snapshots retained. Intermediate81de rawsnapshotgap and late bookkeeping remain explicit; nothing fabricated or normalized.", + "omitted": "Caller90a and caller support/preparer not included as active or accepted code. Full private Pro chat/prompt/response and PLAN/STATE/full workspace excluded. Other source/report paths remain documentary, not live replay inputs.", + "original_source_functions_compiled_imported_executed": false, + "schema": "authenticated-prefix-entry-export-origin-v1", + "scope": "Exact accepted conditional U6.2 entry+12NEWfixture; no complete bootstrap/caller/preparer/runtime admission" +} diff --git a/research/h25-v03-authenticated-prefix-entry/SOURCES.json b/research/h25-v03-authenticated-prefix-entry/SOURCES.json new file mode 100644 index 0000000000..594089b9c7 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/SOURCES.json @@ -0,0 +1,18 @@ +{ + "schema_version": 1, + "base_commit": "7c49fe32c55de02c2c873655c804b16e4c3fef0a", + "files": [ + { + "path": "certificates/selected-result.json", + "usage": "provenance", + "git_blob": "d59b5035e7b4cbaa9d688a1d32dd0d6eb79c466a", + "sha256": "9b8d0eea95b3bf0dfcb7938a732a6439b87a2685dec2a5ab9e525b3b34debbfa" + }, + { + "path": "docs/research/agent-task-catalog.json", + "usage": "provenance", + "git_blob": "3404fbdd5e7529a0674eef26114b5071e4586cec", + "sha256": "ead6cdc9d0af6d58e8a49744d8ec8c7c15e13d2ba93c276c434bcf9b51b93a81" + } + ] +} diff --git a/research/h25-v03-authenticated-prefix-entry/TASK.json b/research/h25-v03-authenticated-prefix-entry/TASK.json new file mode 100644 index 0000000000..686a3820bc --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/TASK.json @@ -0,0 +1,60 @@ +{ + "actual_scope": "Export only independently accepted conditional U6.2 authenticated entry source and frozen12NEWpure/owned-file fixture, with15inert sourcegraph inputs and complete rejection/close history.", + "ai_assistance": "ChatGPT Pro source consultation and substantial OpenAI Codex source-audit/verification assistance. These are agent-assisted findings, not human or proof-kernel acceptance.", + "author": "Chris R / Clear1nsight", + "base_commit": "7c49fe32c55de02c2c873655c804b16e4c3fef0a", + "bottleneck_link": "Retained-byte authentication, actual fresh module identity, dependency-first loading and raw failure custody are necessary conditional entry operations before genuine enclosing-parent integration.", + "budget_minutes": 16, + "evidence": "Exact b783entry/19c1fixture, final7ed7review and37c9callerpartial, raw/verified-reconstruction history including81degap, frozen close and15inert imports; registered pure replay/coldcopy.", + "open_questions": [ + { + "blocked_by": "No accepted preparer/caller integration; genuine T0/current source/policy/gate/stage/native/command/funding/execution inputs, complete C05/C07/current-history/fit and parent-exit evidence remain absent.", + "first_step": "In separately authorized work, implement the complete acyclic preparer against real original schemas, then resolve the caller cap discrepancy and independently review the complete composition.", + "question": "Can a separate actual P/Q/M/JOBS/STAGE preparer and corrected caller satisfy the accepted entry contract and complete integration under genuine admissions?", + "why_it_matters": "U6.2accepts entry source only. Caller90astill lacks finalentrycallcaps and no preparer or complete resource/operation bill exists." + } + ], + "original_card": { + "acceptance_gate": "Preserve immutable source hashes and proof-relevant content; a different compressed byte stream alone is not a mathematical mismatch.", + "allowed_variations": [ + "One interpreter/version mismatch or one payload field comparison." + ], + "bottleneck_link": "Portable exact checks prevent environment failures from blocking valid contributions.", + "first_experiment": "Reproduce one specific mismatch or audit one canonical comparison for omitted proof-relevant fields.", + "first_step": { + "command": [ + "python3", + "-B", + "scripts/research_selected_baseline.py" + ], + "expected": "PASS_RESEARCH_BASELINE_BINDINGS_ONLY", + "inspect": "Resolve the current selected review, separate complex/ordinary BIT/admitted BIT/outer budgets, and compare the card against live handoffs before starting. Historical ceilings require exact source/model equivalence.", + "scope": "Source-binding orientation only; not a scientific replay or all-size proof. Materialize selected inputs if this checkout is sparse." + }, + "id": "portable-replay", + "methods": [ + "Reproduce one portability failure and add a minimal cross-environment fix.", + "Audit one canonical-payload comparison for omitted proof-relevant fields." + ], + "overlap_terms": [ + "gzip container", + "reproducibility", + "canonical payload" + ], + "question": "Can one reproducible environment or artifact-comparison failure be repaired?", + "scope_change_triggers": [ + "Removing immutable-source pins because generated compressed bytes differ." + ], + "starting_points": [ + "research/gzip-container-reproducibility/README.md", + "docs/ci-verification.md" + ] + }, + "outcome": "partial", + "priority_revision": 8, + "schema_version": 1, + "scope_change_reason": "Explicit incremental publication assignment separates accepted entry source operation from the already published U6.1 source graph, unaccepted caller90a and absent preparer/integration.", + "scope_status": "changed", + "stop_rule": "Unit06 source/fixture cutoff13:35:31UTC; closed partial SOURCE-CLOSE7cac801. No source repair/extension or original work. Publication-only target13:58UTC; run exactly frozen12NEWmethods and archive/static checks only.", + "task_id": "portable-replay" +} diff --git a/research/h25-v03-authenticated-prefix-entry/VERIFY.json b/research/h25-v03-authenticated-prefix-entry/VERIFY.json new file mode 100644 index 0000000000..b211722b5f --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/VERIFY.json @@ -0,0 +1,32 @@ +{ + "commands": [ + { + "argv": [ + "{python}", + "-I", + "-B", + "-S", + "{package}/run.py" + ], + "checks": "Archive/source-preservation/graph identities and exactly12frozen NEW pure/owned-file methods; original15 parsed/hashchecked only, no fullmain/entry_operation/caller/runtime", + "timeout_seconds": 30 + }, + { + "argv": [ + "{python}", + "-I", + "-O", + "-B", + "-S", + "{package}/run.py" + ], + "checks": "Same exact12NEWmethods normal-source semantics under optimized Python; no original code execution", + "timeout_seconds": 30 + } + ], + "inputs": [], + "python": "3.12", + "requirements": [], + "schema_version": 1, + "status": "ready" +} diff --git a/research/h25-v03-authenticated-prefix-entry/evidence/AUTHOR-BOOKKEEPING-v1.json b/research/h25-v03-authenticated-prefix-entry/evidence/AUTHOR-BOOKKEEPING-v1.json new file mode 100644 index 0000000000..52510ee683 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/evidence/AUTHOR-BOOKKEEPING-v1.json @@ -0,0 +1,19 @@ +{ + "caller_prefix_sync_completed": false, + "costs": "OPEN_NOT_ZERO", + "created_after_source_test_cutoff": true, + "created_utc": "2026-11-02T13:37:58.497935+00:00", + "freeze_recorded_utc": "2026-11-02T13:36:18.130792+00:00", + "full_C05": false, + "full_V03": false, + "no_backdating": true, + "original_activity_credit": false, + "original_execution": false, + "partial_disposition": "U6.1 accepted at input gate; no author claim of complete U6.2/U6.3/U6.4 source acceptance", + "preparer_implemented": false, + "referenced_freeze": "outputs/c05-v03-completion-20261102T055710Z/unit06/AUTHOR-FREEZE-v1.json", + "referenced_freeze_sha256": "2c304f8810a17549e97a0a565a3e0a74dbde3f7f753d0942dad050e8feb8b2c4", + "schema": "unit06-author-late-bookkeeping-v1", + "source_and_test_operations_remain_stopped": true, + "source_test_cutoff_utc": "2026-11-02T13:35:31Z" +} diff --git a/research/h25-v03-authenticated-prefix-entry/evidence/AUTHOR-FREEZE-v1.json b/research/h25-v03-authenticated-prefix-entry/evidence/AUTHOR-FREEZE-v1.json new file mode 100644 index 0000000000..cb9a80d425 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/evidence/AUTHOR-FREEZE-v1.json @@ -0,0 +1,123 @@ +{ + "U6_1": "parent input gate independently accepted graph/design/caller interfaces", + "U6_2": "authored source plus12newtests; independent complete source acceptance pending, not a milestone claim", + "U6_3": "UNACCEPTED: actual P/Q/M/JOBS/STAGE preparer not implemented; caller successor draft alone does not close integration", + "U6_4": "UNACCEPTED: complete operation/fit/resource bill and whole source preservation acceptance not completed", + "all_further_source_and_fixture_execution_stopped": true, + "artifacts": [ + { + "bytes": 21857, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit06/implementation/predecessor_entry.py", + "sha256": "b783c6812a6295069456cfb4187d4e09bb7acbcb20fffd76e0c10267f90c1201" + }, + { + "bytes": 34412, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit06/implementation/run_queue4_prefix_v1.py", + "sha256": "90a7ed4a45b94e16fa313623e56f6f3efcd85f3ea40355a43b289d8c49a75825" + }, + { + "bytes": 1128, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/NEW-TESTS-normal-v1.txt", + "sha256": "46036065bfa1157fa14ce4f93c047ddec3fc20291fa6e6fb1e67ea6f2a7f3fd7" + }, + { + "bytes": 1541, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/NEW-TESTS-normal-v2.txt", + "sha256": "67746245de08aa4cce869305d1d173a97b0f13c23408783a90e1b4967558ceee" + }, + { + "bytes": 1128, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/NEW-TESTS-optimized-v1.txt", + "sha256": "63e13e6ef1d5e8195b465e6869cb2d4ecaa7838b61272630d8360dee8899bd9d" + }, + { + "bytes": 1541, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/NEW-TESTS-optimized-v2.txt", + "sha256": "c26d90b490e14525b65fdf40255171b107c7b9e65eddab428c3d5f27e688fc3e" + }, + { + "bytes": 431, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/RECONSTRUCTION-v1.json", + "sha256": "342322dae633116c337cdacf0fa5d288b05cd7636c6264e73aaf32f6fdb15616" + }, + { + "bytes": 9574, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/caller_T0_support.py.txt", + "sha256": "c20523438a6bb49ef43ea527cf6c96a07542cadea72a77eb822c54f8f64fb863" + }, + { + "bytes": 11023, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/caller_original_wrapper.py.txt", + "sha256": "ea4c07337ccc1865accfd1b1fe485d51057a04a49e4bfb5f10cc36dc92b5f9a8" + }, + { + "bytes": 2024, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/caller_preservation_v1.json", + "sha256": "7d9c3d9b1e3742adeda2f54ed249e1791a3bf0b7fad354feb94d2e7a8086f5f0" + }, + { + "bytes": 9950, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/initial-draft-VERIFIED-RECONSTRUCTION.py.txt", + "sha256": "d7512ffe6c9ee2b7a51b98672032fd14f50f5d47e193131873ea426a47f25cbd" + }, + { + "bytes": 21773, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/pre-canonical-pair-entry-v1.py.txt", + "sha256": "a8b78c852fe653bfe9ef7b594f5efe1f8021b1128c662e54fb4fea7800b702d5" + }, + { + "bytes": 21764, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/pre-ctypes-entry-v1.py.txt", + "sha256": "75a08c0a5ea2ed80373fbd91d2a8cb53b2b131d9ef1bcab74ccb69d191cb2a56" + }, + { + "bytes": 6532, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/test_bootstrap_new_v1.py", + "sha256": "19c1b08d4daeaf0c2d40357b0e117fcb2ca2f632f627e290fe7442abf49b3504" + } + ], + "caller_prefix_synced_to_final_entry_support": false, + "caller_sha256": "90a7ed4a45b94e16fa313623e56f6f3efcd85f3ea40355a43b289d8c49a75825", + "costs": "OPEN_NOT_ZERO", + "entry_bytes": 21857, + "entry_sha256": "b783c6812a6295069456cfb4187d4e09bb7acbcb20fffd76e0c10267f90c1201", + "full_C05": false, + "full_V03": false, + "full_entry_or_caller_executed": false, + "incomplete": [ + "actual preparation operation", + "complete caller+preparer+entry integration review", + "actual runtime/source/C05/C07/native/funding/admission selections", + "actual complete resource/initialization/outertail fit" + ], + "initial_failed_source": { + "bytes": 9950, + "path": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/initial-draft-VERIFIED-RECONSTRUCTION.py.txt", + "preservation": "VERIFIED_RECONSTRUCTION_NOT_DIRECT_SAVED_COPY; original overwrite gap/earliest ownfix clock retained", + "sha256": "d7512ffe6c9ee2b7a51b98672032fd14f50f5d47e193131873ea426a47f25cbd" + }, + "native_control_compiler_namespace_target_executed": false, + "new_tests": [ + { + "mode": "normal", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/NEW-TESTS-normal-v2.txt", + "sha256": "67746245de08aa4cce869305d1d173a97b0f13c23408783a90e1b4967558ceee", + "twelve_pass": true + }, + { + "mode": "optimized", + "path": "outputs/c05-v03-completion-20261102T055710Z/unit06/fixtures/NEW-TESTS-optimized-v2.txt", + "sha256": "c26d90b490e14525b65fdf40255171b107c7b9e65eddab428c3d5f27e688fc3e", + "twelve_pass": true + } + ], + "original_activity_credit": false, + "original_body_executed": false, + "original_completion_percent": 43.5, + "original_modules_imported": false, + "recorded_utc": "2026-11-02T13:36:18.130792+00:00", + "schema": "unit06-author-partial-freeze-v1", + "shared_support_sha256": "48bc4009acb7569fb4a2ac529bec928a3aafdedc017a0ebaae97f72b7c97eabe", + "source_test_cutoff_utc": "2026-11-02T13:35:31Z", + "test_scope": "NEW entry imported withoutmain; only enumerated NEW literal module bodies and owned temp file I/O/fault injection; original15 parsed as inert AST only" +} diff --git a/research/h25-v03-authenticated-prefix-entry/evidence/NEW-TESTS-normal-v1.txt b/research/h25-v03-authenticated-prefix-entry/evidence/NEW-TESTS-normal-v1.txt new file mode 100644 index 0000000000..ff00aaf667 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/evidence/NEW-TESTS-normal-v1.txt @@ -0,0 +1,14 @@ +test_ambient_project_is_not_adopted (__main__.Tests.test_ambient_project_is_not_adopted) ... ok +test_bad_second_hash_precedes_any_body (__main__.Tests.test_bad_second_hash_precedes_any_body) ... ok +test_exact_cap_path_and_duplicate_json (__main__.Tests.test_exact_cap_path_and_duplicate_json) ... ok +test_foreign_metaclass_callback_never_called (__main__.Tests.test_foreign_metaclass_callback_never_called) ... ok +test_missing_project_dependency_precedes_any_body (__main__.Tests.test_missing_project_dependency_precedes_any_body) ... ok +test_new_data_write_is_exclusive_and_real_identity (__main__.Tests.test_new_data_write_is_exclusive_and_real_identity) ... ok +test_partial_initialization_retained_and_burned (__main__.Tests.test_partial_initialization_retained_and_burned) ... ok +test_read_primary_and_close_secondary_same_objects (__main__.Tests.test_read_primary_and_close_secondary_same_objects) ... ok +test_retained_real_module_identity_and_builtins (__main__.Tests.test_retained_real_module_identity_and_builtins) ... ok + +---------------------------------------------------------------------- +Ran 9 tests in 0.095s + +OK diff --git a/research/h25-v03-authenticated-prefix-entry/evidence/NEW-TESTS-normal-v2.txt b/research/h25-v03-authenticated-prefix-entry/evidence/NEW-TESTS-normal-v2.txt new file mode 100644 index 0000000000..88b3ff8ed3 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/evidence/NEW-TESTS-normal-v2.txt @@ -0,0 +1,17 @@ +test_ambient_project_is_not_adopted (__main__.Tests.test_ambient_project_is_not_adopted) ... ok +test_bad_second_hash_precedes_any_body (__main__.Tests.test_bad_second_hash_precedes_any_body) ... ok +test_exact_cap_path_and_duplicate_json (__main__.Tests.test_exact_cap_path_and_duplicate_json) ... ok +test_exact_gate_names_installed_only_in_fresh_fixture_modules (__main__.Tests.test_exact_gate_names_installed_only_in_fresh_fixture_modules) ... ok +test_fixed_original_graph_is_parsed_only_and_ordered (__main__.Tests.test_fixed_original_graph_is_parsed_only_and_ordered) ... ok +test_foreign_metaclass_callback_never_called (__main__.Tests.test_foreign_metaclass_callback_never_called) ... ok +test_invalid_mode_refuses_before_any_runtime_operation (__main__.Tests.test_invalid_mode_refuses_before_any_runtime_operation) ... ok +test_missing_project_dependency_precedes_any_body (__main__.Tests.test_missing_project_dependency_precedes_any_body) ... ok +test_new_data_write_is_exclusive_and_real_identity (__main__.Tests.test_new_data_write_is_exclusive_and_real_identity) ... ok +test_partial_initialization_retained_and_burned (__main__.Tests.test_partial_initialization_retained_and_burned) ... ok +test_read_primary_and_close_secondary_same_objects (__main__.Tests.test_read_primary_and_close_secondary_same_objects) ... ok +test_retained_real_module_identity_and_builtins (__main__.Tests.test_retained_real_module_identity_and_builtins) ... ok + +---------------------------------------------------------------------- +Ran 12 tests in 0.290s + +OK diff --git a/research/h25-v03-authenticated-prefix-entry/evidence/NEW-TESTS-optimized-v1.txt b/research/h25-v03-authenticated-prefix-entry/evidence/NEW-TESTS-optimized-v1.txt new file mode 100644 index 0000000000..486bbc2b38 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/evidence/NEW-TESTS-optimized-v1.txt @@ -0,0 +1,14 @@ +test_ambient_project_is_not_adopted (__main__.Tests.test_ambient_project_is_not_adopted) ... ok +test_bad_second_hash_precedes_any_body (__main__.Tests.test_bad_second_hash_precedes_any_body) ... ok +test_exact_cap_path_and_duplicate_json (__main__.Tests.test_exact_cap_path_and_duplicate_json) ... ok +test_foreign_metaclass_callback_never_called (__main__.Tests.test_foreign_metaclass_callback_never_called) ... ok +test_missing_project_dependency_precedes_any_body (__main__.Tests.test_missing_project_dependency_precedes_any_body) ... ok +test_new_data_write_is_exclusive_and_real_identity (__main__.Tests.test_new_data_write_is_exclusive_and_real_identity) ... ok +test_partial_initialization_retained_and_burned (__main__.Tests.test_partial_initialization_retained_and_burned) ... ok +test_read_primary_and_close_secondary_same_objects (__main__.Tests.test_read_primary_and_close_secondary_same_objects) ... ok +test_retained_real_module_identity_and_builtins (__main__.Tests.test_retained_real_module_identity_and_builtins) ... ok + +---------------------------------------------------------------------- +Ran 9 tests in 0.097s + +OK diff --git a/research/h25-v03-authenticated-prefix-entry/evidence/NEW-TESTS-optimized-v2.txt b/research/h25-v03-authenticated-prefix-entry/evidence/NEW-TESTS-optimized-v2.txt new file mode 100644 index 0000000000..513d05304a --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/evidence/NEW-TESTS-optimized-v2.txt @@ -0,0 +1,17 @@ +test_ambient_project_is_not_adopted (__main__.Tests.test_ambient_project_is_not_adopted) ... ok +test_bad_second_hash_precedes_any_body (__main__.Tests.test_bad_second_hash_precedes_any_body) ... ok +test_exact_cap_path_and_duplicate_json (__main__.Tests.test_exact_cap_path_and_duplicate_json) ... ok +test_exact_gate_names_installed_only_in_fresh_fixture_modules (__main__.Tests.test_exact_gate_names_installed_only_in_fresh_fixture_modules) ... ok +test_fixed_original_graph_is_parsed_only_and_ordered (__main__.Tests.test_fixed_original_graph_is_parsed_only_and_ordered) ... ok +test_foreign_metaclass_callback_never_called (__main__.Tests.test_foreign_metaclass_callback_never_called) ... ok +test_invalid_mode_refuses_before_any_runtime_operation (__main__.Tests.test_invalid_mode_refuses_before_any_runtime_operation) ... ok +test_missing_project_dependency_precedes_any_body (__main__.Tests.test_missing_project_dependency_precedes_any_body) ... ok +test_new_data_write_is_exclusive_and_real_identity (__main__.Tests.test_new_data_write_is_exclusive_and_real_identity) ... ok +test_partial_initialization_retained_and_burned (__main__.Tests.test_partial_initialization_retained_and_burned) ... ok +test_read_primary_and_close_secondary_same_objects (__main__.Tests.test_read_primary_and_close_secondary_same_objects) ... ok +test_retained_real_module_identity_and_builtins (__main__.Tests.test_retained_real_module_identity_and_builtins) ... ok + +---------------------------------------------------------------------- +Ran 12 tests in 0.229s + +OK diff --git a/research/h25-v03-authenticated-prefix-entry/evidence/RECONSTRUCTION-v1.json b/research/h25-v03-authenticated-prefix-entry/evidence/RECONSTRUCTION-v1.json new file mode 100644 index 0000000000..69a9623ad6 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/evidence/RECONSTRUCTION-v1.json @@ -0,0 +1,8 @@ +{ + "kind": "VERIFIED_RECONSTRUCTION_NOT_DIRECT_SAVED_COPY", + "bytes": 9950, + "sha256": "d7512ffe6c9ee2b7a51b98672032fd14f50f5d47e193131873ea426a47f25cbd", + "method": "exact inverse of the single author edit on current35b prefix; verified against independent original toolread fullhash", + "current_source_sha256": "35b99508cbc4b686f18b29ecd1458c21f4139ffd0a8cc62a774a49570e20c10f", + "original_overwrite_gap_preserved": true +} diff --git a/research/h25-v03-authenticated-prefix-entry/evidence/REPAIR-WINDOW-v1.json b/research/h25-v03-authenticated-prefix-entry/evidence/REPAIR-WINDOW-v1.json new file mode 100644 index 0000000000..24d74095f0 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/evidence/REPAIR-WINDOW-v1.json @@ -0,0 +1,30 @@ +{ + "recorded_utc": "2026-11-02T13:22:33.733419+00:00", + "repair_start_utc": "2026-11-02T13:20:31+00:00", + "repair_end_utc": "2026-11-02T13:35:31+00:00", + "clock_policy": "Conservative earliest author-reported draft correction before independent defect messages; late parent enforcement/bookkeeping and initial overwritten draft gap preserved, not a new15minuteextension", + "sole_repair": true, + "hard_deadline_utc": "2026-11-02T13:56:50.907595+00:00", + "all_candidate_source_and_fixture_edits_freeze_by_repair_end": true, + "findings": [ + "Unowned observe_regular firstread/close can replace primary, omit pending/descriptor/raw/counter custody", + "Exact cap and original bounded ASCII printable path checks before comparison/I/O", + "Foreign metaclass equality callback from kind in (list,dict); exact-type identity needed" + ], + "author_reported_own_initial_fix_utc": "2026-11-02T13:20:31+00:00", + "independent_initial_failed_draft": { + "reported_bytes": 9950, + "sha256_prefix": "d7512ffe", + "exact_preservation": "pending reviewers/author exact verified reconstruction; do not claim direct on-disk preserved copy" + }, + "current_observed_file": { + "bytes": 9247, + "sha256": "35b99508cbc4b686f18b29ecd1458c21f4139ffd0a8cc62a774a49570e20c10f", + "snapshot": "outputs/c05-v03-completion-20261102T055710Z/unit06/repair-v1/predecessor_entry-observed-after-author-self-correction.py.txt" + }, + "original_execution": false, + "new_tests_executed_at_record": false, + "original_C05": false, + "original_V03": false, + "costs": "OPEN_NOT_ZERO" +} diff --git a/research/h25-v03-authenticated-prefix-entry/evidence/SOURCE-CLOSE-v1.json b/research/h25-v03-authenticated-prefix-entry/evidence/SOURCE-CLOSE-v1.json new file mode 100644 index 0000000000..8593a62c41 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/evidence/SOURCE-CLOSE-v1.json @@ -0,0 +1,71 @@ +{ + "recorded_utc": "2026-11-02T13:41:49.940426+00:00", + "phase": "closed_partial_with_independently_accepted_entry_only", + "accepted_checkpoints": [ + "U6.1", + "U6.2" + ], + "accepted_count": 2, + "fixed_local_denominator": 4, + "U6_2_independently_accepted_utc": "2026-11-02T13:38:29+00:00", + "source_and_fixture_edits_cutoff_utc": "2026-11-02T13:35:31+00:00", + "source_and_tests_finished_author_report_utc": "2026-11-02T13:34:18+00:00", + "sole_repair_clock_preserved": "13:20:31 through13:35:31UTC; parentenforcement/bookkeepinglate13:22:33 preserved", + "U6_3": "NOT_ACCEPTED actualP/Q/M/JOBS/STAGEpreparer absent; separate caller90a retainsuncappedcopiedprefix", + "U6_4": "NOT_ACCEPTED no complete integration or complete resourceoperationbill", + "historical_gaps": [ + "initial9950draft recovered verified reconstruction, notdirectsavedcopy", + "intermediate81de rawsnapshotgap disclosed", + "freeze bookkeeping13:36:18 and13:37:58 aftercutoff; no backdating" + ], + "evidence": [ + { + "path": "review-loader-source-v2.json", + "bytes": 5562, + "sha256": "7ed7ef8896abdaab443473038992f652a5054f43c4ea41a0f0aa0f028079b799" + }, + { + "path": "review-caller-source-v2.json", + "bytes": 4061, + "sha256": "37c9f79c9f836fa14ea88d1ae5790b2ce350361699e848f35e2faebe6549c8b6" + }, + { + "path": "AUTHOR-FREEZE-v1.json", + "bytes": 5794, + "sha256": "2c304f8810a17549e97a0a565a3e0a74dbde3f7f753d0942dad050e8feb8b2c4" + }, + { + "path": "AUTHOR-BOOKKEEPING-v1.json", + "bytes": 867, + "sha256": "e2088fd85f57dba85ea375b52af492cff6950469a1e5adedb584efdfd802b287" + }, + { + "path": "SOURCE-CUTOFF-OBSERVATION-v1.json", + "bytes": 3494, + "sha256": "5ef3dc17be7b3e08d49e9e442073952854a7a1f2fd810c34ed6e6f0b373c65f3" + }, + { + "path": "implementation/predecessor_entry.py", + "bytes": 21857, + "sha256": "b783c6812a6295069456cfb4187d4e09bb7acbcb20fffd76e0c10267f90c1201" + }, + { + "path": "implementation/run_queue4_prefix_v1.py", + "bytes": 34412, + "sha256": "90a7ed4a45b94e16fa313623e56f6f3efcd85f3ea40355a43b289d8c49a75825" + }, + { + "path": "fixtures/test_bootstrap_new_v1.py", + "bytes": 6532, + "sha256": "19c1b08d4daeaf0c2d40357b0e117fcb2ca2f632f627e290fe7442abf49b3504" + } + ], + "original_C05": false, + "original_V03": false, + "runtime_qualified": false, + "original_activity_credit_added": 0, + "original_completion_percent": 43.5, + "original_modules_or_target_executed": false, + "reopen_or_extension": false, + "costs": "OPEN_NOT_ZERO" +} diff --git a/research/h25-v03-authenticated-prefix-entry/evidence/SOURCE-CUTOFF-OBSERVATION-v1.json b/research/h25-v03-authenticated-prefix-entry/evidence/SOURCE-CUTOFF-OBSERVATION-v1.json new file mode 100644 index 0000000000..e6f8a2dd93 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/evidence/SOURCE-CUTOFF-OBSERVATION-v1.json @@ -0,0 +1,99 @@ +{ + "recorded_utc": "2026-11-02T13:36:38.200827+00:00", + "source_and_test_cutoff_utc": "2026-11-02T13:35:31+00:00", + "stop_requested": true, + "postcutoff_readonly_review_allowed": true, + "U6_3_complete_preparer_present": false, + "code_and_fixture_pins": [ + { + "path": "implementation/predecessor_entry.py", + "bytes": 21857, + "sha256": "b783c6812a6295069456cfb4187d4e09bb7acbcb20fffd76e0c10267f90c1201", + "mtime_ns": 1793626450518855348 + }, + { + "path": "implementation/run_queue4_prefix_v1.py", + "bytes": 34412, + "sha256": "90a7ed4a45b94e16fa313623e56f6f3efcd85f3ea40355a43b289d8c49a75825", + "mtime_ns": 1793626092320152275 + }, + { + "path": "fixtures/NEW-TESTS-normal-v1.txt", + "bytes": 1128, + "sha256": "46036065bfa1157fa14ce4f93c047ddec3fc20291fa6e6fb1e67ea6f2a7f3fd7", + "mtime_ns": 1793626316763439018 + }, + { + "path": "fixtures/NEW-TESTS-normal-v2.txt", + "bytes": 1541, + "sha256": "67746245de08aa4cce869305d1d173a97b0f13c23408783a90e1b4967558ceee", + "mtime_ns": 1793626450898848691 + }, + { + "path": "fixtures/NEW-TESTS-optimized-v1.txt", + "bytes": 1128, + "sha256": "63e13e6ef1d5e8195b465e6869cb2d4ecaa7838b61272630d8360dee8899bd9d", + "mtime_ns": 1793626317420425046 + }, + { + "path": "fixtures/NEW-TESTS-optimized-v2.txt", + "bytes": 1541, + "sha256": "c26d90b490e14525b65fdf40255171b107c7b9e65eddab428c3d5f27e688fc3e", + "mtime_ns": 1793626451638835744 + }, + { + "path": "fixtures/RECONSTRUCTION-v1.json", + "bytes": 431, + "sha256": "342322dae633116c337cdacf0fa5d288b05cd7636c6264e73aaf32f6fdb15616", + "mtime_ns": 1793625878002959280 + }, + { + "path": "fixtures/caller_T0_support.py.txt", + "bytes": 9574, + "sha256": "c20523438a6bb49ef43ea527cf6c96a07542cadea72a77eb822c54f8f64fb863", + "mtime_ns": 1793626092320152275 + }, + { + "path": "fixtures/caller_original_wrapper.py.txt", + "bytes": 11023, + "sha256": "ea4c07337ccc1865accfd1b1fe485d51057a04a49e4bfb5f10cc36dc92b5f9a8", + "mtime_ns": 1793626092320152275 + }, + { + "path": "fixtures/caller_preservation_v1.json", + "bytes": 2024, + "sha256": "7d9c3d9b1e3742adeda2f54ed249e1791a3bf0b7fad354feb94d2e7a8086f5f0", + "mtime_ns": 1793626092320152275 + }, + { + "path": "fixtures/initial-draft-VERIFIED-RECONSTRUCTION.py.txt", + "bytes": 9950, + "sha256": "d7512ffe6c9ee2b7a51b98672032fd14f50f5d47e193131873ea426a47f25cbd", + "mtime_ns": 1793625878001959323 + }, + { + "path": "fixtures/pre-canonical-pair-entry-v1.py.txt", + "bytes": 21773, + "sha256": "a8b78c852fe653bfe9ef7b594f5efe1f8021b1128c662e54fb4fea7800b702d5", + "mtime_ns": 1793626450518855348 + }, + { + "path": "fixtures/pre-ctypes-entry-v1.py.txt", + "bytes": 21764, + "sha256": "75a08c0a5ea2ed80373fbd91d2a8cb53b2b131d9ef1bcab74ccb69d191cb2a56", + "mtime_ns": 1793626381440126855 + }, + { + "path": "fixtures/test_bootstrap_new_v1.py", + "bytes": 6532, + "sha256": "19c1b08d4daeaf0c2d40357b0e117fcb2ca2f632f627e290fe7442abf49b3504", + "mtime_ns": 1793626450518855348 + } + ], + "no_new_source_test_or_repair_dispatch": true, + "scope_status": "partial source round; exact entry-only review pending, full preparer/caller integration unaccepted", + "full_C05": false, + "full_V03": false, + "original_activity_credit_added": 0, + "costs": "OPEN_NOT_ZERO" +} diff --git a/research/h25-v03-authenticated-prefix-entry/evidence/review-caller-source-v1.json b/research/h25-v03-authenticated-prefix-entry/evidence/review-caller-source-v1.json new file mode 100644 index 0000000000..b95211153a --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/evidence/review-caller-source-v1.json @@ -0,0 +1,69 @@ +{ + "schema": "unit06-caller-source-review-v1", + "recorded_utc": "2026-11-02 13:27:52 UTC", + "verdict": "EARLY_REVIEW_HOLD_COMPLETE_CALLER_PREPARER_ENTRY_NOT_YET_REVIEWED", + "repair_window": { + "start": "2026-11-02T13:20:31Z", + "end": "2026-11-02T13:35:31Z", + "parent_declared": true + }, + "findings": [ + { + "id": "U6-CALLER-01", + "status": "REJECTED_INITIAL_DRAFT_SOURCE_COUNTEREXAMPLE_CORRECTED_DURING_DRAFTING", + "function": "observe_regular", + "counterexample": "unowned first read/fstat raises A; finally close raises B; B escapes and Owner.primary remains None", + "executed": false, + "initial_source": { + "bytes": 9950, + "sha256": "d7512ffe6c9ee2b7a51b98672032fd14f50f5d47e193131873ea426a47f25cbd", + "path": "unit06/fixtures/initial-draft-VERIFIED-RECONSTRUCTION.py.txt", + "kind": "verified reconstruction, not direct saved copy", + "original_overwrite_gap": true + }, + "chronology": "Author reported self-correction13:20:31 before receiving finding. Later35b hash was already corrected and is not failed-oldsource." + }, + { + "id": "U6-CALLER-02", + "status": "REJECTED_35b_PATH_SCHEMA_MISMATCH_CURRENT_PREFIX_CORRECTED", + "source_sha256": "35b99508cbc4b686f18b29ecd1458c21f4139ffd0a8cc62a774a49570e20c10f", + "source_bytes": 9247, + "function": "path_text/validate_blob", + "original_source_span": "epoch_schema_v5.py:121-128", + "counterexamples": [ + "Unicode path", + "newline path", + "65components" + ], + "executed": false + } + ], + "current_inspected_prefix": { + "bytes": 9574, + "sha256": "c20523438a6bb49ef43ea527cf6c96a07542cadea72a77eb822c54f8f64fb863", + "corrections": [ + "owned single-pass observation", + "public prior digest required", + "printable ASCII and64components", + "exact cap/type checks" + ], + "complete_entry_caller_preparation_accepted": false, + "tests_accepted": false + }, + "pending_complete_operations": [ + "actual generic loader/entry", + "actual prior-admission caller successor", + "actual policy/plan/bootstrap-manifest/stage preparation", + "verified-result science DATA receipt bridge", + "meaningful new pure/owned error/ownership and isolation fixtures" + ], + "author_source_edited_by_reviewer": false, + "original_or_new_code_executed_by_reviewer": false, + "original_modules_imported": false, + "protected_runtime_read_or_enumerated": false, + "full_C05": false, + "full_V03": false, + "runtime_qualified": false, + "original_activity_credit_added": 0, + "costs": "OPEN_NOT_ZERO" +} diff --git a/research/h25-v03-authenticated-prefix-entry/evidence/review-caller-source-v1.md b/research/h25-v03-authenticated-prefix-entry/evidence/review-caller-source-v1.md new file mode 100644 index 0000000000..3c08063db0 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/evidence/review-caller-source-v1.md @@ -0,0 +1,26 @@ +# Unit06 caller/preparation review — retained early findings + +This version records early source findings and is not acceptance of a complete caller, preparer or entry operation. No candidate/original code or test was executed by this reviewer. The parent fixed the sole repair window at13:20:31–13:35:31 UTC; the original hard deadline remains unchanged. + +## U6-CALLER-01: unowned observation pass, rejected initial draft + +The initially read200-line predecessor_entry.py defined observe_regular with a separate os.open/read/fstat/finally-os.close pass before invoking the owned retained reader. That first pass had no Owner pending/busy/descriptor capture, primary retention or raw-buffer capture. A concrete source counterexample is read/fstat raising A followed by close raising B: Python finally raises B, while Owner.primary remains None and Owner can appear ready. No test execution is claimed for this witness. + +The author reports a self-correction at13:20:31 before receiving this review finding. The initial whole-file bytes were overwritten before this reviewer captured their same-read hash. The author reconstructed the initial9,950-byte draft by an exact inverse and verified it against an independent original tool-read hash: d7512ffe6c9ee2b7a51b98672032fd14f50f5d47e193131873ea426a47f25cbd. It is retained as fixtures/initial-draft-VERIFIED-RECONSTRUCTION.py.txt, with fixtures/RECONSTRUCTION-v1.json explicitly labeling VERIFIED_RECONSTRUCTION_NOT_DIRECT_SAVED_COPY and preserving the original-overwrite gap. + +The subsequently measured9,247-byte35b99508cbc4b686f18b29ecd1458c21f4139ffd0a8cc62a774a49570e20c10f draft is ALREADY AFTER that self-correction. It must not be relabeled as the failed initial body. This corrected shape has one Owner-controlled _retained_read with optional observation-only digest, a public retained_read that requires a prior digest, and observe_regular delegating once. That removes the naked first pass by source inspection; meaningful new fake I/O failure fixtures remain required. + +## U6-CALLER-02: original blob-path mismatch, rejected35b draft + +35b path_text73–76 accepted Unicode/control characters other than NUL and more than64 components. validate_blob delegated to it. Original epoch_schema_v5.path121–128 requires printable ASCII32..126 and at most64 components. Examples accepted by the old helper but refused by the actual schema are a path containing é, a newline filename, and a path with65 components. This is an incompatible claimed schema/preparation result, not evidence of actual runtime admission. + +The9,574-byte T0-support prefix SHA c20523438a6bb49ef43ea527cf6c96a07542cadea72a77eb822c54f8f64fb863 corrects printable ASCII/component bounds and exact cap typing. It retains the single owned observation/read path. Parent separately preserved35b as pre-path-fix evidence. Current corrections are source-inspected, not an executed success or complete operation milestone. + +## Current scope and pending complete review + +At13:26 the reviewable implementation contains only the T0 support prefix of predecessor_entry.py. The complete generic entry/actual source loader, prior-admission caller successor, real P/Q/M/JOBS/STAGE preparer and output DATA bridge have not yet been reviewed as complete actual code. Architectural input acceptance does not accept those missing bodies. + +The final source review must inspect prior selection checks before config/policy/stage/queue use, canonical R/history/locks and genuine outer ownership, separate real K resources, actual exclusive preparation and post-mode identity observations, acyclic source/policy/plan/manifest finalization, actual result verification before the science DATA receipt, all first-error/partial-FD states and exact new fixture isolation. No callback or serialized successful-owner substitute is accepted. + +No edits were made to author source. Only this review pair is written. Original C05/V03, runtime qualification and activity credit remain false/zero. All previous units stay closed; costs OPEN_NOT_ZERO. + diff --git a/research/h25-v03-authenticated-prefix-entry/evidence/review-caller-source-v2.json b/research/h25-v03-authenticated-prefix-entry/evidence/review-caller-source-v2.json new file mode 100644 index 0000000000..a76c9cb669 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/evidence/review-caller-source-v2.json @@ -0,0 +1,73 @@ +{ + "schema": "unit06-caller-source-review-v2", + "recorded_utc": "2026-11-02 13:37:57 UTC", + "verdict": "PARTIAL_SOURCE_ONLY_CALLER_CAP_GAP_PREPARATION_ABSENT_NO_U6_3_ACCEPTANCE", + "cutoff": "2026-11-02T13:35:31Z; no further source/test changes permitted by this reviewer", + "source_observed_at": "2026-11-02T13:35:33Z", + "entry": { + "bytes": 21857, + "sha256": "b783c6812a6295069456cfb4187d4e09bb7acbcb20fffd76e0c10267f90c1201", + "source_scope": "T0 helper and DATA bridge reviewed; full loader assessment owned separately by component reviewer", + "corrected_by_source_inspection": [ + "single Owner-controlled observation path", + "printable ASCII64component original schema paths", + "read8192 and write4096/8192 callbounds", + "exactmode/outerplan match", + "actual BOTH canonical lockpairs and exactordered Kpaths" + ], + "DATA_bridge": "Actual make_prefix_owner + run_prefix -> retain/verify result -> explicit falsefull/runtime/parentexit bounded exclusive science/receipt.json; no fixture owner substituted." + }, + "caller": { + "bytes": 34412, + "sha256": "90a7ed4a45b94e16fa313623e56f6f3efcd85f3ea40355a43b289d8c49a75825", + "positive_source_scope": [ + "prior selection digest before decode/use", + "config/policy/sourcepacket/entry/queue/runner/stage independent pins checked before first selected oldsupervisor/queue execution", + "actual full stage inventory including separately pinned excluded nested STAGE manifests", + "B/M/JOBS membership and oldqueue case DATA status/falsefield validation", + "actual pre-dispatch _caller_recheck then original RootProxy.run", + "canonical original root/history/locks/subreaper/run_root operations retained", + "first script authenticity stays original prior T0 premise" + ], + "unresolved": "Copied9574-byte T0support lacks new8192read and4096/8192write-call limits present in final entry. One-byte positive short returns can exceed originalcallcaps while respecting bytecaps. No post-cutoff synchronization is accepted as bookkeeping.", + "whole_caller_complete_operation_accepted": false + }, + "preparer": { + "present_at_cutoff": false, + "policy_plan_manifest_stage_preparation_implemented_and_reviewed": false, + "U6_3": false + }, + "tests": { + "source": "unit06/fixtures/test_bootstrap_new_v1.py", + "sha256": "19c1b08d4daeaf0c2d40357b0e117fcb2ca2f632f627e290fe7442abf49b3504", + "methods": 12, + "isolation": "PASS for exact inspected newpure/owned fixture source; imports only NEWentry with main guard inactive, executes only newliteral toy modules/freshfiles; actual15sources parsed/hashchecked only.", + "normal_v2_raw_read": "12PASS in0.290s; author-owned execution, not reviewer rerun", + "no_entry_operation_or_main_or_caller_or_original_graph_execution": true, + "caller_or_preparer_behavior_tested": false, + "rerun_by_reviewer": false + }, + "history": { + "initial_observe_issue": "oldA/read +B/close primary-loss sourcecounterexample; verified9950B d751 reconstruction explicitly not direct savedcopy; oldoverwritegap retained", + "old35b_path_schema_issue": "retained separately;35b already after first self-correction", + "lockpath_report": "earlier finding referred intermediate read; finalentry b783 fixesbothcanonicalpairs and orderedKpaths", + "v1_early_review_preserved": true + }, + "whole_authorship_or_runtime_claims_not_proved": [ + "complete actual caller under all original operationcaps", + "complete concrete P/Q/M/JOBS/STAGE preparer", + "current genuine outer/inner capability or prioradmission", + "originalC05/C07/native/funding/execution and parent-exit", + "full original baseline/V03 controls", + "physical fit or zero cost" + ], + "original_functions_imported_or_executed_by_reviewer": false, + "tests_run_by_reviewer": 0, + "author_code_modified_by_reviewer": false, + "old_units_reopened": false, + "full_C05": false, + "full_V03": false, + "runtime_qualified": false, + "original_activity_credit_added": 0, + "costs": "OPEN_NOT_ZERO" +} diff --git a/research/h25-v03-authenticated-prefix-entry/evidence/review-caller-source-v2.md b/research/h25-v03-authenticated-prefix-entry/evidence/review-caller-source-v2.md new file mode 100644 index 0000000000..8959abf0cd --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/evidence/review-caller-source-v2.md @@ -0,0 +1,14 @@ +# Unit06 caller/preparation review — cutoff disposition + +**PARTIAL SOURCE ONLY. No complete U6.3 acceptance.** Source/test cutoff13:35:31 is retained. The caller's final observed helper still lacks the newly required operation-call caps, and no preparation body is present. This is a source/evidence verdict; no author code or tests were run or edited by this reviewer. + +The post-cutoff13:35:33 observed entry is21,857 bytes, SHA b783c6812a6295069456cfb4187d4e09bb7acbcb20fffd76e0c10267f90c1201. The new owned observation/read path, original printableASCII/64component blob path rules, read8192/write4096-or8192 call counters, exact plan/mode binding, BOTH canonical lock identities and exact ordered private K paths are present. Earlier lock-path reports described an intermediate draft and are not current defects. The DATA bridge source calls actual make_prefix_owner/run_prefix, verifies the real result pin/false qualification fields, then exclusively writes science/receipt.json. This is a source-derived new DATA contract, not an original completion. + +The observed caller is34,412 bytes, SHA90a7ed4a45b94e16fa313623e56f6f3efcd85f3ea40355a43b289d8c49a75825. Its concrete admission path authenticates the independent selection before decode, validates exact control/sourcepacket/stage/B/M/JOBS/queue/runner pins before first old supervisor/queue use, performs full stage inventory including separately pinned excluded nested STAGE manifests, constrains the old generic science receiver to the explicit nonqualifying DATA fields, and rechecks before original RootProxy.run. The unchanged historical queue/runner/outer owner/lock/native keeper and ledger operations remain actual calls. First-script authentication remains the pre-existing T0 premise; source_packet is not retroactive proof. Inherited exception-formatting/permission qualifications remain. + +However, its copied9,574-byte support prefix has no per-read/per-write call counters. Legal short positive returns can exceed original8192read/write or4096record-write call limits while byte counts remain bounded. The corrected entry counters do not repair this separate copy. No synchronization after13:35:31 is accepted as mere bookkeeping. No actual prepare_prefix_stage source is present at this review cutoff, so P/Q/M/JOBS/STAGE preparation remains architectural design, not an implemented operation. Conditional prior-admission code is not a complete deployable caller/bootstrap. + +I read the entire exact new fixture source SHA19c1b08d4daeaf0c2d40357b0e117fcb2ca2f632f627e290fe7442abf49b3504 and normal-v2 raw output showing12PASS/0.290s. Isolation PASS applies only to those inspected fixtures: the imported module is newly authored entry support with main guard inactive; compiled module bodies are explicit new toy byte literals; files are freshly owned; the actual15 project bodies are parsed/hashed, never imported/executed. The fixtures do not execute entry_operation/main, the caller, actual original ownership, or a preparer. No test rerun occurred here. Broader loader/source acceptance is the separate component review. + +The early rejected observe_regular and path-validator findings remain in review-caller-source-v1. Initial9,950-byte d751 evidence is a verified reconstruction with an explicit overwrite gap, not a direct saved copy;35b is already after the first author self-correction. Do not merge these identities or call restoration new progress. All prior units remain closed; original C05/V03/runtime/activity flags remain false/zero, costs OPEN_NOT_ZERO. Later bookkeeping can document frozen bytes and gaps, but cannot add source/tests or confer admission. + diff --git a/research/h25-v03-authenticated-prefix-entry/evidence/review-loader-initial-reconstruction-v1.json b/research/h25-v03-authenticated-prefix-entry/evidence/review-loader-initial-reconstruction-v1.json new file mode 100644 index 0000000000..c7be5a2768 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/evidence/review-loader-initial-reconstruction-v1.json @@ -0,0 +1,14 @@ +{ + "schema": "unit06-first-loader-draft-verified-inverse-reconstruction-v1", + "created_utc": "2026-11-02T13:25:19.680918+00:00", + "kind": "VERIFIED_INVERSE_RECONSTRUCTION_NOT_DIRECT_RETAINED_COPY", + "base_path": "outputs/c05-v03-completion-20261102T055710Z/unit06/repair-v1/predecessor_entry-observed-after-author-self-correction.py.txt", + "base_sha256": "35b99508cbc4b686f18b29ecd1458c21f4139ffd0a8cc62a774a49570e20c10f", + "base_bytes": 9247, + "reconstructed_bytes": 9950, + "reconstructed_sha256": "d7512ffe6c9ee2b7a51b98672032fd14f50f5d47e193131873ea426a47f25cbd", + "expected_first_observed_sha256": "d7512ffe6c9ee2b7a51b98672032fd14f50f5d47e193131873ea426a47f25cbd", + "independently_recorded_before_reconstruction": true, + "method": "Inverse shared-observer repair only: restore original retained_read name/digest guard, remove added wrapper, restore original observe_regular text from retained200-line nl output. Exact known9950-byte/SHA256 match. No source executed.", + "reconstructed_source_text": "\"\"\"Conditional Unit06 authenticated entry. No original project imports at load.\n\nT0 is the original trusted first-launcher/OS/interpreter/system-stdlib premise.\nSource selection does not create source, native, C05/C07, funding or runtime\nadmission. Do not call main except in a separately admitted genuine instance.\n\"\"\"\nfrom __future__ import annotations\nimport ast\nimport builtins\nimport hashlib\nimport json\nimport os\nfrom pathlib import Path\nimport stat\nimport sys\nimport types\n\nFILE_CAP=64*1024*1024\nTOTAL_CAP=256*1024*1024\nRECORD_CAP=1024*1024\nMAX_ROWS=8192\nIDENTITY_KEYS=('device','inode','mode','links','uid','gid','size','mtime_ns','ctime_ns')\nENV={'PATH':'/usr/bin:/bin','PYTHONHASHSEED':'0','LANG':'C.UTF-8','LC_ALL':'C.UTF-8','TZ':'UTC','PYTHONDONTWRITEBYTECODE':'1'}\nSYSTEM_PATH=('/usr/lib/python312.zip','/usr/lib/python3.12','/usr/lib/python3.12/lib-dynload')\n\n\nclass Stop(RuntimeError):pass\n\n\ndef need(condition,message):\n if condition is not True:raise Stop(message)\n\n\ndef plain(value):\n nodes=text=0\n def walk(item,depth):\n nonlocal nodes,text\n nodes+=1\n need(depth<=24 and nodes<=65536,'plain structure bound')\n kind=type(item)\n if item is None or kind is bool:return\n if kind is int:need(-(1<<127)<=item<(1<<127),'integer bound');return\n if kind is str:\n text+=len(item);need(len(item)<=8192 and text<=524288,'text bound');return\n need(kind in (list,dict),'exact plain value required')\n need(len(item)<=MAX_ROWS,'container bound')\n if kind is list:\n for child in item:walk(child,depth+1)\n else:\n for key,child in item.items():\n need(type(key) is str,'exact string key required');walk(key,depth+1);walk(child,depth+1)\n walk(value,0)\n\n\ndef canonical(value,cap=RECORD_CAP):\n plain(value)\n raw=(json.dumps(value,sort_keys=True,separators=(',',':'),ensure_ascii=True,allow_nan=False)+'\\n').encode('ascii')\n need(len(raw)<=cap,'canonical record cap');return raw\n\n\ndef decode(raw,cap=RECORD_CAP):\n need(type(raw) is bytes and len(raw)<=cap,'raw record cap/type')\n def pairs(rows):\n result={}\n for key,value in rows:\n need(key not in result,'duplicate JSON key');result[key]=value\n return result\n def bad(token):raise Stop('non-integer JSON number')\n value=json.loads(raw,object_pairs_hook=pairs,parse_float=bad,parse_constant=bad)\n plain(value);return value\n\n\ndef path_text(value):\n need(type(value) is str and 10 and row['size']==pin['bytes'] and stat.S_ISREG(row['mode']) and row['links']==1,'regular single-link identity')\n\n\nclass Owner:\n \"\"\"New T0-side retained failure state, never an original capability.\"\"\"\n def __init__(self):\n self.primary=None;self.secondary=[];self.pending=False;self.quarantined=False\n self.busy=False;self.burned=False;self.fd_slots=[];self.captures=[];self.total_bytes=0\n self.last_block=None;self.last_raw=None;self.modules={};self.published=[];self.executed=[]\n self.phase='NEW';self.result=None\n def ready(self):\n if self.primary is not None:raise self.primary\n need(not self.quarantined and not self.pending and not self.busy,'owner terminal/uncertain')\n def fail(self,error):\n if self.primary is None:self.primary=error\n elif error is not self.primary:self.secondary.append(error)\n self.quarantined=True\n return self.primary\n\n\ndef retained_read(path,expected_sha256,cap,owner,expected_pin=None):\n \"\"\"Actual descriptor-bound read. Returned source bytes are never reopened for exec.\"\"\"\n need(type(owner) is Owner,'actual local owner required');owner.ready();path_text(path)\n need(type(cap) is int and 0<=cap<=FILE_CAP,'read cap')\n need(type(expected_sha256) is str and len(expected_sha256)==64 and all(c in '0123456789abcdef' for c in expected_sha256),'prior digest')\n if expected_pin is not None:validate_blob(expected_pin,cap);need(expected_pin['path']==path and expected_pin['sha256']==expected_sha256,'prior pin path/digest')\n record={'path':path,'chunks':[],'raw':None,'observed':None};owner.captures.append(record)\n owner.fd_slots.append(None);slot=len(owner.fd_slots)-1;primary=None;owner.busy=True\n try:\n before=identity(os.stat(path,follow_symlinks=False))\n need(stat.S_ISREG(before['mode']) and before['links']==1 and before['size']<=cap,'source kind/link/size')\n owner.pending=True\n owner.fd_slots[slot]=os.open(path,os.O_RDONLY|os.O_NOFOLLOW|os.O_NONBLOCK|os.O_CLOEXEC)\n owner.pending=False\n opened=identity(os.fstat(owner.fd_slots[slot]));need(before==opened,'source open drift')\n if expected_pin is not None:need(opened==expected_pin['identity'],'source installed identity differs')\n count=0\n while count0 and row['size']==pin['bytes'] and stat.S_ISREG(row['mode']) and row['links']==1,'regular single-link identity') + + +class Owner: + """New T0-side retained failure state, never an original capability.""" + def __init__(self): + self.primary=None;self.secondary=[];self.pending=False;self.quarantined=False + self.busy=False;self.burned=False;self.fd_slots=[];self.captures=[];self.total_bytes=0 + self.last_block=None;self.last_raw=None;self.modules={};self.published=[];self.executed=[] + self.phase='NEW';self.result=None + def ready(self): + if self.primary is not None:raise self.primary + need(not self.quarantined and not self.pending and not self.busy,'owner terminal/uncertain') + def fail(self,error): + if self.primary is None:self.primary=error + elif error is not self.primary:self.secondary.append(error) + self.quarantined=True + return self.primary + + +def _retained_read(path,expected_sha256,cap,owner,expected_pin=None): + """Actual descriptor-bound read. Returned source bytes are never reopened for exec.""" + need(type(owner) is Owner,'actual local owner required');owner.ready();path_text(path) + need(type(cap) is int and 0<=cap<=FILE_CAP,'read cap') + if expected_sha256 is not None: + need(type(expected_sha256) is str and len(expected_sha256)==64 and all(c in '0123456789abcdef' for c in expected_sha256),'prior digest') + if expected_pin is not None:validate_blob(expected_pin,cap);need(expected_pin['path']==path and expected_pin['sha256']==expected_sha256,'prior pin path/digest') + record={'path':path,'chunks':[],'raw':None,'observed':None};owner.captures.append(record) + owner.fd_slots.append(None);slot=len(owner.fd_slots)-1;primary=None;owner.busy=True + try: + before=identity(os.stat(path,follow_symlinks=False)) + need(stat.S_ISREG(before['mode']) and before['links']==1 and before['size']<=cap,'source kind/link/size') + owner.pending=True + owner.fd_slots[slot]=os.open(path,os.O_RDONLY|os.O_NOFOLLOW|os.O_NONBLOCK|os.O_CLOEXEC) + owner.pending=False + opened=identity(os.fstat(owner.fd_slots[slot]));need(before==opened,'source open drift') + if expected_pin is not None:need(opened==expected_pin['identity'],'source installed identity differs') + count=0 + while count0 and row['size']==pin['bytes'] and stat.S_ISREG(row['mode']) and row['links']==1,'regular single-link identity') + + +class Owner: + """New T0-side retained failure state, never an original capability.""" + def __init__(self): + self.primary=None;self.secondary=[];self.pending=False;self.quarantined=False + self.busy=False;self.burned=False;self.fd_slots=[];self.captures=[];self.total_bytes=0 + self.last_block=None;self.last_raw=None;self.modules={};self.published=[];self.executed=[] + self.phase='NEW';self.result=None + def ready(self): + if self.primary is not None:raise self.primary + need(not self.quarantined and not self.pending and not self.busy,'owner terminal/uncertain') + def fail(self,error): + if self.primary is None:self.primary=error + elif error is not self.primary:self.secondary.append(error) + self.quarantined=True + return self.primary + + +def retained_read(path,expected_sha256,cap,owner,expected_pin=None): + """Actual descriptor-bound read. Returned source bytes are never reopened for exec.""" + need(type(owner) is Owner,'actual local owner required');owner.ready();path_text(path) + need(type(cap) is int and 0<=cap<=FILE_CAP,'read cap') + need(type(expected_sha256) is str and len(expected_sha256)==64 and all(c in '0123456789abcdef' for c in expected_sha256),'prior digest') + if expected_pin is not None:validate_blob(expected_pin,cap);need(expected_pin['path']==path and expected_pin['sha256']==expected_sha256,'prior pin path/digest') + record={'path':path,'chunks':[],'raw':None,'observed':None};owner.captures.append(record) + owner.fd_slots.append(None);slot=len(owner.fd_slots)-1;primary=None;owner.busy=True + try: + before=identity(os.stat(path,follow_symlinks=False)) + need(stat.S_ISREG(before['mode']) and before['links']==1 and before['size']<=cap,'source kind/link/size') + owner.pending=True + owner.fd_slots[slot]=os.open(path,os.O_RDONLY|os.O_NOFOLLOW|os.O_NONBLOCK|os.O_CLOEXEC) + owner.pending=False + opened=identity(os.fstat(owner.fd_slots[slot]));need(before==opened,'source open drift') + if expected_pin is not None:need(opened==expected_pin['identity'],'source installed identity differs') + count=0 + while count0 and row['size']==pin['bytes'] and stat.S_ISREG(row['mode']) and row['links']==1,'regular single-link identity') + + +class Owner: + """New T0-side retained failure state, never an original capability.""" + def __init__(self): + self.primary=None;self.secondary=[];self.pending=False;self.quarantined=False + self.busy=False;self.burned=False;self.fd_slots=[];self.captures=[];self.total_bytes=0 + self.read_calls=0;self.write_calls=0 + self.last_block=None;self.last_raw=None;self.modules={};self.published=[];self.executed=[] + self.phase='NEW';self.result=None + def ready(self): + if self.primary is not None:raise self.primary + need(not self.quarantined and not self.pending and not self.busy,'owner terminal/uncertain') + def fail(self,error): + if self.primary is None:self.primary=error + elif error is not self.primary:self.secondary.append(error) + self.quarantined=True + return self.primary + + +def _retained_read(path,expected_sha256,cap,owner,expected_pin=None): + """Actual descriptor-bound read. Returned source bytes are never reopened for exec.""" + need(type(owner) is Owner,'actual local owner required');owner.ready();path_text(path) + need(type(cap) is int and 0<=cap<=FILE_CAP,'read cap') + if expected_sha256 is not None: + need(type(expected_sha256) is str and len(expected_sha256)==64 and all(c in '0123456789abcdef' for c in expected_sha256),'prior digest') + if expected_pin is not None:validate_blob(expected_pin,cap);need(expected_pin['path']==path and expected_pin['sha256']==expected_sha256,'prior pin path/digest') + record={'path':path,'chunks':[],'raw':None,'observed':None,'read_calls':0};owner.captures.append(record) + owner.fd_slots.append(None);slot=len(owner.fd_slots)-1;primary=None;owner.busy=True + try: + before=identity(os.stat(path,follow_symlinks=False)) + need(stat.S_ISREG(before['mode']) and before['links']==1 and before['size']<=cap,'source kind/link/size') + owner.pending=True + owner.fd_slots[slot]=os.open(path,os.O_RDONLY|os.O_NOFOLLOW|os.O_NONBLOCK|os.O_CLOEXEC) + owner.pending=False + opened=identity(os.fstat(owner.fd_slots[slot]));need(before==opened,'source open drift') + if expected_pin is not None:need(opened==expected_pin['identity'],'source installed identity differs') + count=0 + while count0 and row['size']==pin['bytes'] and stat.S_ISREG(row['mode']) and row['links']==1,'regular single-link identity') + + +class Owner: + """New T0-side retained failure state, never an original capability.""" + def __init__(self): + self.primary=None;self.secondary=[];self.pending=False;self.quarantined=False + self.busy=False;self.burned=False;self.fd_slots=[];self.captures=[];self.total_bytes=0 + self.read_calls=0;self.write_calls=0 + self.last_block=None;self.last_raw=None;self.modules={};self.published=[];self.executed=[] + self.phase='NEW';self.result=None + def ready(self): + if self.primary is not None:raise self.primary + need(not self.quarantined and not self.pending and not self.busy,'owner terminal/uncertain') + def fail(self,error): + if self.primary is None:self.primary=error + elif error is not self.primary:self.secondary.append(error) + self.quarantined=True + return self.primary + + +def _retained_read(path,expected_sha256,cap,owner,expected_pin=None): + """Actual descriptor-bound read. Returned source bytes are never reopened for exec.""" + need(type(owner) is Owner,'actual local owner required');owner.ready();path_text(path) + need(type(cap) is int and 0<=cap<=FILE_CAP,'read cap') + if expected_sha256 is not None: + need(type(expected_sha256) is str and len(expected_sha256)==64 and all(c in '0123456789abcdef' for c in expected_sha256),'prior digest') + if expected_pin is not None:validate_blob(expected_pin,cap);need(expected_pin['path']==path and expected_pin['sha256']==expected_sha256,'prior pin path/digest') + record={'path':path,'chunks':[],'raw':None,'observed':None,'read_calls':0};owner.captures.append(record) + owner.fd_slots.append(None);slot=len(owner.fd_slots)-1;primary=None;owner.busy=True + try: + before=identity(os.stat(path,follow_symlinks=False)) + need(stat.S_ISREG(before['mode']) and before['links']==1 and before['size']<=cap,'source kind/link/size') + owner.pending=True + owner.fd_slots[slot]=os.open(path,os.O_RDONLY|os.O_NOFOLLOW|os.O_NONBLOCK|os.O_CLOEXEC) + owner.pending=False + opened=identity(os.fstat(owner.fd_slots[slot]));need(before==opened,'source open drift') + if expected_pin is not None:need(opened==expected_pin['identity'],'source installed identity differs') + count=0 + while count0 and row['size']==pin['bytes'] and stat.S_ISREG(row['mode']) and row['links']==1,'regular single-link identity') + + +class Owner: + """New T0-side retained failure state, never an original capability.""" + def __init__(self): + self.primary=None;self.secondary=[];self.pending=False;self.quarantined=False + self.busy=False;self.burned=False;self.fd_slots=[];self.captures=[];self.total_bytes=0 + self.read_calls=0;self.write_calls=0 + self.last_block=None;self.last_raw=None;self.modules={};self.published=[];self.executed=[] + self.phase='NEW';self.result=None + def ready(self): + if self.primary is not None:raise self.primary + need(not self.quarantined and not self.pending and not self.busy,'owner terminal/uncertain') + def fail(self,error): + if self.primary is None:self.primary=error + elif error is not self.primary:self.secondary.append(error) + self.quarantined=True + return self.primary + + +def _retained_read(path,expected_sha256,cap,owner,expected_pin=None): + """Actual descriptor-bound read. Returned source bytes are never reopened for exec.""" + need(type(owner) is Owner,'actual local owner required');owner.ready();path_text(path) + need(type(cap) is int and 0<=cap<=FILE_CAP,'read cap') + if expected_sha256 is not None: + need(type(expected_sha256) is str and len(expected_sha256)==64 and all(c in '0123456789abcdef' for c in expected_sha256),'prior digest') + if expected_pin is not None:validate_blob(expected_pin,cap);need(expected_pin['path']==path and expected_pin['sha256']==expected_sha256,'prior pin path/digest') + record={'path':path,'chunks':[],'raw':None,'observed':None,'read_calls':0};owner.captures.append(record) + owner.fd_slots.append(None);slot=len(owner.fd_slots)-1;primary=None;owner.busy=True + try: + before=identity(os.stat(path,follow_symlinks=False)) + need(stat.S_ISREG(before['mode']) and before['links']==1 and before['size']<=cap,'source kind/link/size') + owner.pending=True + owner.fd_slots[slot]=os.open(path,os.O_RDONLY|os.O_NOFOLLOW|os.O_NONBLOCK|os.O_CLOEXEC) + owner.pending=False + opened=identity(os.fstat(owner.fd_slots[slot]));need(before==opened,'source open drift') + if expected_pin is not None:need(opened==expected_pin['identity'],'source installed identity differs') + count=0 + while count0 and row['size']==pin['bytes'] and stat.S_ISREG(row['mode']) and row['links']==1,'regular single-link identity') + + +class Owner: + """New T0-side retained failure state, never an original capability.""" + def __init__(self): + self.primary=None;self.secondary=[];self.pending=False;self.quarantined=False + self.busy=False;self.burned=False;self.fd_slots=[];self.captures=[];self.total_bytes=0 + self.read_calls=0;self.write_calls=0 + self.last_block=None;self.last_raw=None;self.modules={};self.published=[];self.executed=[] + self.phase='NEW';self.result=None + def ready(self): + if self.primary is not None:raise self.primary + need(not self.quarantined and not self.pending and not self.busy,'owner terminal/uncertain') + def fail(self,error): + if self.primary is None:self.primary=error + elif error is not self.primary:self.secondary.append(error) + self.quarantined=True + return self.primary + + +def _retained_read(path,expected_sha256,cap,owner,expected_pin=None): + """Actual descriptor-bound read. Returned source bytes are never reopened for exec.""" + need(type(owner) is Owner,'actual local owner required');owner.ready();path_text(path) + need(type(cap) is int and 0<=cap<=FILE_CAP,'read cap') + if expected_sha256 is not None: + need(type(expected_sha256) is str and len(expected_sha256)==64 and all(c in '0123456789abcdef' for c in expected_sha256),'prior digest') + if expected_pin is not None:validate_blob(expected_pin,cap);need(expected_pin['path']==path and expected_pin['sha256']==expected_sha256,'prior pin path/digest') + record={'path':path,'chunks':[],'raw':None,'observed':None,'read_calls':0};owner.captures.append(record) + owner.fd_slots.append(None);slot=len(owner.fd_slots)-1;primary=None;owner.busy=True + try: + before=identity(os.stat(path,follow_symlinks=False)) + need(stat.S_ISREG(before['mode']) and before['links']==1 and before['size']<=cap,'source kind/link/size') + owner.pending=True + owner.fd_slots[slot]=os.open(path,os.O_RDONLY|os.O_NOFOLLOW|os.O_NONBLOCK|os.O_CLOEXEC) + owner.pending=False + opened=identity(os.fstat(owner.fd_slots[slot]));need(before==opened,'source open drift') + if expected_pin is not None:need(opened==expected_pin['identity'],'source installed identity differs') + count=0 + while count0 and row['size']==pin['bytes'] and stat.S_ISREG(row['mode']) and row['links']==1,'regular single-link identity') + + +class Owner: + """New T0-side retained failure state, never an original capability.""" + def __init__(self): + self.primary=None;self.secondary=[];self.pending=False;self.quarantined=False + self.busy=False;self.burned=False;self.fd_slots=[];self.captures=[];self.total_bytes=0 + self.read_calls=0;self.write_calls=0 + self.last_block=None;self.last_raw=None;self.modules={};self.published=[];self.executed=[] + self.phase='NEW';self.result=None + def ready(self): + if self.primary is not None:raise self.primary + need(not self.quarantined and not self.pending and not self.busy,'owner terminal/uncertain') + def fail(self,error): + if self.primary is None:self.primary=error + elif error is not self.primary:self.secondary.append(error) + self.quarantined=True + return self.primary + + +def _retained_read(path,expected_sha256,cap,owner,expected_pin=None): + """Actual descriptor-bound read. Returned source bytes are never reopened for exec.""" + need(type(owner) is Owner,'actual local owner required');owner.ready();path_text(path) + need(type(cap) is int and 0<=cap<=FILE_CAP,'read cap') + if expected_sha256 is not None: + need(type(expected_sha256) is str and len(expected_sha256)==64 and all(c in '0123456789abcdef' for c in expected_sha256),'prior digest') + if expected_pin is not None:validate_blob(expected_pin,cap);need(expected_pin['path']==path and expected_pin['sha256']==expected_sha256,'prior pin path/digest') + record={'path':path,'chunks':[],'raw':None,'observed':None,'read_calls':0};owner.captures.append(record) + owner.fd_slots.append(None);slot=len(owner.fd_slots)-1;primary=None;owner.busy=True + try: + before=identity(os.stat(path,follow_symlinks=False)) + need(stat.S_ISREG(before['mode']) and before['links']==1 and before['size']<=cap,'source kind/link/size') + owner.pending=True + owner.fd_slots[slot]=os.open(path,os.O_RDONLY|os.O_NOFOLLOW|os.O_NONBLOCK|os.O_CLOEXEC) + owner.pending=False + opened=identity(os.fstat(owner.fd_slots[slot]));need(before==opened,'source open drift') + if expected_pin is not None:need(opened==expected_pin['identity'],'source installed identity differs') + count=0 + while count None: + schema.exact(COPY_CONFIGURATION, ('leaf_policy_sha256', 'configuration_sha256', 'scandir_release_premise_sha256')) + schema.exact(COPY_EXECUTION_APPROVAL, ('external_launch_policy_sha256',)) + schema.exact(COPY_FUNDING, ('reservation_sha256',)) + for values in (COPY_CONFIGURATION, COPY_EXECUTION_APPROVAL, COPY_FUNDING): + for value in values.values(): + schema.digest(value) + + +def _fd(value) -> None: + schema.integer(value, 0, (1 << 31) - 1) + + +def _identity(info) -> dict: + schema.need(_TYPE(info) is _STAT_RESULT, 'exact native stat result required') + row = dict(zip(schema.IDENTITY_KEYS, (info.st_dev, info.st_ino, info.st_mode, info.st_nlink, + info.st_uid, info.st_gid, info.st_size, info.st_mtime_ns, info.st_ctime_ns))) + for value in row.values(): + schema.integer(value, 0, (1 << 127) - 1) + return row + + + + + +def _parent(path: str, owner, fd_slots: list, destination: int) -> str: + """Fill the caller-owned slot; caller's finally owns all five slots. + + No descriptor tuple crosses the helper return boundary. The fifth slot + owns the next ancestor until its transfer; any helper-entry/body failure + leaves all known descriptors reachable to the caller's inline cleanup. + """ + schema.path(path) + _state = schema.owner_state(owner) + _primary, _secondary, _phases, _uncertain = _state[0], _state[1], _state[2], _state[3] + _counts, _overflow, _io = _state[4], _state[5], _state[7] + _attempt_digits, _confirmed_digits = _io[7], _io[8] + _successors = schema.CUSTODY_SUCCESSORS + _quarantine_error = schema.IO_QUARANTINE_ERROR + _base_error, _close_native = BaseException, _CLOSE + _error_index = _digit = 0 + _owned_fd = _close_error = _acquisition_error = None + cleanup_primary = operation_primary = None + schema.need(_TYPE(fd_slots) is list and _LEN(fd_slots) == 5, 'internal FD slots differ') + schema.integer(destination, 0, 3) + schema.need(fd_slots[destination] is None and fd_slots[4] is None, 'parent slots already owned') + parts = path.split('/') + name = parts[-1] + flags = os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW | os.O_DIRECTORY + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + fd_slots[destination] = _OPEN('/', flags) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + _fd(fd_slots[destination]) + for part in parts[1:-1]: + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + fd_slots[4] = _OPEN(part, flags, dir_fd=fd_slots[destination]) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + _fd(fd_slots[4]) + previous = fd_slots[destination] + fd_slots[destination] = fd_slots[4] + fd_slots[4] = None + _owned_fd = previous + previous = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + if cleanup_primary is not None: + raise cleanup_primary + return name + +def _hash_fd(descriptor: int, limit: int) -> tuple[str, int]: + _fd(descriptor) + schema.integer(limit, 0, schema.FILE_BYTES) + digest, total, read_calls = hashlib.sha256(), 0, 0 + position = _LSEEK(descriptor, 0, os.SEEK_SET) + schema.integer(position, 0, 0) + while True: + read_calls += 1 + schema.need(read_calls <= schema.MAX_READ_CALLS, 'hash read-call bound exceeded') + raw = _READ(descriptor, min(schema.CHUNK_BYTES, limit + 1 - total)) + schema.need(_TYPE(raw) is bytes, 'native read returned foreign data') + if _LEN(raw) == 0: + break + total += _LEN(raw) + schema.need(total <= limit, 'file exceeds copy/hash bound') + digest.update(raw) + return digest.hexdigest(), total + + +def inspect(path: str, limit: int = schema.FILE_BYTES, *, error_owner) -> dict: + schema.owner_state(error_owner) + schema.path(path) + schema.integer(limit, 0, schema.FILE_BYTES) + _gate() + _state = schema.owner_state(error_owner) + _primary, _secondary, _phases, _uncertain = _state[0], _state[1], _state[2], _state[3] + _counts, _overflow, _io = _state[4], _state[5], _state[7] + _attempt_digits, _confirmed_digits = _io[7], _io[8] + _successors = schema.CUSTODY_SUCCESSORS + _quarantine_error = schema.IO_QUARANTINE_ERROR + _base_error, _close_native = BaseException, _CLOSE + _error_index = _digit = 0 + _owned_fd = _close_error = _acquisition_error = None + cleanup_primary = operation_primary = None + _fd_slots = [None] * 5 + _iterator = _owned_iterator = None + try: + name = _parent(path, error_owner, _fd_slots, 1) + parent = _fd_slots[1] + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + _fd_slots[0] = _OPEN(name, os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=parent) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + descriptor = _fd_slots[0] + _fd(descriptor) + before = _identity(_FSTAT(descriptor)) + schema.need(stat.S_ISREG(before['mode']) and before['links'] == 1 and before['size'] <= limit, + 'file kind/link/size differs') + digest, count = _hash_fd(descriptor, limit) + after = _identity(_FSTAT(descriptor)) + named = _identity(_STAT(name, dir_fd=parent, follow_symlinks=False)) + schema.need(before == after == named and count == before['size'], 'file changed during bounded snapshot') + result = {'path': path, 'sha256': digest, 'bytes': count, 'identity': after} + schema.blob(result, limit) + return result + except _base_error as operation_error: + operation_primary = operation_error + if _primary[0] is None: + _primary[0] = operation_error + _primary[1] = 'inspect' + _primary[2] = None + elif _primary[0] is not operation_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = operation_error + _phases[_error_index] = 'inspect' + _uncertain[_error_index] = None + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = operation_error + raise + finally: + _owned_fd = _fd_slots[0] + _fd_slots[0] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[1] + _fd_slots[1] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[2] + _fd_slots[2] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[3] + _fd_slots[3] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[4] + _fd_slots[4] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + if operation_primary is None and cleanup_primary is not None: + raise cleanup_primary + +def verify(expected: dict, limit: int = schema.FILE_BYTES, *, error_owner) -> None: + schema.owner_state(error_owner) + schema.blob(expected, limit) + schema.need(inspect(expected['path'], limit, error_owner=error_owner) == expected, + 'current source/store custody differs') + + +def copy_once(source: dict, destination: str, occupied_inodes: tuple, *, error_owner) -> dict: + schema.owner_state(error_owner) + schema.blob(source) + schema.path(destination) + schema.need(_TYPE(occupied_inodes) is tuple and _LEN(occupied_inodes) <= 51, 'inode collection differs') + for pair in occupied_inodes: + schema.need(_TYPE(pair) is tuple and _LEN(pair) == 2, 'inode pair differs') + schema.integer(pair[0], 0, (1 << 127) - 1) + schema.integer(pair[1], 1, (1 << 127) - 1) + schema.need(source['path'] != destination, 'copy path aliases source') + _gate() + verify(source, error_owner=error_owner) + _state = schema.owner_state(error_owner) + _primary, _secondary, _phases, _uncertain = _state[0], _state[1], _state[2], _state[3] + _counts, _overflow, _io = _state[4], _state[5], _state[7] + _attempt_digits, _confirmed_digits = _io[7], _io[8] + _successors = schema.CUSTODY_SUCCESSORS + _quarantine_error = schema.IO_QUARANTINE_ERROR + _base_error, _close_native = BaseException, _CLOSE + _error_index = _digit = 0 + _owned_fd = _close_error = _acquisition_error = None + cleanup_primary = operation_primary = None + _fd_slots = [None] * 5 + _iterator = _owned_iterator = None + try: + source_name = _parent(source['path'], error_owner, _fd_slots, 3) + source_parent = _fd_slots[3] + target_name = _parent(destination, error_owner, _fd_slots, 2) + target_parent = _fd_slots[2] + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + _fd_slots[1] = _OPEN(source_name, os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=source_parent) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + source_fd = _fd_slots[1] + _fd(source_fd) + before = _identity(_FSTAT(source_fd)) + schema.need(before == source['identity'], 'source changed before copy') + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + _fd_slots[0] = _OPEN(target_name, os.O_RDWR | os.O_CREAT | os.O_EXCL | os.O_CLOEXEC | os.O_NOFOLLOW, 0o600, dir_fd=target_parent) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + target_fd = _fd_slots[0] + _fd(target_fd) + initial = _identity(_FSTAT(target_fd)) + schema.need(stat.S_ISREG(initial['mode']) and initial['links'] == 1 and initial['size'] == 0 and + stat.S_IMODE(initial['mode']) == 0o600 and + (initial['device'], initial['inode']) not in occupied_inodes and + (initial['device'], initial['inode']) != schema.inode(source), 'exclusive destination alias') + digest, count, write_calls, read_calls = hashlib.sha256(), 0, 0, 0 + while True: + read_calls += 1 + schema.need(read_calls <= schema.MAX_READ_CALLS, 'copy read-call bound exceeded') + raw = _READ(source_fd, min(schema.CHUNK_BYTES, source['bytes'] + 1 - count)) + schema.need(_TYPE(raw) is bytes, 'native copy read returned foreign data') + if _LEN(raw) == 0: + break + count += _LEN(raw) + schema.need(count <= source['bytes'], 'source grew during copy') + digest.update(raw) + offset = 0 + while offset < _LEN(raw): + write_calls += 1 + schema.need(write_calls <= schema.MAX_WRITE_CALLS, 'copy write-call bound exceeded') + written = _WRITE(target_fd, raw[offset:]) + schema.integer(written, 1, _LEN(raw) - offset) + offset += written + schema.need(count == source['bytes'] and digest.hexdigest() == source['sha256'] and + _identity(_FSTAT(source_fd)) == source['identity'] and + _identity(_STAT(source_name, dir_fd=source_parent, follow_symlinks=False)) == source['identity'], + 'copy source custody/bytes differ') + _FSYNC(target_fd) + _FSYNC(target_parent) + before_readback = _identity(_FSTAT(target_fd)) + read_sha, read_size = _hash_fd(target_fd, schema.FILE_BYTES) + after = _identity(_FSTAT(target_fd)) + named = _identity(_STAT(target_name, dir_fd=target_parent, follow_symlinks=False)) + schema.need(read_sha == source['sha256'] and read_size == source['bytes'] and after['links'] == 1 and + (after['device'], after['inode']) == (initial['device'], initial['inode']) and + before_readback == after == named, 'destination readback/custody differs') + result = {'path': destination, 'sha256': read_sha, 'bytes': read_size, 'identity': after} + schema.blob(result) + verify(source, error_owner=error_owner) + schema.need(inspect(destination, error_owner=error_owner) == result, 'destination path changed after copy') + return result + except _base_error as operation_error: + operation_primary = operation_error + if _primary[0] is None: + _primary[0] = operation_error + _primary[1] = 'copy_once' + _primary[2] = None + elif _primary[0] is not operation_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = operation_error + _phases[_error_index] = 'copy_once' + _uncertain[_error_index] = None + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = operation_error + raise + finally: + _owned_fd = _fd_slots[0] + _fd_slots[0] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[1] + _fd_slots[1] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[2] + _fd_slots[2] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[3] + _fd_slots[3] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[4] + _fd_slots[4] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + if operation_primary is None and cleanup_primary is not None: + raise cleanup_primary + +def write_once(path: str, raw: bytes, *, error_owner) -> dict: + schema.owner_state(error_owner) + schema.path(path) + schema.need(_TYPE(raw) is bytes, 'exact record bytes required') + schema.need(0 < _LEN(raw) <= schema.RECORD_BYTES, 'record bound differs') + _gate() + _state = schema.owner_state(error_owner) + _primary, _secondary, _phases, _uncertain = _state[0], _state[1], _state[2], _state[3] + _counts, _overflow, _io = _state[4], _state[5], _state[7] + _attempt_digits, _confirmed_digits = _io[7], _io[8] + _successors = schema.CUSTODY_SUCCESSORS + _quarantine_error = schema.IO_QUARANTINE_ERROR + _base_error, _close_native = BaseException, _CLOSE + _error_index = _digit = 0 + _owned_fd = _close_error = _acquisition_error = None + cleanup_primary = operation_primary = None + _fd_slots = [None] * 5 + _iterator = _owned_iterator = None + try: + name = _parent(path, error_owner, _fd_slots, 1) + parent = _fd_slots[1] + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + _fd_slots[0] = _OPEN(name, os.O_RDWR | os.O_CREAT | os.O_EXCL | os.O_CLOEXEC | os.O_NOFOLLOW, 0o600, dir_fd=parent) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + descriptor = _fd_slots[0] + _fd(descriptor) + initial = _identity(_FSTAT(descriptor)) + schema.need(stat.S_ISREG(initial['mode']) and initial['links'] == 1 and initial['size'] == 0 and + stat.S_IMODE(initial['mode']) == 0o600, 'exclusive record file differs') + offset, calls = 0, 0 + while offset < _LEN(raw): + calls += 1 + schema.need(calls <= schema.MAX_RECORD_WRITE_CALLS, 'record write-call bound exceeded') + written = _WRITE(descriptor, raw[offset:offset + schema.CHUNK_BYTES]) + schema.integer(written, 1, min(schema.CHUNK_BYTES, _LEN(raw) - offset)) + offset += written + _FSYNC(descriptor) + _FSYNC(parent) + owned = _identity(_FSTAT(descriptor)) + result = inspect(path, schema.RECORD_BYTES, error_owner=error_owner) + schema.need(result['identity'] == owned and + (owned['device'], owned['inode']) == (initial['device'], initial['inode']) and + result['sha256'] == schema.sha(raw) and result['bytes'] == _LEN(raw), 'record readback differs') + return result + except _base_error as operation_error: + operation_primary = operation_error + if _primary[0] is None: + _primary[0] = operation_error + _primary[1] = 'write_once' + _primary[2] = None + elif _primary[0] is not operation_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = operation_error + _phases[_error_index] = 'write_once' + _uncertain[_error_index] = None + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = operation_error + raise + finally: + _owned_fd = _fd_slots[0] + _fd_slots[0] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[1] + _fd_slots[1] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[2] + _fd_slots[2] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[3] + _fd_slots[3] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[4] + _fd_slots[4] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + if operation_primary is None and cleanup_primary is not None: + raise cleanup_primary + +def read_verified(expected: dict, limit: int = schema.RECORD_BYTES, *, error_owner) -> bytes: + schema.owner_state(error_owner) + schema.integer(limit, 1, schema.RAW_RESULT_BYTES) + schema.blob(expected, limit) + _gate() + verify(expected, limit, error_owner=error_owner) + _state = schema.owner_state(error_owner) + _primary, _secondary, _phases, _uncertain = _state[0], _state[1], _state[2], _state[3] + _counts, _overflow, _io = _state[4], _state[5], _state[7] + _attempt_digits, _confirmed_digits = _io[7], _io[8] + _successors = schema.CUSTODY_SUCCESSORS + _quarantine_error = schema.IO_QUARANTINE_ERROR + _base_error, _close_native = BaseException, _CLOSE + _error_index = _digit = 0 + _owned_fd = _close_error = _acquisition_error = None + cleanup_primary = operation_primary = None + _fd_slots = [None] * 5 + _iterator = _owned_iterator = None + try: + name = _parent(expected['path'], error_owner, _fd_slots, 1) + parent = _fd_slots[1] + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + _fd_slots[0] = _OPEN(name, os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=parent) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + descriptor = _fd_slots[0] + _fd(descriptor) + schema.need(_identity(_FSTAT(descriptor)) == expected['identity'], 'evidence changed before read') + chunks, count, calls = [], 0, 0 + while True: + calls += 1 + schema.need(calls <= schema.MAX_READ_CALLS, 'evidence read-call bound exceeded') + raw = _READ(descriptor, min(schema.CHUNK_BYTES, limit + 1 - count)) + schema.need(_TYPE(raw) is bytes, 'native evidence read returned foreign data') + if _LEN(raw) == 0: + break + count += _LEN(raw) + schema.need(count <= limit, 'evidence byte bound exceeded') + chunks.append(raw) + result = b''.join(chunks) + schema.need(count == expected['bytes'] and schema.sha(result) == expected['sha256'] and + _identity(_FSTAT(descriptor)) == expected['identity'] and + _identity(_STAT(name, dir_fd=parent, follow_symlinks=False)) == expected['identity'], + 'retained evidence bytes/custody differ') + verify(expected, limit, error_owner=error_owner) + return result + except _base_error as operation_error: + operation_primary = operation_error + if _primary[0] is None: + _primary[0] = operation_error + _primary[1] = 'read_verified' + _primary[2] = None + elif _primary[0] is not operation_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = operation_error + _phases[_error_index] = 'read_verified' + _uncertain[_error_index] = None + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = operation_error + raise + finally: + _owned_fd = _fd_slots[0] + _fd_slots[0] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[1] + _fd_slots[1] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[2] + _fd_slots[2] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[3] + _fd_slots[3] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[4] + _fd_slots[4] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + if operation_primary is None and cleanup_primary is not None: + raise cleanup_primary + +def require_entries(directory: str, expected_names: tuple[str, ...], *, error_owner) -> None: + schema.owner_state(error_owner) + schema.path(directory) + schema.need(_TYPE(expected_names) is tuple and _LEN(expected_names) <= 7, 'census tuple differs') + # Validate all names before hashing, equality, membership, or set creation. + for name in expected_names: + schema.text(name, 256) + schema.need(0 < _LEN(name) and '/' not in name and name not in ('.', '..'), 'census name differs') + schema.need(_LEN(set(expected_names)) == _LEN(expected_names), 'duplicate census name') + _gate() + _state = schema.owner_state(error_owner) + _primary, _secondary, _phases, _uncertain = _state[0], _state[1], _state[2], _state[3] + _counts, _overflow, _io = _state[4], _state[5], _state[7] + _attempt_digits, _confirmed_digits = _io[7], _io[8] + _successors = schema.CUSTODY_SUCCESSORS + _quarantine_error = schema.IO_QUARANTINE_ERROR + _base_error, _close_native = BaseException, _CLOSE + _error_index = _digit = 0 + _owned_fd = _close_error = _acquisition_error = None + cleanup_primary = operation_primary = None + _fd_slots = [None] * 5 + _iterator = _owned_iterator = None + try: + name = _parent(directory, error_owner, _fd_slots, 1) + parent = _fd_slots[1] + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + _fd_slots[0] = _OPEN(name, os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW | os.O_DIRECTORY, dir_fd=parent) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + descriptor = _fd_slots[0] + _fd(descriptor) + before = _identity(_FSTAT(descriptor)) + schema.need(stat.S_ISDIR(before['mode']), 'copy root is not a directory') + names = [] + if _io[0] or _io[1] or _io[10] or _overflow[1] or _attempt_digits[4] == 1: + raise _quarantine_error + _io[1] = True + try: + _iterator = _SCANDIR(descriptor) + except _base_error as _acquisition_error: + if _io[3] is None: + _io[3] = _acquisition_error + _io[0] = True + _io[2] = True + _io[4] = True + raise + _io[1] = False + for entry in _iterator: + # Exact native entry guard remains before its attribute access. + schema.need(_TYPE(entry) is os.DirEntry, 'native directory entry type differs') + entry_name = entry.name + schema.text(entry_name, 256) + names.append(entry_name) + schema.need(_LEN(names) <= 7, 'copy root entry bound exceeded') + _owned_iterator = _iterator + _iterator = None + if _owned_iterator is not None: + try: + _owned_iterator.close() + except _base_error as _close_error: + if _io[5] is None: + _io[5] = _owned_iterator + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'scandir-close' + _primary[2] = None + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'scandir-close' + _uncertain[_error_index] = None + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + # A normal/no-op return after a delivered body error cannot + # invoke the selected release premise or clear uncertainty. + if operation_primary is None and not _io[0] and _io[5] is None: + _io[9] = True + _io[4] = True + if cleanup_primary is not None: + raise cleanup_primary + schema.need(set(names) == set(expected_names) and before == _identity(_FSTAT(descriptor)) == + _identity(_STAT(name, dir_fd=parent, follow_symlinks=False)), 'copy root entries/custody differ') + except _base_error as operation_error: + operation_primary = operation_error + # Any body failure may follow an ignored closedir result, including + # iterator OSError/MemoryError before an explicit close becomes a no-op. + # Root the exact error first; quarantine and retain stream uncertainty + # before cleanup or any optional helper/reporting can run. + _io[0] = True + _io[4] = True + if _io[5] is None: + if _iterator is not None: + _io[5] = _iterator + elif _owned_iterator is not None: + _io[5] = _owned_iterator + if _primary[0] is None: + _primary[0] = operation_error + _primary[1] = 'require_entries' + _primary[2] = None + elif _primary[0] is not operation_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = operation_error + _phases[_error_index] = 'require_entries' + _uncertain[_error_index] = None + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = operation_error + raise + finally: + _owned_iterator = _iterator + _iterator = None + if _owned_iterator is not None: + try: + _owned_iterator.close() + except _base_error as _close_error: + if _io[5] is None: + _io[5] = _owned_iterator + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'scandir-close' + _primary[2] = None + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'scandir-close' + _uncertain[_error_index] = None + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + # A normal/no-op return after a delivered body error cannot + # invoke the selected release premise or clear uncertainty. + if operation_primary is None and not _io[0] and _io[5] is None: + _io[9] = True + _io[4] = True + _owned_fd = _fd_slots[0] + _fd_slots[0] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[1] + _fd_slots[1] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[2] + _fd_slots[2] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[3] + _fd_slots[3] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + _owned_fd = _fd_slots[4] + _fd_slots[4] = None + if _owned_fd is not None: + if _attempt_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _attempt_digits[_digit] == 255: + _attempt_digits[_digit] = 0 + _digit = _successors[_digit] + _attempt_digits[_digit] = _successors[_attempt_digits[_digit]] + try: + _close_native(_owned_fd) + except _base_error as _close_error: + _io[0] = True + _io[4] = True + if cleanup_primary is None: + cleanup_primary = _close_error + if _primary[0] is None: + _primary[0] = _close_error + _primary[1] = 'close' + _primary[2] = _owned_fd + elif _primary[0] is not _close_error: + _error_index = _counts[0] + if _error_index < 64: + _secondary[_error_index] = _close_error + _phases[_error_index] = 'close' + _uncertain[_error_index] = _owned_fd + _counts[0] = _successors[_error_index] + else: + _overflow[1] = True + _io[0] = True + _io[4] = True + if _overflow[0] is None: + _overflow[0] = _close_error + else: + if _confirmed_digits[4] == 1: + _io[6] = True + _io[0] = True + _io[4] = True + else: + _digit = 0 + while _digit < 4 and _confirmed_digits[_digit] == 255: + _confirmed_digits[_digit] = 0 + _digit = _successors[_digit] + _confirmed_digits[_digit] = _successors[_confirmed_digits[_digit]] + if operation_primary is None and cleanup_primary is not None: + raise cleanup_primary \ No newline at end of file diff --git a/research/h25-v03-authenticated-prefix-entry/prerequisites/epoch_parent_v5.py.txt b/research/h25-v03-authenticated-prefix-entry/prerequisites/epoch_parent_v5.py.txt new file mode 100644 index 0000000000..7fb46f3cf3 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/prerequisites/epoch_parent_v5.py.txt @@ -0,0 +1,466 @@ +"""Parent-only single-attempt epoch source; no execution authority is configured. + +Parent authority and run tickets are identity capabilities in the trusted parent +process. They are never serialized or sent to a child. This is not a Python +sandbox against code already executing inside that trusted parent. The future +source-fixed supervisor must authenticate original compiler/terminal/raw data +before submitting a completion; a child JSON object or saved PASS is not that +call. The missing supervisor adapter is an explicit independent-review blocker. +""" +from dataclasses import dataclass +import epoch_schema_v5 as schema +import epoch_copy_v5 as copying +import epoch_stop_v5 as stopping + +CONFIGURATION = None +SOURCE_REVIEW = None +EXECUTION_APPROVAL = None +FUNDING = None +_RESERVED_EPOCHS = set() +_PARENT_OWNERS = [] +_TYPE = type + + +@dataclass(frozen=True, slots=True) +class ParentCompletion: + """In-memory result of the separately pinned parent evidence checker. + + Cannot be reconstructed from a child report as authority. All raw evidence + remains referenced by producer_record and must be re-read by each consumer. + Whole-domain closure is stronger than a compiler's direct-child wait. + """ + producer_ticket: object + checker_sha256: str + observation_sha256: str + generation: str + mode: str + producer_role: str + process_id: int + process_start_ticks: int + direct_child_reaped: bool + whole_process_domain_closed: bool + own_in_process_obligations_authenticated: bool + original_attempts_and_logs_authenticated: bool + final_source_custody_authenticated: bool + returned_groups_captured: bool + + +def _gate() -> None: + schema.exact(CONFIGURATION, ('parent_checker_sha256', 'configuration_sha256')) + schema.exact(SOURCE_REVIEW, ('review_sha256',)) + schema.exact(EXECUTION_APPROVAL, ('external_launch_policy_sha256',)) + schema.exact(FUNDING, ('reservation_sha256',)) + for record in (CONFIGURATION, SOURCE_REVIEW, EXECUTION_APPROVAL, FUNDING): + for value in record.values(): + schema.digest(value) + + +_COMPLETION_FIELDS = ('producer_ticket', 'checker_sha256', 'observation_sha256', 'generation', 'mode', + 'producer_role', 'process_id', 'process_start_ticks', 'direct_child_reaped', 'whole_process_domain_closed', + 'own_in_process_obligations_authenticated', 'original_attempts_and_logs_authenticated', + 'final_source_custody_authenticated', 'returned_groups_captured') +_COMPLETION_GETTERS = tuple(ParentCompletion.__dict__[name].__get__ for name in _COMPLETION_FIELDS) + + +def _completion_values(observation) -> dict: + schema.need(_TYPE(observation) is ParentCompletion, 'exact parent completion type required') + values = {name: getter(observation, ParentCompletion) + for name, getter in zip(_COMPLETION_FIELDS, _COMPLETION_GETTERS)} + schema.need(_TYPE(values['producer_ticket']) is object, 'exact opaque producer ticket required') + schema.digest(values['checker_sha256']) + schema.digest(values['observation_sha256']) + schema.label(values['generation']) + schema.choice(values['mode'], ('normal', 'optimized')) + schema.choice(values['producer_role'], schema.PRODUCERS) + schema.integer(values['process_id'], 1, (1 << 31) - 1) + schema.integer(values['process_start_ticks'], 1, (1 << 64) - 1) + for name in _COMPLETION_FIELDS[8:]: + schema.boolean(values[name]) + return values + + +def _clone(value: dict) -> dict: + return schema.decode(schema.canonical(value)) + + +def _plan(value: dict, role: str) -> None: + schema.choice(role, schema.PRODUCERS) + schema.exact(value, ('role', 'generation', 'stage_sha256', 'command_sha256', 'root_sha256', + 'artifact_plans')) + schema.choice(value['role'], schema.PRODUCERS) + schema.need(value['role'] == role, 'planned producer role differs') + schema.label(value['generation']) + for key in ('stage_sha256', 'command_sha256', 'root_sha256'): + schema.digest(value[key]) + roles = schema.ROLES[:3] if role == 'group01' else schema.ROLES[3:] + schema.need(type(value['artifact_plans']) is list and len(value['artifact_plans']) == len(roles), + 'planned build count differs') + for artifact_role, row in zip(roles, value['artifact_plans']): + schema.exact(row, ('role', 'command_sha256', 'profile', 'original_output_path')) + schema.choice(row['role'], schema.ROLES) + schema.need(row['role'] == artifact_role, 'planned artifact role differs') + schema.digest(row['command_sha256']) + schema.profile(row['profile']) + schema.path(row['original_output_path']) + + +_STATE_KEYS = ('_authority', '_bytes', '_children', '_copies', '_directory', '_epoch_id', '_error_owner', '_failure_fallback', '_generations', '_intent_file', '_manifest', '_manifest_file', '_mode', '_occupied_inodes', '_occupied_paths', '_plans', '_processes', '_producers', '_state', '_stop', '_tickets') + + +def _registry() -> list: + schema.need(_TYPE(_PARENT_OWNERS) is list and len(_PARENT_OWNERS) <= 2, + 'original parent registry shape differs') + for record in _PARENT_OWNERS: + schema.need(_TYPE(record) is tuple and len(record) == 2, 'original parent registry row differs') + schema.need(_TYPE(record[0]) is ParentEpoch, 'original parent registry identity differs') + schema.exact(record[1], _STATE_KEYS) + return _PARENT_OWNERS + + +def _constructor_identity(owner) -> None: + schema.need(_TYPE(owner) is ParentEpoch, 'exact parent owner required') + records = _registry() + schema.need(len(records) < 2 and not any(owner is record[0] for record in records), + 'parent constructor instance reused or finite bound exceeded') + + +def _registered_parent(owner) -> tuple: + # Identity only. Never read owner.__dict__ or dispatch owner helpers. + schema.need(_TYPE(owner) is ParentEpoch, 'exact parent owner required') + for original in _registry(): + if owner is original[0]: + return original # Canonical constructor-held object and state. + raise schema.EpochStop('parent was not original constructor instance') + + +def _entry_state(owner, authority) -> dict: + canonical, state = _registered_parent(owner) + _gate() + schema.need(authority is state['_authority'], 'parent capability differs') + schema.need(state['_stop'][1] is None, 'epoch has a retained terminal failure') + schema.choice(state['_state'], ('RESERVED', 'PRODUCERS_PENDING', 'EXPORT_READY', + 'EXPORT_ATTEMPT_CONSUMED', 'COMMITTED', 'STOP', 'CLOSED')) + schema.need(state['_state'] not in ('STOP', 'CLOSED'), 'epoch is terminal') + return state + + +def _failed_state(state, operation: str, error) -> None: + # Only a source-owned registry sidecar is used. The supplied instance's + # _owner/_failed attributes are never looked up, even on failure paths. + schema.need(any(state is record[1] for record in _registry()), 'failure state not owned') + schema.text(operation, 96) + state['_state'] = 'STOP' + if state['_stop'][1] is error: + try: + schema.retain_primary(state['_error_owner'], error, operation) + except BaseException as custody_failure: + if state['_failure_fallback'][0] is None: + state['_failure_fallback'][0] = custody_failure + return + try: + stopping.retain_stop(state['_directory'], operation, state['_error_owner']) + except BaseException as evidence_failure: + if state['_failure_fallback'][1] is None: + state['_failure_fallback'][1] = evidence_failure + try: + schema.retain_secondary(state['_error_owner'], evidence_failure, 'stop-capture', None) + except BaseException as custody_failure: + if state['_failure_fallback'][2] is None: + state['_failure_fallback'][2] = custody_failure + + +class ParentEpoch: + """One parent instance; two producers, five exports, thirteen child attempts. + + Any caught operational failure moves state to STOP permanently. Tickets are + burned before validation/I/O. No serialized-state restore or retry exists. + The constructor does not create directories; the supervised parent must own + fresh exclusive directories and charge their creation/retention separately. + """ + def __init__(self, authority: object, epoch_id: str, mode: str, + export_directory: str, producer_plans: list[dict]): + _constructor_identity(self) + _gate() + schema.need(_TYPE(authority) is object, 'trusted parent capability must be exact object') + schema.label(epoch_id) + schema.choice(mode, ('normal', 'optimized')) + schema.path(export_directory) + schema.need(epoch_id not in _RESERVED_EPOCHS and len(_RESERVED_EPOCHS) < 2, + 'parent epoch reused or finite mode count exceeded') + # Reservation precedes all further work; invalid construction burns id. + _RESERVED_EPOCHS.add(epoch_id) + state = {} + state['_state'] = 'RESERVED' + state['_authority'] = authority + state['_epoch_id'], state['_mode'] = epoch_id, mode + state['_directory'] = export_directory + state['_plans'], state['_tickets'], state['_producers'] = {}, {}, {} + state['_children'], state['_generations'], state['_processes'] = {}, set(), set() + state['_occupied_paths'], state['_occupied_inodes'] = set(), set() + state['_copies'], state['_bytes'] = 0, 0 + state['_manifest'] = state['_manifest_file'] = state['_intent_file'] = None + state['_stop'] = [None, None] + state['_failure_fallback'] = [None, None, None, None] + state['_error_owner'] = schema.make_error_owner() + _PARENT_OWNERS.append((self, state)) + _stop_slots, _fallback_slots = state['_stop'], state['_failure_fallback'] + try: + schema.need(type(producer_plans) is list and len(producer_plans) == 2, 'two producer plans required') + for role, plan in zip(schema.PRODUCERS, producer_plans): + _plan(plan, role) + schema.need(plan['generation'] not in state['_generations'], 'producer generation reused') + state['_generations'].add(plan['generation']) + state['_plans'][role] = _clone(plan) + copying.require_entries(state['_directory'], (), error_owner=state['_error_owner']) + intent = {'schema': 'h25-negative-epoch-intent-v3', 'epoch_id': epoch_id, 'mode': mode, + 'producer_plans': [state['_plans'][role] for role in schema.PRODUCERS], + 'restore_or_retry_allowed': False} + state['_intent_file'] = copying.write_once(state['_directory'] + '/epoch-intent.json', schema.canonical(intent), error_owner=state['_error_owner']) + state['_state'] = 'PRODUCERS_PENDING' + except BaseException as error: + if _stop_slots[1] is None: + _stop_slots[1] = error + _stop_slots[0] = 'constructor' + try: + _failed_state(state, 'constructor', error) + except BaseException as helper_error: + if _fallback_slots[3] is None: + _fallback_slots[3] = helper_error + raise + + def _owner(self, authority: object) -> None: + _entry_state(self, authority) + + def _failed(self, operation: str, error: BaseException) -> None: + canonical, state = _registered_parent(self) + stop_slots, fallback_slots = state['_stop'], state['_failure_fallback'] + if stop_slots[1] is None: + stop_slots[1] = error + stop_slots[0] = operation + try: + _failed_state(state, operation, error) + except BaseException as helper_error: + if fallback_slots[3] is None: + fallback_slots[3] = helper_error + + + def reserve_producer(self, authority: object, role: str) -> object: + state = _entry_state(self, authority) + _stop_slots, _fallback_slots = state['_stop'], state['_failure_fallback'] + try: + schema.choice(role, schema.PRODUCERS) + schema.need(state['_state'] == 'PRODUCERS_PENDING' and role in schema.PRODUCERS and + role not in state['_tickets'], 'producer attempt already consumed/unknown') + ticket = object() + state['_tickets'][role] = {'ticket': ticket, 'state': 'ATTEMPT_RESERVED'} + return ticket + except BaseException as error: + if _stop_slots[1] is None: + _stop_slots[1] = error + _stop_slots[0] = 'reserve_producer' + try: + _failed_state(state, 'reserve_producer', error) + except BaseException as helper_error: + if _fallback_slots[3] is None: + _fallback_slots[3] = helper_error + raise + + def accept_completed_producer(self, authority: object, ticket: object, + observation: ParentCompletion, producer_record: dict) -> None: + state = _entry_state(self, authority) + _stop_slots, _fallback_slots = state['_stop'], state['_failure_fallback'] + try: + matches = [role for role, row in state['_tickets'].items() if row['ticket'] is ticket] + schema.need(len(matches) == 1, 'unknown producer attempt capability') + role = matches[0] + attempt = state['_tickets'][role] + schema.need(attempt['state'] == 'ATTEMPT_RESERVED', 'producer completion replay') + attempt['state'] = 'COMPLETION_CONSUMED' + observed = _completion_values(observation) + schema.need(observed['producer_ticket'] is ticket, + 'serialized/replayed completion is not this parent attempt') + schema.need(observed['checker_sha256'] == CONFIGURATION['parent_checker_sha256'], + 'parent completion checker source differs') + schema.digest(observed['observation_sha256']) + schema.integer(observed['process_id'], 1, (1 << 31) - 1) + schema.integer(observed['process_start_ticks'], 1, (1 << 64) - 1) + process_key = (observed['process_id'], observed['process_start_ticks']) + schema.need(process_key not in state['_processes'], 'producer process generation reused') + state['_processes'].add(process_key) + plan = state['_plans'][role] + schema.need(observed['generation'] == plan['generation'] and observed['mode'] == state['_mode'] and + observed['producer_role'] == role, 'terminal observation independent role/generation differs') + for value in (observed['direct_child_reaped'], observed['whole_process_domain_closed'], + observed['own_in_process_obligations_authenticated'], + observed['original_attempts_and_logs_authenticated'], + observed['final_source_custody_authenticated'], observed['returned_groups_captured']): + schema.need(value is True, 'parent completion obligation absent') + schema.producer(producer_record) + record = _clone(producer_record) + schema.need(record['completion_checker_sha256'] == observed['checker_sha256'] and + record['parent_observation']['sha256'] == observed['observation_sha256'], + 'parent observation bytes/checker binding differs') + for key in ('role', 'generation', 'stage_sha256', 'command_sha256', 'root_sha256'): + schema.need(record[key] == plan[key], 'producer independent plan differs') + for item, planned in zip(record['builds'], plan['artifact_plans']): + schema.need(item['role'] == planned['role'] and item['command_sha256'] == planned['command_sha256'] and + item['profile'] == planned['profile'] and + item['original_output']['path'] == planned['original_output_path'], + 'build original command/source/profile/path differs') + for key, bound in (('original_output', schema.FILE_BYTES), ('original_receipt', 65536), + ('attempt', 65536), ('journal', schema.JOURNAL_BYTES), + ('stdout', schema.LOG_BYTES), ('stderr', schema.LOG_BYTES)): + copying.verify(item[key], bound, error_owner=state['_error_owner']) + original = item['original_output'] + schema.need(original['path'] not in state['_occupied_paths'] and + schema.inode(original) not in state['_occupied_inodes'], 'producer output aliases another role') + state['_occupied_paths'].add(original['path']) + state['_occupied_inodes'].add(schema.inode(original)) + for key in ('terminal', 'raw_result', 'raw_groups', 'final_source_custody', 'parent_observation'): + copying.verify(record[key], schema.RAW_RESULT_BYTES, error_owner=state['_error_owner']) + # No control/PASS/native result is returned to a child as authority. + state['_producers'][role] = record + attempt['state'] = 'AUTHENTICATED_COMPLETED' + if len(state['_producers']) == 2: + state['_state'] = 'EXPORT_READY' + except BaseException as error: + if _stop_slots[1] is None: + _stop_slots[1] = error + _stop_slots[0] = 'accept_completed_producer' + try: + _failed_state(state, 'accept_completed_producer', error) + except BaseException as helper_error: + if _fallback_slots[3] is None: + _fallback_slots[3] = helper_error + raise + + def commit_exports(self, authority: object) -> dict: + state = _entry_state(self, authority) + _stop_slots, _fallback_slots = state['_stop'], state['_failure_fallback'] + try: + schema.need(state['_state'] == 'EXPORT_READY', 'partial/failed producer epoch cannot export') + state['_state'] = 'EXPORT_ATTEMPT_CONSUMED' + copying.verify(state['_intent_file'], schema.RECORD_BYTES, error_owner=state['_error_owner']) + copying.require_entries(state['_directory'], ('epoch-intent.json',), error_owner=state['_error_owner']) + exports = [] + for parent in (state['_producers'][role] for role in schema.PRODUCERS): + for item in parent['builds']: + destination = state['_directory'] + '/' + item['role'] + '.artifact' + schema.need(destination not in state['_occupied_paths'], 'export path alias') + copy = copying.copy_once(item['original_output'], destination, tuple(state['_occupied_inodes']), error_owner=state['_error_owner']) + state['_bytes'] += copy['bytes'] + schema.need(state['_bytes'] <= schema.MAX_EPOCH_FILE_BYTES, 'aggregate copy payload bound exceeded') + state['_occupied_paths'].add(copy['path']) + state['_occupied_inodes'].add(schema.inode(copy)) + exports.append({'role': item['role'], 'build_sha256': schema.sha(schema.canonical(item)), 'file': copy}) + manifest = {'schema': schema.SCHEMA, 'epoch_id': state['_epoch_id'], 'mode': state['_mode'], + 'publication_state': 'COMMITTED', 'intent': state['_intent_file'], + 'producers': [state['_producers'][role] for role in schema.PRODUCERS], + 'exports': exports, 'not_runtime_authority': True} + schema.epoch(manifest) + # Recheck every source/store before the publication write. + for producer in manifest['producers']: + for item in producer['builds']: + copying.verify(item['original_output'], error_owner=state['_error_owner']) + for row in exports: + copying.verify(row['file'], error_owner=state['_error_owner']) + raw = schema.canonical(manifest) + published = copying.write_once(state['_directory'] + '/epoch.json', raw, error_owner=state['_error_owner']) + copying.require_entries(state['_directory'], tuple(role + '.artifact' for role in schema.ROLES) + ('epoch.json', 'epoch-intent.json'), error_owner=state['_error_owner']) + state['_manifest'], state['_manifest_file'] = manifest, published + state['_state'] = 'COMMITTED' + return _clone(published) + except BaseException as error: + if _stop_slots[1] is None: + _stop_slots[1] = error + _stop_slots[0] = 'commit_exports' + try: + _failed_state(state, 'commit_exports', error) + except BaseException as helper_error: + if _fallback_slots[3] is None: + _fallback_slots[3] = helper_error + raise + + def claim_child(self, authority: object, group: str, generation: str, + launch_binding: dict, private_directory: str) -> tuple[dict, dict]: + state = _entry_state(self, authority) + _stop_slots, _fallback_slots = state['_stop'], state['_failure_fallback'] + try: + schema.need(state['_state'] == 'COMMITTED', 'uncommitted epoch cannot be consumed') + roles = schema.required_roles(group) + schema.label(generation) + schema.need(group not in state['_children'] and generation not in state['_generations'], + 'child group/generation replay') + # Burn group/generation before any caller data check or filesystem IO. + state['_children'][group] = {'generation': generation, 'state': 'ATTEMPT_CONSUMED'} + state['_generations'].add(generation) + schema.launch(launch_binding) + schema.path(private_directory) + copying.require_entries(private_directory, (), error_owner=state['_error_owner']) + copying.require_entries(state['_directory'], tuple(role + '.artifact' for role in schema.ROLES) + ('epoch.json', 'epoch-intent.json'), error_owner=state['_error_owner']) + copying.verify(state['_intent_file'], schema.RECORD_BYTES, error_owner=state['_error_owner']) + copying.verify(state['_manifest_file'], schema.RECORD_BYTES, error_owner=state['_error_owner']) + for row in state['_manifest']['exports']: + copying.verify(row['file'], error_owner=state['_error_owner']) + copies = [] + for role in roles: + source = next(row for row in state['_manifest']['exports'] if row['role'] == role) + destination = private_directory + '/' + role + '.artifact' + schema.need(destination not in state['_occupied_paths'] and state['_copies'] < schema.MAX_PRIVATE_COPIES, + 'private path/copy bound differs') + state['_copies'] += 1 + copy = copying.copy_once(source['file'], destination, tuple(state['_occupied_inodes']), error_owner=state['_error_owner']) + state['_bytes'] += copy['bytes'] + schema.need(state['_bytes'] <= schema.MAX_EPOCH_FILE_BYTES, 'aggregate copy payload bound exceeded') + state['_occupied_paths'].add(copy['path']) + state['_occupied_inodes'].add(schema.inode(copy)) + copies.append({'role': role, 'build_sha256': source['build_sha256'], + 'source': source['file'], 'destination': copy}) + claim = {'schema': schema.CLAIM_SCHEMA, 'epoch_id': state['_epoch_id'], 'mode': state['_mode'], + 'group': group, 'generation': generation, 'manifest_sha256': state['_manifest_file']['sha256'], + 'launch': _clone(launch_binding), 'copies': copies, 'local_compilations': 0, + 'not_runtime_authority': True, 'admission': 'CURRENT_CHILD_CHECKS_REQUIRED'} + schema.claim(claim, state['_manifest'], launch_binding, group, generation, private_directory) + published = copying.write_once(private_directory + '/import-claim.json', schema.canonical(claim), error_owner=state['_error_owner']) + copying.require_entries(private_directory, tuple(role + '.artifact' for role in roles) + ('import-claim.json',), error_owner=state['_error_owner']) + copying.require_entries(state['_directory'], tuple(role + '.artifact' for role in schema.ROLES) + ('epoch.json', 'epoch-intent.json'), error_owner=state['_error_owner']) + state['_children'][group]['state'] = 'CLAIM_ISSUED' + state['_children'][group]['claim'] = published + return _clone(claim), _clone(published) + except BaseException as error: + if _stop_slots[1] is None: + _stop_slots[1] = error + _stop_slots[0] = 'claim_child' + try: + _failed_state(state, 'claim_child', error) + except BaseException as helper_error: + if _fallback_slots[3] is None: + _fallback_slots[3] = helper_error + raise + + def close(self, authority: object) -> dict: + state = _entry_state(self, authority) + _stop_slots, _fallback_slots = state['_stop'], state['_failure_fallback'] + try: + schema.need(state['_state'] == 'COMMITTED' and tuple(sorted(state['_children'])) == schema.GROUPS and + all(row['state'] == 'CLAIM_ISSUED' for row in state['_children'].values()) and + state['_copies'] == schema.MAX_PRIVATE_COPIES, 'core epoch claim schedule incomplete') + state['_state'] = 'CLOSED' + return {'schema': 'h25-negative-epoch-accounting-v3', 'epoch_id': state['_epoch_id'], 'mode': state['_mode'], + 'exports': 5, 'private_copies': state['_copies'], 'copy_payload_bytes': state['_bytes'], + 'child_runtime_results': 'NOT_ADMITTED_BY_THIS_API', 'complete_cost': None} + except BaseException as error: + if _stop_slots[1] is None: + _stop_slots[1] = error + _stop_slots[0] = 'close' + try: + _failed_state(state, 'close', error) + except BaseException as helper_error: + if _fallback_slots[3] is None: + _fallback_slots[3] = helper_error + raise + + def stop_evidence(self, authority: object) -> tuple: + canonical, state = _registered_parent(self) + schema.need(authority is state['_authority'], 'parent capability differs') + return state['_stop'], state['_error_owner'], state['_failure_fallback'] diff --git a/research/h25-v03-authenticated-prefix-entry/prerequisites/epoch_schema_v5.py.txt b/research/h25-v03-authenticated-prefix-entry/prerequisites/epoch_schema_v5.py.txt new file mode 100644 index 0000000000..b95c2385a9 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/prerequisites/epoch_schema_v5.py.txt @@ -0,0 +1,676 @@ +"""Finite negative-only data records. No import/load/compile/runtime authority. + +Source draft: no target execution has been authorized. These functions are not +run during source checks. Every caller must be a separately reviewed fixed +parent/child source; JSON never creates a parent capability. +""" +import hashlib +import json + +SCHEMA = 'h25-negative-build-epoch-v3' +CLAIM_SCHEMA = 'h25-negative-import-claim-v3' +ROLES = ('production', 'watcher', 'bounds', 'pyinit_failure', 'exec_failure') +PRODUCERS = ('group01', 'failure_variants') +GROUPS = ('02', '03', '04', '07', '08', '09', '10', '11', '12', '13', '14', '15', '16') +PROFILE_KEYS = ('source_manifest_sha256', 'project_headers_sha256', 'system_headers_sha256', + 'compiler_link_sha256', 'link_profile_sha256') +LAUNCH_KEYS = ('configuration_sha256', 'root_sha256', 'stage_sha256', 'command_sha256', + 'startup_tcb_sha256', 'expected_history_sha256') +FILE_BYTES = 64 * 1024 * 1024 +RECORD_BYTES = 1024 * 1024 +RAW_RESULT_BYTES = 4 * 1024 * 1024 +LOG_BYTES = 2 * 1024 * 1024 +JOURNAL_BYTES = 3 * 65536 +CHUNK_BYTES = 65536 +PATH_BYTES = 4096 +MAX_PATH_COMPONENTS = 64 +MAX_READ_CALLS = 8192 +MAX_WRITE_CALLS = 8192 +MAX_RECORD_WRITE_CALLS = 4096 +MAX_PRIVATE_COPIES = 41 +MAX_EXPORTS = 5 +MAX_EPOCH_FILE_BYTES = 46 * FILE_BYTES +IDENTITY_KEYS = ('device', 'inode', 'mode', 'links', 'uid', 'gid', 'size', 'mtime_ns', 'ctime_ns') + + +# Captured before any adverse input. Actual startup primitive/source admission +# is still required by the future caller; no module is imported in source work. +_TYPE, _LEN = type, len +_DICT, _LIST, _TUPLE, _STR, _INT, _BOOL, _BYTES = dict, list, tuple, str, int, bool, bytes +MAX_RECORD_KEYS = 256 +MAX_SEQUENCE = 256 +MAX_WIRE_NODES = 8192 +MAX_WIRE_DEPTH = 24 +MAX_WIRE_TEXT = 8192 +MAX_WIRE_TEXT_TOTAL = 512 * 1024 + + +class EpochStop(RuntimeError): + """Literal bounded source error; original foreign failures remain opaque.""" + + +def need(condition: bool, message: str) -> None: + # No truth testing or formatting of an unknown object. + if _TYPE(message) is not _STR or _LEN(message) > 256: + raise EpochStop('invalid internal error literal') + if condition is not True: + raise EpochStop(message) + + +def exact(value: dict, keys: tuple[str, ...]) -> None: + need(_TYPE(value) is _DICT, 'exact record type differs') + need(_LEN(value) <= MAX_RECORD_KEYS, 'record cardinality bound exceeded') + need(_TYPE(keys) is _TUPLE, 'exact expected key tuple differs') + need(_LEN(keys) <= MAX_RECORD_KEYS, 'expected key cardinality bound exceeded') + # Iteration over an exact dict does not hash its keys. Complete this walk + # before membership, set creation, or any value lookup in that dictionary. + for key in value: + need(_TYPE(key) is _STR, 'foreign record key rejected') + need(_LEN(key) <= MAX_WIRE_TEXT, 'record key length bound exceeded') + for key in keys: + need(_TYPE(key) is _STR, 'foreign expected key rejected') + need(_LEN(key) <= MAX_WIRE_TEXT, 'expected key length bound exceeded') + need(_LEN(value) == _LEN(keys), 'exact record keys differ') + seen = set() + for key in keys: + need(key not in seen, 'duplicate expected key') + seen.add(key) + for key in value: + need(key in seen, 'exact record keys differ') + + +def integer(value: int, lower: int, upper: int) -> None: + need(_TYPE(value) is _INT and _TYPE(lower) is _INT and _TYPE(upper) is _INT, + 'exact integer type differs') + need(lower <= value <= upper, 'bounded exact integer differs') + + +def boolean(value: bool) -> None: + need(_TYPE(value) is _BOOL, 'exact boolean type differs') + + +def text(value: str, limit: int = MAX_WIRE_TEXT) -> None: + need(_TYPE(value) is _STR and _TYPE(limit) is _INT, 'exact text/limit type differs') + need(0 <= limit <= MAX_WIRE_TEXT and _LEN(value) <= limit, 'text bound exceeded') + + +def choice(value: str, choices: tuple[str, ...]) -> None: + text(value) + need(_TYPE(choices) is _TUPLE and _LEN(choices) <= MAX_SEQUENCE, 'choice tuple differs') + for item in choices: + text(item) + need(value in choices, 'literal choice differs') + + +def sequence(value: list, count: int) -> None: + need(_TYPE(value) is _LIST and _TYPE(count) is _INT, 'exact sequence type differs') + need(0 <= count <= MAX_SEQUENCE and _LEN(value) == count, 'exact sequence count differs') + + +def digest(value: str) -> None: + text(value, 64) + need(_LEN(value) == 64 and all(c in '0123456789abcdef' for c in value), 'sha256 differs') + + +def label(value: str) -> None: + text(value, 96) + need(1 <= _LEN(value) <= 96 and + all(c in 'abcdefghijklmnopqrstuvwxyz0123456789-' for c in value), 'label differs') + + +def path(value: str) -> None: + text(value, PATH_BYTES) + need(1 < _LEN(value) <= PATH_BYTES and value.isascii() and value.startswith('/'), + 'canonical absolute path differs') + parts = value.split('/')[1:] + need(_LEN(parts) <= MAX_PATH_COMPONENTS and + all(p not in ('', '.', '..') for p in parts) and + all(32 <= ord(c) <= 126 for c in value), 'canonical absolute path differs') + + +def _plain(value, depth: int, budget: list): + # depth and budget are newly created private native values, never inputs. + budget[0] += 1 + need(budget[0] <= MAX_WIRE_NODES and depth <= MAX_WIRE_DEPTH, 'plain record node/depth bound') + kind = _TYPE(value) + if value is None or kind is _BOOL: + return value + if kind is _STR: + need(_LEN(value) <= MAX_WIRE_TEXT, 'plain text bound') + budget[1] += _LEN(value) + need(budget[1] <= MAX_WIRE_TEXT_TOTAL, 'plain total text bound') + return value + if kind is _INT: + need(-(1 << 127) <= value < (1 << 127), 'plain integer bound') + return value + if kind is _DICT: + need(_LEN(value) <= MAX_RECORD_KEYS, 'plain dictionary bound') + for key in value: + need(_TYPE(key) is _STR, 'plain foreign dictionary key') + need(_LEN(key) <= MAX_WIRE_TEXT, 'plain dictionary key bound') + result = {} + for key, item in value.items(): + budget[1] += _LEN(key) + need(budget[1] <= MAX_WIRE_TEXT_TOTAL, 'plain total key text bound') + result[key] = _plain(item, depth + 1, budget) + return result + if kind is _LIST or kind is _TUPLE: + need(_LEN(value) <= MAX_SEQUENCE, 'plain sequence bound') + return [_plain(item, depth + 1, budget) for item in value] + raise EpochStop('foreign plain-record value rejected') + + +def plain_copy(value): + """Bounded callback-free native copy before any codec/equality use.""" + return _plain(value, 0, [0, 0]) + + +def required_roles(group: str) -> tuple[str, ...]: + text(group, 2) + need(group in GROUPS, 'positive/non-native/unknown group cannot import') + return ROLES[:3] + (('pyinit_failure',) if group == '13' else + ('exec_failure',) if group == '14' else ()) + + +def profile(value: dict) -> None: + exact(value, PROFILE_KEYS) + for key in PROFILE_KEYS: + digest(value[key]) + + +def launch(value: dict) -> None: + exact(value, LAUNCH_KEYS) + for key in LAUNCH_KEYS: + digest(value[key]) + + +def blob(value: dict, limit: int = FILE_BYTES) -> None: + integer(limit, 0, FILE_BYTES) + exact(value, ('path', 'sha256', 'bytes', 'identity')) + path(value['path']) + digest(value['sha256']) + integer(value['bytes'], 0, limit) + identity = value['identity'] + exact(identity, IDENTITY_KEYS) + for key in IDENTITY_KEYS: + integer(identity[key], 0, (1 << 127) - 1) + need(identity['inode'] > 0 and identity['size'] == value['bytes'] and + identity['mode'] & 0o170000 == 0o100000 and identity['links'] == 1, + 'regular single-link file custody differs') + + +def inode(value: dict) -> tuple[int, int]: + blob(value) + return value['identity']['device'], value['identity']['inode'] + + +def canonical(value: dict) -> bytes: + need(_TYPE(value) is _DICT, 'canonical top-level exact dictionary required') + safe = plain_copy(value) + raw = json.dumps(safe, sort_keys=True, separators=(',', ':'), ensure_ascii=True, + allow_nan=False).encode('ascii') + b'\n' + need(_LEN(raw) <= RECORD_BYTES, 'record byte bound exceeded') + return raw + + +def sha(raw: bytes) -> str: + need(_TYPE(raw) is _BYTES, 'exact byte buffer required') + return hashlib.sha256(raw).hexdigest() + + +def _pairs(pairs: list) -> dict: + need(_TYPE(pairs) is _LIST and _LEN(pairs) <= MAX_RECORD_KEYS, 'decoded key count differs') + result = {} + for pair in pairs: + need(_TYPE(pair) is _TUPLE and _LEN(pair) == 2, 'decoded pair differs') + key, value = pair + text(key) + need(key not in result, 'duplicate JSON key') + result[key] = value + return result + + +def _reject_constant(value): + raise EpochStop('nonfinite JSON constant rejected') + + +def decode(raw: bytes) -> dict: + need(_TYPE(raw) is _BYTES, 'exact raw bytes required') + need(0 < _LEN(raw) <= RECORD_BYTES, 'raw record bound differs') + result = json.loads(raw.decode('ascii'), object_pairs_hook=_pairs, parse_constant=_reject_constant) + need(_TYPE(result) is _DICT, 'decoded top-level record differs') + safe = plain_copy(result) + need(canonical(safe) == raw, 'noncanonical record bytes') + return safe + + +def build(value: dict) -> None: + exact(value, ('role', 'producer_role', 'producer_generation', 'producer_stage_sha256', + 'command_sha256', 'profile', 'original_output', 'original_receipt', + 'attempt', 'journal', 'stdout', 'stderr')) + choice(value['role'], ROLES) + choice(value['producer_role'], PRODUCERS) + need((value['role'] in ROLES[:3]) == (value['producer_role'] == 'group01'), 'producer role swap') + label(value['producer_generation']) + digest(value['producer_stage_sha256']) + digest(value['command_sha256']) + profile(value['profile']) + blob(value['original_output']) + need(value['original_output']['bytes'] > 0, 'empty compiled artifact') + for key, bound in (('original_receipt', 65536), ('attempt', 65536), + ('journal', JOURNAL_BYTES), ('stdout', LOG_BYTES), ('stderr', LOG_BYTES)): + blob(value[key], bound) + + +def producer(value: dict) -> None: + exact(value, ('role', 'generation', 'stage_sha256', 'command_sha256', 'root_sha256', + 'terminal', 'raw_result', 'raw_groups', 'final_source_custody', + 'parent_observation', 'completion_checker_sha256', 'builds')) + choice(value['role'], PRODUCERS) + label(value['generation']) + for key in ('stage_sha256', 'command_sha256', 'root_sha256', 'completion_checker_sha256'): + digest(value[key]) + for key in ('terminal', 'raw_result', 'raw_groups', 'final_source_custody', 'parent_observation'): + blob(value[key], RAW_RESULT_BYTES) + roles = ROLES[:3] if value['role'] == 'group01' else ROLES[3:] + sequence(value['builds'], len(roles)) + for role, row in zip(roles, value['builds']): + build(row) + need(row['role'] == role and row['producer_role'] == value['role'] and + row['producer_generation'] == value['generation'] and + row['producer_stage_sha256'] == value['stage_sha256'], 'producer build binding differs') + + +def epoch(value: dict) -> None: + exact(value, ('schema', 'epoch_id', 'mode', 'publication_state', 'intent', 'producers', 'exports', + 'not_runtime_authority')) + text(value['schema']) + text(value['publication_state']) + boolean(value['not_runtime_authority']) + need(value['schema'] == SCHEMA and value['publication_state'] == 'COMMITTED' and + value['not_runtime_authority'] is True, 'epoch publication/schema/authority differs') + label(value['epoch_id']) + blob(value['intent'], RECORD_BYTES) + choice(value['mode'], ('normal', 'optimized')) + sequence(value['producers'], 2) + builds = [] + for role, row in zip(PRODUCERS, value['producers']): + producer(row) + need(row['role'] == role, 'producer order differs') + builds.extend(row['builds']) + need(value['producers'][0]['generation'] != value['producers'][1]['generation'], 'producer generation reused') + sequence(value['exports'], MAX_EXPORTS) + seen_paths, seen_inodes = set(), set() + for role, source, row in zip(ROLES, builds, value['exports']): + exact(row, ('role', 'build_sha256', 'file')) + digest(row['build_sha256']) + choice(row['role'], ROLES) + need(row['role'] == role and row['build_sha256'] == sha(canonical(source)), 'export build binding differs') + blob(row['file']) + need((row['file']['sha256'], row['file']['bytes']) == + (source['original_output']['sha256'], source['original_output']['bytes']), 'export bytes differ') + for record in (source['original_output'], row['file']): + need(record['path'] not in seen_paths and inode(record) not in seen_inodes, 'artifact/link alias') + seen_paths.add(record['path']) + seen_inodes.add(inode(record)) + + +def claim(value: dict, manifest: dict, expected_launch: dict, + expected_group: str, expected_generation: str, expected_private_directory: str) -> None: + epoch(manifest) + launch(expected_launch) + label(expected_generation) + path(expected_private_directory) + roles = required_roles(expected_group) + exact(value, ('schema', 'epoch_id', 'mode', 'group', 'generation', 'manifest_sha256', + 'launch', 'copies', 'local_compilations', 'not_runtime_authority', 'admission')) + text(value['schema']) + label(value['epoch_id']) + choice(value['mode'], ('normal', 'optimized')) + text(value['group'], 2) + label(value['generation']) + digest(value['manifest_sha256']) + integer(value['local_compilations'], 0, 0) + boolean(value['not_runtime_authority']) + text(value['admission']) + need(value['schema'] == CLAIM_SCHEMA and value['epoch_id'] == manifest['epoch_id'] and + value['mode'] == manifest['mode'] and value['group'] == expected_group and + value['generation'] == expected_generation and value['manifest_sha256'] == sha(canonical(manifest)), + 'claim independent epoch/mode/group/generation/manifest differs') + launch(value['launch']) + need(value['launch'] == expected_launch and type(value['local_compilations']) is int and + value['local_compilations'] == 0 and value['not_runtime_authority'] is True and + value['admission'] == 'CURRENT_CHILD_CHECKS_REQUIRED', 'claim authority/launch differs') + sequence(value['copies'], len(roles)) + export_by_role = {row['role']: row for row in manifest['exports']} + builds = [row for parent in manifest['producers'] for row in parent['builds']] + occupied_paths = {row['original_output']['path'] for row in builds} + occupied_inodes = {inode(row['original_output']) for row in builds} + occupied_paths.update(row['file']['path'] for row in manifest['exports']) + occupied_inodes.update(inode(row['file']) for row in manifest['exports']) + for role, row in zip(roles, value['copies']): + exact(row, ('role', 'build_sha256', 'source', 'destination')) + choice(row['role'], ROLES) + digest(row['build_sha256']) + blob(row['source']) + blob(row['destination']) + expected = export_by_role[role] + need(row['role'] == role and row['build_sha256'] == expected['build_sha256'] and + row['source'] == expected['file'], 'copy original source provenance differs') + dest = row['destination'] + need(dest['path'] == expected_private_directory + '/' + role + '.artifact', + 'private origin differs from independent launch') + need((dest['sha256'], dest['bytes']) == (row['source']['sha256'], row['source']['bytes']), + 'private copy bytes differ') + need(dest['path'] not in occupied_paths and inode(dest) not in occupied_inodes, 'private copy alias') + occupied_paths.add(dest['path']) + occupied_inodes.add(inode(dest)) + + +def imported_inputs(raw_manifest: bytes, raw_claim: bytes, expected_manifest_sha256: str, + expected_launch: dict, expected_group: str, expected_generation: str, + expected_private_directory: str) -> tuple: + """Validate data binding only. Child must still perform all original checks. + + Expected values must be supplied by independently pinned fresh launch source, + never from either JSON argument. This helper has no runtime admission state. + The negative Root must consume its one-attempt guard BEFORE invoking it. + """ + digest(expected_manifest_sha256) + need(sha(raw_manifest) == expected_manifest_sha256, 'independent parent manifest pin differs') + manifest, receipt = decode(raw_manifest), decode(raw_claim) + claim(receipt, manifest, expected_launch, expected_group, expected_generation, expected_private_directory) + return manifest, receipt + +# Opaque error/result custody. The owner never invokes a foreign object's +# string, equality, hash, attribute, metaclass, or formatting protocol. +ERROR_SLOTS = 64 +CASE_SLOTS = 64 +MAX_ERROR_ARGS = 2 +MAX_ERROR_ARG_CHARS = 256 +MAX_SECONDARY_PROJECTIONS = 6 +_BASE_ARGS_GET = BaseException.args.__get__ +_NATIVE_ERROR_LABELS = ( + (EpochStop, 'EPOCH_STOP'), (RuntimeError, 'RUNTIME_ERROR'), + (ValueError, 'VALUE_ERROR'), (TypeError, 'TYPE_ERROR'), + (OSError, 'OS_ERROR'), (FileNotFoundError, 'FILE_NOT_FOUND'), + (PermissionError, 'PERMISSION_ERROR'), (InterruptedError, 'INTERRUPTED_ERROR'), + (BlockingIOError, 'BLOCKING_IO_ERROR'), (MemoryError, 'MEMORY_ERROR'), + (KeyboardInterrupt, 'KEYBOARD_INTERRUPT'), (SystemExit, 'SYSTEM_EXIT'), + (OverflowError, 'OVERFLOW_ERROR'), (RecursionError, 'RECURSION_ERROR'), + (UnicodeDecodeError, 'UNICODE_DECODE_ERROR')) + + +CUSTODY_SUCCESSORS = tuple(range(1, 257)) +IO_QUARANTINE_ERROR = EpochStop('epoch IO quarantined; parent teardown required') + + +class ErrorOwner: + __slots__ = ('_state',) + + +_OWNER_GET = ErrorOwner._state.__get__ +_OWNER_SET = ErrorOwner._state.__set__ +_OBJECT_NEW = object.__new__ + + +def make_error_owner() -> ErrorOwner: + owner = _OBJECT_NEW(ErrorOwner) + # 0 primary [opaque,phase]; 1 errors; 2 phases; 3 uncertain FD; + # 4 counts [secondary,close_attempts,close_confirmed,cases]; + # 5 overflow [first opaque, incomplete flag]; + # 6 cases [name,opaque,is_error,capture_state,raw_sink_return,validated]. + state = [[None, None, None], [None] * ERROR_SLOTS, [None] * ERROR_SLOTS, + [None] * ERROR_SLOTS, [0, 0, 0, 0], [None, False], + [[None, None, False, 'NOT_RETURNED', None, False, None, None] for _ in range(CASE_SLOTS)], + [False, False, False, None, False, None, False, [0] * 5, [0] * 5, False, False, False, None], + [[None, False, 'NOT_RETURNED', None] for _ in range(CASE_SLOTS)]] + _OWNER_SET(owner, state) + return owner + + +def owner_state(owner: ErrorOwner) -> list: + need(_TYPE(owner) is ErrorOwner, 'exact trusted error owner required') + state = _OWNER_GET(owner, ErrorOwner) + need(_TYPE(state) is _LIST and _LEN(state) == 9, 'trusted owner state shape differs') + for index, count in ((0, 3), (1, ERROR_SLOTS), (2, ERROR_SLOTS), (3, ERROR_SLOTS), + (4, 4), (5, 2), (6, CASE_SLOTS), (7, 13), (8, CASE_SLOTS)): + need(_TYPE(state[index]) is _LIST and _LEN(state[index]) == count, 'trusted owner slot shape differs') + integer(state[4][0], 0, ERROR_SLOTS) + integer(state[4][1], 0, 1 << 32) + integer(state[4][2], 0, state[4][1]) + integer(state[4][3], 0, CASE_SLOTS) + boolean(state[5][1]) + io = state[7] + for index in (0, 1, 2, 4, 6, 9, 10, 11): + boolean(io[index]) + for index in (7, 8): + need(_TYPE(io[index]) is _LIST and _LEN(io[index]) == 5, 'close counter digits differ') + for digit in io[index][:4]: + integer(digit, 0, 255) + integer(io[index][4], 0, 1) + need(io[index][4] == 0 or io[index][:4] == [0, 0, 0, 0], 'close counter exceeds inherited bound') + # Fallible scalar projection occurs only at API entry/snapshot, never in + # the inline cleanup path. The five native digits are authoritative. + attempts = io[7][0] + (io[7][1] << 8) + (io[7][2] << 16) + (io[7][3] << 24) + (io[7][4] << 32) + confirmed = io[8][0] + (io[8][1] << 8) + (io[8][2] << 16) + (io[8][3] << 24) + (io[8][4] << 32) + need(confirmed <= attempts, 'native close confirmation exceeds attempt') + state[4][1], state[4][2] = attempts, confirmed + return state + + +def retain_primary(owner: ErrorOwner, opaque, phase: str, uncertain_fd=None) -> None: + state = owner_state(owner) + text(phase, 96) + if uncertain_fd is not None: + integer(uncertain_fd, 0, (1 << 31) - 1) + if state[0][0] is None: + state[0][0], state[0][1], state[0][2] = opaque, phase, uncertain_fd + elif state[0][0] is not opaque: + retain_secondary(owner, opaque, phase, uncertain_fd) + + +def retain_secondary(owner: ErrorOwner, opaque, phase: str, uncertain_fd) -> None: + state = owner_state(owner) + text(phase, 96) + if uncertain_fd is not None: + integer(uncertain_fd, 0, (1 << 31) - 1) + index = state[4][0] + if index < ERROR_SLOTS: + # Preallocated native slots: no error formatting/attributes, no append. + state[1][index], state[2][index], state[3][index] = opaque, phase, uncertain_fd + state[4][0] = index + 1 + else: + state[5][1] = True + if state[5][0] is None: + state[5][0] = opaque + + +def close_attempt(owner: ErrorOwner) -> None: + state = owner_state(owner) + need(state[4][1] < 1 << 32, 'close attempt counter bound') + digits = state[7][7] + index = 0 + while index < 4 and digits[index] == 255: + digits[index] = 0 + index = CUSTODY_SUCCESSORS[index] + digits[index] = CUSTODY_SUCCESSORS[digits[index]] + + +def close_confirmed(owner: ErrorOwner) -> None: + state = owner_state(owner) + need(state[4][2] < state[4][1], 'close confirmation lacks attempt') + digits = state[7][8] + index = 0 + while index < 4 and digits[index] == 255: + digits[index] = 0 + index = CUSTODY_SUCCESSORS[index] + digits[index] = CUSTODY_SUCCESSORS[digits[index]] + + +def project_error(opaque) -> dict: + kind = _TYPE(opaque) + label_value, admitted = 'FOREIGN_OPAQUE_EXCEPTION', False + for expected_kind, literal_label in _NATIVE_ERROR_LABELS: + if kind is expected_kind: + label_value, admitted = literal_label, True + break + strings, omitted = [], False + if admitted: + # Native BaseException descriptor, only after exact whitelisted type. + # No normal error.args/__dict__/cause/context/name/str access exists. + arguments = _BASE_ARGS_GET(opaque, BaseException) + if _TYPE(arguments) is _TUPLE: + omitted = _LEN(arguments) > MAX_ERROR_ARGS + for argument in arguments[:MAX_ERROR_ARGS]: + if _TYPE(argument) is _STR: + if _LEN(argument) <= MAX_ERROR_ARG_CHARS: + strings.append(argument) + else: + strings.append(argument[:MAX_ERROR_ARG_CHARS]) + omitted = True + else: + omitted = True + else: + omitted = True + return {'literal_type_label': label_value, 'exact_string_args': strings, + 'foreign_or_excess_args_omitted': omitted or not admitted, + 'original_object_retained_opaquely': True} + + +def error_snapshot(owner: ErrorOwner) -> dict: + state = owner_state(owner) + secondary = [] + for index in range(min(state[4][0], MAX_SECONDARY_PROJECTIONS)): + text(state[2][index], 96) + if state[3][index] is not None: + integer(state[3][index], 0, (1 << 31) - 1) + secondary.append({'slot': index, 'phase': state[2][index], + 'uncertain_close_fd': state[3][index], + 'error': project_error(state[1][index])}) + primary = None + if state[0][0] is not None: + text(state[0][1], 96) + if state[0][2] is not None: + integer(state[0][2], 0, (1 << 31) - 1) + primary = {'phase': state[0][1], 'uncertain_close_fd': state[0][2], + 'error': project_error(state[0][0])} + # Projection happens only after operation cleanup. At most six recorder + # errors are projected; a scan of all 64 slots counts omitted projections. + recording_failures = [] + recording_failure_count = 0 + for index, row in enumerate(state[8]): + if row[3] is not None: + recording_failure_count += 1 + if len(recording_failures) < MAX_SECONDARY_PROJECTIONS: + recording_failures.append({'slot': index, 'state': row[2], + 'target_is_error': row[1], 'recording_error': project_error(row[3]), + 'target_retained_opaquely': row[2] != 'NOT_RETURNED'}) + return {'primary': primary, 'secondary': secondary, + 'secondary_capture_incomplete': state[5][1], + 'secondary_projection_omitted': max(0, state[4][0] - MAX_SECONDARY_PROJECTIONS), + 'close_attempts': state[4][1], 'close_confirmed': state[4][2], + 'close_counter_incomplete': state[7][6], + 'io_quarantined': state[7][0], 'native_acquisition_pending': state[7][1], + 'possible_unreturned_native_fd': state[7][2], + 'parent_kernel_teardown_required': state[7][4], + 'uncertain_scandir_owner_retained': state[7][5] is not None, + 'scandir_close_returned_result_unobserved': state[7][9], + # An earlier normal close observation never overrides a later + # delivered failure or retained stream uncertainty. + 'scandir_release_uses_external_premise': (state[7][9] and not state[7][0] + and state[7][5] is None), + 'external_guard_acquisition_pending': state[7][10], + 'external_guard_fd_count_unavailable': state[7][11], + 'native_acquisition_error': None if state[7][3] is None else project_error(state[7][3]), + 'external_guard_error': None if state[7][12] is None else project_error(state[7][12]), + 'recording_failures': recording_failures, + 'recording_projection_omitted': max(0, recording_failure_count - MAX_SECONDARY_PROJECTIONS)} + + + +def record_case(owner: ErrorOwner, name: str, opaque, is_error: bool) -> int: + state = owner_state(owner) + text(name, 16) + boolean(is_error) + count = state[4][3] + need(count < CASE_SLOTS, 'case capacity exceeded') + for index in range(count): + row = state[6][index] + need(_TYPE(row) is _LIST and _LEN(row) == 8, 'case slot shape differs') + text(row[0], 16) + need(row[0] != name, 'case identity replay') + row = state[6][count] + need(_TYPE(row) is _LIST and _LEN(row) == 8, 'case slot shape differs') + text(row[3], 32) + need(row[3] == 'NOT_RETURNED', 'case slot already used') + row[0], row[1], row[2] = name, opaque, is_error + row[3] = 'RETURNED_NOT_CAPTURED' + state[4][3] = count + 1 + return count + + +def case_slot(owner: ErrorOwner, index: int) -> list: + state = owner_state(owner) + integer(index, 0, CASE_SLOTS - 1) + need(index < state[4][3], 'case not recorded') + row = state[6][index] + need(_TYPE(row) is _LIST and _LEN(row) == 8, 'case slot shape differs') + text(row[0], 16) + boolean(row[2]) + choice(row[3], ('NOT_RETURNED', 'RETURNED_NOT_CAPTURED', 'RAW_CAPTURED', 'VALIDATED')) + boolean(row[5]) + return row + +# Original-function record checks use native descriptors only after exact +# FunctionType/CellType gates. Provenance must come from the authenticated Root +# factory call, never a record recaptured after adverse input. +from types import FunctionType as _FUNCTION_TYPE, CellType as _CELL_TYPE +_FUNCTION_GETTERS = tuple(_FUNCTION_TYPE.__dict__[name].__get__ for name in + ('__code__', '__globals__', '__defaults__', '__kwdefaults__', '__closure__', '__annotations__', '__dict__')) +_CELL_GET = _CELL_TYPE.cell_contents.__get__ + + +def capture_original_function(function) -> tuple: + need(_TYPE(function) is _FUNCTION_TYPE, 'exact original function required') + values = tuple(getter(function, _FUNCTION_TYPE) for getter in _FUNCTION_GETTERS) + need(values[2] is None and values[3] is None, 'original callback defaults differ') + closure = values[4] + cells = [] + if closure is not None: + need(_TYPE(closure) is _TUPLE and _LEN(closure) <= 64, 'original closure bound differs') + for cell in closure: + need(_TYPE(cell) is _CELL_TYPE, 'original closure cell differs') + cells.append((cell, _CELL_GET(cell, _CELL_TYPE))) + return function, values, tuple(cells) + + +def check_original_function(function, record) -> None: + need(_TYPE(function) is _FUNCTION_TYPE, 'foreign callable rejected') + need(_TYPE(record) is _TUPLE and _LEN(record) == 3, 'original callback record differs') + need(function is record[0], 'original callback identity differs') + values, cells = record[1], record[2] + need(_TYPE(values) is _TUPLE and _LEN(values) == 7, 'original callback value record differs') + need(_TYPE(cells) is _TUPLE and _LEN(cells) <= 64, 'original callback cell record differs') + for getter, expected in zip(_FUNCTION_GETTERS, values): + need(getter(function, _FUNCTION_TYPE) is expected, 'original callback environment differs') + need(values[2] is None and values[3] is None, 'original callback defaults differ') + closure = values[4] + if closure is None: + need(_LEN(cells) == 0, 'unexpected original closure records') + return + need(_TYPE(closure) is _TUPLE and _LEN(closure) == _LEN(cells), 'original closure record count differs') + for actual_cell, pair in zip(closure, cells): + need(_TYPE(pair) is _TUPLE and _LEN(pair) == 2, 'original cell pair differs') + need(_TYPE(actual_cell) is _CELL_TYPE and actual_cell is pair[0], 'original cell identity differs') + need(_CELL_GET(actual_cell, _CELL_TYPE) is pair[1], 'original closure content identity differs') + + +def prepare_case_shadow(owner: ErrorOwner) -> tuple: + state = owner_state(owner) + count = state[4][3] + need(count < CASE_SLOTS, 'case shadow capacity exceeded') + row = state[8][count] + need(_TYPE(row) is _LIST and _LEN(row) == 4 and row[0] is None and row[3] is None and row[2] == 'NOT_RETURNED', + 'case shadow was already consumed') + return state, count, row diff --git a/research/h25-v03-authenticated-prefix-entry/prerequisites/epoch_stop_v5.py.txt b/research/h25-v03-authenticated-prefix-entry/prerequisites/epoch_stop_v5.py.txt new file mode 100644 index 0000000000..21e8401a68 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/prerequisites/epoch_stop_v5.py.txt @@ -0,0 +1,184 @@ +"""Opaque error evidence and original-source-admitted per-case raw capture. + +Source only. Registry/factory provenance must be established by the authenticated +Root before adverse work. There is no arbitrary supplied callback or retry path. +""" +import epoch_schema_v5 as schema +import epoch_copy_v5 as copying + +STOP_CONFIGURATION = None +STOP_EXECUTION_APPROVAL = None +STOP_FUNDING = None +STOP_BYTES = 65536 +_TYPE, _LEN = type, len +_SINK_REGISTRY = [] + + +def _gate() -> None: + schema.exact(STOP_CONFIGURATION, ('leaf_policy_sha256', 'configuration_sha256')) + schema.exact(STOP_EXECUTION_APPROVAL, ('external_launch_policy_sha256',)) + schema.exact(STOP_FUNDING, ('reservation_sha256',)) + for config in (STOP_CONFIGURATION, STOP_EXECUTION_APPROVAL, STOP_FUNDING): + for value in config.values(): + schema.digest(value) + + +def retain_stop(directory: str, operation: str, error_owner) -> dict: + _custody_state = schema.owner_state(error_owner) + _io = _custody_state[7] + if _io[0] or _io[1] or _io[10]: + raise schema.IO_QUARANTINE_ERROR + schema.path(directory) + schema.text(operation, 96) + _gate() + record = {'schema': 'h25-negative-epoch-stop-v3', 'status': 'STOP', 'operation': operation, + 'opaque_error_projection': schema.error_snapshot(error_owner), + 'retry_permitted': False, 'partial_products_retained': True, 'complete_cost': None} + raw = schema.canonical(record) + schema.need(_LEN(raw) <= STOP_BYTES, 'STOP byte bound exceeded') + # If this fails, caller's already active except block records the secondary + # opaquely and bare-reraises its exact original primary. No callback fallback. + return copying.write_once(directory + '/STOP.json', raw, error_owner=error_owner) + + +def make_raw_sink(directory: str, error_owner, original_source_guard, original_guard_record, + source_sha256: str) -> tuple: + """Invoke only through the original Root's source-authenticated factory. + + The supplied guard and record must be the original Root factory return, + adopted before adverse input; this function does not confer that provenance. + Current source/primitive authentication remains delegated to that original + guard. Capture functions themselves are source-fixed here and registered by + opaque identity, so a consumer cannot supply its own writer callback. + """ + _custody_state = schema.owner_state(error_owner) + _io = _custody_state[7] + if _io[0] or _io[1] or _io[10]: + raise schema.IO_QUARANTINE_ERROR + schema.path(directory) + schema.digest(source_sha256) + schema.check_original_function(original_source_guard, original_guard_record) + _gate() + schema.need(_LEN(_SINK_REGISTRY) < 2, 'finite original sink factory count exceeded') + if _io[0] or _io[1] or _io[10]: + raise schema.IO_QUARANTINE_ERROR + _io[10] = True + try: + original_source_guard() + except BaseException as guard_error: + if _io[12] is None: + _io[12] = guard_error + _io[0] = True + _io[11] = True + _io[4] = True + raise + _io[10] = False + schema.check_original_function(original_source_guard, original_guard_record) + copying.require_entries(directory, (), error_owner=error_owner) + consumed = [False] * schema.CASE_SLOTS + + def capture(index, raw): + schema.integer(index, 0, schema.CASE_SLOTS - 1) + schema.need(_TYPE(raw) is bytes and 0 < _LEN(raw) <= schema.RECORD_BYTES, 'raw case bytes differ') + schema.need(_TYPE(consumed) is list and _LEN(consumed) == schema.CASE_SLOTS, 'raw capture state differs') + schema.boolean(consumed[index]) + schema.need(consumed[index] is False, 'raw case capture already consumed') + consumed[index] = True + # Native integer formatting only after exact type and finite bound. + name = 'case-%02d.raw.json' % index + return copying.write_once(directory + '/' + name, raw, error_owner=error_owner) + + capture_record = schema.capture_original_function(capture) + ticket = object() + packet = ('h25-original-epoch-raw-sink-v3', ticket, capture, capture_record, + original_source_guard, original_guard_record, error_owner, directory, source_sha256) + _SINK_REGISTRY.append(packet) + return packet + + +def check_raw_sink(packet, error_owner, expected_source_sha256: str) -> tuple: + schema.owner_state(error_owner) + schema.digest(expected_source_sha256) + schema.need(_TYPE(packet) is tuple and _LEN(packet) == 9, 'original raw sink packet differs') + schema.text(packet[0], 128) + schema.need(packet[0] == 'h25-original-epoch-raw-sink-v3' and _TYPE(packet[1]) is object, + 'original raw sink tag/ticket differs') + schema.need(packet[6] is error_owner, 'raw sink owner differs') + schema.path(packet[7]) + schema.digest(packet[8]) + schema.need(packet[8] == expected_source_sha256, 'independent raw sink source pin differs') + # Identity only, never equality on a foreign packet or function. + found = False + for original in _SINK_REGISTRY: + if packet is original: + found = True + break + schema.need(found is True, 'raw sink was not original authenticated factory return') + schema.check_original_function(packet[2], packet[3]) + schema.check_original_function(packet[4], packet[5]) + return packet + + +def capture_case(packet, error_owner, expected_source_sha256: str, index: int) -> dict: + """Persist one rooted raw outcome before any behavior comparison/next case. + + Failures leave RETURNED_NOT_CAPTURED and the opaque raw return/error rooted. + The caller preserves original failure with a bare re-raise; no sink/source + guard retry, exception formatter, or callback-bearing cleanup is attempted. + """ + _custody_state = schema.owner_state(error_owner) + _io = _custody_state[7] + if _io[0] or _io[1] or _io[10]: + raise schema.IO_QUARANTINE_ERROR + row = schema.case_slot(error_owner, index) + schema.need(row[3] == 'RETURNED_NOT_CAPTURED', 'case capture state differs') + original = check_raw_sink(packet, error_owner, expected_source_sha256) + guard, guard_record, capture, capture_record = original[4], original[5], original[2], original[3] + schema.check_original_function(guard, guard_record) + if _io[0] or _io[1] or _io[10]: + raise schema.IO_QUARANTINE_ERROR + _io[10] = True + try: + guard() + except BaseException as guard_error: + if _io[12] is None: + _io[12] = guard_error + _io[0] = True + _io[11] = True + _io[4] = True + raise + _io[10] = False + schema.check_original_function(guard, guard_record) + schema.check_original_function(capture, capture_record) + if row[2] is True: + raw_value = {'returned_error': schema.project_error(row[1])} + else: + raw_value = {'returned_value': schema.plain_copy(row[1])} + raw = schema.canonical({'schema': 'h25-epoch-raw-case-v3', 'case': row[0], 'slot': index, + 'capture_state_before_write': 'RETURNED_NOT_CAPTURED', + 'opaque_original_retained_in_owner': True, 'raw': raw_value}) + receipt = capture(index, raw) + row[4] = receipt # Root exact original return before any validation/callback. + schema.check_original_function(capture, capture_record) + schema.check_original_function(guard, guard_record) + if _io[0] or _io[1] or _io[10]: + raise schema.IO_QUARANTINE_ERROR + _io[10] = True + try: + guard() + except BaseException as guard_error: + if _io[12] is None: + _io[12] = guard_error + _io[0] = True + _io[11] = True + _io[4] = True + raise + _io[10] = False + schema.check_original_function(guard, guard_record) + schema.check_original_function(capture, capture_record) + schema.blob(receipt, schema.RECORD_BYTES) + expected_path = original[7] + '/case-%02d.raw.json' % index + schema.need(receipt['path'] == expected_path and receipt['sha256'] == schema.sha(raw) and + receipt['bytes'] == _LEN(raw), 'original raw sink receipt differs') + row[3] = 'RAW_CAPTURED' + return receipt diff --git a/research/h25-v03-authenticated-prefix-entry/prerequisites/group01_evidence_v1.py.txt b/research/h25-v03-authenticated-prefix-entry/prerequisites/group01_evidence_v1.py.txt new file mode 100644 index 0000000000..bde3f97232 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/prerequisites/group01_evidence_v1.py.txt @@ -0,0 +1,256 @@ +"""Parent data replay of the exact unchanged Group01 finite producer route. + +All arguments come from the owning parent registry and independently frozen +prelaunch plan. A parsed status never establishes process ownership, native +correctness or historical source continuity. Those are separate original +source/runtime and owned-domain obligations. No function was executed here. +""" +import json +import math +import epoch_schema_v5 as schema +import epoch_copy_v5 as copying +import original_build_provenance_v5 as original_build +import parent_closure_v1 as closure +import group01_original_predicates_v1 as original_predicates + +_TYPE, _LEN = type, len +GROUP_ORDER = ('native', 'transport', 'collector', 'pure_initial', 'pure_extended', + 'pure_combined', 'root_model', 'sink_close_model', 'projection_model', 'aggregate') +GROUP_KEYS = ('native', 'transport', 'collector', 'elf', 'providers', 'elf_extended') +MAX_JSON_NODES = 200000 +MAX_JSON_BYTES = 4 * 1024 * 1024 +FINITE_KEYS = ('status', 'lanes', 'data_handling', 'data_source_custody', 'optimized', + 'original_controls', 'new_controls', 'new_source_custody', 'driver_sha256', + 'initial_native_tcb', 'initial_native_tcb_restoration', 'native_packet', + 'reference_driver_sha256', 'phases') + + +def _pairs(pairs): + schema.need(_TYPE(pairs) is list and _LEN(pairs) <= 8192, 'receipt JSON object bound') + result = {} + for key, value in pairs: + schema.need(_TYPE(key) is str and _LEN(key) <= 65536 and key not in result, + 'receipt duplicate/foreign/oversize key') + result[key] = value + return result + + +def _reject(value): + raise schema.EpochStop('nonfinite receipt JSON constant') + + +def _plain(value, budget, depth=0): + schema.need(depth <= 40 and budget[0] > 0, 'receipt JSON node/depth bound') + budget[0] -= 1 + kind = _TYPE(value) + if value is None or kind is bool: + return + if kind is int: + schema.need(value.bit_length() <= 4096, 'receipt integer bound') + return + if kind is float: + schema.need(math.isfinite(value), 'nonfinite receipt number') + return + if kind is str: + schema.need(_LEN(value) <= 65536, 'receipt string bound') + budget[1] += _LEN(value) + schema.need(budget[1] <= MAX_JSON_BYTES, 'receipt text budget') + return + schema.need(kind in (list, dict) and _LEN(value) <= 8192, 'receipt exact collection bound') + if kind is dict: + for key, item in value.items(): + schema.need(_TYPE(key) is str, 'receipt exact key required') + _plain(key, budget, depth + 1) + _plain(item, budget, depth + 1) + else: + for item in value: + _plain(item, budget, depth + 1) + + +def decode(raw): + schema.need(_TYPE(raw) is bytes and 0 < _LEN(raw) <= MAX_JSON_BYTES, 'receipt raw byte bound') + value = json.loads(raw.decode('ascii'), object_pairs_hook=_pairs, parse_constant=_reject) + schema.need(_TYPE(value) is dict, 'receipt top-level exact object required') + _plain(value, [MAX_JSON_NODES, 0]) + return value + + +def encode(value): + _plain(value, [MAX_JSON_NODES, 0]) + raw = json.dumps(value, sort_keys=True, separators=(',', ':'), ensure_ascii=True, + allow_nan=False).encode('ascii') + b'\n' + schema.need(_LEN(raw) <= MAX_JSON_BYTES, 'receipt canonical byte bound') + return raw + + +def same_json(left, right): + # Both operands are exact bounded JSON-native data. Canonical bytes retain + # bool/int/float distinctions that Python nested equality otherwise loses. + return encode(left) == encode(right) + + +def _read(path, bound, error_owner): + pin = copying.inspect(path, bound, error_owner=error_owner) + raw = copying.read_verified(pin, bound, error_owner=error_owner) + return pin, raw + + +def _captured_call(receiver_capability, module, name, *args): + # Exact module/function names below are source literals, not caller-selected + # callbacks. Current source/identity checks surround every receiving call. + closure.check_receivers(receiver_capability) + function = closure.receiver(receiver_capability, module, name) + result = function(*args) + closure.check_receivers(receiver_capability) + return result + + +def _legacy_controls(result, expected): + schema.exact(expected, ('original_counts', 'original_fixture_sha256', + 'original_v2_counts', 'original_v2_stream', 'new_controls')) + schema.digest(expected['original_fixture_sha256']) + native = result['original_controls'] + schema.need(_TYPE(native) is dict and native.get('status') == 'FINITE_NATIVE_GF2_CONTROLS_PASS' and + same_json(native.get('counts'), expected['original_counts']) and + native.get('fixture_sha256') == expected['original_fixture_sha256'] and + _TYPE(native.get('micro_repetitions')) is int and native['micro_repetitions'] == 128 and + native.get('independent_oracle') == + 'Dense binary lists, descending pivots, addition modulo 2; no packed/source/native helpers', + 'original native independent outcome projection differs') + schema.need(_TYPE(native.get('micro_fixtures')) is int and native['micro_fixtures'] > 0 and + _TYPE(native.get('native_and_fallback_calls')) is dict and + all(_TYPE(value) is int and value > 0 for value in native['native_and_fallback_calls'].values()), + 'original native and fallback paths not represented') + v2 = native.get('v2_controls') + schema.need(_TYPE(v2) is dict and v2.get('status') == 'V2_RUNTIME_AND_COMPLEMENT_STREAM_PASS' and + same_json(v2.get('counts'), expected['original_v2_counts']) and + same_json(v2.get('complement_fixture_stream'), expected['original_v2_stream']) and + _TYPE(v2.get('modified_helper_invocations')) is int and v2['modified_helper_invocations'] == 0, + 'original runtime/ordered-complement independent projection differs') + # The expected complete new-control tree is an independently approved input + # before launch. It is never learned from this result or an earlier PASS. + schema.need(same_json(result['new_controls'], expected['new_controls']), + 'complete original bookkeeping control return differs') + + +def authenticate_group01(output, expected, process_id, parent_file_limits, + receiver_capability, error_owner, stdout_raw): + """Return actual evidence data; only the owning launcher can mint authority.""" + schema.path(output) + schema.integer(process_id, 1, (1 << 31) - 1) + schema.exact(expected, ('mode', 'generation', 'stage_sha256', 'root_sha256', + 'driver_sha256', 'reference_driver_sha256', 'builds', 'legacy_outcomes', + 'source_receipts', 'tcb_files', 'hashlib_origin')) + schema.choice(expected['mode'], ('normal', 'optimized')) + schema.label(expected['generation']) + for key in ('stage_sha256', 'root_sha256', 'driver_sha256', 'reference_driver_sha256'): + schema.digest(expected[key]) + schema.path(expected['hashlib_origin']) + optimize = 0 if expected['mode'] == 'normal' else 1 + result_pin, result_raw = _read(output + '/receipt.json', MAX_JSON_BYTES, error_owner) + result = decode(result_raw) + schema.exact(result, FINITE_KEYS) + schema.need(result['status'] == 'H25_DATA_HANDLING_FINITE_PASS' and + result['lanes'] == 'all' and _TYPE(result['optimized']) is int and + result['optimized'] == optimize and + result['driver_sha256'] == expected['driver_sha256'] and + result['reference_driver_sha256'] == expected['reference_driver_sha256'], + 'original finite producer route/mode/source differs') + schema.need(same_json(decode(stdout_raw), result), 'original stdout and terminal finite receipt differ') + _legacy_controls(result, expected['legacy_outcomes']) + finite_pin, finite_raw = _read(output + '/finite-controls.json', MAX_JSON_BYTES, error_owner) + schema.need(same_json(decode(finite_raw), result['original_controls']), 'original finite raw result differs') + data, packet = result['data_handling'], result['native_packet'] + schema.need(_TYPE(data) is dict and data.get('schema') == 'h25-data-handling-v2' and + data.get('full_caller_run') is False and data.get('full_candidate_admission') is False and + data.get('cache_teardown_stops') == [] and same_json(data.get('native_packet'), packet), + 'original finite data or cleanup boundary differs') + original_predicates.check_original_control_union( + {'controls': data['controls'], 'native_packet': packet}, optimize, include_late=True) + schema.need(packet['late_started'] is True and packet['late_completed'] is True and + packet['field_service_closed'] is True and packet['direct_close_stop'] is None and + packet['field_group_stop'] is None and packet['field_restoration_receipt_checked'] is True and + packet['field_runtime_qualification'] is False, + 'original late/group/field cleanup or qualification boundary differs') + schema.exact(expected['source_receipts'], ('data_source_custody', 'new_source_custody', + 'compiler_dependencies')) + for key in ('data_source_custody', 'new_source_custody'): + schema.need(same_json(result[key], expected['source_receipts'][key]), 'source-derived receipt custody differs') + schema.need(same_json(packet['compiler_dependencies'], expected['source_receipts']['compiler_dependencies']), + 'original compiler/link/header receipt closure differs') + # Original placement is authenticated by exact launched source. This call + # replays its fixed data contract; it does not rerun initial native checks. + tcb_files = tuple(tuple(row) for row in expected['tcb_files']) + _captured_call(receiver_capability, 'restoration_contract_v1', 'validate_restoration', + result['initial_native_tcb'], data['controls']['native_initial_tcb'], + result['initial_native_tcb_restoration'], tcb_files, expected['hashlib_origin'], + expected['root_sha256'], len(tcb_files)) + schema.integer(result['initial_native_tcb']['pid'], 1, (1 << 31) - 1) + schema.integer(result['initial_native_tcb_restoration']['pid'], 1, (1 << 31) - 1) + schema.need(result['initial_native_tcb']['pid'] == process_id and + result['initial_native_tcb_restoration']['pid'] == process_id, + 'initial/restoration receipt belongs to another process') + initial_pin, initial_raw = _read(output + '/initial-native-tcb.json', MAX_JSON_BYTES, error_owner) + restored_pin, restored_raw = _read(output + '/initial-native-tcb-restoration.json', MAX_JSON_BYTES, error_owner) + schema.need(same_json(decode(initial_raw), result['initial_native_tcb']) and + same_json(decode(restored_raw), result['initial_native_tcb_restoration']), + 'initial/restoration retained raw differs') + controls_pin, controls_raw = _read(output + '/initial-tcb-controls/receipt.json', MAX_JSON_BYTES, error_owner) + schema.need(same_json(decode(controls_raw), data['controls']['native_initial_tcb']), 'original initial five-control raw differs') + delivery = packet['field_group_delivery'] + aggregate = delivery['aggregate'] + schema.need(same_json(data['controls']['native_fields'], aggregate), 'field aggregate projections differ') + # JSON object order is not the original insertion-order observation. Restore + # only this explicit source-fixed mapping order for the existing validator; + # no value/case/sequence/order or unknown-key repair is permitted. + schema.exact(aggregate['groups'], GROUP_KEYS) + aggregate['groups'] = {key: aggregate['groups'][key] for key in GROUP_KEYS} + _captured_call(receiver_capability, 'run_controls_v5', 'validate_all', delivery, expected['mode']) + values = (aggregate['groups']['native'], aggregate['groups']['transport'], + aggregate['groups']['collector'], aggregate['pure_v2']['initial'], + aggregate['pure_v2']['extended'], aggregate['pure_v2'], aggregate['root_model'], + aggregate['sink_close_model'], aggregate['projection_model'], aggregate) + group_rows = [] + for index, (group, value) in enumerate(zip(GROUP_ORDER, values)): + raw_ref = delivery['group_evidence']['raw_pins'][index][1] + validation_ref = delivery['group_evidence']['validation_pins'][index][1] + raw_pin, raw = _read(output + '/' + raw_ref['file'], 1048576, error_owner) + validation_pin, validation_raw = _read(output + '/' + validation_ref['file'], 8192, error_owner) + schema.need(raw_pin['sha256'] == raw_ref['sha256'] and raw_pin['bytes'] == raw_ref['bytes'] and + validation_pin['sha256'] == validation_ref['sha256'] and validation_pin['bytes'] == validation_ref['bytes'], + 'durable group pin differs from actual retained bytes') + schema.need(raw == encode(value), 'complete raw group differs from original aggregate projection') + note = {'schema': 'h25-full-group-evidence-sink-v5', 'mode': expected['mode'], 'group': group, + 'state': 'RETURNED_RAW_OUTER_VALIDATED', 'raw': raw_ref} + schema.need(validation_raw == encode(note), 'complete validation note differs') + group_rows.append({'group': group, 'raw': raw_pin, 'validation': validation_pin}) + builds = [] + schema.sequence(expected['builds'], 3) + for role, build_plan in zip(schema.ROLES[:3], expected['builds']): + schema.exact(build_plan, ('role', 'profile', 'command_sha256', 'original_output_path', 'expected_original')) + schema.need(build_plan['role'] == role, 'original build role order differs') + base = output + '/cold-native-metadata/' + role + original_record_pin, raw_receipt = _read(base + '-build.json', 65536, error_owner) + original_record = decode(raw_receipt) + schema.need(same_json(original_record, packet['builds'][role]), 'original build raw/terminal projection differs') + row = {'role': role, 'producer_role': 'group01', 'producer_generation': expected['generation'], + 'producer_stage_sha256': expected['stage_sha256'], 'command_sha256': build_plan['command_sha256'], + 'profile': build_plan['profile'], + 'original_output': copying.inspect(build_plan['original_output_path'], error_owner=error_owner), + 'original_receipt': original_record_pin, + 'attempt': copying.inspect(base + '.attempt.json', 65536, error_owner=error_owner), + 'journal': copying.inspect(base + '.attempt.jsonl', schema.JOURNAL_BYTES, error_owner=error_owner), + 'stdout': copying.inspect(base + '.stdout.raw', schema.LOG_BYTES, error_owner=error_owner), + 'stderr': copying.inspect(base + '.stderr.raw', schema.LOG_BYTES, error_owner=error_owner)} + independent = schema.plain_copy(build_plan['expected_original']) + independent['producer_process_id'] = process_id + independent['parent_file_limits'] = list(parent_file_limits) + closure.check_receivers(receiver_capability) + original_build.authenticate_original_build(row, independent, error_owner=error_owner) + closure.check_receivers(receiver_capability) + builds.append(row) + return {'raw_result': result_pin, 'group_rows': group_rows, 'builds': builds, + 'additional_raw': [finite_pin, initial_pin, restored_pin, controls_pin], + 'own_group01_source_and_result_contract_checked': True, + 'later_cross_root_aggregate_required_before_export': False, + 'native_runtime_or_full_union_qualified': False} diff --git a/research/h25-v03-authenticated-prefix-entry/prerequisites/group01_original_predicates_v1.py.txt b/research/h25-v03-authenticated-prefix-entry/prerequisites/group01_original_predicates_v1.py.txt new file mode 100644 index 0000000000..dea4c1f744 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/prerequisites/group01_original_predicates_v1.py.txt @@ -0,0 +1,366 @@ +"""Source-derived original receipt predicates; no controls are executed here. + +The exact original _check_controls body is retained, with only an explicit +child optimization integer and literal native status expansion. This +replays the existing result predicates, not the underlying native tests. +""" +from epoch_schema_v5 import need + +EXPECTED_CACHE_TRANSCRIPT_RECORDS = 155 + +EXPECTED_V7_CONSUMER_CASES = ('source-before-native', 'source-before-trace', 'builtin-before-native', 'builtin-shadow-and-key-cleanup', 'row-calling-environment-full-and-light', 'row-key-first-error-and-cleanup', 'actual-row-native-observation', 'cold-_code_named-code', 'cold-_code_named-defaults', 'cold-_code_named-globals', 'cold-_check_factory_environment-code', 'cold-_check_factory_environment-defaults', 'cold-_check_factory_environment-globals', 'final-class-__init__-code', 'final-class-__init__-defaults', 'final-class-__init__-closure', 'final-class-check-code', 'final-class-check-defaults', 'final-class-check-closure', 'final-class-check_backend-code', 'final-class-check_backend-defaults', 'final-class-check_backend-closure', 'unregistered-final-subclass', 'restored-final-class-binds') + +EXPECTED_V8_CALLER_CASES = ('cold-dispatcher-code', 'cold-dispatcher-defaults', 'cold-dispatcher-kwdefaults', 'cold-dispatcher-closure', 'runtime-dispatcher-code', 'runtime-dispatcher-defaults', 'runtime-dispatcher-kwdefaults', 'runtime-dispatcher-closure', 'runtime-collector-code', 'runtime-collector-defaults', 'runtime-collector-kwdefaults', 'runtime-collector-closure') + +EXPECTED_AUTHORITY_CONTROL_CASES = ('A1-authority-entry-and-helper-fields', 'A2-caller-dispatcher-fields', 'A3-every-owned-module-helper', 'A4-registered-product-methods-and-closure-helpers', 'A5-foreign-key-failure-disposal', 'A6-runtime-child-dispatcher-and-helper-fields') + +_CONTROL_CONTRACT = {'cache_counts': {'binding_rejections': 12, + 'cases': 29, + 'requests': 71, + 'source_admission_rejections': 2, + 'tamper_rejections': 1, + 'unsupported_rejections': 2}, + 'construction_normal_names': ['complete-constructor-h8', + 'complete-constructor-h9', + 'exact-add-0', + 'exact-add-1', + 'exact-add-2', + 'exact-add-3', + 'exact-add-4', + 'exact-add-5', + 'exact-add-6', + 'exact-add-7', + 'exact-add-8', + 'exact-add-9', + 'exact-add-10', + 'overlap-assertion-matching-mode', + 'negative-index', + 'index-outside', + 'none-index', + 'float-index', + 'bool-index', + 'unhashable-kind', + 'mask-callback', + 'index-callback', + 'kind-callback', + 'support-callback', + 'lookup-callback', + 'unarmed-construction-remains-incremental', + 'retired-complete-index-and-private-snapshot', + 'resumed-run-loses-frozen-tail-qualification', + 'resumed-duplicate-restores-same-dictionary', + 'reinitialized-run-loses-qualification-h8', + 'retired-object-literal-reinitialization-h8', + 'reinitialized-run-loses-qualification-h9', + 'retired-object-literal-reinitialization-h9', + 'reinitialized-run-loses-qualification-h7', + 'retired-object-literal-reinitialization-h7', + 'resumption-restores-original-index-after-graph-edits', + 'lookup-entry-mutation', + 'lookup-replacement', + 'snapshot-binding', + 'double-finalize', + 'wrong-finalizer', + 'factory-rejects-changed-original-add', + 'factory-rejects-source-builtin-shadow', + 'seal-rejects-late-add-replacement', + 'scope-cannot-be-rearmed', + 'hook-bearing-constructor-trace', + 'hook-bearing-constructor-profile', + 'hook-bearing-constructor-gc', + 'hook-bearing-constructor-thread', + 'hook-bearing-constructor-signal', + 'hook-bearing-constructor-monitoring', + 'invalid-dimension-original-assertion', + 'malformed-complete-index-before-clear', + 'generic-subclass-add-fallback', + 'factory-rejects-original-defaults', + 'factory-rejects-original-code', + 'factory-rejects-original-helper', + 'factory-rejects-original-descriptor', + 'owner-rejects-changed-wrapper-defaults', + 'public-total-helper-restores-before-add', + 'p1-original-authentication-and-final-wrapper-composition'], + 'construction_optimized_names': ['complete-constructor-h8', + 'complete-constructor-h9', + 'exact-add-0', + 'exact-add-1', + 'exact-add-2', + 'exact-add-3', + 'exact-add-4', + 'exact-add-5', + 'exact-add-6', + 'exact-add-7', + 'exact-add-8', + 'exact-add-9', + 'exact-add-10', + 'overlap-assertion-matching-mode', + 'negative-index', + 'index-outside', + 'none-index', + 'float-index', + 'bool-index', + 'unhashable-kind', + 'mask-callback', + 'index-callback', + 'kind-callback', + 'support-callback', + 'lookup-callback', + 'unarmed-construction-remains-incremental', + 'retired-complete-index-and-private-snapshot', + 'resumed-run-loses-frozen-tail-qualification', + 'resumed-duplicate-restores-same-dictionary', + 'reinitialized-run-loses-qualification-h8', + 'retired-object-literal-reinitialization-h8', + 'reinitialized-run-loses-qualification-h9', + 'retired-object-literal-reinitialization-h9', + 'reinitialized-run-loses-qualification-h7', + 'retired-object-literal-reinitialization-h7', + 'resumption-restores-original-index-after-graph-edits', + 'lookup-entry-mutation', + 'lookup-replacement', + 'snapshot-binding', + 'double-finalize', + 'wrong-finalizer', + 'factory-rejects-changed-original-add', + 'factory-rejects-source-builtin-shadow', + 'seal-rejects-late-add-replacement', + 'scope-cannot-be-rearmed', + 'hook-bearing-constructor-trace', + 'hook-bearing-constructor-profile', + 'hook-bearing-constructor-gc', + 'hook-bearing-constructor-thread', + 'hook-bearing-constructor-signal', + 'hook-bearing-constructor-monitoring', + 'malformed-complete-index-before-clear', + 'generic-subclass-add-fallback', + 'factory-rejects-original-defaults', + 'factory-rejects-original-code', + 'factory-rejects-original-helper', + 'factory-rejects-original-descriptor', + 'owner-rejects-changed-wrapper-defaults', + 'public-total-helper-restores-before-add', + 'p1-original-authentication-and-final-wrapper-composition'], + 'inventory_cases': [['valid', 'value'], + ['list-pins', 'value'], + ['wrong-digest', 'error'], + ['missing', 'error'], + ['extra', 'error'], + ['extra-nonexact', 'value'], + ['symlink', 'error'], + ['root-symlink', 'error'], + ['changed-mode', 'value'], + ['fresh-call-after-mutation', 'error'], + ['restored', 'value']], + 'rank_guard_mutation_names': ['__code__', + '__defaults__', + '__kwdefaults__', + '_LEN', + '_GET', + '_MAX_ENTRIES', + 'make_row_interner', + 'make_runtime_guard', + 'builtin/len', + 'builtin/int', + 'cell/exact_int', + 'cell/exact_tuple', + 'cell/exact_type', + 'cell/get', + 'cell/length', + 'cell/max_entries', + 'cell/max_rows', + 'cell/max_value', + 'cell/missing', + 'cell/table', + 'empty-cell'], + 'serialization_names': ['ordinary', + 'empty', + 'rows-1', + 'rows-1023', + 'rows-1024', + 'rows-1025', + 'rows-2048', + 'byte-bound-169', + 'byte-bound-170', + 'byte-bound-171', + 'scalars-unicode-wide', + 'wide-unlimited', + 'wide-digit-error', + 'interned-rank-rows', + 'depth-30', + 'depth-33', + 'circular', + 'callback-list', + 'callback-dict', + 'callback-error', + 'int-subclass', + 'unsupported-object', + 'malformed-result', + 'malformed-witness', + 'malformed-rank', + 'nonstring-supported-keys', + 'expected-result_sha256', + 'expected-exact_witness_sha256', + 'expected-rank_trace_sha256', + 'expected-rank_call_count', + 'expected-rank_distinct_matrix_count', + 'failure-stage_create', + 'failure-stage_open', + 'failure-stage_write', + 'failure-stage_flush', + 'failure-stage_after_close', + 'failure-stage_hash', + 'failure-final_open-result.json', + 'failure-final_write-result.json', + 'failure-final_flush-result.json', + 'failure-final_after_close-result.json', + 'failure-final_open-witness.json', + 'failure-final_write-witness.json', + 'failure-final_flush-witness.json', + 'failure-final_after_close-witness.json', + 'failure-final_open-rank-trace.json', + 'failure-final_write-rank-trace.json', + 'failure-final_flush-rank-trace.json', + 'failure-final_after_close-rank-trace.json', + 'short-final-0', + 'short-final-1', + 'copy-corrupt-content', + 'stage-mutated-size', + 'copy-read-error', + 'copy-hash-error', + 'cleanup-unlink-error', + 'cleanup-rmdir-error', + 'primary-plus-close-error', + 'primary-plus-manifest-error', + 'drift-reference_global', + 'drift-json_default', + 'drift-expected_value', + 'drift-effective_builtin', + 'drift-json_global_shadow', + 'drift-keyword_default', + 'exit-json-drift', + 'fallback-exit-json-drift', + 'existing-finals', + 'state-mutation-between-writes', + 'path-subclass-fallback']} + +DATA_CONTROL_STATUS = { + 'construction': 'PASS', + 'serialization': 'SERIALIZATION_FINITE_PASS', + 'cache_validity': 'PASS', + 'cold_authority': 'PASS', + 'rank_metadata': 'AREA6_METADATA_HELPER_CONTROLS_PASS', + 'rank_native': 'NATIVE_OBSERVATION_DIFFERENTIAL_CONTROLS_PASS', + 'inventory': 'INVENTORY_DIFFERENTIAL_CONTROLS_PASS', + 'combined_composition': 'BOUNDED_COMBINED_COMPOSITION_PASS', + 'cache_reference_v3': 'PASS', + 'native_initial_tcb': 'NATIVE_INITIAL_TCB_CONTROLS_PASS', + **{'native_probe': 'NATIVE_METADATA_CONTROLS_PASS', 'bootstrap_preload': 'BOOTSTRAP_PRELOAD_CONTROLS_PASS', 'bootstrap_late': 'BOOTSTRAP_LATE_CONTROL_PASS', 'native_metadata': 'PASS', 'native_fields': 'SOURCE_CONTROL_OBSERVATIONS_COMPLETE_RUNTIME_GATE_OPEN'}, +} + +def check_original_control_union(state, optimize, *, include_late=False): + controls = state['controls'] + expected_status = {name: status for name, status in DATA_CONTROL_STATUS.items() + if include_late or name != 'bootstrap_late'} + need(set(controls) == set(expected_status), 'Complete data control union missing') + for name, expected in expected_status.items(): + need(type(controls[name]) is dict and controls[name].get('status') == expected, + 'Data control did not pass: ' + name) + expected_names = _CONTROL_CONTRACT['construction_optimized_names' if optimize else 'construction_normal_names'] + construction = controls['construction'] + need(construction.get('schema') == 'h25-construction-controls-v2' and + construction.get('cases') == len(expected_names) and + construction.get('optimized') is bool(optimize) and + [row['name'] for row in construction.get('controls', [])] == expected_names and + all(row['status'] == 'PASS' for row in construction['controls']), + 'Exact construction control census changed') + serialization = controls['serialization'] + need(serialization.get('case_count') == 70 and serialization.get('optimization') == optimize and + [row['case'] for row in serialization.get('cases', [])] == _CONTROL_CONTRACT['serialization_names'], + 'Exact serialization control census changed') + cache_counts = dict(_CONTROL_CONTRACT['cache_counts'], cases=30, requests=74) + cache = controls['cache_validity'] + need(cache.get('counts') == cache_counts and + type(EXPECTED_CACHE_TRANSCRIPT_RECORDS) is int and + cache.get('transcript_record_count') == EXPECTED_CACHE_TRANSCRIPT_RECORDS and + cache.get('native_consumer_case_count') == 10 and + cache.get('native_consumer_cases') == [ + 'empty-first-result-authority', 'offhash-foreign-key', 'offhash-value-resize', + 'eligible-native-exit-unsupported', 'provider-function-binding', + 'binding-inspect-code', 'binding-inspect-defaults', 'isolated-module-close', + 'teardown-validation-rejection', 'teardown-attempted-native-accounting-rejection'], + 'Exact retained native-consumer control census changed') + need(cache.get('v6_consumer_case_count') == 18 and + len(cache.get('v6_consumer_cases', [])) == 18, 'Exact additive v6 control count changed') + need(type(EXPECTED_V7_CONSUMER_CASES) is tuple and + cache.get('v7_consumer_case_count') == len(EXPECTED_V7_CONSUMER_CASES) and + cache.get('v7_consumer_cases') == list(EXPECTED_V7_CONSUMER_CASES), + 'Exact additive V7 control census is unconfigured or changed') + need(type(EXPECTED_V8_CALLER_CASES) is tuple and + cache.get('v8_caller_case_count') == len(EXPECTED_V8_CALLER_CASES) and + cache.get('v8_caller_cases') == list(EXPECTED_V8_CALLER_CASES), + 'Exact additive V8 caller control census is unconfigured or changed') + authority_controls = controls['cold_authority'] + authority_rows = authority_controls.get('records', []) + need(authority_controls.get('schema') == 'h25-cold-authority-controls-v7' and + type(EXPECTED_AUTHORITY_CONTROL_CASES) is tuple and + authority_controls.get('expected_records') == authority_controls.get('observed_record_count') == len(authority_rows) == 6 and + [row['case'] for row in authority_rows] == list(EXPECTED_AUTHORITY_CONTROL_CASES) and + all(type(row['expected_cases']) is int and type(row['observed_cases']) is int and + row['expected_cases'] == row['observed_cases'] for row in authority_rows) and + authority_controls.get('expected_subcases') == authority_controls.get('observed_subcases') == + sum(row['observed_cases'] for row in authority_rows) and + authority_controls.get('scientific_calls') == authority_controls.get('native_private_calls') == 0, + 'Exact cold authority grouped and derived subcase census changed') + metadata_native = controls['native_metadata'] + need(metadata_native.get('schema') == 'h25-native-metadata-controls-v3' and + metadata_native.get('observed_record_count') == len(metadata_native.get('records', [])) == 16 and + metadata_native.get('native_lifecycle_before') == metadata_native.get('native_lifecycle_after'), + 'Exact additive native metadata control census changed') + need(controls['cache_reference_v3'].get('counts') == cache_counts, + 'Separate bounded v3 reference control census changed') + initial_tcb = controls['native_initial_tcb'] + need(initial_tcb.get('schema') == 'h25-native-tcb-controls-v1' and + len(initial_tcb.get('records', [])) == 5 and initial_tcb.get('expected_records') == 5 and + initial_tcb.get('scientific_calls') == 0 and initial_tcb.get('probe_native_imports') == 0, + 'Initial native TCB control census changed') + native_controls = controls['native_probe'] + need(native_controls.get('records') == 62 and + native_controls['direct'].get('inspection_calls') == 58 and + len(native_controls['direct'].get('records', [])) == 60 and + len(native_controls.get('disarmed', [])) == 1 and len(native_controls.get('bounds', [])) == 1, + 'Native metadata direct/fixture census changed') + need(len(controls['bootstrap_preload'].get('records', [])) == 21 and + controls['bootstrap_preload'].get('scientific_calls') == 0, 'Bootstrap preload census changed') + if include_late: + need(state['native_packet']['late_completed'] is True and + len(controls['bootstrap_late'].get('records', [])) == 1, 'Bootstrap late-last census changed') + metadata = controls['rank_metadata'] + rows, guard, digests = metadata['rows'], metadata['guard'], metadata['digests'] + need(rows['status'] == 'ROW_METADATA_CONTROLS_PASS' and rows['event_fixture_count'] == 8 and + rows['unsupported_cases'] == 9 and rows['table_cap_tested'] == 4096 and rows['callback_events'] == [], + 'Exact immutable-row control census changed') + need(guard['status'] == 'OBSERVATION_GUARD_CONTROLS_PASS' and guard['base_check_calls'] == 43 and + len(guard['mutations']) == 21 and + {row[0] for row in guard['mutations']} == set(_CONTROL_CONTRACT['rank_guard_mutation_names']), + 'Exact observation-guard control census changed') + need(digests['status'] == 'DIGEST_SNAPSHOT_CONTROLS_PASS' and + digests['declared_fixture_bytes'] == 2097172 and digests['same_snapshot_sha_calls'] == 3 and + digests['stream_request_bytes'] == [1048576] * 4 and + digests['read_once_same_snapshot'] is True and digests['fresh_after_mutation'] is True, + 'Exact same-call digest control census changed') + native = controls['rank_native'] + need(native['rank_events'] == 17 and len(native['outcomes']) == 18 and + native['callbacks'] == ['basis.values', 'basis.values'] and + native['counters'] == {'complement_native': 0, 'complement_fallback': 0, + 'gram_native': 14, 'gram_fallback': 4}, + 'Exact native observation control census changed') + need([list(row) for row in controls['inventory']['cases']] == _CONTROL_CONTRACT['inventory_cases'], + 'Exact inventory control census changed') + composition = controls['combined_composition'] + need(composition['height'] == 8 and composition['optimized'] == optimize and + composition['arms'] == ['baseline', 'candidate'] and + set(composition['files']) == {'result.json', 'witness.json', 'rank-trace.json', 'complements.json'} and + composition['production_writer_expected_unchanged'] is True and + composition['production_writer_executed'] is False and composition['full_h25_gate_passed'] is False, + 'Exact bounded composition scope changed') diff --git a/research/h25-v03-authenticated-prefix-entry/prerequisites/h25_parent_supervisor.py.txt b/research/h25-v03-authenticated-prefix-entry/prerequisites/h25_parent_supervisor.py.txt new file mode 100644 index 0000000000..73ed60fe21 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/prerequisites/h25_parent_supervisor.py.txt @@ -0,0 +1,475 @@ +"""Parent-only bounded process supervision; imports no candidate implementation. + +The runtime caller must establish the trusted clean launcher before calling us. +This source was prepared without loading ctypes or running any control. The +closed single-threaded child domain is an explicit premise, not a hostile-fork +sandbox. Numeric process IDs are never used as signal destinations. +""" +import fcntl +import hashlib +import json +import os +from pathlib import Path +import resource +import signal +import stat +import subprocess +import sys +import time + +FLAGS = ('-S', '-s', '-P', '-B') +ENV = {'PATH': '/usr/bin:/bin', 'PYTHONHASHSEED': '0', 'LANG': 'C.UTF-8', + 'LC_ALL': 'C.UTF-8', 'TZ': 'UTC', 'PYTHONDONTWRITEBYTECODE': '1'} +RUNNER_SHA = 'bd882e3dadb1b6aeaa63ee824f1a1c58f8ef2546b6840a2bffa46885a184d3eb' +QUEUE_SHA = '1348a7b4d7cc1f9fef556f5e0abdaf04411a998afdcd574d7812c76ab37dcf68' +TCB_SHA = '610492b3fc06baa0560175edc3ba27057de00d00b8fd3d58dbe55e5a371c042a' +LIBC = '/usr/lib/x86_64-linux-gnu/libc.so.6' +NATIVE_PINS = { + LIBC: '3a15d66867d83762c7f2f1e37359cb8f6c5743edb369c65285cb0b1c4f7498bf', + '/usr/lib/python3.12/lib-dynload/_ctypes.cpython-312-x86_64-linux-gnu.so': 'aad3e24f186e6c0a1c7efa8f16004f951f527db86f6451d30118657384a456c1', + '/usr/lib/x86_64-linux-gnu/libffi.so.8.1.4': '00f593fe192f2851b8ce23b25cec2488d769beb5a8f63e8c9e563071e1075153', + '/usr/lib/python3.12/ctypes/__init__.py': '0782592567ad71097198a3afe985ac3e2ea0b9b5e75452402c9460c89a86318a', + '/usr/lib/python3.12/ctypes/_endian.py': 'c5d692bdce10dfee242752620061bab684633bc72445a3def484961ef1bdbf3a', +} +CHUNK = 65536 +LOG_CAP = 2 * 1024 * 1024 +META_CAP = 256 * 1024 +CLEANUP_SECONDS = 2.0 + + +def need(condition, message): + if not condition: + raise RuntimeError(message) + + +def launch_contract(): + need(sys.executable == '/usr/bin/python3.12', 'Pinned interpreter required') + need(sys.flags.no_site == sys.flags.no_user_site == sys.flags.dont_write_bytecode == 1 and + sys.flags.safe_path and sys.flags.ignore_environment == sys.flags.isolated == + sys.flags.hash_randomization == 0, 'Trusted no-site safe-path fixed-seed flags required') + need(dict(os.environ) == ENV, 'Exact clean environment required') + need(tuple(sys.path) == ('/usr/lib/python312.zip', '/usr/lib/python3.12', + '/usr/lib/python3.12/lib-dynload'), 'Initial system stdlib path changed') + need(list(Path('/proc/self/task').iterdir()) == [Path('/proc/self/task') / str(os.getpid())], + 'Exactly one parent task required') + + +def identity(info): + return (info.st_dev, info.st_ino, info.st_mode, info.st_size, info.st_mtime_ns, info.st_ctime_ns) + + +def stable_file(path, limit, keep=False): + """Complete bounded snapshot; no file read can extend a growing snapshot.""" + path = Path(path) + before = path.stat(follow_symlinks=False) + need(stat.S_ISREG(before.st_mode) and before.st_size <= limit, 'File type/size bound: ' + str(path)) + fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK | os.O_CLOEXEC) + h, count, blocks = hashlib.sha256(), 0, [] + try: + opened = os.fstat(fd) + need(identity(before) == identity(opened), 'File changed while opening') + while count < opened.st_size: + block = os.read(fd, min(CHUNK, opened.st_size - count)) + need(bool(block), 'Short retained-file read') + count += len(block) + h.update(block) + if keep: + blocks.append(block) + after_fd = os.fstat(fd) + finally: + os.close(fd) + after = path.stat(follow_symlinks=False) + need(identity(before) == identity(after_fd) == identity(after), 'File drift during retained snapshot') + row = {'path': str(path), 'sha256': h.hexdigest(), 'bytes': count, + 'identity': list(identity(after)), 'stable': True, 'read_chunk_bytes': CHUNK} + return (row, b''.join(blocks)) if keep else row + + +def read_json(path, limit=META_CAP): + row, raw = stable_file(path, limit, True) + return json.loads(raw), row + + +def write_new(path, row): + raw = json.dumps(row, sort_keys=True, indent=2).encode('ascii') + b'\n' + need(len(raw) <= META_CAP, 'Bounded metadata record exceeded') + fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_CLOEXEC | os.O_NOFOLLOW, 0o600) + try: + view = memoryview(raw) + while view: + written = os.write(fd, view) + need(written > 0, 'Metadata write made no progress') + view = view[written:] + os.fsync(fd) + finally: + os.close(fd) + + +def proc(pid): + try: + with open('/proc/' + str(pid) + '/stat', 'rb') as stream: + raw = stream.read(8193) + need(len(raw) <= 8192, 'Unexpected process-stat size') + end = raw.rfind(b') ') + need(end >= 0, 'Malformed process stat') + fields = raw[end + 2:].split() + return {'pid': int(pid), 'ppid': int(fields[1]), 'pgid': int(fields[2]), + 'sid': int(fields[3]), 'start_ticks': int(fields[19]), + 'state': fields[0].decode('ascii'), + 'rss_bytes': int(fields[21]) * os.sysconf('SC_PAGE_SIZE')} + except (FileNotFoundError, ProcessLookupError, PermissionError): + return None + + +def census(): + found = {} + with os.scandir('/proc') as entries: + for entry in entries: + if entry.name.isdecimal(): + row = proc(int(entry.name)) + if row is not None: + found[row['pid']] = row + return found + + +def generation(row): + return row['pid'], row['start_ticks'] + + +def children_now(): + return [row for row in census().values() if row['ppid'] == os.getpid()] + + +def install_subreaper(root): + """Called only by the future parent, before any controlled root exists.""" + launch_contract() + need(not children_now(), 'Parent must own no preexisting child processes') + tcb, tcb_row = read_json(root / 'control/NATIVE-INITIAL-TCB-v1.json') + need(tcb_row['sha256'] == TCB_SHA, 'Accepted initial TCB changed') + need(any(row['path'] == LIBC and row['sha256'] == NATIVE_PINS[LIBC] + for row in tcb['files']), 'Pinned libc absent from accepted TCB') + evidence = {path: stable_file(path, 16 * 1024 * 1024) for path in NATIVE_PINS} + need(all(evidence[path]['sha256'] == expected for path, expected in NATIVE_PINS.items()), + 'Subreaper native/stdlib source supplement changed') + # This import and native call have NOT been performed during source authoring. + need(Path('/usr/lib/x86_64-linux-gnu/libffi.so.8').resolve() == + Path('/usr/lib/x86_64-linux-gnu/libffi.so.8.1.4'), 'Foreign libffi SONAME resolution') + import ctypes + need(sys.modules['_ctypes'].__file__ == + '/usr/lib/python3.12/lib-dynload/_ctypes.cpython-312-x86_64-linux-gnu.so', 'Foreign _ctypes owner') + need(ctypes.__file__ == '/usr/lib/python3.12/ctypes/__init__.py', 'Foreign ctypes owner') + library = ctypes.CDLL(LIBC, use_errno=True) + call = library.prctl + call.argtypes = [ctypes.c_int, ctypes.c_ulong, ctypes.c_ulong, ctypes.c_ulong, ctypes.c_ulong] + call.restype = ctypes.c_int + prior, actual = ctypes.c_int(), ctypes.c_int() + need(call(37, ctypes.addressof(prior), 0, 0, 0) == 0, 'PR_GET_CHILD_SUBREAPER failed') + need(call(36, 1, 0, 0, 0) == 0, 'PR_SET_CHILD_SUBREAPER failed') + need(call(37, ctypes.addressof(actual), 0, 0, 0) == 0 and actual.value == 1, + 'Same-process subreaper readback failed') + for path, expected in NATIVE_PINS.items(): + need(stable_file(path, 16 * 1024 * 1024)['sha256'] == expected, 'TCB bytes changed across load') + # Retain the CDLL and typed function in the owning parent for its whole queue. + return {'pid': os.getpid(), 'prior': prior.value, 'actual': actual.value, + 'tcb_sha256': TCB_SHA, 'native_source_evidence': evidence, + 'trust': 'Trusted OS/loader/initial system stdlib; file pins do not authenticate native memory'}, (library, call) + + +def ledger(root, allow_unclosed=False): + result = {} + runs = root / 'runtime/runs' + for folder in sorted(runs.iterdir()): + need(folder.is_dir() and not folder.is_symlink(), 'Unexpected round run entry') + if allow_unclosed and not (folder / 'receipt.json').exists(): + continue + receipt, _ = read_json(folder / 'receipt.json', 4 * 1024 * 1024) + amount = receipt.get('runner_wall_seconds', receipt.get('wall_seconds')) + need(type(amount) in (int, float) and amount >= 0, 'Invalid ledger amount') + result[folder.name] = float(amount) + return result + + +def budget(root): + phase, _ = read_json(root / 'control/EXECUTION-PHASE.json') + cap = phase['aggregate_cap_seconds'] + need(type(cap) is int and cap in (600, 2400), 'Unrecognized budget phase') + current = ledger(root) + need(sum(current.values()) < cap, 'Round budget consumed') + return cap, current + + +def parent_lock(root): + lock = (root / 'runtime/parent-queue.lock').open('a') + try: + fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB) + except BaseException: + lock.close() + raise + return lock + + +class ExecutionDeadline(RuntimeError): + pass + + +def deadline_handler(signum, frame): + raise ExecutionDeadline('Outer execution deadline reached, including Popen/preexec') + + +class OwnedDomain: + """Only our new children and their observed descendants enter this domain.""" + def __init__(self): + need(not children_now(), 'Owned child domain was not initially empty') + self.rows, self.fds, self.groups, self.reaped = {}, {}, set(), [] + self.root = None + self.parent_group = os.getpgrp() + self.parent_session = os.getsid(0) + + def add(self, row): + key = generation(row) + if key in self.rows: + if row['pgid'] != self.parent_group: + self.groups.add((row['pgid'], row['sid'])) + return + need(len(self.rows) < 128, 'Owned process observation limit exceeded') + need(row['pid'] != os.getpid(), 'Parent cannot enter its own child domain') + try: + fd = os.pidfd_open(row['pid'], 0) + except ProcessLookupError: + return + current = proc(row['pid']) + if current is None or generation(current) != key: + os.close(fd) + return + self.rows[key], self.fds[key] = dict(current), fd + # During interrupted Popen a child can briefly precede setsid. Its + # individual pidfd is owned; the queue parent group never is. + if current['pgid'] != self.parent_group: + self.groups.add((current['pgid'], current['sid'])) + + def observe(self): + all_rows = census() + known = {pid for pid, start in self.rows if pid in all_rows and + all_rows[pid]['start_ticks'] == start} + for pid in known: + self.add(all_rows[pid]) + changed = True + while changed: + changed = False + for pid, row in all_rows.items(): + if pid not in known and (row['ppid'] == os.getpid() or row['ppid'] in known): + self.add(row) + if generation(row) in self.rows: + known.add(pid) + changed = True + return all_rows, [all_rows[pid] for pid in known] + + def kill_owned(self): + self.observe() + for key, fd in self.fds.items(): + current = proc(key[0]) + if current is not None and generation(current) == key and current['state'] != 'Z': + try: + signal.pidfd_send_signal(fd, signal.SIGKILL, None, 0) + except ProcessLookupError: + pass + + def cleanup(self, process): + start = time.monotonic() + seen_after_root = [] + completed = False + while True: + _, current = self.observe() + if process is not None and process.returncode is not None: + seen_after_root.extend(generation(row) for row in current if row['pid'] != process.pid) + self.kill_owned() + if process is not None: + process.poll() + for key in list(self.rows): + row = proc(key[0]) + if row is None or generation(row) != key or row['ppid'] != os.getpid(): + continue + if process is not None and row['pid'] == process.pid: + continue + try: + pid, status = os.waitpid(row['pid'], os.WNOHANG) + except ChildProcessError: + continue + if pid: + self.reaped.append({'pid': pid, 'start_ticks': key[1], 'wait_status': status}) + all_rows, current = self.observe() + occupied = [row for row in all_rows.values() if (row['pgid'], row['sid']) in self.groups] + if not current and not occupied and not children_now(): + completed = True + break + if time.monotonic() - start >= CLEANUP_SECONDS: + break + time.sleep(0.01) + final_rows = census() + remaining = [row for row in final_rows.values() if + generation(row) in self.rows or (row['pgid'], row['sid']) in self.groups or + row['ppid'] == os.getpid()] + for fd in self.fds.values(): + os.close(fd) + self.fds.clear() + return {'complete': completed and not remaining, + 'owned_generations': list(self.rows.values()), + 'groups': [{'pgid': g, 'sid': s} for g, s in sorted(self.groups)], + 'reaped_adopted': self.reaped, + 'observed_after_root_exit': [list(key) for key in sorted(set(seen_after_root))], + 'remaining': remaining, 'cleanup_seconds': time.monotonic() - start, + 'cleanup_tail_limit_seconds': CLEANUP_SECONDS, + 'group_empty_proved': completed and not remaining, + 'signal_method': 'SIGKILL via generation-checked pidfd only; never killpg'} + + +def reconcile_missing_receipt(root, label, began, cause, cleanup): + folder = root / 'runtime/runs' / label + folder.mkdir(exist_ok=True) + if not cleanup['complete'] and not (folder / 'receipt.json').exists(): + # A surviving root must never race a replacement canonical receipt. + # Leave its attempt unclosed, blocking the unchanged runner, and add a + # distinct charged STOP record for the parent to reconcile manually. + folder = root / 'runtime/runs' / (label + '-outer-unclosed-stop') + folder.mkdir() + path = folder / 'receipt.json' + if path.exists(): + return None + start = {} + if (folder / 'START.json').exists(): + start, _ = read_json(folder / 'START.json') + row = dict(start, schema='h25-outer-reconciled-stop-v1', status='STOP', label=label, + kind='outer_reconciled_incomplete_root', termination=cause, attempt_label=label, + wall_seconds=time.monotonic() - began, original_root_receipt_absent=True, + original_root_completion_claimed=False, cleanup_complete=cleanup['complete'], + all_prior_files_preserved=True) + row['label'] = folder.name + row['runner_wall_seconds'] = row['wall_seconds'] + if not (folder / 'START.json').exists(): + write_new(folder / 'START.json', {'kind': row['kind'], 'label': label}) + write_new(path, row) + return row + + +def run_root(root, case, evidence, seconds, shared_deadline, as_bytes=201326592, + rss_bytes=201326592): + """One root. Cleanup and stable custody finish before returning to a queue.""" + launch_contract() + need(stable_file(root / 'run_guarded_v3.py', META_CAP)['sha256'] == RUNNER_SHA, + 'Actual root runner changed') + need(time.monotonic() + CLEANUP_SECONDS < shared_deadline, 'No reserved cleanup tail remains') + command = ['/usr/bin/python3.12', *FLAGS, str(root / 'run_guarded_v3.py'), + case['stage'], case['job'], case['label']] + for value in (case['stage'], case['job'], case['label']): + need(type(value) is str and value and all(c in 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_' for c in value), + 'Unsafe case identity') + evidence.mkdir() + need(type(seconds) in (int, float) and 0 < seconds <= 190, 'Unadmitted root deadline') + need(type(as_bytes) is int and 0 < as_bytes <= 1024 ** 3, 'Unadmitted root address-space bound') + need(type(rss_bytes) is int and 0 < rss_bytes <= 1024 ** 3, 'Unadmitted aggregate RSS bound') + began = time.monotonic() + deadline = min(began + seconds, shared_deadline - CLEANUP_SECONDS) + domain = OwnedDomain() + process, failure, cleanup = None, None, None + peak, spawn_entered, captured = 0, False, None + setter, limit_kind, limits = resource.setrlimit, resource.RLIMIT_AS, (as_bytes, as_bytes) + need(list(Path('/proc/self/task').iterdir()) == [Path('/proc/self/task') / str(os.getpid())], + 'Root preexec requires exactly one task') + def child_limit(): + setter(limit_kind, limits) + old_handler = signal.getsignal(signal.SIGALRM) + need(signal.getitimer(signal.ITIMER_REAL) == (0.0, 0.0), 'Parent already has an execution alarm') + write_new(evidence / 'LAUNCH.json', {'command': command, 'parent_pid': os.getpid(), + 'parent_pgid': os.getpgrp(), 'parent_sid': os.getsid(0), + 'root_execution_seconds': seconds, 'address_space_bytes': as_bytes, + 'rss_sum_bytes': rss_bytes, 'new_session': True, 'cleanup_reserved_seconds': CLEANUP_SECONDS}) + try: + with (evidence / 'root.stdout.raw').open('xb') as out, (evidence / 'root.stderr.raw').open('xb') as err: + signal.signal(signal.SIGALRM, deadline_handler) + signal.setitimer(signal.ITIMER_REAL, max(0.000001, deadline - time.monotonic())) + try: + spawn_entered = True + process = subprocess.Popen(command, cwd=root, env=dict(ENV), stdout=out, + stderr=err, start_new_session=True, preexec_fn=child_limit) + # Popen leaves an exited root waitable; capture its generation BEFORE poll. + captured = proc(process.pid) + need(captured is not None and captured['pgid'] == captured['sid'] == process.pid, + 'New root process/session identity missing') + domain.root = generation(captured) + domain.add(captured) + write_new(evidence / 'ROOT-PROCESS.json', captured) + while True: + _, current = domain.observe() + peak = max(peak, sum(row['rss_bytes'] for row in current)) + need(peak <= rss_bytes, 'Owned process RSS sum exceeded') + need(max((evidence / name).stat().st_size for name in + ('root.stdout.raw', 'root.stderr.raw')) <= LOG_CAP, 'Outer raw log cap exceeded') + if process.poll() is not None: + break + time.sleep(0.01) + finally: + signal.setitimer(signal.ITIMER_REAL, 0) + signal.signal(signal.SIGALRM, old_handler) + except BaseException as error: + failure = {'type': type(error).__name__, 'message': str(error)[:2048]} + finally: + signal.setitimer(signal.ITIMER_REAL, 0) + signal.signal(signal.SIGALRM, old_handler) + # This is also required when Popen raised before returning an object. + try: + cleanup = domain.cleanup(process) + except BaseException as cleanup_error: + cleanup = {'complete': False, 'group_empty_proved': False, + 'owned_generations': list(domain.rows.values()), + 'groups': [{'pgid': g, 'sid': sid} for g, sid in sorted(domain.groups)], + 'reaped_adopted': domain.reaped, 'observed_after_root_exit': [], + 'remaining': 'UNKNOWN_AFTER_CLEANUP_ERROR', + 'error': {'type': type(cleanup_error).__name__, 'message': str(cleanup_error)[:2048]}} + for fd in domain.fds.values(): + os.close(fd) + domain.fds.clear() + if not cleanup['complete']: + failure = failure or {'type': 'CleanupIncomplete', 'message': 'Owned descendants/group remain after bounded cleanup tail'} + if time.monotonic() > shared_deadline: + failure = failure or {'type': 'SharedDeadline', 'message': 'Shared cap crossed; necessary cleanup charged'} + reconciled = reconcile_missing_receipt(root, case['label'], began, + failure or {'type': 'MissingRootReceipt', 'message': 'Root exited without receipt'}, cleanup) + if reconciled is not None: + failure = failure or {'type': 'MissingRootReceipt', 'message': 'New reconciled STOP receipt; no retry'} + logs = {} + for name in ('root.stdout.raw', 'root.stderr.raw'): + try: + logs[name] = stable_file(evidence / name, LOG_CAP) + except BaseException as error: + failure = failure or {'type': type(error).__name__, 'message': str(error)[:2048]} + logs[name] = {'path': str(evidence / name), 'complete_hash': None, 'stable': False} + result = {'schema': 'h25-parent-root-supervision-v1', 'label': case['label'], + 'status': 'STOP' if failure else 'ROOT_COMPLETED_AND_OWNED_DOMAIN_EMPTY', + 'failure': failure, 'spawn_entered': spawn_entered, + 'spawn_returned': process is not None, 'captured_root': captured, + 'returncode': None if process is None else process.returncode, + 'cleanup': cleanup, 'outer_logs': logs, 'sampled_owned_rss_bytes': peak, + 'execution_and_cleanup_seconds': time.monotonic() - began, + 'root_receipt_reconciled': reconciled is not None, + 'no_hostile_fork_or_concurrent_children_claim': True} + write_new(evidence / 'SUPERVISION.json', result) + return result + + +def stop_supplement(root, label, reason): + folder = root / 'runtime/runs' / (label + '-supervision-stop') + folder.mkdir() + row = {'status': 'STOP', 'label': folder.name, 'kind': 'supervision_failure_marker', + 'failure': reason, 'wall_seconds': 0.0, 'runner_wall_seconds': 0.0, + 'cost_accounted_by_enclosing_queue_overhead': True, 'original_receipts_preserved': True} + write_new(folder / 'START.json', {'kind': row['kind']}) + write_new(folder / 'receipt.json', row) + + +def packet_unchanged(directory, manifest): + for name, expected in manifest['files'].items(): + row = stable_file(directory / name, META_CAP) + need(row['sha256'] == expected['sha256'] and row['bytes'] == expected['bytes'], + 'Parent source packet changed: ' + name) + need(not (directory / name).stat().st_mode & 0o222, 'Parent source packet became writable') + return True diff --git a/research/h25-v03-authenticated-prefix-entry/prerequisites/original_build_provenance_v5.py.txt b/research/h25-v03-authenticated-prefix-entry/prerequisites/original_build_provenance_v5.py.txt new file mode 100644 index 0000000000..517f88b202 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/prerequisites/original_build_provenance_v5.py.txt @@ -0,0 +1,247 @@ +"""Strict source-only parser for the unchanged original helper/triple protocol. + +No function is invoked during source work. Independent parent launch, actual +producer PID/generation, source closure and whole-domain evidence remain required. +""" +import json +import epoch_schema_v5 as schema +import epoch_copy_v5 as copying + +PARSER_CONFIGURATION = None +PARSER_EXECUTION_APPROVAL = None +PARSER_FUNDING = None +_TYPE, _LEN = type, len +ORIGINAL_HELPER_SHA256 = 'aa0a315110e031e19291970c9611fe5e0f91465fa20eaec51e81186099563f78' +PRODUCTION_HEADERS = ('field_service_v1.h', 'field_loader_snapshot_v1.h') +PRELAUNCH_KEYS = ('schema', 'status', 'command', 'timeout_seconds', 'context', + 'stdout_path', 'stderr_path', 'attempt_path', 'journal_path', 'process_group_policy', + 'operational_log_threshold_bytes', 'child_only_inherited_hard_file_limit_bytes', + 'returncode', 'process_id', 'direct_child_reaped', 'spawn_entered', 'spawn_returned', + 'descendant_termination_joined', 'failure_log_hashes_final') +STARTED_KEYS = PRELAUNCH_KEYS + ('parent_file_limits_before', 'preexec_code_sha256', 'single_thread_before_spawn') +FINAL_KEYS = STARTED_KEYS + ('logs', 'parent_file_limits_after') + + +def _decode_original(raw: bytes, limit: int) -> dict: + schema.integer(limit, 1, schema.RAW_RESULT_BYTES) + schema.need(_TYPE(raw) is bytes, 'exact legacy bytes required') + schema.need(_LEN(raw) <= limit, 'legacy record byte bound differs') + value = json.loads(raw.decode('utf-8'), object_pairs_hook=schema._pairs, + parse_constant=schema._reject_constant) + schema.need(_TYPE(value) is dict, 'legacy record is not exact object') + return schema.plain_copy(value) + + +def _source_row(value) -> None: + schema.exact(value, ('sha256', 'bytes', 'mode')) + schema.digest(value['sha256']) + schema.integer(value['bytes'], 1, schema.FILE_BYTES) + schema.integer(value['mode'], 0, 0o7777) + + +def _limits(value) -> None: + schema.sequence(value, 2) + for item in value: + schema.integer(item, -1, (1 << 64) - 1) + schema.need(item == -1 or item >= 16 * 1024 * 1024, 'inherited file limit below original cap') + soft, hard = value + schema.need((soft == -1 and hard == -1) or + (soft != -1 and (hard == -1 or soft <= hard)), 'invalid inherited soft/hard order') + + +def _census(value, expected_pid: int) -> None: + schema.integer(expected_pid, 1, (1 << 31) - 1) + schema.exact(value, ('process_id', 'task_ids', 'task_count')) + schema.integer(value['process_id'], 1, (1 << 31) - 1) + schema.integer(value['task_count'], 1, 1) + schema.sequence(value['task_ids'], 1) + schema.integer(value['task_ids'][0], 1, (1 << 31) - 1) + schema.need(value['process_id'] == value['task_ids'][0] == expected_pid, 'original producer thread identity differs') + + +def _context(value, expected, role) -> None: + keys = ('source', 'source_name', 'no_cached_binary', 'module_name', 'target') + if role == 'production': + keys += ('source_headers', 'system_header_admission_sha256') + schema.exact(value, keys) + _source_row(value['source']) + schema.text(value['source_name'], 256) + schema.text(value['module_name'], 256) + schema.boolean(value['no_cached_binary']) + schema.path(value['target']) + if role == 'production': + schema.exact(value['source_headers'], PRODUCTION_HEADERS) + for row in value['source_headers'].values(): + _source_row(row) + schema.digest(value['system_header_admission_sha256']) + schema.need(value == expected, 'original compiler context differs') + + +def _event(event, kind, expected, row, context, compiler_pid) -> None: + schema.choice(kind, ('PRELAUNCH_INTENT', 'STARTED', 'EXIT0_LOGS_STABLE_PENDING_SOURCE_CUSTODY')) + keys = PRELAUNCH_KEYS if kind == 'PRELAUNCH_INTENT' else STARTED_KEYS if kind == 'STARTED' else FINAL_KEYS + schema.exact(event, keys) + for key in ('schema', 'status', 'process_group_policy'): + schema.text(event[key], 128) + schema.need(event['schema'] == 'h25-cold-build-attempt-v1' and event['status'] == kind and + event['process_group_policy'] == 'INHERIT_OUTER_GROUP_NO_NEW_SESSION', 'original event tag differs') + schema.need(_TYPE(event['command']) is list and 1 <= _LEN(event['command']) <= 64, 'original argv shape differs') + for argument in event['command']: + schema.text(argument, 8192) + schema.need(event['command'] == expected['command'], 'original event command differs') + schema.integer(event['timeout_seconds'], 1, 15) + schema.need(event['timeout_seconds'] == expected['timeout_seconds'], 'original timeout differs') + _context(event['context'], context, row['role']) + for event_key, row_key in (('stdout_path', 'stdout'), ('stderr_path', 'stderr'), + ('attempt_path', 'attempt'), ('journal_path', 'journal')): + schema.path(event[event_key]) + schema.need(event[event_key] == row[row_key]['path'], 'original event origin differs') + schema.integer(event['operational_log_threshold_bytes'], schema.LOG_BYTES, schema.LOG_BYTES) + schema.integer(event['child_only_inherited_hard_file_limit_bytes'], 16 * 1024 * 1024, 16 * 1024 * 1024) + for key in ('spawn_entered', 'spawn_returned', 'descendant_termination_joined', 'failure_log_hashes_final'): + schema.boolean(event[key]) + schema.need(event['descendant_termination_joined'] is False and event['failure_log_hashes_final'] is False, + 'direct-child evidence cannot become outer-domain authority') + if kind == 'PRELAUNCH_INTENT': + schema.need(event['returncode'] is None and event['process_id'] is None and + event['direct_child_reaped'] is None and event['spawn_entered'] is False and + event['spawn_returned'] is False, 'original prelaunch fields differ') + return + schema.integer(event['process_id'], 1, (1 << 31) - 1) + schema.integer(compiler_pid, 1, (1 << 31) - 1) + schema.need(event['process_id'] == compiler_pid and event['spawn_entered'] is True and + event['spawn_returned'] is True, 'original started process differs') + _limits(event['parent_file_limits_before']) + schema.need(event['parent_file_limits_before'] == expected['parent_file_limits'], 'independent inherited limits differ') + schema.digest(event['preexec_code_sha256']) + schema.need(event['preexec_code_sha256'] == expected['preexec_code_sha256'], 'independent preexec bytecode pin differs') + _census(event['single_thread_before_spawn'], expected['producer_process_id']) + if kind == 'STARTED': + schema.need(event['returncode'] is None and event['direct_child_reaped'] is None, 'started event claims completion') + else: + schema.integer(event['returncode'], 0, 0) + schema.boolean(event['direct_child_reaped']) + schema.need(event['direct_child_reaped'] is True, 'direct compiler child not reaped') + _limits(event['parent_file_limits_after']) + schema.need(event['parent_file_limits_after'] == expected['parent_file_limits'], 'parent limits changed') + + +def authenticate_original_build(row: dict, expected: dict, *, error_owner) -> dict: + schema.owner_state(error_owner) + schema.exact(PARSER_CONFIGURATION, ('leaf_policy_sha256', 'configuration_sha256', 'original_helper_sha256')) + schema.exact(PARSER_EXECUTION_APPROVAL, ('external_launch_policy_sha256',)) + schema.exact(PARSER_FUNDING, ('reservation_sha256',)) + for config in (PARSER_CONFIGURATION, PARSER_EXECUTION_APPROVAL, PARSER_FUNDING): + for value in config.values(): + schema.digest(value) + schema.need(PARSER_CONFIGURATION['original_helper_sha256'] == ORIGINAL_HELPER_SHA256, 'original helper source protocol differs') + schema.build(row) + schema.need(row['role'] in schema.ROLES[:3] and row['producer_role'] == 'group01', 'variant cannot become original row') + schema.exact(expected, ('role', 'command', 'timeout_seconds', 'source', 'source_name', 'module_name', + 'source_headers', 'system_header_admission_sha256', 'preexec_code_sha256', + 'producer_process_id', 'parent_file_limits')) + schema.choice(expected['role'], schema.ROLES[:3]) + schema.need(expected['role'] == row['role'], 'independent original role differs') + schema.need(_TYPE(expected['command']) is list and 1 <= _LEN(expected['command']) <= 64, 'independent argv shape differs') + for argument in expected['command']: + schema.text(argument, 8192) + schema.need(_LEN(argument) > 0, 'empty independent compiler argument') + schema.path(expected['command'][0]) + schema.integer(expected['timeout_seconds'], 1, 15) + _source_row(expected['source']) + schema.text(expected['source_name'], 256) + schema.text(expected['module_name'], 256) + schema.digest(expected['preexec_code_sha256']) + schema.integer(expected['producer_process_id'], 1, (1 << 31) - 1) + _limits(expected['parent_file_limits']) + if row['role'] == 'production': + schema.exact(expected['source_headers'], PRODUCTION_HEADERS) + for header in expected['source_headers'].values(): + _source_row(header) + schema.digest(expected['system_header_admission_sha256']) + else: + schema.need(expected['source_headers'] is None and expected['system_header_admission_sha256'] is None, + 'fixture cannot borrow production header authority') + expected = schema.plain_copy(expected) + schema.need(schema.sha(schema.canonical({'argv': expected['command']})) == row['command_sha256'], 'original command pin differs') + copying.verify(row['original_output'], error_owner=error_owner) + receipt = _decode_original(copying.read_verified(row['original_receipt'], 65536, error_owner=error_owner), 65536) + receipt_keys = ('command', 'returncode', 'stdout', 'stderr', 'attempt_path', 'attempt_journal_path', + 'process_policy', 'source', 'source_name', 'no_cached_binary', 'module_name', 'path', 'status', 'binary') + if row['role'] == 'production': + receipt_keys += ('source_headers', 'system_header_admission_sha256') + schema.exact(receipt, receipt_keys) + # Both sides are bounded native copies before any nested comparison. + schema.integer(receipt['returncode'], 0, 0) + schema.boolean(receipt['no_cached_binary']) + for key in ('status', 'process_policy', 'source_name', 'module_name'): + schema.text(receipt[key], 256) + for key in ('path', 'attempt_path', 'attempt_journal_path'): + schema.path(receipt[key]) + schema.need(_TYPE(receipt['command']) is list and 1 <= _LEN(receipt['command']) <= 64, 'receipt argv shape differs') + for argument in receipt['command']: + schema.text(argument, 8192) + _source_row(receipt['source']) + _source_row(receipt['binary']) + schema.need(receipt['command'] == expected['command'] and receipt['no_cached_binary'] is True and + receipt['status'] == 'COLD_NATIVE_BUILD_SOURCE_CUSTODY_PASS' and + receipt['path'] == row['original_output']['path'] and receipt['attempt_path'] == row['attempt']['path'] and + receipt['attempt_journal_path'] == row['journal']['path'] and + receipt['process_policy'] == 'INHERIT_OUTER_GROUP_NO_NEW_SESSION', 'original cold receipt differs') + for key in ('source', 'source_name', 'module_name'): + schema.need(receipt[key] == expected[key], 'original source/module field differs') + schema.need(receipt['binary'] == {'sha256': row['original_output']['sha256'], 'bytes': row['original_output']['bytes'], + 'mode': row['original_output']['identity']['mode'] & 0o7777}, 'actual original binary differs') + if row['role'] == 'production': + schema.exact(receipt['source_headers'], PRODUCTION_HEADERS) + for header in receipt['source_headers'].values(): + _source_row(header) + schema.digest(receipt['system_header_admission_sha256']) + schema.need(receipt['source_headers'] == expected['source_headers'] and + receipt['system_header_admission_sha256'] == expected['system_header_admission_sha256'], 'original headers differ') + attempt = _decode_original(copying.read_verified(row['attempt'], 65536, error_owner=error_owner), 65536) + schema.exact(attempt, FINAL_KEYS) + schema.integer(attempt['process_id'], 1, (1 << 31) - 1) + context = {'source': expected['source'], 'source_name': expected['source_name'], 'no_cached_binary': True, + 'module_name': expected['module_name'], 'target': row['original_output']['path']} + if row['role'] == 'production': + context.update(source_headers=expected['source_headers'], system_header_admission_sha256=expected['system_header_admission_sha256']) + _event(attempt, 'EXIT0_LOGS_STABLE_PENDING_SOURCE_CUSTODY', expected, row, context, attempt['process_id']) + schema.exact(attempt['logs'], ('stdout', 'stderr')) + for stream in ('stdout', 'stderr'): + snapshot = attempt['logs'][stream] + schema.exact(snapshot, ('path', 'bytes_before', 'bytes_after', 'prefix_bytes_hashed', 'prefix_sha256', + 'preview_bytes', 'preview_utf8', 'stable_during_snapshot', 'complete_file_sha256', 'raw_finality', + 'operational_threshold_bytes', 'child_inherited_hard_file_limit_bytes')) + schema.path(snapshot['path']) + for key in ('bytes_before', 'bytes_after', 'prefix_bytes_hashed'): + schema.integer(snapshot[key], 0, schema.LOG_BYTES) + schema.digest(snapshot['prefix_sha256']) + schema.digest(snapshot['complete_file_sha256']) + schema.integer(snapshot['preview_bytes'], 0, 512) + schema.text(snapshot['preview_utf8'], 512) + schema.boolean(snapshot['stable_during_snapshot']) + schema.text(snapshot['raw_finality'], 128) + schema.integer(snapshot['operational_threshold_bytes'], schema.LOG_BYTES, schema.LOG_BYTES) + schema.integer(snapshot['child_inherited_hard_file_limit_bytes'], 16 * 1024 * 1024, 16 * 1024 * 1024) + raw_log = copying.read_verified(row[stream], schema.LOG_BYTES, error_owner=error_owner) + preview = raw_log[:512] + schema.need(schema.canonical(snapshot) == schema.canonical(receipt[stream]) and snapshot['path'] == row[stream]['path'] and + snapshot['bytes_before'] == snapshot['bytes_after'] == snapshot['prefix_bytes_hashed'] == row[stream]['bytes'] and + snapshot['prefix_sha256'] == snapshot['complete_file_sha256'] == row[stream]['sha256'] and + snapshot['stable_during_snapshot'] is True and + snapshot['raw_finality'] == 'DIRECT_CHILD_EXIT0_AND_STABLE_COMPLETED_LOG' and + snapshot['preview_bytes'] == _LEN(preview) and snapshot['preview_utf8'] == preview.decode('utf-8', errors='replace'), + 'complete original raw log/preview differs') + raw_journal = copying.read_verified(row['journal'], schema.JOURNAL_BYTES, error_owner=error_owner) + lines = raw_journal.splitlines(keepends=True) + schema.need(_LEN(lines) == 3 and all(line.endswith(b'\n') for line in lines), 'missing/extra/retried original journal') + events = [_decode_original(line, 65536) for line in lines] + for kind, event in zip(('PRELAUNCH_INTENT', 'STARTED', 'EXIT0_LOGS_STABLE_PENDING_SOURCE_CUSTODY'), events): + _event(event, kind, expected, row, context, attempt['process_id']) + schema.need(schema.canonical(events[-1]) == schema.canonical(attempt), 'original final journal/attempt differs') + return {'schema': 'h25-original-build-data-authentication-v3', 'role': row['role'], + 'original_build_record_sha256': schema.sha(schema.canonical(row)), + 'original_receipt_sha256': row['original_receipt']['sha256'], + 'original_helper_sha256': ORIGINAL_HELPER_SHA256, + 'actual_parent_launch_terminal_custody_binding_still_required': True, 'not_runtime_authority': True} diff --git a/research/h25-v03-authenticated-prefix-entry/prerequisites/parent_closure_v1.py.txt b/research/h25-v03-authenticated-prefix-entry/prerequisites/parent_closure_v1.py.txt new file mode 100644 index 0000000000..cd9b3758ac --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/prerequisites/parent_closure_v1.py.txt @@ -0,0 +1,271 @@ +"""Finite concrete receiver admission inside the original trusted parent. + +This verifies pinned source, bytecode derived from those bytes without executing +them, concrete local import edges, and the current captured object graph. It is +not a new Python sandbox or proof of the initial OS/interpreter/native memory. +The original parent must load these exact modules through its admitted bootstrap +before adverse input. No user supplied arbitrary checker is accepted. +""" +import ast +import builtins +import __future__ +import copy +import dataclasses +import fcntl +import gc +import hashlib +import json +import marshal +import math +import os +import pathlib +import posix +import resource +import signal +import struct +import subprocess +import sys +import time +import types +import epoch_schema_v5 as schema +import epoch_copy_v5 as copying + +_TYPE, _LEN, _COMPILE = type, len, compile +_MODULE_DICT = types.ModuleType.__dict__['__dict__'].__get__ +_FUNCTION_GETTERS = tuple(types.FunctionType.__dict__[name].__get__ for name in + ('__code__', '__globals__', '__builtins__', '__defaults__', '__kwdefaults__', '__closure__', '__dict__')) +_CELL_GET = types.CellType.__dict__['cell_contents'].__get__ +_CLASS_DICT = type.__dict__['__dict__'].__get__ +_STATIC_FUNCTION = staticmethod.__dict__['__func__'].__get__ +_CLASS_FUNCTION = classmethod.__dict__['__func__'].__get__ +_SOURCE_RECEIVERS = [] +_STDLIB_MODULES = {name: module for name, module in tuple(sys.modules.items()) + if _TYPE(name) is str and _TYPE(module) is types.ModuleType} +MAX_MODULES = 48 +MAX_GLOBALS = 512 + +# These exact registries are intentionally mutated only by their original +# source. Their object identities are still checked. Private-state sabotage +# by code already running in this trusted parent remains outside the boundary. +_MUTABLE_NAMES = { + 'v03_prefix_supervisor_v1': ('_PREFIX', '_UNKNOWN_OWNER'), + 'epoch_parent_v5': ('_RESERVED_EPOCHS', '_PARENT_OWNERS'), + 'epoch_schema_v5': ('_ERROR_OWNERS',), + 'epoch_stop_v5': ('_SINK_REGISTRY',), + 'parent_domain_v1': ('_DOMAINS',), + 'parent_completion_v1': ('_PARENTS', '_PROCESS'), + 'parent_closure_v1': ('_SOURCE_RECEIVERS',), +} +_GATE_SUFFIXES = ('CONFIGURATION', 'SOURCE_REVIEW', 'EXECUTION_APPROVAL', 'FUNDING', + 'STAGE_APPROVAL', 'COMMAND_APPROVAL', 'VALIDATION_EXECUTION') + + +def _namespace(module): + schema.need(_TYPE(module) is types.ModuleType, 'exact original module required') + namespace = _MODULE_DICT(module, types.ModuleType) + schema.need(_TYPE(namespace) is dict and _LEN(namespace) <= MAX_GLOBALS, + 'original module namespace bound differs') + for key in namespace: + schema.text(key, 256) + return namespace + + +def _function_record(function): + schema.need(_TYPE(function) is types.FunctionType, 'exact source function required') + values = tuple(getter(function, types.FunctionType) for getter in _FUNCTION_GETTERS) + closure = values[5] + cells = () if closure is None else tuple((cell, _CELL_GET(cell, types.CellType)) for cell in closure) + schema.need(_LEN(cells) <= 64, 'source function closure bound exceeded') + return function, values, cells + + +def _function_check(record): + function, values, cells = record + schema.need(_TYPE(function) is types.FunctionType, 'source function identity changed') + for getter, expected in zip(_FUNCTION_GETTERS, values): + schema.need(getter(function, types.FunctionType) is expected, + 'source function code/globals/builtins/defaults/closure/dict changed') + for cell, expected in cells: + schema.need(_CELL_GET(cell, types.CellType) is expected, 'source function closure contents changed') + + +def _codes(code, result): + result.setdefault(code.co_qualname, []).append(code) + for child in code.co_consts: + if _TYPE(child) is types.CodeType: + _codes(child, result) + + +def _data(value, depth=0): + """Snapshot literal data only; no foreign repr/hash/eq/iteration protocols.""" + schema.need(depth <= 32, 'literal snapshot depth exceeded') + kind = _TYPE(value) + if value is None or kind in (str, int, bool, bytes, float): + return (kind, value) + if kind in (list, tuple): + schema.need(_LEN(value) <= 65536, 'literal sequence bound exceeded') + return (kind, tuple(_data(item, depth + 1) for item in value)) + if kind is dict: + schema.need(_LEN(value) <= 8192, 'literal mapping bound exceeded') + for key in value: + schema.need(_TYPE(key) in (str, int), 'nonliteral mapping key') + return (kind, tuple((_data(key, depth + 1), _data(item, depth + 1)) + for key, item in value.items())) + if kind in (set, frozenset): + schema.need(_LEN(value) <= 8192 and all(_TYPE(item) in (str, int) for item in value), + 'nonliteral set value') + return (kind, frozenset(value)) + raise schema.EpochStop('not literal data') + + +def _validate_code(function, compiled_codes, namespace): + values = tuple(getter(function, types.FunctionType) for getter in _FUNCTION_GETTERS) + code = values[0] + schema.need(values[1] is namespace and values[2] is builtins.__dict__, + 'source function original namespace/builtins differs') + candidates = compiled_codes.get(code.co_qualname, ()) + encoded = marshal.dumps(code) + schema.need(any(marshal.dumps(expected) == encoded for expected in candidates), + 'receiving function bytecode differs from pinned source') + + +def bind_receivers(modules, source_policy, error_owner): + """Only the source-fixed original parent calls this before child launch. + + source_policy is a separately pinned, prelaunch source inventory, never a + report supplied by a child. The two producer-specific validators have fixed + names; unsupported or absent variant source cannot be substituted by a + callable argument. Every received module must be listed in the policy. + """ + schema.owner_state(error_owner) + schema.need(_TYPE(modules) is dict and 1 <= _LEN(modules) <= MAX_MODULES and + _TYPE(source_policy) is dict, 'finite receiver module map required') + for name in modules: + schema.text(name, 128) + for name in source_policy: + schema.text(name, 128) + schema.need(set(modules) == set(source_policy), 'exact receiver closure differs') + records = [] + for name in sorted(modules): + module = modules[name] + namespace = _namespace(module) + pin = source_policy[name] + schema.blob(pin) + raw = copying.read_verified(pin, schema.FILE_BYTES, error_owner=error_owner) + schema.need(namespace.get('__name__') == name and namespace.get('__file__') == pin['path'], + 'original receiving module origin differs') + tree = ast.parse(raw, filename=pin['path']) + compiled = _COMPILE(raw, pin['path'], 'exec', dont_inherit=True, optimize=sys.flags.optimize) + compiled_codes = {} + _codes(compiled, compiled_codes) + functions, classes, literals, imports = [], [], [], [] + for node in tree.body: + if _TYPE(node) is ast.FunctionDef: + function = namespace[node.name] + _validate_code(function, compiled_codes, namespace) + functions.append(_function_record(function)) + elif _TYPE(node) is ast.ClassDef: + cls = namespace[node.name] + schema.need(_TYPE(cls) is type, 'source class type differs') + class_namespace = _CLASS_DICT(cls, type) + for item in node.body: + if _TYPE(item) is ast.FunctionDef: + method = class_namespace[item.name] + # The currently selected explicit methods have no + # property/classmethod/staticmethod decorators. + schema.need(not item.decorator_list, 'unreviewed decorated receiver method') + # Python implicitly wraps __new__ and two class hooks. + # No arbitrary descriptor protocol is invoked. + if item.name == '__new__' and _TYPE(method) is staticmethod: + method = _STATIC_FUNCTION(method, staticmethod) + elif item.name in ('__init_subclass__', '__class_getitem__') and _TYPE(method) is classmethod: + method = _CLASS_FUNCTION(method, classmethod) + _validate_code(method, compiled_codes, namespace) + functions.append(_function_record(method)) + # Dataclass-generated methods are part of the inherited + # dataclasses/initial-parent trust, not compiled from this + # class body. Their actual original code/environment remains + # captured and checked; they cannot be changed after capture. + for method in class_namespace.values(): + if _TYPE(method) is types.FunctionType and not any(method is r[0] for r in functions): + functions.append(_function_record(method)) + classes.append((cls, tuple(class_namespace.items()))) + elif _TYPE(node) in (ast.Import, ast.ImportFrom): + for alias in node.names: + schema.need(alias.name != '*', 'star receiver import unsupported') + if _TYPE(node) is ast.Import: + source_name = alias.name + local_name = alias.asname or source_name.split('.')[0] + expected = modules.get(source_name, _STDLIB_MODULES.get(source_name)) + else: + source_name = node.module + schema.need(node.level == 0, 'relative receiver import unsupported') + local_name = alias.asname or alias.name + source_module = modules.get(source_name, _STDLIB_MODULES.get(source_name)) + schema.need(source_module is not None, 'receiver import dependency absent') + expected = _namespace(source_module).get(alias.name) + schema.need(expected is not None and namespace.get(local_name) is expected, + 'concrete receiving import identity differs') + imports.append((local_name, expected)) + elif _TYPE(node) is ast.Assign: + if _LEN(node.targets) != 1 or _TYPE(node.targets[0]) is not ast.Name: + continue + key = node.targets[0].id + if key in _MUTABLE_NAMES.get(name, ()) or key.endswith(_GATE_SUFFIXES): + continue + try: + literal = ast.literal_eval(node.value) + except (ValueError, TypeError, SyntaxError): + continue + schema.need(_data(namespace[key]) == _data(literal), 'receiver literal differs from source') + literals.append((key, _data(literal))) + for function in namespace.values(): + if _TYPE(function) is types.FunctionType and not any(function is r[0] for r in functions): + functions.append(_function_record(function)) + records.append((name, module, namespace, pin, tuple(namespace.items()), + tuple(functions), tuple(classes), tuple(literals), tuple(imports))) + capability = object() + packet = (capability, tuple(records), error_owner) + schema.need(_LEN(_SOURCE_RECEIVERS) < 2, 'receiver closure finite parent bound exceeded') + _SOURCE_RECEIVERS.append(packet) + check_receivers(capability) + return capability + + +def _packet(capability): + schema.need(_TYPE(capability) is object, 'exact receiver capability required') + for packet in _SOURCE_RECEIVERS: + if packet[0] is capability: + return packet + raise schema.EpochStop('unknown original receiver closure') + + +def check_receivers(capability): + packet = _packet(capability) + for name, module, namespace, pin, original_items, functions, classes, literals, imports in packet[1]: + schema.need(_namespace(module) is namespace and _LEN(namespace) == _LEN(original_items), + 'receiver namespace identity/census changed') + for key, expected in original_items: + schema.need(namespace.get(key) is expected, 'receiver namespace binding changed') + for record in functions: + _function_check(record) + for cls, items in classes: + current = _CLASS_DICT(cls, type) + schema.need(_LEN(current) == _LEN(items), 'receiver class census changed') + for key, expected in items: + schema.need(current.get(key) is expected, 'receiver class binding changed') + for key, expected in literals: + schema.need(_data(namespace[key]) == expected, 'receiver literal data changed') + copying.verify(pin, error_owner=packet[2]) + return None + + +def receiver(capability, module_name, name): + """Return only a specifically named original from the registered closure.""" + schema.text(module_name, 128) + schema.text(name, 128) + for row in _packet(capability)[1]: + if row[0] == module_name: + schema.need(name in row[2], 'fixed receiving entry missing') + return row[2][name] + raise schema.EpochStop('fixed receiving module missing') diff --git a/research/h25-v03-authenticated-prefix-entry/prerequisites/parent_completion_v1.py.txt b/research/h25-v03-authenticated-prefix-entry/prerequisites/parent_completion_v1.py.txt new file mode 100644 index 0000000000..3191be7570 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/prerequisites/parent_completion_v1.py.txt @@ -0,0 +1,880 @@ +"""Source-only two-producer completion owner for one future guarded parent. + +No configuration or execution gate is installed. The original trusted parent +must authenticate this source, its exact receiver closure and initial OS/runtime +before importing it. Capabilities are process local. This component never +invokes run_guarded, a queue wrapper, a global ledger writer, or a child report +as authority. The enclosing single orchestrator pays this entire component +once, including all child, validation, retention, failure and final-exit costs. +""" +import fcntl +import os +import resource +import signal +import stat +import subprocess +import sys +import time +import epoch_schema_v5 as schema +import epoch_copy_v5 as copying +import epoch_parent_v5 as epoch +import parent_closure_v1 as closure +import parent_domain_v1 as domain +import group01_evidence_v1 as group01 + +CONFIGURATION = None +SOURCE_REVIEW = None +STAGE_APPROVAL = None +COMMAND_APPROVAL = None +FUNDING = None +EXECUTION_APPROVAL = None + +FLAGS = ('-S', '-s', '-P', '-B') +ENV = {'PATH': '/usr/bin:/bin', 'PYTHONHASHSEED': '0', 'LANG': 'C.UTF-8', + 'LC_ALL': 'C.UTF-8', 'TZ': 'UTC', 'PYTHONDONTWRITEBYTECODE': '1'} +_TYPE, _LEN = type, len +_OPEN, _CLOSE, _MKDIR, _STAT, _SCANDIR = os.open, os.close, os.mkdir, os.stat, os.scandir +_POPEN = subprocess.Popen +_CLOCK, _SLEEP = time.monotonic, time.sleep +_SETRLIMIT, _GETRLIMIT = resource.setrlimit, resource.getrlimit +_SETTIMER, _GETTIMER = signal.setitimer, signal.getitimer +_SIGNAL, _GETSIGNAL = signal.signal, signal.getsignal +_PARENTS = [] +_PROCESS = [None] +# Shared before the first constructor read, including failures before a parent +# capability can be published. No mode can replace or reset this owner. +_UNKNOWN_OWNER = {'quarantine': [False], 'pending': [False], + 'iterator_uncertain': [False], 'primary': [None], + 'native_errors': [None] * 4} +_EPOCH_ENTRY = epoch._entry_state +_EPOCH_RESERVE = epoch.ParentEpoch.reserve_producer +_EPOCH_ACCEPT = epoch.ParentEpoch.accept_completed_producer +_EPOCH_COMPLETION = epoch.ParentCompletion +_EPOCH_COMMIT = epoch.ParentEpoch.commit_exports +_EPOCH_CLOSE = epoch.ParentEpoch.close +MAX_SOURCE_FILES = 8192 +MAX_STAGE_ENTRIES = 16384 +MAX_RAW_VARIANT_FILES = 64 +VARIANT_MODULE = 'variant_validation_v1' +VARIANT_FUNCTION = 'validate_variant_producer' +MAX_VARIANT_RAW_BYTES = 32 * 1024 * 1024 +# Source-literal inventory copied from the separately pinned concrete interface. +VARIANT_FILES = ('initial-tcb.raw.json', 'initial-controls.raw.json', 'initial-restoration.raw.json', 'root-before.raw.json', 'preflight-before.raw.json', 'custody-before.raw.json', 'pyinit_failure/control.attempt.json', 'pyinit_failure/control.attempt.jsonl', 'pyinit_failure/control.stdout.raw', 'pyinit_failure/control.stderr.raw', 'pyinit_failure/helper-return.raw.json', 'pyinit_failure/build.json', 'pyinit_failure/_h25_dict_probe.cpython-312-x86_64-linux-gnu.so', 'pyinit_failure/elf.raw.json', 'exec_failure/control.attempt.json', 'exec_failure/control.attempt.jsonl', 'exec_failure/control.stdout.raw', 'exec_failure/control.stderr.raw', 'exec_failure/helper-return.raw.json', 'exec_failure/build.json', 'exec_failure/_h25_dict_probe.cpython-312-x86_64-linux-gnu.so', 'exec_failure/elf.raw.json', 'preflight-after.raw.json', 'custody-after.raw.json', 'root-after.raw.json', 'receipt.json') +VARIANT_GROUPS = ('initial-tcb.raw.json', 'initial-controls.raw.json', 'initial-restoration.raw.json', 'root-before.raw.json', 'preflight-before.raw.json', 'custody-before.raw.json', 'pyinit_failure/helper-return.raw.json', 'pyinit_failure/elf.raw.json', 'exec_failure/helper-return.raw.json', 'exec_failure/elf.raw.json', 'preflight-after.raw.json', 'custody-after.raw.json', 'root-after.raw.json') +REQUIRED_MODULES = ( + 'epoch_schema_v5', 'epoch_copy_v5', 'epoch_parent_v5', 'epoch_stop_v5', + 'original_build_provenance_v5', 'h25_parent_supervisor', 'parent_closure_v1', + 'parent_domain_v1', 'parent_completion_v1', 'group01_evidence_v1', + 'group01_original_predicates_v1', 'receipt_contract_v1', 'native_field_controls_v1', + 'transport_controls_v1', 'collector_controls_v1', 'elf_literal_fixture_v1', + 'elf_controls_v1', 'provider_controls_v1', 'run_pure_controls_v1', + 'elf_literal_fixture_v2', 'elf_extended_controls_v2', 'run_pure_controls_v2', + 'restoration_contract_v1', 'loader_model_controls_v1', 'driver_model_body_sources_v3', + 'root_model_body_sources_v3', 'loader_model_controls_v3', 'group_evidence_v5', + 'close_model_controls_v5', 'projection_model_controls_v5', 'run_controls_v5', + 'variant_validation_v1', 'sealed_elf_profile_v2') + + +class ParentDeadline(RuntimeError): + pass + + +def _alarm(signum, frame): + raise ParentDeadline('owned producer deadline including Popen/preexec') + + +def _gate(): + schema.exact(CONFIGURATION, ('plans', 'receiver_policy', 'checker_source')) + schema.exact(CONFIGURATION['plans'], ('normal', 'optimized')) + for pin in tuple(CONFIGURATION['plans'].values()) + (CONFIGURATION['receiver_policy'], CONFIGURATION['checker_source']): + schema.blob(pin, schema.RECORD_BYTES) + for record, key in ((SOURCE_REVIEW, 'review_sha256'), (STAGE_APPROVAL, 'stage_review_sha256'), + (COMMAND_APPROVAL, 'command_review_sha256'), (FUNDING, 'reservation_sha256'), + (EXECUTION_APPROVAL, 'external_launch_policy_sha256')): + schema.exact(record, (key,)) + schema.digest(record[key]) + + +def _state(capability): + schema.need(_TYPE(capability) is object, 'exact parent capability required') + for token, state in _PARENTS: + if token is capability: + return state + raise schema.EpochStop('unregistered parent completion owner') + + +def _receiver_gate_values(receivers): + # Fail before any producer if the concrete downstream parsers are still + # source-only. These stronger parent envelopes are installed by the + # independently authenticated original bootstrap; hashes alone grant none. + specifications = ( + ('original_build_provenance_v5', 'PARSER_CONFIGURATION', + ('leaf_policy_sha256', 'configuration_sha256', 'original_helper_sha256')), + ('original_build_provenance_v5', 'PARSER_EXECUTION_APPROVAL', ('external_launch_policy_sha256',)), + ('original_build_provenance_v5', 'PARSER_FUNDING', ('reservation_sha256',)), + ('variant_validation_v1', 'VALIDATION_CONFIGURATION', ('leaf_policy_sha256', 'configuration_sha256')), + ('variant_validation_v1', 'VALIDATION_SOURCE_REVIEW', ('review_sha256',)), + ('variant_validation_v1', 'VALIDATION_EXECUTION', ('external_launch_policy_sha256',)), + ('variant_validation_v1', 'VALIDATION_FUNDING', ('reservation_sha256',))) + result = {} + for module, name, keys in specifications: + value = closure.receiver(receivers, module, name) + schema.exact(value, keys) + for item in value.values(): + schema.digest(item) + result[module + '.' + name] = schema.plain_copy(value) + schema.need(result['original_build_provenance_v5.PARSER_CONFIGURATION']['original_helper_sha256'] == + 'aa0a315110e031e19291970c9611fe5e0f91465fa20eaec51e81186099563f78', + 'original helper source protocol differs before producer launch') + return result + + +def _guard(state): + _gate() + schema.need(state['phase'] not in ('STOP', 'CLOSED'), 'parent completion owner is terminal') + domain.refresh_unknown_owner(state['unknown_owner']) + schema.need(state['io_quarantine'][0] is False and state['unknown_owner']['pending'][0] is False and + state['unknown_owner']['iterator_uncertain'][0] is False and + state['unknown_owner']['primary'][0] is None, + 'parent I/O ownership requires kernel teardown') + schema.need(os.getpid() == state['pid'], 'parent capability cannot cross exec/process') + schema.need(_POPEN is subprocess.Popen and _OPEN is os.open and _CLOSE is os.close and + _SETRLIMIT is resource.setrlimit and _GETRLIMIT is resource.getrlimit and + _CLOCK is time.monotonic and _SETTIMER is signal.setitimer and + _GETTIMER is signal.getitimer and _SIGNAL is signal.signal and + _GETSIGNAL is signal.getsignal, + 'original parent runtime primitive binding changed') + schema.need(epoch._entry_state is _EPOCH_ENTRY and epoch.ParentEpoch.reserve_producer is _EPOCH_RESERVE and + epoch.ParentEpoch.accept_completed_producer is _EPOCH_ACCEPT and + epoch.ParentCompletion is _EPOCH_COMPLETION and epoch.ParentEpoch.commit_exports is _EPOCH_COMMIT and + epoch.ParentEpoch.close is _EPOCH_CLOSE, 'original epoch receiving entry changed') + closure.check_receivers(state['receivers']) + schema.need(_receiver_gate_values(state['receivers']) == state['receiver_gate_snapshot'], + 'independently installed receiver gates changed') + for key in ('plan', 'receiver_policy', 'checker_source'): + current = CONFIGURATION['plans'][state['plan']['mode']] if key == 'plan' else CONFIGURATION[key] + schema.need(current == state['configuration'][key], 'configured source binding changed') + copying.verify(state['configuration'][key], error_owner=state['errors']) + schema.need(_CLOCK() <= state['shared_deadline'], 'complete parent reservation deadline exceeded') + + +def _stop(state, operation, primary): + # No formatting or instance dispatch on an exception. Capture failure is + # separate, never a reason to replace the already delivered primary. + state['phase'] = 'STOP' + # The shared slot was stored inline at the first delivered local/domain + # failure, before any optional retention helper or cleanup call. + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = primary + elif state['unknown_owner']['primary'][0] is not primary: + if state['fallback'][4] is None: + state['fallback'][4] = primary + primary = state['unknown_owner']['primary'][0] + if state['stop'][0] is None: + state['stop'][0] = primary + state['stop'][1] = operation + try: + domain.refresh_unknown_owner(state['unknown_owner']) + except BaseException as error: + # Failure even to inspect retained ownership cannot permit a writer. + state['io_quarantine'][0] = True + if state['fallback'][5] is None: + state['fallback'][5] = error + try: + schema.retain_primary(state['errors'], primary, operation) + except BaseException as error: + state['fallback'][0] = error + # An uncertain native acquisition prevents further diagnostic I/O. The + # outer guard must retain memory state and observe kernel parent teardown. + if (state['directory_created'] and not state['stop_write_attempted'] and not state['io_quarantine'][0] and + not state['unknown_owner']['pending'][0] and not state['unknown_owner']['iterator_uncertain'][0] and + not (_PROCESS[0] is not None and _PROCESS[0]['acquisition_in_flight'])): + try: + state['stop_write_attempted'] = True + record = {'schema': 'h25-parent-completion-stop-v1', 'operation': operation, + 'epoch_id': state['plan']['epoch_id'], 'mode': state['plan']['mode'], + 'status': 'STOP', 'retry_or_restore_allowed': False, + 'error': schema.error_snapshot(state['errors']), + 'domain_obligations_may_be_incomplete': True, + 'enclosing_guard_must_observe_parent_exit': True} + state['stop_file'] = copying.write_once(state['plan']['session_directory'] + '/STOP.json', + schema.canonical(record), error_owner=state['errors']) + except BaseException as error: + state['fallback'][1] = error + + +def _snapshot_sources(plan, error_owner): + schema.need(_TYPE(plan['source_files']) is list and 1 <= _LEN(plan['source_files']) <= MAX_SOURCE_FILES, + 'complete prelaunch source inventory bound differs') + rows, paths, categories = [], set(), set() + for expected in plan['source_files']: + schema.exact(expected, ('category', 'path', 'sha256', 'bytes', 'mode')) + schema.choice(expected['category'], ('parent', 'root', 'provider', 'driver', 'project', + 'system_headers', 'compiler_link', 'oracle', 'stage')) + schema.path(expected['path']) + schema.digest(expected['sha256']) + schema.integer(expected['bytes'], 1, schema.FILE_BYTES) + schema.integer(expected['mode'], 0, 0o7777) + schema.need(expected['path'] not in paths, 'duplicate prelaunch source path') + paths.add(expected['path']) + categories.add(expected['category']) + actual = copying.inspect(expected['path'], schema.FILE_BYTES, error_owner=error_owner) + schema.need(actual['sha256'] == expected['sha256'] and actual['bytes'] == expected['bytes'] and + actual['identity']['mode'] & 0o7777 == expected['mode'], 'source/profile/closure changed') + rows.append(actual) + schema.need(categories == {'parent', 'root', 'provider', 'driver', 'project', 'system_headers', + 'compiler_link', 'oracle', 'stage'}, 'a mandatory source category is absent') + return rows + + +def _tree(root, state): + """Bounded exact stage census; all actual file contents are separately read.""" + schema.path(root) + pending, files, directories = [('', root)], [], [] + count = 0 + while pending: + schema.need(state['io_quarantine'][0] is False and state['unknown_owner']['pending'][0] is False and + state['unknown_owner']['iterator_uncertain'][0] is False, + 'stage census cannot acquire after uncertain ownership') + relative, current = pending.pop() + before = _STAT(current, follow_symlinks=False) + schema.need(stat.S_ISDIR(before.st_mode) and not before.st_mode & 0o222, + 'immutable stage directory kind/mode differs') + entries, primary = None, None + state['unknown_owner']['pending'][0] = True + try: + entries = _SCANDIR(current) + state['unknown_owner']['pending'][0] = False + for entry in entries: + count += 1 + schema.need(count <= MAX_STAGE_ENTRIES, 'stage census bound exceeded') + name = entry.name + schema.need(_TYPE(name) is str and name not in ('.', '..') and '/' not in name, + 'stage entry name differs') + child = name if not relative else relative + '/' + name + info = entry.stat(follow_symlinks=False) + if stat.S_ISREG(info.st_mode): + files.append(child) + elif stat.S_ISDIR(info.st_mode): + directories.append(child) + pending.append((child, current + '/' + name)) + else: + raise schema.EpochStop('stage has symlink or special file') + except BaseException as error: + primary = error + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['io_quarantine'][0] = True + state['unknown_owner']['iterator_uncertain'][0] = True + state['fallback'][2] = error + raise + finally: + if entries is not None: + owned = entries + entries = None + try: + owned.close() + except BaseException as error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['io_quarantine'][0] = True + state['unknown_owner']['iterator_uncertain'][0] = True + state['fallback'][3] = error + if primary is None: + raise + after = _STAT(current, follow_symlinks=False) + schema.need((before.st_dev, before.st_ino, before.st_mode, before.st_mtime_ns, before.st_ctime_ns) == + (after.st_dev, after.st_ino, after.st_mode, after.st_mtime_ns, after.st_ctime_ns), + 'stage directory changed during census') + return sorted(files), sorted(directories) + + +def _stage(plan, error_owner, state): + copying.verify(plan['stage_manifest'], error_owner=error_owner) + raw = copying.read_verified(plan['stage_manifest'], schema.RECORD_BYTES, error_owner=error_owner) + declared = group01.decode(raw) + schema.need(_TYPE(declared.get('files')) is dict and + plan['stage_manifest']['path'] == plan['stage_directory'] + '/STAGE.json', + 'independent stage manifest origin differs') + files, directories = _tree(plan['stage_directory'], state) + schema.need(files == sorted(list(declared['files']) + ['STAGE.json']) and + directories == plan['stage_directories'], 'complete immutable stage census differs') + source_by_path = {row['path']: row for row in plan['source_files']} + for relative, expected in declared['files'].items(): + schema.need(_TYPE(relative) is str and not relative.startswith('/') and + all(part not in ('', '.', '..') for part in relative.split('/')), + 'stage relative path differs') + path = plan['stage_directory'] + '/' + relative + schema.need(path in source_by_path and expected == + {'sha256': source_by_path[path]['sha256'], 'mode': source_by_path[path]['mode']}, + 'stage file absent from independently fixed current source closure') + return {'manifest': plan['stage_manifest'], 'file_count': len(files), 'directories': directories} + + +def _validate_plan(plan): + schema.exact(plan, ('schema', 'epoch_id', 'mode', 'round_root', 'session_directory', + 'session_seconds', 'source_closure_admission_sha256', 'source_files', 'producers')) + schema.need(plan['schema'] == 'h25-parent-completion-plan-v1', 'parent plan schema differs') + schema.label(plan['epoch_id']) + schema.choice(plan['mode'], ('normal', 'optimized')) + schema.path(plan['round_root']) + schema.path(plan['session_directory']) + schema.integer(plan['session_seconds'], 1, 600) + schema.digest(plan['source_closure_admission_sha256']) + schema.exact(plan['producers'], ('group01', 'failure_variants')) + for role in schema.PRODUCERS: + row = plan['producers'][role] + schema.exact(row, ('epoch_plan', 'command', 'cwd', 'output', 'evidence_directory', + 'stage_directory', 'stage_manifest', 'stage_directories', 'launch_binding', 'launch_nonce', + 'root_seconds', 'address_space_bytes', 'rss_bytes', 'evidence_plan', 'launch_artifacts')) + epoch._plan(row['epoch_plan'], role) + schema.launch(row['launch_binding']) + schema.text(row['launch_nonce'], 64) + schema.need(_LEN(row['launch_nonce']) == 64 and + all(c in '0123456789abcdef' for c in row['launch_nonce']), 'one-use launch nonce differs') + for key in ('cwd', 'output', 'evidence_directory', 'stage_directory'): + schema.path(row[key]) + schema.blob(row['stage_manifest'], schema.RECORD_BYTES) + schema.need(row['stage_manifest']['sha256'] == row['epoch_plan']['stage_sha256'] == + row['launch_binding']['stage_sha256'], 'independent producer stage pins differ') + schema.need(row['launch_binding']['root_sha256'] == row['epoch_plan']['root_sha256'], + 'independent producer root pins differ') + schema.integer(row['root_seconds'], 1, 180) + schema.integer(row['address_space_bytes'], 1, 1024 ** 3) + schema.integer(row['rss_bytes'], 1, 1024 ** 3) + command = row['command'] + schema.need(_TYPE(command) is list and 6 <= _LEN(command) <= 128, 'bounded original root argv required') + for argument in command: + schema.text(argument, 8192) + schema.need(bool(argument), 'empty root argument') + prefix = ['/usr/bin/python3.12', *FLAGS] + (['-O'] if plan['mode'] == 'optimized' else []) + schema.need(command[:len(prefix)] == prefix, 'original root interpreter/flags/mode differs') + entry = command[len(prefix)] + schema.path(entry) + schema.need(entry.startswith(row['stage_directory'] + '/') and + entry == row['stage_directory'] + '/integration/full_driver.py', + 'source-fixed genuine root entry differs') + schema.need(command.count('--output') == 1 and + command[command.index('--output') + 1] == row['output'], 'independent root output differs') + args = command[len(prefix) + 1:] + schema.need(len(args) >= 11 and args[0] == '--root-sha256' and args[2] == '--provider' and + args[5] == '--driver' and args[8] == '--integration' and args[10] == '--', + 'original bootstrap argv positions differ') + by_path = {item['path']: item for item in plan['source_files']} + integration = row['stage_directory'] + '/integration' + schema.need(args[1] == row['epoch_plan']['root_sha256'] and args[9] == integration and + args[3].rsplit('/', 1)[0] == args[6].rsplit('/', 1)[0] == integration, + 'actual root/provider/driver source origins differ') + for path, digest, category in ((entry, args[1], 'root'), (args[3], args[4], 'provider'), + (args[6], args[7], 'driver')): + schema.need(path in by_path and by_path[path]['sha256'] == digest and + by_path[path]['category'] == category, 'bootstrap hash not in independent source closure') + schema.exact(row['launch_artifacts'], ('configuration_sha256', 'startup_tcb_sha256', 'expected_history_sha256')) + for key, pin in row['launch_artifacts'].items(): + schema.blob(pin, schema.RECORD_BYTES) + schema.need(pin['sha256'] == row['launch_binding'][key] and pin['path'] in by_path and + by_path[pin['path']]['sha256'] == pin['sha256'] and + by_path[pin['path']]['bytes'] == pin['bytes'], 'launch data binding lacks actual source pin') + evidence = row['evidence_plan'] + if role == 'group01': + schema.need(command.count('--finite-only') == 1 and command.count('--lanes') == 1 and + command[command.index('--lanes') + 1] == 'candidate', 'Group01 must use original finite candidate route') + schema.need(evidence['mode'] == plan['mode'] and evidence['generation'] == row['epoch_plan']['generation'] and + evidence['stage_sha256'] == row['epoch_plan']['stage_sha256'] and + evidence['root_sha256'] == args[1] and evidence['driver_sha256'] == args[7], + 'Group01 evidence expectation not bound to actual independent launch') + else: + schema.need(args[11:] == ['--output', row['output'], '--generation', row['epoch_plan']['generation'], + '--launch-nonce', row['launch_nonce']], 'variant exact tail argv differs') + schema.need(args[1] == 'f5a2d33f2b4d3651f214156a0e7094c2bb516ce2d5ab7698d18c11f98f35dee0' and + args[3] == integration + '/probe_binding_v3.py' and + args[4] == '9cbb7368f89e71d1e6cc46db5dc77efed3e03ed2a801c98c88fe316e4d9f3ef2' and + args[6] == integration + '/variant_driver_v1.py', 'variant genuine original bootstrap differs') + schema.need(evidence['binding'] == {'mode': plan['mode'], 'generation': row['epoch_plan']['generation'], + 'launch_nonce': row['launch_nonce']} and evidence['output'] == row['output'] and + evidence['stage_root'] == row['stage_directory'] and evidence['raw_file_names'] == list(VARIANT_FILES), + 'variant expectation not bound to actual independent launch') + schema.need(schema.sha(schema.canonical({'argv': command})) == row['epoch_plan']['command_sha256'] == + row['launch_binding']['command_sha256'], 'independent exact root command digest differs') + schema.need(row['evidence_directory'] == plan['session_directory'] + '/' + role and + row['output'] == row['evidence_directory'] + '/producer-output', + 'source-fixed private producer origins differ') + schema.need(plan['producers']['group01']['launch_nonce'] != plan['producers']['failure_variants']['launch_nonce'], + 'producer exec launch nonce reused') + + +def make_parent(original_epoch, original_authority, original_receivers): + _gate() + schema.need(_LEN(_PARENTS) < 2, 'finite two-mode parent owner bound exceeded') + # A second mode shares the same process and therefore the same unknown + # resources. Check before the first configuration read can acquire an FD. + for unused, prior in _PARENTS: + owner = prior['unknown_owner'] + domain.refresh_unknown_owner(owner) + schema.need(prior['phase'] != 'STOP' and owner['primary'][0] is None and + owner['quarantine'][0] is False and owner['pending'][0] is False and + owner['iterator_uncertain'][0] is False, + 'prior parent failure forbids a new mode or configuration read') + schema.need(_PROCESS[0] is None or _PROCESS[0]['acquisition_in_flight'] is False, + 'uncertain process-owned lock acquisition requires kernel teardown') + owner = _UNKNOWN_OWNER + domain.refresh_unknown_owner(owner) + schema.need(owner['primary'][0] is None and owner['quarantine'][0] is False and + owner['pending'][0] is False and owner['iterator_uncertain'][0] is False, + 'earlier constructor failure prohibits configuration reads') + try: + errors = schema.make_error_owner() + native_index = 2 * len(_PARENTS) + owner['native_errors'][native_index] = schema.owner_state(errors) + original_state = _EPOCH_ENTRY(original_epoch, original_authority) + owner['native_errors'][native_index + 1] = schema.owner_state(original_state['_error_owner']) + domain.refresh_unknown_owner(owner) + schema.need(owner['quarantine'][0] is False, 'original V5 owner already requires teardown') + mode = original_state['_mode'] + schema.choice(mode, ('normal', 'optimized')) + schema.need(not any(item[1]['plan']['mode'] == mode for item in _PARENTS), 'mode parent already consumed') + configuration = schema.plain_copy({'plan': CONFIGURATION['plans'][mode], + 'receiver_policy': CONFIGURATION['receiver_policy'], 'checker_source': CONFIGURATION['checker_source']}) + plan = group01.decode(copying.read_verified(configuration['plan'], schema.RECORD_BYTES, error_owner=errors)) + _validate_plan(plan) + policy = group01.decode(copying.read_verified(configuration['receiver_policy'], schema.RECORD_BYTES, error_owner=errors)) + schema.need(set(policy) == set(REQUIRED_MODULES), 'exact fixed parent/producer receiving closure differs') + schema.need(policy['parent_completion_v1'] == configuration['checker_source'], + 'actual completion source differs from configured checker') + receivers = closure.bind_receivers(original_receivers, policy, errors) + receiver_gate_snapshot = _receiver_gate_values(receivers) + schema.need(closure.receiver(receivers, 'epoch_parent_v5', 'ParentEpoch') is epoch.ParentEpoch and + closure.receiver(receivers, 'epoch_schema_v5', 'need') is schema.need and + closure.receiver(receivers, 'epoch_copy_v5', 'inspect') is copying.inspect, + 'parent/checker epoch module identities differ') + source_guard = closure.receiver(receivers, 'h25_parent_supervisor', 'launch_contract') + source_guard() + closure.check_receivers(receivers) + original_state = _EPOCH_ENTRY(original_epoch, original_authority) + schema.need(original_state['_epoch_id'] == plan['epoch_id'] and original_state['_mode'] == plan['mode'] and + original_state['_state'] == 'PRODUCERS_PENDING' and + original_state['_plans'] == {role: row['epoch_plan'] for role, row in plan['producers'].items()} and + epoch.CONFIGURATION['parent_checker_sha256'] == configuration['checker_source']['sha256'], + 'original constructor registry is not this prelaunch epoch/plan/checker') + token = object() + state = {'pid': os.getpid(), 'phase': 'CONSTRUCTING', 'epoch': original_epoch, + 'authority': original_authority, 'errors': errors, 'plan': plan, 'configuration': configuration, + 'receivers': receivers, 'receiver_gate_snapshot': receiver_gate_snapshot, + 'runs': {}, 'next': 0, 'directory_created': False, + 'stop': [None, None], 'fallback': [None] * 8, 'stop_file': None, + 'stop_write_attempted': False, 'io_quarantine': owner['quarantine'], + 'unknown_owner': owner, + 'began': _CLOCK(), 'shared_deadline': _CLOCK() + plan['session_seconds'], + 'subreaper': None, 'native_keeper': None, 'lock_fds': [None, None], + 'lock_attempted': [False, False], 'initial_sources': None} + _PARENTS.append((token, state)) + except BaseException as error: + # Reserve the original error before another call or native cleanup. + # This also covers failures before _PARENTS receives a capability. + if owner['primary'][0] is None: + owner['primary'][0] = error + owner['quarantine'][0] = True + raise + try: + # Exclusive creation is the persistent no-restore marker. It is never + # deleted by this source; a crashed/partial same-plan session cannot run. + _MKDIR(plan['session_directory'], 0o700) + state['directory_created'] = True + if _PROCESS[0] is None: + process_record = {'pid': state['pid'], 'locks': [None, None], 'keeper': None, + 'subreaper': None, 'acquisition_in_flight': False} + _PROCESS[0] = process_record + for index, name in enumerate(('parent-queue.lock', 'science.lock')): + process_record['acquisition_in_flight'] = True + process_record['locks'][index] = _OPEN(plan['round_root'] + '/runtime/' + name, + os.O_RDWR | os.O_CREAT | os.O_CLOEXEC | os.O_NOFOLLOW, 0o600) + process_record['acquisition_in_flight'] = False + fcntl.flock(process_record['locks'][index], fcntl.LOCK_EX | fcntl.LOCK_NB) + installer = closure.receiver(receivers, 'h25_parent_supervisor', 'install_subreaper') + # Original installer has a concrete pinned source/TCB/native closure. + # Its path interface is the original pathlib.Path contract. + from pathlib import Path + subreaper, keeper = installer(Path(plan['round_root'])) + process_record['subreaper'], process_record['keeper'] = subreaper, keeper + process_record = _PROCESS[0] + schema.need(process_record['pid'] == state['pid'] and process_record['keeper'] is not None, + 'original same-process subreaper ownership missing') + state['subreaper'], state['native_keeper'] = process_record['subreaper'], process_record['keeper'] + closure.check_receivers(receivers) + state['initial_sources'] = _snapshot_sources(plan, errors) + copying.verify(configuration['checker_source'], error_owner=errors) + copying.write_once(plan['session_directory'] + '/PARENT-INTENT.json', + schema.canonical({'schema': 'h25-parent-completion-intent-v1', 'epoch_id': plan['epoch_id'], + 'mode': plan['mode'], 'configuration': configuration, 'parent_pid': state['pid'], + 'source_closure_admission_sha256': plan['source_closure_admission_sha256'], + 'retry_or_restore_allowed': False, 'accounting': 'nested non-additive; paid by one outer orchestrator'}), + error_owner=errors) + state['phase'] = 'READY' + _guard(state) + return token + except BaseException as primary: + _stop(state, 'make_parent', primary) + raise + + +def _close_logs(run, primary): + first = None + for index in range(2): + descriptor = run['log_fds'][index] + if descriptor is None or run['log_close_attempted'][index]: + continue + run['log_close_attempted'][index] = True + try: + _CLOSE(descriptor) + run['log_close_confirmed'][index] = True + except BaseException as error: + if run['unknown_owner']['primary'][0] is None: + run['unknown_owner']['primary'][0] = primary if primary is not None else error + run['unknown_owner']['quarantine'][0] = True + run['errors'][index] = error + if first is None: + first = error + if primary is None and first is not None: + raise first + + +def run_producer(owner_capability, producer_role): + state = _state(owner_capability) + try: + _guard(state) + schema.choice(producer_role, schema.PRODUCERS) + schema.need(state['phase'] == 'READY' and state['next'] < 2 and + producer_role == schema.PRODUCERS[state['next']] and producer_role not in state['runs'], + 'producer order, replay or prior completion differs') + except BaseException as primary: + _stop(state, 'run_producer_entry', primary) + raise + row = state['plan']['producers'][producer_role] + # Burn the actual epoch ticket before any later preparation or launch. + try: + ticket = _EPOCH_RESERVE(state['epoch'], state['authority'], producer_role) + run_token = object() + run = {'token': run_token, 'ticket': ticket, 'role': producer_role, 'phase': 'RESERVED', + 'unknown_owner': state['unknown_owner'], + 'plan': row, 'domain': None, 'process': None, 'root': None, 'terminal': None, + 'log_fds': [None, None], 'log_close_attempted': [False, False], + 'log_close_confirmed': [False, False], 'errors': [None] * 8, + 'primary': [None], 'acquisition_in_flight': False, 'spawn_entered': False, + 'spawn_returned': False, 'source_before': None, 'stage_before': None, + 'began': _CLOCK(), 'peak_rss': 0, 'file_limits': tuple(_GETRLIMIT(resource.RLIMIT_FSIZE))} + state['runs'][producer_role] = run + state['phase'] = 'PRODUCER_IN_FLIGHT' + except BaseException as primary: + _stop(state, 'run_producer_reservation', primary) + raise + primary = None + old_handler = None + alarm_installed = False + try: + _guard(state) + _MKDIR(row['evidence_directory'], 0o700) + # output remains absent; the genuine original Root creates it exclusively. + try: + _STAT(row['output'], follow_symlinks=False) + except FileNotFoundError: + pass + else: + raise schema.EpochStop('producer output already exists') + local_plan = dict(state['plan'], **row) + run['source_before'] = _snapshot_sources(state['plan'], state['errors']) + run['stage_before'] = _stage(local_plan, state['errors'], state) + # Reject oversized complete-custody records BEFORE any child launch. + run['source_bytes_before'] = _source_custody_bytes(state, run['source_before'], run['stage_before']) + for pin in row['launch_artifacts'].values(): + copying.verify(pin, schema.RECORD_BYTES, error_owner=state['errors']) + run['domain'] = domain.create_domain(state['unknown_owner']) + launch = {'schema': 'h25-owned-producer-launch-v1', 'epoch_id': state['plan']['epoch_id'], + 'mode': state['plan']['mode'], 'role': producer_role, + 'generation': row['epoch_plan']['generation'], 'launch_nonce': row['launch_nonce'], + 'parent_pid': state['pid'], 'command': row['command'], 'environment': ENV, 'cwd': row['cwd'], + 'launch_binding': row['launch_binding'], 'parent_file_limits': list(run['file_limits']), + 'new_session': True, 'close_fds': True, 'pass_fds': [], + 'root_seconds': row['root_seconds'], 'rss_bytes': row['rss_bytes'], + 'address_space_bytes': row['address_space_bytes']} + run['launch'] = copying.write_once(row['evidence_directory'] + '/LAUNCH.json', + schema.canonical(launch), error_owner=state['errors']) + for index, name in enumerate(('stdout.raw', 'stderr.raw')): + schema.need(state['io_quarantine'][0] is False and state['unknown_owner']['pending'][0] is False and + state['unknown_owner']['iterator_uncertain'][0] is False, + 'raw stream cannot acquire after uncertain ownership') + run['acquisition_in_flight'] = True + state['unknown_owner']['pending'][0] = True + run['log_fds'][index] = _OPEN(row['evidence_directory'] + '/' + name, + os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_CLOEXEC | os.O_NOFOLLOW, 0o600) + run['acquisition_in_flight'] = False + state['unknown_owner']['pending'][0] = False + setter, kind, limits = _SETRLIMIT, resource.RLIMIT_AS, (row['address_space_bytes'], row['address_space_bytes']) + def child_limit(): + setter(kind, limits) + schema.need(_GETTIMER(signal.ITIMER_REAL) == (0.0, 0.0), 'existing parent timer cannot be replaced') + old_handler = _GETSIGNAL(signal.SIGALRM) + _SIGNAL(signal.SIGALRM, _alarm) + alarm_installed = True + deadline = min(run['began'] + row['root_seconds'], state['shared_deadline'] - domain.CLEANUP_SECONDS) + schema.need(_CLOCK() < deadline, 'no funded root/cleanup interval remains') + _SETTIMER(signal.ITIMER_REAL, max(0.000001, deadline - _CLOCK())) + run['spawn_entered'] = True + run['process'] = _POPEN(row['command'], cwd=row['cwd'], env=dict(ENV), + stdout=run['log_fds'][0], stderr=run['log_fds'][1], stdin=subprocess.DEVNULL, + close_fds=True, pass_fds=(), start_new_session=True, preexec_fn=child_limit) + run['spawn_returned'] = True + run['root'] = domain.adopt_popen(run['domain'], run['process']) + while True: + unused, current = domain.observe(run['domain']) + run['peak_rss'] = max(run['peak_rss'], sum(item[6] for item in current)) + schema.need(run['peak_rss'] <= row['rss_bytes'], 'owned process RSS sum exceeded') + schema.need(max(_STAT(row['evidence_directory'] + '/' + name, follow_symlinks=False).st_size + for name in ('stdout.raw', 'stderr.raw')) <= schema.LOG_BYTES, 'root output bound exceeded') + if domain.poll_owned(run['domain']) is not None: + break + _SLEEP(0.01) + except BaseException as error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + primary = state['unknown_owner']['primary'][0] + run['primary'][0] = primary + if primary is not error: + run['errors'][4] = error + if (run['acquisition_in_flight'] or state['unknown_owner']['pending'][0] or + state['unknown_owner']['iterator_uncertain'][0] or _TYPE(error) is MemoryError): + state['io_quarantine'][0] = True + raise primary + finally: + # Preserve the first locally delivered primary through all cleanup. + first_cleanup = None + if alarm_installed: + try: + _SETTIMER(signal.ITIMER_REAL, 0) + _SIGNAL(signal.SIGALRM, old_handler) + except BaseException as error: + run['errors'][2] = error + first_cleanup = error + if run['domain'] is not None: + try: + domain.finish_domain(run['domain']) + except BaseException as error: + run['errors'][3] = error + state['io_quarantine'][0] = True + if first_cleanup is None: + first_cleanup = error + try: + _close_logs(run, primary if primary is not None else first_cleanup) + except BaseException as error: + if first_cleanup is None: + first_cleanup = error + for index in range(2): + if run['log_close_attempted'][index] and not run['log_close_confirmed'][index]: + state['io_quarantine'][0] = True + if primary is not None: + _stop(state, 'run_producer', primary) + elif first_cleanup is not None: + _stop(state, 'run_producer_cleanup', first_cleanup) + raise first_cleanup + try: + schema.need(run['spawn_entered'] is True and run['spawn_returned'] is True and + run['acquisition_in_flight'] is False and all(run['log_close_confirmed']), + 'root spawn or raw stream ownership incomplete') + run['terminal'] = domain.terminal_facts(run['domain']) + schema.need(tuple(_GETRLIMIT(resource.RLIMIT_FSIZE)) == run['file_limits'], 'parent file limit drift') + run['phase'] = 'JOINED' + state['phase'] = 'PRODUCER_JOINED' + _guard(state) + return run_token + except BaseException as primary: + _stop(state, 'postcleanup_terminal', primary) + raise + + +def _source_custody_bytes(state, files, stage): + raw = group01.encode({'schema': 'h25-parent-current-source-custody-v1', 'files': files, + 'stage': stage, 'source_closure_admission_sha256': state['plan']['source_closure_admission_sha256'], + 'historical_compiler_interval_proof_claimed_by_this_record': False}) + schema.need(len(raw) <= schema.RECORD_BYTES, 'complete source custody record exceeds admitted writer bound') + return raw + + +def _variant(state, run, stdout_raw): + """Dedicated concrete typed receiver; source remains external until frozen.""" + expected = group01.decode(group01.encode(run['plan']['evidence_plan'])) + expected['producer_process_id'] = run['root'][0] + expected['parent_file_limits'] = list(run['file_limits']) + files = expected['raw_file_names'] + schema.need(_TYPE(files) is list and files == list(VARIANT_FILES), + 'fixed variant raw file inventory missing') + raw_files, pins, total = {}, [], 0 + for relative in files: + schema.text(relative, 256) + schema.need(not relative.startswith('/') and all(part not in ('', '.', '..') for part in relative.split('/')), + 'variant raw origin differs') + path = run['plan']['output'] + '/' + relative + limit = 8388608 if relative.endswith('.so') else schema.LOG_BYTES if relative.endswith('.raw') else schema.RECORD_BYTES + pin = copying.inspect(path, limit, error_owner=state['errors']) + total += pin['bytes'] + schema.need(total <= MAX_VARIANT_RAW_BYTES, 'variant aggregate byte bound exceeded before allocation') + raw_files[relative] = copying.read_verified(pin, limit, error_owner=state['errors']) + pins.append(pin) + closure.check_receivers(state['receivers']) + validator = closure.receiver(state['receivers'], VARIANT_MODULE, VARIANT_FUNCTION) + result = validator(raw_files, expected) + closure.check_receivers(state['receivers']) + # Exact result schema is fixed with the separately frozen variant source. + # This branch cannot run before that complete source/interface is admitted. + schema.exact(result, ('schema', 'raw_result_relative', 'raw_group_relatives', 'builds', + 'zero_candidate_loads', 'not_runtime_authority')) + schema.need(result['schema'] == 'h25-negative-variant-data-authentication-v1' and + result['zero_candidate_loads'] is True and result['not_runtime_authority'] is True, + 'variant data-validation scope differs') + pin_by_relative = dict(zip(files, pins)) + schema.need(result['raw_result_relative'] == 'receipt.json' and + group01.same_json(group01.decode(stdout_raw), group01.decode(raw_files['receipt.json'])), + 'variant original stdout/final raw result differs') + builds = [] + schema.sequence(result['builds'], 2) + for role, row in zip(schema.ROLES[3:], result['builds']): + schema.exact(row, ('role', 'command_sha256', 'profile', 'files')) + schema.need(row['role'] == role, 'variant build role order differs') + schema.exact(row['files'], ('original_output', 'original_receipt', 'attempt', 'journal', 'stdout', 'stderr')) + build = {'role': role, 'producer_role': 'failure_variants', + 'producer_generation': run['plan']['epoch_plan']['generation'], + 'producer_stage_sha256': run['plan']['epoch_plan']['stage_sha256'], + 'command_sha256': row['command_sha256'], 'profile': row['profile']} + for key, relative in row['files'].items(): + schema.text(relative, 256) + schema.need(relative in pin_by_relative, 'variant validator returned unowned file') + build[key] = pin_by_relative[relative] + schema.build(build) + builds.append(build) + schema.need(result['raw_group_relatives'] == list(VARIANT_GROUPS), 'variant exact raw group census differs') + raw_groups = [] + for relative in result['raw_group_relatives']: + schema.text(relative, 256) + schema.need(relative in pin_by_relative, 'variant validator returned unowned raw group') + raw_groups.append({'file': relative, 'raw': pin_by_relative[relative]}) + return {'raw_result': pin_by_relative['receipt.json'], 'group_rows': raw_groups, + 'builds': builds, 'additional_raw': pins, + 'native_runtime_or_full_union_qualified': False} + + +def accept_producer(owner_capability, completed_run_capability): + state = _state(owner_capability) + try: + _guard(state) + schema.need(_TYPE(completed_run_capability) is object and state['phase'] == 'PRODUCER_JOINED', + 'joined original producer capability required') + matches = [run for run in state['runs'].values() if run['token'] is completed_run_capability] + schema.need(_LEN(matches) == 1 and matches[0]['phase'] == 'JOINED', 'unknown or replayed producer completion') + run = matches[0] + run['phase'] = 'COMPLETION_CONSUMED' + terminal = domain.terminal_facts(run['domain']) + schema.need(terminal == run['terminal'], 'owned terminal facts changed') + row, errors = run['plan'], state['errors'] + stdout = copying.inspect(row['evidence_directory'] + '/stdout.raw', schema.LOG_BYTES, error_owner=errors) + stderr = copying.inspect(row['evidence_directory'] + '/stderr.raw', schema.LOG_BYTES, error_owner=errors) + schema.need(stderr['bytes'] == 0, 'original producer stderr is not empty') + stdout_raw = copying.read_verified(stdout, schema.LOG_BYTES, error_owner=errors) + if run['role'] == 'group01': + actual = group01.authenticate_group01(row['output'], row['evidence_plan'], run['root'][0], + run['file_limits'], state['receivers'], errors, stdout_raw) + else: + actual = _variant(state, run, stdout_raw) + # These facts are parent-derived from current bytes and real owned + # cleanup, never child status flags or an imported ParentCompletion. + source_after = _snapshot_sources(state['plan'], errors) + schema.need(source_after == run['source_before'] == state['initial_sources'], 'complete current source identity changed') + stage_after = _stage(dict(state['plan'], **row), errors, state) + schema.need(stage_after == run['stage_before'], 'late complete stage custody changed') + closure.check_receivers(state['receivers']) + schema.need(domain.terminal_facts(run['domain']) == terminal, 'late parent-domain cleanup changed') + copying.verify(stdout, schema.LOG_BYTES, error_owner=errors) + copying.verify(stderr, schema.LOG_BYTES, error_owner=errors) + for build in actual['builds']: + for key, limit in (('original_output', schema.FILE_BYTES), ('original_receipt', 65536), + ('attempt', 65536), ('journal', schema.JOURNAL_BYTES), ('stdout', schema.LOG_BYTES), ('stderr', schema.LOG_BYTES)): + copying.verify(build[key], limit, error_owner=errors) + for pin in actual['additional_raw']: + copying.verify(pin, schema.FILE_BYTES, error_owner=errors) + copying.verify(actual['raw_result'], schema.RAW_RESULT_BYTES, error_owner=errors) + for pin in row['launch_artifacts'].values(): + copying.verify(pin, schema.RECORD_BYTES, error_owner=errors) + for group in actual['group_rows']: + copying.verify(group['raw'], schema.RECORD_BYTES, error_owner=errors) + if run['role'] == 'group01': + copying.verify(group['validation'], 8192, error_owner=errors) + directory = row['evidence_directory'] + terminal_pin = copying.write_once(directory + '/TERMINAL.json', schema.canonical({ + 'schema': 'h25-owned-producer-terminal-v1', 'launch': run['launch'], + 'generation': row['epoch_plan']['generation'], 'launch_nonce': row['launch_nonce'], + 'actual': terminal, 'stdout': stdout, 'stderr': stderr, + 'root_wall_before_completion_diagnostic_nanoseconds': int((_CLOCK() - run['began']) * 1000000000), + 'diagnostic_is_nested_not_additive': True}), error_owner=errors) + raw_groups = copying.write_once(directory + '/RAW-GROUPS.json', + group01.encode({'schema': 'h25-parent-retained-raw-groups-v1', 'rows': actual['group_rows'], + 'additional_raw': actual['additional_raw'], 'returned_groups_checked_before_mint': True}), error_owner=errors) + source_bytes_after = _source_custody_bytes(state, source_after, stage_after) + schema.need(source_bytes_after == run['source_bytes_before'], 'source custody changed after prelaunch size gate') + source_pin = copying.write_once(directory + '/FINAL-SOURCE-CUSTODY.json', source_bytes_after, error_owner=errors) + _guard(state) + schema.need(_CLOCK() - run['began'] <= row['root_seconds'], 'complete root including validation/custody exceeded bound') + observation = {'schema': 'h25-owned-parent-observation-v1', 'epoch_id': state['plan']['epoch_id'], + 'mode': state['plan']['mode'], 'producer_role': run['role'], 'generation': row['epoch_plan']['generation'], + 'launch_nonce': row['launch_nonce'], 'launch': run['launch'], 'terminal': terminal_pin, + 'raw_result': actual['raw_result'], 'raw_groups': raw_groups, 'final_source_custody': source_pin, + 'root_pid': run['root'][0], 'root_start_ticks': run['root'][4], + 'later_cross_root_aggregate_required_before_export': False, + 'native_full_or_gain_qualification': False} + observed_pin = copying.write_once(directory + '/PARENT-OBSERVATION.json', schema.canonical(observation), error_owner=errors) + record = {key: row['epoch_plan'][key] for key in ('role', 'generation', 'stage_sha256', 'command_sha256', 'root_sha256')} + record.update(terminal=terminal_pin, raw_result=actual['raw_result'], raw_groups=raw_groups, + final_source_custody=source_pin, parent_observation=observed_pin, + completion_checker_sha256=state['configuration']['checker_source']['sha256'], builds=actual['builds']) + schema.producer(record) + # The only mint site is below every actual launch/domain/raw/source + # check. Neither ticket nor completion is ever returned to a caller. + _guard(state) + completion = _EPOCH_COMPLETION(run['ticket'], state['configuration']['checker_source']['sha256'], + observed_pin['sha256'], row['epoch_plan']['generation'], state['plan']['mode'], run['role'], + run['root'][0], run['root'][4], True, True, True, True, True, True) + _EPOCH_ACCEPT(state['epoch'], state['authority'], run['ticket'], completion, record) + _guard(state) + schema.need(_CLOCK() - run['began'] <= row['root_seconds'], + 'complete root plus acceptance tail exceeded bound') + run['phase'], run['record'] = 'ACCEPTED', record + state['next'] += 1 + state['phase'] = 'READY' if state['next'] < 2 else 'PRODUCERS_ACCEPTED' + return schema.plain_copy(record) + except BaseException as primary: + _stop(state, 'accept_producer', primary) + raise + + +def commit_exports(owner_capability): + state = _state(owner_capability) + try: + _guard(state) + schema.need(state['phase'] == 'PRODUCERS_ACCEPTED' and state['next'] == 2 and + all(run['phase'] == 'ACCEPTED' for run in state['runs'].values()), + 'only two genuinely accepted producer records may export') + result = _EPOCH_COMMIT(state['epoch'], state['authority']) + _guard(state) + state['phase'] = 'EXPORTED' + return result + except BaseException as primary: + _stop(state, 'commit_exports', primary) + raise + + +def stop_evidence(owner_capability): + state = _state(owner_capability) + summaries = [{'role': run['role'], 'phase': run['phase'], + 'spawn_entered': run['spawn_entered'], 'spawn_returned': run['spawn_returned'], + 'log_close_attempted': list(run['log_close_attempted']), + 'log_close_confirmed': list(run['log_close_confirmed'])} + for run in state['runs'].values()] + # Never expose the epoch ticket, Popen object, domain capability or private + # run sidecar through diagnostic return values. + return state['stop'], state['errors'], state['fallback'], summaries diff --git a/research/h25-v03-authenticated-prefix-entry/prerequisites/parent_domain_v1.py.txt b/research/h25-v03-authenticated-prefix-entry/prerequisites/parent_domain_v1.py.txt new file mode 100644 index 0000000000..a0f242854a --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/prerequisites/parent_domain_v1.py.txt @@ -0,0 +1,532 @@ +"""Owned Linux child domains for one trusted, single-threaded parent process. + +Source proposal only. No target was imported or run during authoring. The +external launcher must authenticate the OS, interpreter, system modules and +original subreaper installer before importing this module. This is the original +closed child-domain premise, not a sandbox against hostile forking or a hostile +host. Acquisition/unwind ambiguity quarantines the parent; it never authorizes +another launch or a completion. The enclosing guard must observe parent exit. +""" +import os +import signal +import subprocess +import time +import epoch_schema_v5 as schema + +_TYPE, _LEN = type, len +_OPEN, _READ, _CLOSE = os.open, os.read, os.close +_STAT = os.stat +_SCANDIR, _GETPID, _GETPGRP, _GETSID = os.scandir, os.getpid, os.getpgrp, os.getsid +_PIDFD_OPEN, _PIDFD_SIGNAL = os.pidfd_open, signal.pidfd_send_signal +_WAITPID, _CLOCK, _SLEEP = os.waitpid, time.monotonic, time.sleep +_POPEN, _POLL = subprocess.Popen, subprocess.Popen.poll +_PAGE_BYTES = os.sysconf('SC_PAGE_SIZE') +_DOMAINS = [] +MAX_GENERATIONS = 128 +MAX_PROC_ENTRIES = 131072 +MAX_PROC_BYTES = 8192 +CLEANUP_SECONDS = 2.0 + + +def _state(capability): + schema.need(_TYPE(capability) is object, 'exact owned domain capability required') + for token, state in _DOMAINS: + if token is capability: + return state + raise schema.EpochStop('unregistered owned domain') + + +def refresh_unknown_owner(owner): + # These are exact V5 ErrorOwner state references captured by the original + # parent before use. Read only the pinned private shape; no projection, + # callback, native I/O or interpretation of historical release slot9. + for native in owner['native_errors']: + if native is None: + continue + io = native[7] + if (io[0] or io[1] or io[2] or io[4] or io[6] or io[10] or io[11] or + io[5] is not None or native[5][1] or io[7][4] == 1): + owner['quarantine'][0] = True + if io[5] is not None: + owner['iterator_uncertain'][0] = True + + +def _fresh_acquisition(state): + # This shares the original parent's preallocated unknown-resource owner. + # Pending acquisition and delivered census failure are independent of a + # later Python close return. Neither flag is cleared by cleanup. + owner = state['unknown_owner'] + refresh_unknown_owner(owner) + schema.need(state['quarantine'] is False and state['acquisition_in_flight'] is False and + state['io_uncertain'] is False and owner['quarantine'][0] is False and + owner['pending'][0] is False and owner['iterator_uncertain'][0] is False, + 'uncertain ownership prohibits a fresh native acquisition') + + +def _opaque(state, error, slot): + # Preallocated slots retain the actual delivered object, without formatting. + # A secondary never replaces the first primary. Slots are finite and an + # overflow means quarantine, not a successful evidence projection. + state['quarantine'] = True + if state['primary'][0] is None: + state['primary'][0] = error + elif state['secondary'][slot] is None: + state['secondary'][slot] = error + else: + state['overflow'][0] = error + + +def _proc(pid, state): + schema.integer(pid, 1, (1 << 31) - 1) + descriptor = None + primary = None + _fresh_acquisition(state) + # The uncertain acquisition flag is set before the native entry. If open + # raises after an undisclosed descriptor acquisition, parent exit is needed. + try: + try: + _STAT('/proc/' + str(pid) + '/stat', dir_fd=None, follow_symlinks=False) + except (FileNotFoundError, ProcessLookupError): + # Only the pinned metadata-only primitive establishes absence. + # An exception from a later acquisition never proves no FD existed. + return None + state['acquisition_in_flight'] = True + state['unknown_owner']['pending'][0] = True + descriptor = _OPEN('/proc/' + str(pid) + '/stat', + os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW | os.O_NONBLOCK) + state['acquisition_in_flight'] = False + state['unknown_owner']['pending'][0] = False + raw = _READ(descriptor, MAX_PROC_BYTES + 1) + schema.need(_TYPE(raw) is bytes and _LEN(raw) <= MAX_PROC_BYTES, + 'bounded proc stat read differs') + end = raw.rfind(b') ') + schema.need(end >= 0, 'malformed proc stat') + fields = raw[end + 2:].split() + schema.need(_LEN(fields) >= 22 and raw[:raw.find(b' ')] == str(pid).encode('ascii'), + 'proc stat identity or shape differs') + row = (pid, int(fields[1]), int(fields[2]), int(fields[3]), + int(fields[19]), fields[0].decode('ascii'), int(fields[21]) * _PAGE_BYTES) + schema.need(row[4] > 0 and row[6] >= 0, 'proc generation or RSS differs') + return row + except BaseException as error: + primary = error + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + _opaque(state, error, 0) + raise + finally: + if descriptor is not None: + # Burn before entry; a failed native close is not retried. + owned = descriptor + descriptor = None + try: + _CLOSE(owned) + except BaseException as close_error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = close_error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + state['io_uncertain'] = True + _opaque(state, close_error, 1) + if primary is None: + raise + + +def _census(state): + iterator = None + primary = None + rows = {} + _fresh_acquisition(state) + state['acquisition_in_flight'] = True + state['unknown_owner']['pending'][0] = True + try: + iterator = _SCANDIR('/proc') + state['acquisition_in_flight'] = False + state['unknown_owner']['pending'][0] = False + count = 0 + for entry in iterator: + count += 1 + schema.need(count <= MAX_PROC_ENTRIES, 'proc census entry bound exceeded') + name = entry.name + if name.isdecimal(): + row = _proc(int(name), state) + if row is not None: + rows[row[0]] = row + return rows + except BaseException as error: + primary = error + # All delivered iteration/body failures latch before optional helper + # entry. A no-op/successful close cannot establish release afterward. + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['quarantine'] = True + state['io_uncertain'] = True + state['unknown_owner']['quarantine'][0] = True + state['unknown_owner']['iterator_uncertain'][0] = True + _opaque(state, error, 2) + raise + finally: + if iterator is not None: + owned = iterator + iterator = None + try: + owned.close() + except BaseException as close_error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = close_error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + state['unknown_owner']['iterator_uncertain'][0] = True + state['io_uncertain'] = True + _opaque(state, close_error, 3) + if primary is None: + raise + + +def create_domain(unknown_owner): + """Called only after the original same-process subreaper was installed.""" + schema.need(_LEN(_DOMAINS) < 4, 'two modes by two producers domain bound exceeded') + schema.exact(unknown_owner, ('quarantine', 'pending', 'iterator_uncertain', 'primary', 'native_errors')) + for key in ('quarantine', 'pending', 'iterator_uncertain', 'primary'): + schema.need(_TYPE(unknown_owner[key]) is list and _LEN(unknown_owner[key]) == 1, + 'original parent unknown-resource slot differs') + schema.need(_TYPE(unknown_owner['native_errors']) is list and _LEN(unknown_owner['native_errors']) == 4, + 'exact two-mode V5 error-owner registry required') + for native in unknown_owner['native_errors']: + schema.need(native is None or (_TYPE(native) is list and _LEN(native) == 9 and + _TYPE(native[7]) is list and _LEN(native[7]) == 13), + 'original captured V5 error-owner shape differs') + refresh_unknown_owner(unknown_owner) + schema.need(all(unknown_owner[key][0] is False for key in + ('quarantine', 'pending', 'iterator_uncertain')) and unknown_owner['primary'][0] is None, + 'unknown-resource parent already requires teardown') + token = object() + state = {'rows': [None] * MAX_GENERATIONS, 'fds': [None] * MAX_GENERATIONS, + 'fd_attempted': [False] * MAX_GENERATIONS, + 'fd_closed': [False] * MAX_GENERATIONS, 'count': 0, + 'groups': set(), 'reaped': [], 'after_root': set(), + 'process': None, 'root': None, 'returncode': None, + 'parent_pid': _GETPID(), 'parent_group': _GETPGRP(), 'parent_session': _GETSID(0), + 'phase': 'CONSTRUCTING', 'quarantine': False, + 'acquisition_in_flight': False, 'io_uncertain': False, 'primary': [None], + 'unknown_owner': unknown_owner, + 'secondary': [None] * 16, 'overflow': [None], + 'final_rows': None, 'closure_confirmed': False} + _DOMAINS.append((token, state)) + try: + rows = _census(state) + schema.need(not any(row[1] == state['parent_pid'] for row in rows.values()), + 'parent has preexisting child processes') + state['phase'] = 'RESERVED' + return token + except BaseException as error: + if unknown_owner['primary'][0] is None: + unknown_owner['primary'][0] = error + unknown_owner['quarantine'][0] = True + state['quarantine'] = True + _opaque(state, error, 4) + state['phase'] = 'STOP' + raise + + +def _add(state, row): + _fresh_acquisition(state) + key = row[0], row[4] + schema.need(row[0] != state['parent_pid'], 'parent cannot enter own child domain') + for index in range(state['count']): + prior = state['rows'][index] + if prior is not None and (prior[0], prior[4]) == key: + if row[2] != state['parent_group']: + state['groups'].add((row[2], row[3])) + return True + index = state['count'] + schema.need(index < MAX_GENERATIONS, 'owned process generation bound exceeded') + # Reserve the slot before native acquisition. No role/generation slot is + # recycled after a failed or disappeared acquisition. + state['count'] = index + 1 + state['rows'][index] = row + state['acquisition_in_flight'] = True + state['unknown_owner']['pending'][0] = True + try: + state['fds'][index] = _PIDFD_OPEN(row[0], 0) + state['acquisition_in_flight'] = False + state['unknown_owner']['pending'][0] = False + current = _proc(row[0], state) + if current is None or (current[0], current[4]) != key: + return False # The actual FD stays owned for one terminal close. + if current[2] != state['parent_group']: + state['groups'].add((current[2], current[3])) + return True + except BaseException as error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + _opaque(state, error, 5) + raise + + +def observe(capability): + state = _state(capability) + all_rows = _census(state) + known = set() + for index in range(state['count']): + prior = state['rows'][index] + current = None if prior is None else all_rows.get(prior[0]) + if current is not None and current[4] == prior[4]: + known.add(current[0]) + _add(state, current) + for unused in range(MAX_GENERATIONS + 1): + changed = False + for pid, row in all_rows.items(): + if pid not in known and (row[1] == state['parent_pid'] or row[1] in known): + if _add(state, row): + known.add(pid) + changed = True + if not changed: + break + else: + raise schema.EpochStop('child-domain closure iteration bound exceeded') + return all_rows, tuple(all_rows[pid] for pid in sorted(known)) + + +def adopt_popen(capability, process): + state = _state(capability) + schema.need(state['phase'] == 'RESERVED' and state['process'] is None and + _TYPE(process) is _POPEN, 'Popen ownership or one-attempt state differs') + state['process'] = process # Exact original return, never a supplied proxy. + row = _proc(process.pid, state) + schema.need(row is not None and row[1] == state['parent_pid'] and + row[2] == row[3] == process.pid, + 'new child PID/session/generation missing before first poll') + state['root'] = row + schema.need(_add(state, row) is True, 'original child pidfd generation not owned') + state['phase'] = 'RUNNING' + return row + + +def poll_owned(capability): + state = _state(capability) + schema.need(state['phase'] == 'RUNNING' and _TYPE(state['process']) is _POPEN, + 'original running Popen required') + result = _POLL(state['process']) + if result is not None: + schema.integer(result, -128, 255) + state['returncode'] = result + return result + + +def _kill(state): + for index in range(state['count']): + fd, prior = state['fds'][index], state['rows'][index] + if fd is None or state['fd_attempted'][index]: + continue + current = _proc(prior[0], state) + if current is not None and current[4] == prior[4] and current[5] != 'Z': + try: + _PIDFD_SIGNAL(fd, signal.SIGKILL, None, 0) + except ProcessLookupError: + pass + + +def finish_domain(capability): + """Always attempted, including Popen exceptions; no caller closure claims.""" + state = _state(capability) + schema.need(state['phase'] in ('RESERVED', 'RUNNING'), 'domain cleanup replay') + state['phase'] = 'CLEANUP_CONSUMED' + started = _CLOCK() + primary = None + try: + _fresh_acquisition(state) + while True: + all_rows, current = observe(capability) + process = state['process'] + if process is not None and process.returncode is not None: + for row in current: + if row[0] != process.pid: + state['after_root'].add((row[0], row[4])) + _kill(state) + if process is not None: + result = _POLL(process) + if result is not None: + state['returncode'] = result + for index in range(state['count']): + prior = state['rows'][index] + row = _proc(prior[0], state) + if (row is None or row[4] != prior[4] or row[1] != state['parent_pid'] or + (process is not None and row[0] == process.pid)): + continue + try: + pid, status = _WAITPID(row[0], os.WNOHANG) + except ChildProcessError: + continue + if pid: + state['reaped'].append((pid, prior[4], status)) + all_rows, current = observe(capability) + remaining = tuple(row for row in all_rows.values() + if row[1] == state['parent_pid'] or (row[2], row[3]) in state['groups'] or + any(prior is not None and (row[0], row[4]) == (prior[0], prior[4]) + for prior in state['rows'][:state['count']])) + state['final_rows'] = remaining + if not current and not remaining: + state['closure_confirmed'] = True + break + if _CLOCK() - started >= CLEANUP_SECONDS: + break + _SLEEP(0.01) + except BaseException as error: + primary = error + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + _opaque(state, error, 6) + raise + finally: + # Every known FD gets one attempt even if a prior close failed. Native + # return/boxing, Python call-entry and final unwind still have no total + # recovery theorem; any such failure forbids minting and parent reuse. + first_close = None + for index in range(state['count']): + descriptor = state['fds'][index] + if descriptor is None or state['fd_attempted'][index]: + continue + state['fd_attempted'][index] = True + try: + _CLOSE(descriptor) + state['fd_closed'][index] = True + except BaseException as error: + if state['unknown_owner']['primary'][0] is None: + state['unknown_owner']['primary'][0] = error + state['quarantine'] = True + state['unknown_owner']['quarantine'][0] = True + state['io_uncertain'] = True + _opaque(state, error, 7) + if first_close is None: + first_close = error + state['phase'] = 'CLOSED' if primary is None and first_close is None else 'STOP' + if primary is None and first_close is not None: + raise first_close + + +def terminal_facts(capability): + state = _state(capability) + _fresh_acquisition(state) + schema.need(state['phase'] == 'CLOSED' and state['quarantine'] is False and + state['acquisition_in_flight'] is False and state['io_uncertain'] is False and state['root'] is not None and + state['returncode'] == 0 and state['closure_confirmed'] is True and + state['final_rows'] == () and not state['after_root'] and not state['reaped'] and + all(fd is None or (state['fd_attempted'][index] and state['fd_closed'][index]) + for index, fd in enumerate(state['fds'])), + 'owned terminal domain is incomplete, failed, orphaned or quarantined') + # Fresh census after FD cleanup. This is independent of receipt booleans. + rows = _census(state) + schema.need(not any(row[1] == state['parent_pid'] or + (row[2], row[3]) in state['groups'] for row in rows.values()), + 'postcleanup owned child/group still present') + return {'root': list(state['root']), 'returncode': state['returncode'], + 'owned_generations': [list(row) for row in state['rows'][:state['count']]], + 'groups': [list(pair) for pair in sorted(state['groups'])], + 'remaining': [], 'adopted_reaps': [], 'observed_after_root_exit': [], + 'pidfd_close_attempted': list(state['fd_attempted'][:state['count']]), + 'pidfd_close_confirmed': list(state['fd_closed'][:state['count']]), + 'source': 'original in-process Popen and owned generation registry', + 'hostile_fork_or_privileged_host_resistance_claimed': False} + + +def stop_slots(capability): + state = _state(capability) + return state['primary'], state['secondary'], state['overflow'], { + 'phase': state['phase'], 'quarantine': state['quarantine'], + 'acquisition_in_flight': state['acquisition_in_flight'], + 'io_uncertain': state['io_uncertain'], + 'shared_pending': state['unknown_owner']['pending'][0], + 'shared_iterator_uncertain': state['unknown_owner']['iterator_uncertain'][0], + 'shared_quarantine': state['unknown_owner']['quarantine'][0], + 'closure_confirmed': state['closure_confirmed'], + 'pidfd_close_attempted': list(state['fd_attempted'][:state['count']]), + 'pidfd_close_confirmed': list(state['fd_closed'][:state['count']])} + + +def prefix_exit1_terminal_facts(capability): + """Return cleanup/exit DATA for an actual owned prefix child exiting 1. + + Separate from production terminal_facts. Never creates an epoch ticket, + ParentCompletion, source admission, or control-family acceptance. + """ + state = _state(capability) + owner = state['unknown_owner'] + try: + schema.need(_GETPID() == state['parent_pid'], + 'prefix terminal observer is not the owning parent') + _fresh_acquisition(state) + schema.need(owner['primary'][0] is None and + state['primary'][0] is None, + 'earlier error forbids prefix terminal observation') + schema.need( + state['phase'] == 'CLOSED' and + state['quarantine'] is False and + state['acquisition_in_flight'] is False and + state['io_uncertain'] is False and + state['root'] is not None and + _TYPE(state['returncode']) is int and + state['returncode'] == 1 and + state['closure_confirmed'] is True and + state['final_rows'] == () and + not state['after_root'] and + not state['reaped'] and + all(fd is None or + (state['fd_attempted'][index] and state['fd_closed'][index]) + for index, fd in enumerate(state['fds'])), + 'owned exit1 prefix domain is incomplete or quarantined', + ) + rows = _census(state) + schema.need( + not any(row[1] == state['parent_pid'] or + (row[2], row[3]) in state['groups'] + for row in rows.values()), + 'postcleanup owned prefix child/group still present', + ) + return { + 'schema': 'h25-prefix-exit1-terminal-facts-v1', + 'root': list(state['root']), + 'returncode': state['returncode'], + 'owned_generations': [ + list(row) for row in state['rows'][:state['count']] + ], + 'groups': [list(pair) for pair in sorted(state['groups'])], + 'remaining': [], + 'adopted_reaps': [], + 'observed_after_root_exit': [], + 'pidfd_close_attempted': list( + state['fd_attempted'][:state['count']] + ), + 'pidfd_close_confirmed': list( + state['fd_closed'][:state['count']] + ), + 'source': 'original in-process Popen and owned generation registry', + 'production_completion': False, + 'refusal_semantics_authenticated_by_this_function': False, + 'hostile_fork_or_privileged_host_resistance_claimed': False, + } + except BaseException as error: + if owner['primary'][0] is None: + prior = state['primary'][0] + owner['primary'][0] = error if prior is None else prior + primary = owner['primary'][0] + if state['primary'][0] is None: + state['primary'][0] = primary + if error is not primary: + if state['secondary'][8] is None: + state['secondary'][8] = error + elif state['overflow'][0] is None: + state['overflow'][0] = error + state['quarantine'] = True + owner['quarantine'][0] = True + # Do not change phase: an invalid early call must not prevent + # finish_domain from reaching its known-FD cleanup. + if primary is error: + raise + raise primary diff --git a/research/h25-v03-authenticated-prefix-entry/prerequisites/v03_integrated_constructor_v2.py.txt b/research/h25-v03-authenticated-prefix-entry/prerequisites/v03_integrated_constructor_v2.py.txt new file mode 100644 index 0000000000..16989cabf0 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/prerequisites/v03_integrated_constructor_v2.py.txt @@ -0,0 +1,133 @@ +"""Pure authoring support for the proposed genuine-Root V03 prefix route. + +No original module is imported or executed. Output is a source draft with +all eight original admission/configuration literals still None. The selected +prefix requires independent review as V03 source-gate coverage, and is not V01. +""" +import ast +import hashlib + +ROOT_SHA = 'f5a2d33f2b4d3651f214156a0e7094c2bb516ce2d5ab7698d18c11f98f35dee0' +PROVIDER_SHA = '9cbb7368f89e71d1e6cc46db5dc77efed3e03ed2a801c98c88fe316e4d9f3ef2' +VARIANT_SHA = 'cdb1479253358508088f8aa0e1e92e6c75ffcc127e54552698598a02de061254' +NATIVE_ENV = ( + (b'PATH', b'/usr/bin:/bin'), + (b'PYTHONHASHSEED', b'0'), + (b'LANG', b'C.UTF-8'), + (b'LC_ALL', b'C.UTF-8'), + (b'TZ', b'UTC'), + (b'PYTHONDONTWRITEBYTECODE', b'1'), +) +GATES = ('VARIANT_CONFIGURATION', 'VARIANT_SOURCE_REVIEW', + 'VARIANT_STAGE_ADMISSION', 'VARIANT_NATIVE_PROFILE', + 'VARIANT_HEADER_ADMISSION', 'VARIANT_COMMAND_ADMISSION', + 'VARIANT_FUNDING', 'VARIANT_EXECUTION') +TAIL = b'''try: + _variant_main() +except BaseException as _variant_error: + _VARIANT_TERMINAL_ERROR[0] = _variant_error + raise +''' +CONTROL_TAIL = b'''_V03_RESULT = [None] +try: + _V03_RESULT[0] = _v03_original_input_prefix() + _vroot(_INITIAL_OUTPUT + '/v03-root-after.raw.json') + _vraw(_INITIAL_OUTPUT + '/v03-input-result.raw.json', { + 'schema': 'h25-v03-input-prefix-result-v1', + 'status': 'ORIGINAL_INPUT_PREFIX_RETURNED', + 'binding': _V03_RESULT[0], + 'whole_variant_producer_completed': False, + 'runtime_qualified': False}) +except BaseException as _v03_error: + _VARIANT_TERMINAL_ERROR[0] = _v03_error + # No diagnostic allocation or I/O after an inherited failure. The genuine + # parent retains its raw stderr stream and owned terminal facts; absent or + # incomplete evidence is STOP, never a successful negative control. + raise +''' + + +def need(condition, message): + if not condition: + raise ValueError(message) + + +def absolute(path): + need(type(path) is str and 1 < len(path) <= 4096 and + path.startswith('/') and all(32 <= ord(c) < 127 for c in path) and + all(part not in ('', '.', '..') for part in path.split('/')[1:]), + 'canonical bounded absolute ASCII path required') + return path + + +def build_control_driver(original): + """Construct an unconfigured driver by a checked source transformation.""" + need(type(original) is bytes and len(original) == 41337 and + hashlib.sha256(original).hexdigest() == VARIANT_SHA, + 'exact original variant source required') + tree = ast.parse(original, feature_version=(3, 12)) + functions = [node for node in tree.body if isinstance(node, ast.FunctionDef) + and node.name == '_variant_main'] + need(len(functions) == 1, 'unique original main required') + function = functions[0] + lines = original.splitlines(keepends=True) + body = b''.join(lines[function.lineno - 1:function.end_lineno]) + cut = b' builds = []\n' + need(body.count(cut) == 1 and body.startswith(b'def _variant_main():\n'), + 'original prebuild boundary differs') + prefix = body.split(cut, 1)[0] + prefix = prefix.replace(b'def _variant_main():\n', + b'def _v03_original_input_prefix():\n', 1) + prefix += b' return binding\n\n\n' + need(original.endswith(TAIL) and original.count(TAIL) == 1, + 'original terminal entry differs') + result = original[:-len(TAIL)] + prefix + CONTROL_TAIL + need(len(result) <= 262144, 'genuine Root driver limit exceeded') + result_tree = ast.parse(result, feature_version=(3, 12)) + found = {} + for node in result_tree.body: + if isinstance(node, ast.Assign) and len(node.targets) == 1: + target = node.targets[0] + if isinstance(target, ast.Name) and target.id in GATES: + need(isinstance(node.value, ast.Constant) and + node.value.value is None, 'original gate was configured') + found[target.id] = None + need(set(found) == set(GATES), 'original gate census differs') + return result + + +def genuine_launch(stage, output, generation, nonce, mode, driver_bytes): + """Return launch DATA only. It is not stage/source/funding admission. + + CWD=stage is an explicit choice of this launch instance, allowed by the + original Root. It becomes part of Gamma and must enter C05 rule derivation. + The future parent must authenticate and own that exact stage and output + ancestor before actually passing these values to its genuine Popen route. + """ + absolute(stage) + absolute(output) + need(output != stage and not output.startswith(stage + '/'), + 'output must be outside the immutable stage') + need(type(generation) is str and 1 <= len(generation) <= 96 and + all(c in 'abcdefghijklmnopqrstuvwxyz0123456789-' for c in generation), + 'generation differs') + need(type(nonce) is str and len(nonce) == 64 and + all(c in '0123456789abcdef' for c in nonce), 'nonce differs') + need(type(mode) is str and mode in ('normal', 'optimized'), 'mode differs') + need(type(driver_bytes) is bytes and 0 < len(driver_bytes) <= 262144, + 'bounded reviewed driver bytes required') + integration = stage + '/integration' + command = ['/usr/bin/python3.12', '-S', '-s', '-P', '-B'] + if mode == 'optimized': + command.append('-O') + command += [integration + '/full_driver.py', + '--root-sha256', ROOT_SHA, + '--provider', integration + '/probe_binding_v3.py', PROVIDER_SHA, + '--driver', integration + '/v03_control_driver_v1.py', + hashlib.sha256(driver_bytes).hexdigest(), + '--integration', integration, '--', + '--output', output, '--generation', generation, + '--launch-nonce', nonce] + return {'command': command, 'env': dict(NATIVE_ENV), 'cwd': stage, + 'mode': mode, 'generation': generation, 'launch_nonce': nonce, + 'source_admitted': False, 'execution_admitted': False} diff --git a/research/h25-v03-authenticated-prefix-entry/prerequisites/v03_prefix_derivation_v1.py.txt b/research/h25-v03-authenticated-prefix-entry/prerequisites/v03_prefix_derivation_v1.py.txt new file mode 100644 index 0000000000..8140477dcd --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/prerequisites/v03_prefix_derivation_v1.py.txt @@ -0,0 +1,99 @@ +"""Verify only eight literal replacements in the exact reviewed V03 prefix. + +Source proposal, Apache-2.0. Preserve original authors and derivation notices. +Pinned gate-value DATA does not confer source/native/funding/runtime admission. +""" +import ast +from v03_integrated_constructor_v2 import GATES, build_control_driver + + +def _plain(value): + budget = [0, 0] + + def walk(item, depth): + budget[0] += 1 + if depth > 24 or budget[0] > 65536: + raise ValueError('gate tree bound') + kind = type(item) + if item is None or kind is bool: + return + if kind is int: + if not -(1 << 64) <= item < (1 << 64): + raise ValueError('gate integer bound') + return + if kind is str: + budget[1] += len(item) + if len(item) > 8192 or budget[1] > 524288: + raise ValueError('gate text bound') + return + if kind not in (list, dict) or len(item) > 1024: + raise ValueError('gate exact JSON domain') + if kind is dict: + for key in item: + if type(key) is not str: + raise ValueError('gate exact string key required') + walk(key, depth + 1) + walk(item[key], depth + 1) + else: + for child in item: + walk(child, depth + 1) + + walk(value, 0) + + +def _same(left, right): + if type(left) is not type(right): + return False + if type(left) is dict: + return (set(left) == set(right) and + all(_same(left[k], right[k]) for k in left)) + if type(left) is list: + return (len(left) == len(right) and + all(_same(a, b) for a, b in zip(left, right))) + return left == right + + +def verify_configured_prefix(original_bytes, driver_bytes, frozen_gate_values): + expected = build_control_driver(original_bytes) + if type(driver_bytes) is not bytes or not 0 < len(driver_bytes) <= 262144: + raise ValueError('selected driver byte bound') + _plain(frozen_gate_values) + if type(frozen_gate_values) is not dict or set(frozen_gate_values) != set(GATES): + raise ValueError('exact eight frozen gates required') + + tree = ast.parse(driver_bytes, feature_version=(3, 12)) + offsets, position = [], 0 + for line in driver_bytes.splitlines(keepends=True): + offsets.append(position) + position += len(line) + + actual, spans = {}, [] + for node in tree.body: + if (type(node) is ast.Assign and len(node.targets) == 1 and + type(node.targets[0]) is ast.Name and + node.targets[0].id in GATES): + name, value = node.targets[0].id, node.value + if name in actual: + raise ValueError('duplicate configured gate') + pending, count = [(value, 0)], 0 + while pending: + child, depth = pending.pop() + count += 1 + if depth > 26 or count > 65536: + raise ValueError('literal AST bound') + pending.extend((part, depth + 1) + for part in ast.iter_child_nodes(child)) + actual[name] = ast.literal_eval(value) + spans.append(( + offsets[value.lineno - 1] + value.col_offset, + offsets[value.end_lineno - 1] + value.end_col_offset, + )) + + _plain(actual) + if set(actual) != set(GATES) or not _same(actual, frozen_gate_values): + raise ValueError('configured values differ from independently pinned data') + normalized = driver_bytes + for start, end in sorted(spans, reverse=True): + normalized = normalized[:start] + b'None' + normalized[end:] + if normalized != expected: + raise ValueError('selected source differs outside eight literal values') diff --git a/research/h25-v03-authenticated-prefix-entry/prerequisites/v03_prefix_supervisor_v1.py.txt b/research/h25-v03-authenticated-prefix-entry/prerequisites/v03_prefix_supervisor_v1.py.txt new file mode 100644 index 0000000000..9d79e7dd85 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/prerequisites/v03_prefix_supervisor_v1.py.txt @@ -0,0 +1,830 @@ +"""One non-minting genuine-Root V03 prefix observation per fresh parent. + +Conditional source proposal, Apache-2.0. Derived from the recovered original +parent/domain/closure/copy/supervisor sources. Preserve all original notices. + +The enclosing trusted bootstrap must authenticate this source, its imports, +configured selections and native/OS startup before import. C07 ancestor and +immutable-lifetime conditions remain actual external prerequisites. + +No epoch is created, reserved, accepted, committed or completed here. +""" +import fcntl +import os +from pathlib import Path +import resource +import signal +import stat +import subprocess +import time + +import epoch_schema_v5 as schema +import epoch_copy_v5 as copying +import parent_domain_v1 as domain +import parent_closure_v1 as closure +import parent_completion_v1 as parent +import group01_evidence_v1 as group01 +import v03_prefix_derivation_v1 as derivation + +CONFIGURATION = None +SOURCE_REVIEW = None +STAGE_APPROVAL = None +COMMAND_APPROVAL = None +FUNDING = None +EXECUTION_APPROVAL = None + +ROOT_SHA = 'f5a2d33f2b4d3651f214156a0e7094c2bb516ce2d5ab7698d18c11f98f35dee0' +PROVIDER_SHA = '9cbb7368f89e71d1e6cc46db5dc77efed3e03ed2a801c98c88fe316e4d9f3ef2' +VARIANT_SHA = 'cdb1479253358508088f8aa0e1e92e6c75ffcc127e54552698598a02de061254' +OBSERVER = 'v03_source_refusal_observer_v1' +ENV = {'PATH': '/usr/bin:/bin', 'PYTHONHASHSEED': '0', + 'LANG': 'C.UTF-8', 'LC_ALL': 'C.UTF-8', 'TZ': 'UTC', + 'PYTHONDONTWRITEBYTECODE': '1'} + +_PID, _CLOCK, _FLOCK = os.getpid, time.monotonic, fcntl.flock +_PREFIX = [False, None] +_UNKNOWN_OWNER = { + 'quarantine': [False], 'pending': [False], + 'iterator_uncertain': [False], 'primary': [None], + 'native_errors': [None] * 4, +} +_INITIAL = ( + 'initial-tcb.raw.json', 'initial-controls.raw.json', + 'initial-restoration.raw.json', +) +_PREFLIGHT = _INITIAL + ('root-before.raw.json', 'preflight-before.raw.json') +_CUSTODY = _PREFLIGHT + ('custody-before.raw.json',) +_RETURNED = _CUSTODY + ( + 'v03-root-after.raw.json', 'v03-input-result.raw.json', +) + + +def _gate_snapshot(): + schema.exact(CONFIGURATION, ( + 'plan', 'receiver_policy', 'checker_source', 'original_variant', + )) + for pin in CONFIGURATION.values(): + schema.blob(pin, schema.RECORD_BYTES) + records = ( + (SOURCE_REVIEW, 'review_sha256'), + (STAGE_APPROVAL, 'stage_review_sha256'), + (COMMAND_APPROVAL, 'command_review_sha256'), + (FUNDING, 'reservation_sha256'), + (EXECUTION_APPROVAL, 'external_launch_policy_sha256'), + ) + for record, key in records: + schema.exact(record, (key,)) + schema.digest(record[key]) + copying._gate() + return schema.plain_copy({ + 'configuration': CONFIGURATION, + 'source': SOURCE_REVIEW, 'stage': STAGE_APPROVAL, + 'command': COMMAND_APPROVAL, 'funding': FUNDING, + 'execution': EXECUTION_APPROVAL, + 'copy_configuration': copying.COPY_CONFIGURATION, + 'copy_execution': copying.COPY_EXECUTION_APPROVAL, + 'copy_funding': copying.COPY_FUNDING, + }) + + +def _state(token): + schema.need(type(token) is object and _PREFIX[1] is not None and + _PREFIX[1][0] is token, 'unknown prefix owner') + return _PREFIX[1][1] + + +def _clean(owner): + domain.refresh_unknown_owner(owner) + schema.need(owner['primary'][0] is None and + owner['quarantine'][0] is False and + owner['pending'][0] is False and + owner['iterator_uncertain'][0] is False, + 'prefix owner requires kernel teardown') + + +def _native_bindings(): + schema.need( + _PID is os.getpid and _CLOCK is time.monotonic and + _FLOCK is fcntl.flock and parent.ENV == ENV and + parent._OPEN is os.open and parent._CLOSE is os.close and + parent._MKDIR is os.mkdir and parent._STAT is os.stat and + parent._SCANDIR is os.scandir and + parent._POPEN is subprocess.Popen and + parent._CLOCK is time.monotonic and parent._SLEEP is time.sleep and + parent._SETRLIMIT is resource.setrlimit and + parent._GETRLIMIT is resource.getrlimit and + parent._SETTIMER is signal.setitimer and + parent._GETTIMER is signal.getitimer and + parent._SIGNAL is signal.signal and + parent._GETSIGNAL is signal.getsignal, + 'prefix native primitive binding changed', + ) + + +def _guard(state): + schema.need(state['phase'] not in ('STOP', 'CLOSED'), + 'prefix owner is terminal') + schema.need(_PID() == state['pid'], 'prefix owner crossed process') + _native_bindings() + _clean(state['unknown_owner']) + schema.need(_gate_snapshot() == state['admissions'], + 'prefix admission selections changed') + closure.check_receivers(state['receivers']) + for pin in state['configuration'].values(): + copying.verify(pin, error_owner=state['errors']) + schema.need(state['native_keeper'] is not None and + all(type(fd) is int and fd >= 0 for fd in state['lock_fds']), + 'prefix real keeper or lock ownership missing') + schema.need(_CLOCK() <= state['shared_deadline'], + 'complete prefix owner deadline exceeded') + + +def _expected_files(expected): + schema.exact(expected, ( + 'outcome', 'exception_type', 'message', 'terminal_function', + 'v03_discriminator', 'compiler_launches', 'candidate_image_loads', + 'complete_raw_and_owned_terminal_required', + )) + schema.boolean(expected['v03_discriminator']) + schema.need(type(expected['compiler_launches']) is int and + expected['compiler_launches'] == 0 and + type(expected['candidate_image_loads']) is int and + expected['candidate_image_loads'] == 0 and + expected['complete_raw_and_owned_terminal_required'] is True, + 'prefix expectation scope differs') + outcome = expected['outcome'] + function, message = expected['terminal_function'], expected['message'] + if outcome == 'PREFIX_RETURN': + schema.need(function is None and message is None and + expected['exception_type'] is None, + 'positive prefix expectation differs') + return _RETURNED + schema.need(outcome == 'EXACT_SOURCE_REFUSAL' and + expected['exception_type'] == 'RuntimeError', + 'prefix refusal expectation differs') + if function == '_vcheck_literal_sources': + schema.need(message in ( + 'Variant source role path differs', + 'Variant reviewed source/header differs', + 'Variant role file omitted from closure', + ), 'prefix literal refusal site differs') + return _INITIAL + if function == '_vcheck_custody': + schema.need(message == 'Variant current source closure differs', + 'prefix custody refusal site differs') + return _CUSTODY + schema.need(function == '_v03_original_input_prefix', + 'prefix refusal function differs') + if message == 'Variant literal configuration differs': + return _INITIAL + schema.need(message == 'Variant original preflight differs' and + expected['v03_discriminator'] is False, + 'earlier preflight refusal cannot receive V03 credit') + return _PREFLIGHT + + +def _validate_plan(plan): + schema.exact(plan, ( + 'schema', 'mode', 'round_root', 'session_directory', + 'session_seconds', 'source_closure_admission_sha256', + 'source_files', 'case', + )) + schema.need(plan['schema'] == 'h25-v03-prefix-parent-plan-v1', + 'prefix plan schema differs') + schema.choice(plan['mode'], ('normal', 'optimized')) + for key in ('round_root', 'session_directory'): + schema.path(plan[key]) + schema.integer(plan['session_seconds'], 1, 600) + schema.digest(plan['source_closure_admission_sha256']) + schema.need(type(plan['source_files']) is list and + 1 <= len(plan['source_files']) + 1 <= parent.MAX_SOURCE_FILES, + 'prefix parent source inventory bound differs') + case = plan['case'] + schema.exact(case, ( + 'id', 'generation', 'launch_nonce', 'stage_directory', + 'stage_manifest', 'stage_directories', 'output', 'command', + 'root_seconds', 'address_space_bytes', 'rss_bytes', + 'root_source', 'driver_source', 'gate_values', 'expectation', + )) + schema.label(case['id']) + schema.label(case['generation']) + schema.digest(case['launch_nonce']) + schema.path(case['stage_directory']) + schema.path(case['output']) + schema.need( + case['output'] == plan['session_directory'] + '/producer-output' and + case['output'] != case['stage_directory'] and + not case['output'].startswith(case['stage_directory'] + '/'), + 'prefix source/output origins differ', + ) + schema.integer(case['root_seconds'], 1, 180) + schema.integer(case['address_space_bytes'], 1, 1024 ** 3) + schema.integer(case['rss_bytes'], 1, 1024 ** 3) + for key in ('stage_manifest', 'root_source', 'driver_source', 'gate_values'): + schema.blob(case[key], schema.RECORD_BYTES) + schema.need(type(case['stage_directories']) is list and + len(case['stage_directories']) <= parent.MAX_STAGE_ENTRIES, + 'prefix stage directory declaration differs') + integration = case['stage_directory'] + '/integration' + schema.need( + case['root_source']['path'] == integration + '/full_driver.py' and + case['root_source']['sha256'] == ROOT_SHA and + case['root_source']['bytes'] == 38851 and + case['driver_source']['path'] == + integration + '/v03_control_driver_v1.py' and + 0 < case['driver_source']['bytes'] <= 262144, + 'prefix genuine Root/selected driver source differs', + ) + command = ['/usr/bin/python3.12', '-S', '-s', '-P', '-B'] + if plan['mode'] == 'optimized': + command.append('-O') + command += [ + integration + '/full_driver.py', '--root-sha256', ROOT_SHA, + '--provider', integration + '/probe_binding_v3.py', PROVIDER_SHA, + '--driver', case['driver_source']['path'], + case['driver_source']['sha256'], '--integration', integration, '--', + '--output', case['output'], '--generation', case['generation'], + '--launch-nonce', case['launch_nonce'], + ] + schema.need(type(case['command']) is list and + all(type(arg) is str for arg in case['command']) and + case['command'] == command, + 'prefix exact original Root command differs') + _expected_files(case['expectation']) + + +def _record_bytes(value): + raw = group01.encode(value) + schema.need(len(raw) <= schema.RECORD_BYTES, + 'prefix parent record exceeds original writer bound') + return raw + + +def _source_snapshot(state): + plan = state['plan'] + plan_pin = state['configuration']['plan'] + schema.need(len(plan['source_files']) + 1 <= parent.MAX_SOURCE_FILES, + 'outer plan row exceeds original parent inventory bound') + schema.need(all(row['path'] != plan_pin['path'] + for row in plan['source_files']), + 'outer plan cannot be its own inner source row') + index = state['plan_endpoint_count'] + schema.need(type(index) is int and 0 <= index < 3, + 'outer plan endpoint read count differs') + state['plan_endpoint_count'] = index + 1 + endpoint = copying.read_verified( + plan_pin, schema.RECORD_BYTES, error_owner=state['errors']) + state['plan_endpoint_raw'][index] = endpoint + schema.need(endpoint == state['plan_raw'], + 'outer authenticated plan bytes changed') + files = parent._snapshot_sources(plan, state['errors']) + plan_inode = schema.inode(plan_pin) + schema.need(all(schema.inode(row) != plan_inode for row in files), + 'outer plan inode aliases an inner source input') + stage = parent._stage(dict(plan, **plan['case']), state['errors'], state) + raw = _record_bytes({ + 'schema': 'h25-prefix-source-custody-v1', + 'outer_plan': {'pin': plan_pin, 'bytes': len(endpoint), + 'sha256': schema.sha(endpoint)}, + 'parent_source_rows_including_outer_plan': len(files) + 1, + 'files': files, 'stage': stage, + 'source_closure_admission_sha256': + plan['source_closure_admission_sha256'], + 'interval_proved_by_endpoint_equality': False, + }) + return files, stage, raw + + +def make_prefix_owner(original_receivers): + schema.need(_PREFIX[0] is False, 'one prefix owner per fresh process') + _PREFIX[0] = True + began = _CLOCK() + state = None + try: + admissions = _gate_snapshot() + _native_bindings() + _clean(_UNKNOWN_OWNER) + errors = schema.make_error_owner() + _UNKNOWN_OWNER['native_errors'][0] = schema.owner_state(errors) + configuration = schema.plain_copy(CONFIGURATION) + plan_raw = copying.read_verified( + configuration['plan'], schema.RECORD_BYTES, error_owner=errors) + plan = group01.decode(plan_raw) + _validate_plan(plan) + policy = group01.decode(copying.read_verified( + configuration['receiver_policy'], schema.RECORD_BYTES, + error_owner=errors)) + schema.need(type(policy) is dict and + policy.get('v03_prefix_supervisor_v1') == + configuration['checker_source'], + 'prefix checker absent from independent source policy') + receivers = closure.bind_receivers(original_receivers, policy, errors) + schema.need( + closure.receiver(receivers, 'v03_prefix_supervisor_v1', + 'make_prefix_owner') is make_prefix_owner and + closure.receiver(receivers, 'epoch_schema_v5', + 'make_error_owner') is schema.make_error_owner and + closure.receiver(receivers, 'epoch_copy_v5', + 'inspect') is copying.inspect and + closure.receiver(receivers, 'parent_domain_v1', + 'create_domain') is domain.create_domain and + closure.receiver(receivers, 'parent_completion_v1', + '_snapshot_sources') is parent._snapshot_sources and + closure.receiver(receivers, 'v03_prefix_derivation_v1', + 'verify_configured_prefix') is + derivation.verify_configured_prefix, + 'prefix actual receiver identities differ', + ) + schema.need(parent._PARENTS == [] and parent._PROCESS[0] is None and + domain._DOMAINS == [], + 'prefix requires a fresh parent/domain lifetime') + _clean(parent._UNKNOWN_OWNER) + launch_contract = closure.receiver( + receivers, 'h25_parent_supervisor', 'launch_contract') + installer = closure.receiver( + receivers, 'h25_parent_supervisor', 'install_subreaper') + launch_contract() + closure.check_receivers(receivers) + + case = plan['case'] + state = { + 'pid': _PID(), 'phase': 'CONSTRUCTING', 'errors': errors, + 'plan': plan, 'configuration': configuration, + 'plan_raw': plan_raw, 'plan_endpoint_raw': [None, None, None], + 'plan_endpoint_count': 0, + 'admissions': admissions, 'receivers': receivers, + 'unknown_owner': _UNKNOWN_OWNER, + 'io_quarantine': _UNKNOWN_OWNER['quarantine'], + 'fallback': [None] * 8, + 'began': began, + 'shared_deadline': began + plan['session_seconds'], + 'lock_fds': [None, None], + 'native_keeper': None, 'subreaper': None, + 'initial_sources': None, 'run': None, + } + # Retain construction resources even if no capability is returned. + _PREFIX[1] = (None, state) + + parent._MKDIR(plan['session_directory'], 0o700) + parent._MKDIR(plan['session_directory'] + '/retained', 0o700) + for index, name in enumerate(('parent-queue.lock', 'science.lock')): + _clean(_UNKNOWN_OWNER) + _UNKNOWN_OWNER['pending'][0] = True + state['lock_fds'][index] = parent._OPEN( + plan['round_root'] + '/runtime/' + name, + os.O_RDWR | os.O_CREAT | os.O_CLOEXEC | os.O_NOFOLLOW, 0o600) + _UNKNOWN_OWNER['pending'][0] = False + _FLOCK(state['lock_fds'][index], fcntl.LOCK_EX | fcntl.LOCK_NB) + + _UNKNOWN_OWNER['pending'][0] = True + installed = installer(Path(plan['round_root'])) + state['subreaper'], state['native_keeper'] = installed + _UNKNOWN_OWNER['pending'][0] = False + closure.check_receivers(receivers) + _clean(_UNKNOWN_OWNER) + + state['initial_sources'] = _source_snapshot(state) + by_path = {row['path']: row for row in plan['source_files']} + pins = tuple(pin for name, pin in configuration.items() + if name != 'plan') + ( + case['root_source'], case['driver_source'], case['gate_values'], + ) + for pin in pins: + schema.need(pin['path'] in by_path and + by_path[pin['path']]['sha256'] == pin['sha256'] and + by_path[pin['path']]['bytes'] == pin['bytes'] and + by_path[pin['path']]['mode'] == + pin['identity']['mode'] & 0o7777, + 'prefix input absent from parent source custody') + state['root_bytes'] = copying.read_verified( + case['root_source'], 262144, error_owner=errors) + state['driver_bytes'] = copying.read_verified( + case['driver_source'], 262144, error_owner=errors) + original = copying.read_verified( + configuration['original_variant'], 262144, error_owner=errors) + schema.need(configuration['original_variant']['sha256'] == VARIANT_SHA, + 'original variant source pin differs') + gate_raw = copying.read_verified( + case['gate_values'], schema.RECORD_BYTES, error_owner=errors) + decode = closure.receiver(receivers, OBSERVER, '_decode') + values = decode(gate_raw, schema.RECORD_BYTES) + derivation.verify_configured_prefix( + original, state['driver_bytes'], values) + schema.need(all(value is not None for value in values.values()), + 'prefix remains unconfigured; launch withheld') + # The check above does not approve these values. Their genuine + # admission must already be established by the authenticated bootstrap. + state['before_pin'] = copying.write_once( + plan['session_directory'] + '/SOURCE-BEFORE.json', + state['initial_sources'][2], error_owner=errors) + state['phase'] = 'READY' + _guard(state) + token = object() + _PREFIX[1] = (token, state) + return token + except BaseException as error: + if _UNKNOWN_OWNER['primary'][0] is None: + _UNKNOWN_OWNER['primary'][0] = error + _UNKNOWN_OWNER['quarantine'][0] = True + if state is not None: + state['phase'] = 'STOP' + primary = _UNKNOWN_OWNER['primary'][0] + if primary is error: + raise + raise primary + + +def _terminal(state, run): + _guard(state) + schema.need(run['primary'][0] is None, + 'earlier run error forbids terminal observation') + if run['expectation']['outcome'] == 'PREFIX_RETURN': + return domain.terminal_facts(run['domain']) + return domain.prefix_exit1_terminal_facts(run['domain']) + + +def _supervise(state): + owner, plan = state['unknown_owner'], state['plan'] + case = plan['case'] + run = None + primary = first_cleanup = None + old_handler = None + alarm_installed = False + try: + _guard(state) + schema.need(state['phase'] == 'READY' and state['run'] is None, + 'prefix control already consumed') + state['phase'] = 'CONTROL_CONSUMED' + run = { + 'plan': case, 'unknown_owner': owner, + 'domain': None, 'process': None, 'root': None, 'terminal': None, + 'log_fds': [None, None], + 'log_close_attempted': [False, False], + 'log_close_confirmed': [False, False], + 'errors': [None] * 8, 'primary': [None], + 'acquisition_in_flight': False, + 'spawn_entered': False, 'spawn_returned': False, + 'finish_attempted': False, + 'began': _CLOCK(), 'peak_rss': 0, 'file_limits': None, + 'retained': {}, 'expectation': case['expectation'], + } + state['run'] = run + before = _source_snapshot(state) + schema.need(before == state['initial_sources'], + 'prefix source/stage changed before launch') + try: + parent._STAT(case['output'], follow_symlinks=False) + except FileNotFoundError: + pass + else: + raise schema.EpochStop('prefix output already exists') + + run['file_limits'] = tuple(parent._GETRLIMIT(resource.RLIMIT_FSIZE)) + run['domain'] = domain.create_domain(owner) + run['launch'] = copying.write_once( + plan['session_directory'] + '/LAUNCH.json', + _record_bytes({ + 'schema': 'h25-prefix-control-launch-v1', + 'case': case['id'], 'mode': plan['mode'], + 'generation': case['generation'], + 'launch_nonce': case['launch_nonce'], + 'parent_pid': state['pid'], 'command': case['command'], + 'cwd': case['stage_directory'], 'environment': ENV, + 'parent_file_limits': list(run['file_limits']), + 'root_seconds': case['root_seconds'], + 'address_space_bytes': case['address_space_bytes'], + 'rss_bytes': case['rss_bytes'], + 'new_session': True, 'close_fds': True, 'pass_fds': [], + 'production_completion': False, + }), error_owner=state['errors']) + + for index, name in enumerate(('stdout.raw', 'stderr.raw')): + _clean(owner) + run['acquisition_in_flight'] = True + owner['pending'][0] = True + run['log_fds'][index] = parent._OPEN( + plan['session_directory'] + '/' + name, + os.O_WRONLY | os.O_CREAT | os.O_EXCL | + os.O_CLOEXEC | os.O_NOFOLLOW, 0o600) + run['acquisition_in_flight'] = False + owner['pending'][0] = False + + setter, kind = parent._SETRLIMIT, resource.RLIMIT_AS + limits = (case['address_space_bytes'], case['address_space_bytes']) + + def child_limit(): + setter(kind, limits) + + schema.need(parent._GETTIMER(signal.ITIMER_REAL) == (0.0, 0.0), + 'existing timer cannot be replaced') + old_handler = parent._GETSIGNAL(signal.SIGALRM) + parent._SIGNAL(signal.SIGALRM, parent._alarm) + alarm_installed = True + deadline = min(run['began'] + case['root_seconds'], + state['shared_deadline'] - domain.CLEANUP_SECONDS) + schema.need(_CLOCK() < deadline, 'no funded root/cleanup interval') + parent._SETTIMER(signal.ITIMER_REAL, + max(0.000001, deadline - _CLOCK())) + _guard(state) + run['spawn_entered'] = True + run['process'] = parent._POPEN( + case['command'], cwd=case['stage_directory'], env=dict(ENV), + stdout=run['log_fds'][0], stderr=run['log_fds'][1], + stdin=subprocess.DEVNULL, close_fds=True, pass_fds=(), + start_new_session=True, preexec_fn=child_limit) + run['spawn_returned'] = True + run['root'] = domain.adopt_popen(run['domain'], run['process']) + while True: + unused, current = domain.observe(run['domain']) + run['peak_rss'] = max(run['peak_rss'], + sum(row[6] for row in current)) + schema.need(run['peak_rss'] <= case['rss_bytes'], + 'owned prefix RSS sum exceeded') + schema.need(max(parent._STAT( + plan['session_directory'] + '/' + name, + follow_symlinks=False).st_size + for name in ('stdout.raw', 'stderr.raw')) <= schema.LOG_BYTES, + 'prefix raw log bound exceeded') + if domain.poll_owned(run['domain']) is not None: + break + parent._SLEEP(0.01) + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + primary = owner['primary'][0] + if run is not None: + run['primary'][0] = primary + if error is not primary: + run['errors'][4] = error + if (owner['pending'][0] or owner['iterator_uncertain'][0] or + (run is not None and run['acquisition_in_flight']) or + type(error) is MemoryError): + owner['quarantine'][0] = True + finally: + if alarm_installed: + try: + parent._SETTIMER(signal.ITIMER_REAL, 0) + parent._SIGNAL(signal.SIGALRM, old_handler) + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + if run is not None: + run['errors'][2] = error + first_cleanup = error + if run is not None and run['domain'] is not None: + run['finish_attempted'] = True + try: + domain.finish_domain(run['domain']) + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + owner['quarantine'][0] = True + run['errors'][3] = error + if first_cleanup is None: + first_cleanup = error + if run is not None: + try: + parent._close_logs( + run, primary if primary is not None else first_cleanup) + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + if first_cleanup is None: + first_cleanup = error + for index in range(2): + if (run['log_close_attempted'][index] and + not run['log_close_confirmed'][index]): + owner['quarantine'][0] = True + + if owner['primary'][0] is not None: + state['phase'] = 'STOP' + raise owner['primary'][0] + schema.need(run is not None and run['spawn_entered'] is True and + run['spawn_returned'] is True and + run['finish_attempted'] is True and + run['acquisition_in_flight'] is False and + all(run['log_close_confirmed']), + 'prefix spawn/stream ownership incomplete') + schema.need(tuple(parent._GETRLIMIT(resource.RLIMIT_FSIZE)) == + run['file_limits'], 'parent file limit drift') + run['terminal'] = _terminal(state, run) + state['phase'] = 'CONTROL_JOINED' + return run + + +def _directory_identity(info): + return (info.st_dev, info.st_ino, info.st_mode, info.st_nlink, + info.st_uid, info.st_gid, info.st_size, + info.st_mtime_ns, info.st_ctime_ns) + + +def _census_output(state, directory, files, directories): + """Original path-census ownership pattern; C07 remains a prerequisite.""" + _clean(state['unknown_owner']) + schema.path(directory) + schema.need(len(files) + len(directories) <= 9, + 'prefix output declaration bound') + before = parent._STAT(directory, follow_symlinks=False) + schema.need(stat.S_ISDIR(before.st_mode), 'prefix directory kind differs') + owner = state['unknown_owner'] + iterator = None + primary = None + found_files, found_directories = [], [] + owner['pending'][0] = True + try: + iterator = parent._SCANDIR(directory) + owner['pending'][0] = False + for entry in iterator: + schema.need(type(entry) is os.DirEntry, + 'prefix native directory entry differs') + name = entry.name + schema.need(type(name) is str and 0 < len(name) <= 256 and + '/' not in name and name not in ('.', '..'), + 'prefix directory entry name differs') + schema.need(len(found_files) + len(found_directories) < 9, + 'prefix output entry bound exceeded') + info = entry.stat(follow_symlinks=False) + if stat.S_ISREG(info.st_mode): + found_files.append(name) + elif stat.S_ISDIR(info.st_mode): + found_directories.append(name) + else: + raise schema.EpochStop('prefix symlink/special output refused') + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + primary = owner['primary'][0] + owner['quarantine'][0] = True + owner['iterator_uncertain'][0] = True + if primary is error: + raise + raise primary + finally: + if iterator is not None: + owned = iterator + iterator = None + try: + owned.close() + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + owner['quarantine'][0] = True + owner['iterator_uncertain'][0] = True + if state['fallback'][3] is None: + state['fallback'][3] = error + if primary is None: + raise owner['primary'][0] + after = parent._STAT(directory, follow_symlinks=False) + schema.need(_directory_identity(before) == _directory_identity(after), + 'prefix directory changed during census') + schema.need(sorted(found_files) == sorted(files) and + sorted(found_directories) == sorted(directories), + 'prefix exact output census differs') + return _directory_identity(after) + + +def _capture(state, run): + plan, case = state['plan'], state['plan']['case'] + names = _expected_files(case['expectation']) + occupied, raw, pins = (), {}, {} + sources = ( + ('stdout.raw', plan['session_directory'] + '/stdout.raw', + schema.LOG_BYTES), + ('stderr.raw', plan['session_directory'] + '/stderr.raw', + schema.LOG_BYTES), + ) + tuple((name, case['output'] + '/' + name, schema.RECORD_BYTES) + for name in names) + + # Complete exclusive copies precede semantic interpretation. + for name, path, bound in sources: + _guard(state) + source = copying.inspect(path, bound, error_owner=state['errors']) + run['retained'][name] = {'source': source} + pair = schema.inode(source) + schema.need(pair not in occupied, 'prefix raw occurrences alias') + occupied += (pair,) + copied = copying.copy_once( + source, plan['session_directory'] + '/retained/' + name, + occupied, error_owner=state['errors']) + run['retained'][name]['copy'] = copied + occupied += (schema.inode(copied),) + raw[name] = copying.read_verified( + copied, bound, error_owner=state['errors']) + pins[name] = (source, copied, bound) + + output_identity = _census_output( + state, case['output'], names, ('initial-tcb-controls',)) + scratch_identity = _census_output( + state, case['output'] + '/initial-tcb-controls', (), ()) + decode = closure.receiver(state['receivers'], OBSERVER, '_decode') + values = {name: decode(raw[name], schema.RECORD_BYTES) for name in names} + closure.check_receivers(state['receivers']) + schema.need(raw['stdout.raw'] == b'', 'prefix stdout is not empty') + for name in ('initial-tcb.raw.json', 'initial-restoration.raw.json'): + receipt = values[name] + schema.need(type(receipt) is dict and + type(receipt.get('pid')) is int and + receipt['pid'] == run['root'][0], + 'prefix initial/restoration PID differs') + + expected = case['expectation'] + binding = {'mode': plan['mode'], 'generation': case['generation'], + 'launch_nonce': case['launch_nonce']} + if expected['outcome'] == 'PREFIX_RETURN': + schema.need(raw['stderr.raw'] == b'', + 'positive prefix stderr is not empty') + check = closure.receiver( + state['receivers'], OBSERVER, 'corroborate_positive') + ok = check(raw['v03-input-result.raw.json'], + raw['v03-root-after.raw.json'], + raw['preflight-before.raw.json'], + binding, schema.RECORD_BYTES) + else: + check = closure.receiver( + state['receivers'], OBSERVER, 'corroborate_complete_refusal') + ok = check(state['driver_bytes'], state['root_bytes'], + case['driver_source']['path'], case['root_source']['path'], + raw['stderr.raw'], expected['terminal_function'], + expected['message'], schema.LOG_BYTES) + schema.need(ok is True, 'complete prefix data corroboration differs') + closure.check_receivers(state['receivers']) + for source, copied, bound in pins.values(): + _clean(state['unknown_owner']) + copying.verify(source, bound, error_owner=state['errors']) + copying.verify(copied, bound, error_owner=state['errors']) + schema.need( + _census_output(state, case['output'], names, + ('initial-tcb-controls',)) == output_identity and + _census_output(state, case['output'] + '/initial-tcb-controls', + (), ()) == scratch_identity, + 'prefix output changed after capture', + ) + + +def run_prefix(token): + state = _state(token) + owner = state['unknown_owner'] + try: + run = _supervise(state) + _capture(state, run) + after = _source_snapshot(state) + schema.need(after == state['initial_sources'], + 'complete prefix source/stage custody changed') + schema.need(_terminal(state, run) == run['terminal'], + 'prefix owned terminal facts changed') + case = state['plan']['case'] + schema.need(_CLOCK() - run['began'] <= case['root_seconds'], + 'complete prefix root/capture tail exceeded bound') + _guard(state) + record = { + 'schema': 'h25-owned-v03-prefix-observation-v1', + 'case': case['id'], 'mode': state['plan']['mode'], + 'generation': case['generation'], + 'launch_nonce': case['launch_nonce'], + 'launch': run['launch'], 'terminal': run['terminal'], + 'source_before': state['before_pin'], + 'source_after_equals_before': True, + 'outer_plan_endpoint_reads': state['plan_endpoint_count'], + 'raw': run['retained'], + 'data_corroboration': 'COMPLETE_PREFIX_DATA_ONLY', + 'independent_native_receipt_replay_performed': False, + 'interval_proved_by_endpoint_equality': False, + 'parent_exit_observed_here': False, + 'enclosing_guard_must_observe_parent_exit': True, + 'production_completion': False, + 'full_c05': False, 'full_v03': False, + 'runtime_qualified': False, + } + result = copying.write_once( + state['plan']['session_directory'] + '/PREFIX-OBSERVATION.json', + _record_bytes(record), error_owner=state['errors']) + _guard(state) + schema.need(_CLOCK() - run['began'] <= case['root_seconds'], + 'complete prefix result-writing tail exceeded bound') + state['phase'] = 'CLOSED' + # Plain file pin DATA only. No owner/domain/Popen/epoch token escapes. + return schema.plain_copy(result) + except BaseException as error: + if owner['primary'][0] is None: + owner['primary'][0] = error + state['phase'] = 'STOP' + if owner['pending'][0] or owner['iterator_uncertain'][0]: + owner['quarantine'][0] = True + primary = owner['primary'][0] + if primary is error: + raise + raise primary + + +def stop_evidence(token): + state = _state(token) + run = state['run'] + summary = None if run is None else { + 'spawn_entered': run['spawn_entered'], + 'spawn_returned': run['spawn_returned'], + 'finish_attempted': run['finish_attempted'], + 'log_close_attempted': list(run['log_close_attempted']), + 'log_close_confirmed': list(run['log_close_confirmed']), + } + return (state['unknown_owner']['primary'], state['errors'], + state['fallback'], summary) diff --git a/research/h25-v03-authenticated-prefix-entry/prerequisites/v03_source_refusal_observer_v1.py.txt b/research/h25-v03-authenticated-prefix-entry/prerequisites/v03_source_refusal_observer_v1.py.txt new file mode 100644 index 0000000000..d03b4e14bd --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/prerequisites/v03_source_refusal_observer_v1.py.txt @@ -0,0 +1,290 @@ +"""Pure source-location corroboration for parent-retained V03 stderr. + +This does not establish ownership, currentness, admission, or even that a child +ran. The genuine parent must supply its complete retained raw stderr after +actual owned termination, with independently authenticated driver/stage pins. +No result of this function by itself is a V03 PASS or a ParentCompletion. +""" +import ast +import hashlib +import json + +COMPONENT_LOG_BYTES = 2 * 1024 * 1024 +COMPONENT_RECORD_BYTES = 1048576 +ROOT_COUNTERS = ('load_calls', 'native_creations', 'native_execs', + 'activation_attempts', 'successful_bindings', + 'deactivation_attempts', 'cleanup_failures', + 'control_module_creations') + +MESSAGES = { + '_vcheck_literal_sources': ( + 'Variant source role path differs', + 'Variant reviewed source/header differs', + 'Variant role file omitted from closure'), + '_vcheck_custody': ('Variant current source closure differs',), + '_v03_original_input_prefix': ( + 'Variant literal configuration differs', + 'Variant original preflight differs'), +} + + +def source_site(driver_bytes, function, message): + """Derive the unique original logical-raise line without running code.""" + if (type(driver_bytes) is not bytes or not 0 < len(driver_bytes) <= 262144 or + type(function) is not str or type(message) is not str or + function not in MESSAGES or message not in MESSAGES[function]): + raise ValueError('bounded source and literal V03 refusal required') + tree = ast.parse(driver_bytes, feature_version=(3, 12)) + candidates = [node for node in tree.body + if isinstance(node, ast.FunctionDef) and node.name == function] + if len(candidates) != 1: + raise ValueError('unique actual control function required') + sites = [] + for node in ast.walk(candidates[0]): + if not isinstance(node, ast.Raise): + continue + value = node.exc + if (isinstance(value, ast.Call) and isinstance(value.func, ast.Name) and + value.func.id == 'RuntimeError' and len(value.args) == 1 and + not value.keywords and isinstance(value.args[0], ast.Constant) and + type(value.args[0].value) is str and value.args[0].value == message): + sites.append(node.lineno) + if len(sites) != 1: + raise ValueError('unique actual literal raise required') + return sites[0] + + +def corroborate_raw_refusal(driver_bytes, driver_path, stderr_raw, + function, message, original_log_bound): + """Recognize only the expected terminal logical source refusal. + + All exceptions from this checker mean incomplete verification. A False + return means different or insufficient raw evidence; never generic success. + The bound is the existing parent's independently fixed log limit, not a + newly increased allowance. This is terminal-site corroboration only: it + refuses conventional chaining but does not establish the middle frames or + complete traceback grammar. Use corroborate_complete_refusal as well before + accepting the proposed genuine-Root source-refusal route. + """ + if (type(driver_path) is not str or not 1 < len(driver_path) <= 4096 or + not driver_path.startswith('/') or + any(not 32 <= ord(c) < 127 for c in driver_path) or + type(original_log_bound) is not int or original_log_bound <= 0): + raise ValueError('actual source path and existing parent log limit required') + if (type(stderr_raw) is not bytes or + len(stderr_raw) > min(original_log_bound, COMPONENT_LOG_BYTES)): + return False + line_number = source_site(driver_bytes, function, message) + header = (' File "' + driver_path + '", line ' + str(line_number) + + ', in ' + function).encode('ascii') + ending = ('RuntimeError: ' + message + '\n').encode('ascii') + start = b'Traceback (most recent call last):\n' + if (not stderr_raw.startswith(start) or not stderr_raw.endswith(ending) or + stderr_raw.count(start) != 1 or + b'During handling of the above exception' in stderr_raw or + b'The above exception was the direct cause' in stderr_raw): + return False + frames = [line for line in stderr_raw.splitlines() if line.startswith(b' File "')] + return bool(frames) and frames[-1] == header + + +def _executed_calls(node, name): + """Find module/function-body calls without descending into new scopes.""" + result = [] + pending = list(ast.iter_child_nodes(node)) + while pending: + child = pending.pop() + if isinstance(child, (ast.FunctionDef, ast.AsyncFunctionDef, + ast.ClassDef, ast.Lambda)): + continue + if (isinstance(child, ast.Call) and isinstance(child.func, ast.Name) + and child.func.id == name): + result.append(child.lineno) + pending.extend(ast.iter_child_nodes(child)) + if len(result) != 1: + raise ValueError('unique actual source call required') + return result[0] + + +def corroborate_complete_refusal(driver_bytes, root_bytes, driver_path, + root_path, stderr_raw, function, message, + original_log_bound): + """Check the full standard traceback shape for the exact f5 Root route. + + This is a strict source-derived corroborator. It grants no ownership, + authenticity, currentness, error-delivery or admission credential. The parent + must separately authenticate the exact selected driver and complete streams. + Unavailable source lines, custom formatters, elision and nonstandard output + are refused, rather than silently accepted as complete original evidence. + """ + if not corroborate_raw_refusal(driver_bytes, driver_path, stderr_raw, + function, message, original_log_bound): + return False + if (type(root_bytes) is not bytes or len(root_bytes) != 38851 or + hashlib.sha256(root_bytes).hexdigest() != + 'f5a2d33f2b4d3651f214156a0e7094c2bb516ce2d5ab7698d18c11f98f35dee0' or + type(root_path) is not str or not 1 < len(root_path) <= 4096 or + not root_path.startswith('/') or root_path == driver_path or + any(not 32 <= ord(c) < 127 for c in root_path)): + raise ValueError('exact original Root bytes and distinct path required') + root_tree = ast.parse(root_bytes, feature_version=(3, 12)) + driver_tree = ast.parse(driver_bytes, feature_version=(3, 12)) + roots = [n for n in root_tree.body + if isinstance(n, ast.FunctionDef) and n.name == '_entry'] + prefixes = [n for n in driver_tree.body if isinstance(n, ast.FunctionDef) + and n.name == '_v03_original_input_prefix'] + if len(roots) != 1 or len(prefixes) != 1: + raise ValueError('unique actual Root entry and control prefix required') + terminal = source_site(driver_bytes, function, message) + expected = [(root_path, _executed_calls(root_tree, '_entry'), ''), + (root_path, _executed_calls(roots[0], '_EXEC'), '_entry'), + (driver_path, _executed_calls(driver_tree, + '_v03_original_input_prefix'), + '')] + if function != '_v03_original_input_prefix': + expected.append((driver_path, _executed_calls(prefixes[0], function), + '_v03_original_input_prefix')) + expected.append((driver_path, terminal, function)) + root_lines = root_bytes.decode('utf-8').splitlines() + driver_lines = driver_bytes.decode('utf-8').splitlines() + raw_lines = stderr_raw.splitlines(keepends=True) + position = 1 # The terminal corroborator already checked the initial header. + for path, line, frame in expected: + header = (' File "' + path + '", line ' + str(line) + ', in ' + + frame + '\n').encode('ascii') + source = root_lines if path == root_path else driver_lines + printed = (' ' + source[line - 1].strip() + '\n').encode('utf-8') + if (position + 1 >= len(raw_lines) or raw_lines[position] != header or + raw_lines[position + 1] != printed): + return False + position += 2 + # CPython may add a range indicator. It has no extra source authority. + if (position < len(raw_lines) and + raw_lines[position].startswith(b' ') and + raw_lines[position].strip(b' \n') and + all(c in b' ~^\n' for c in raw_lines[position]) and + b'^' in raw_lines[position]): + indicator = raw_lines[position].strip(b' \n') + # The standard formatter has one contiguous primary caret range. + first = indicator.find(b'^') + last = indicator.rfind(b'^') + if (any(c != 126 for c in indicator[:first]) or + any(c != 94 for c in indicator[first:last+1]) or + any(c != 126 for c in indicator[last+1:])): + return False + position += 1 + ending = ('RuntimeError: ' + message + '\n').encode('ascii') + return position == len(raw_lines) - 1 and raw_lines[position] == ending + + +def _no_noninteger(token): + raise ValueError('noninteger JSON number or constant') + + +def _integer(token): + if len(token) > 21: + raise ValueError('JSON integer length bound') + value = int(token) + if not -(1 << 64) <= value < (1 << 64): + raise ValueError('JSON integer domain') + return value + + +def _pairs(pairs): + if len(pairs) > 1024: + raise ValueError('JSON mapping bound') + result = {} + for key, value in pairs: + if key in result: + raise ValueError('duplicate JSON key') + result[key] = value + return result + + +def _tree(value, depth, budget): + budget[0] += 1 + if depth > 24 or budget[0] > 65536: + raise ValueError('JSON tree bound') + kind = type(value) + if value is None or kind is bool or kind is int: + return + if kind is str: + budget[1] += len(value) + if len(value) > 8192 or budget[1] > 524288: + raise ValueError('JSON text bound') + return + if kind is list: + if len(value) > 1024: + raise ValueError('JSON sequence bound') + for item in value: + _tree(item, depth + 1, budget) + return + if kind is dict: + for key in value: + _tree(key, depth + 1, budget) + _tree(value[key], depth + 1, budget) + return + raise ValueError('foreign JSON value') + + +def _decode(raw, original_record_bound): + if (type(original_record_bound) is not int or original_record_bound <= 0 or + type(raw) is not bytes or + not 0 < len(raw) <= min(original_record_bound, COMPONENT_RECORD_BYTES)): + raise ValueError('existing parent/raw component byte bound') + value = json.loads(raw.decode('ascii'), object_pairs_hook=_pairs, + parse_int=_integer, parse_float=_no_noninteger, + parse_constant=_no_noninteger) + _tree(value, 0, [0, 0]) + return value + + +def corroborate_positive(result_raw, root_after_raw, preflight_raw, + parent_binding, original_record_bound): + """Corroborate three complete raw records against independent launch data. + + A True result is ONLY these three checks. Original initial TCB/five-control/ + restoration records, custody-before, independent dependencies, parent source + continuity, domain ownership and terminal capture remain required elsewhere. + Limits here are additional component ceilings, never increased parent caps. + Decode resource/MemoryError failures propagate for parent first-error capture. + """ + if (type(parent_binding) is not dict or + any(type(k) is not str for k in parent_binding) or set(parent_binding) != { + 'mode', 'generation', 'launch_nonce'} or + any(type(v) is not str for v in parent_binding.values()) or + parent_binding['mode'] not in ('normal', 'optimized') or + not 1 <= len(parent_binding['generation']) <= 96 or + any(c not in 'abcdefghijklmnopqrstuvwxyz0123456789-' + for c in parent_binding['generation']) or + len(parent_binding['launch_nonce']) != 64 or + any(c not in '0123456789abcdef' for c in parent_binding['launch_nonce'])): + raise ValueError('independent actual parent launch binding required') + result = _decode(result_raw, original_record_bound) + counters = _decode(root_after_raw, original_record_bound) + preflight = _decode(preflight_raw, original_record_bound) + if (type(result) is not dict or set(result) != { + 'schema', 'status', 'binding', 'whole_variant_producer_completed', + 'runtime_qualified'} or + type(result['schema']) is not str or + result['schema'] != 'h25-v03-input-prefix-result-v1' or + type(result['status']) is not str or + result['status'] != 'ORIGINAL_INPUT_PREFIX_RETURNED' or + result['whole_variant_producer_completed'] is not False or + result['runtime_qualified'] is not False or + type(result['binding']) is not dict or + set(result['binding']) != set(parent_binding) or + any(type(result['binding'][k]) is not str or + result['binding'][k] != parent_binding[k] for k in parent_binding)): + return False + if (type(counters) is not dict or set(counters) != set(ROOT_COUNTERS) or + any(type(counters[k]) is not int or counters[k] != 0 for k in ROOT_COUNTERS)): + return False + return (type(preflight) is dict and set(preflight) == { + 'schema', 'authenticated_files', 'native_private_access', 'cached_admission'} and + type(preflight['schema']) is str and + preflight['schema'] == 'h25-public-runtime-preflight-v2' and + type(preflight['authenticated_files']) is int and + preflight['authenticated_files'] == 217 and + preflight['native_private_access'] is False and + preflight['cached_admission'] is False) diff --git a/research/h25-v03-authenticated-prefix-entry/run.py b/research/h25-v03-authenticated-prefix-entry/run.py new file mode 100644 index 0000000000..18fb977093 --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/run.py @@ -0,0 +1,91 @@ +#!/usr/bin/env python3 +# SPDX-License-Identifier: Apache-2.0 +"""Only fixture path bindings change; frozen algorithms/assertions stay exact.""" +from pathlib import Path +import ast +import importlib.util +import json +import sys +import tempfile +from types import ModuleType +import unittest + +PACKAGE = Path(__file__).resolve().parent + + +def main(): + spec = importlib.util.spec_from_file_location('entry_export_archive_check', PACKAGE / 'verify.py') + checker = importlib.util.module_from_spec(spec) + spec.loader.exec_module(checker) + checker.main() + fixture_path = PACKAGE / 'fixtures/test_bootstrap_new_v1.py' + raw = fixture_path.read_bytes() + tree = ast.parse(raw, filename=str(fixture_path)) + frozen_functions = [ast.dump(n, include_attributes=True) for n in tree.body if isinstance(n, (ast.FunctionDef, ast.ClassDef))] + bases = [n for n in tree.body if isinstance(n, ast.Assign) and len(n.targets) == 1 and isinstance(n.targets[0], ast.Name) and n.targets[0].id == 'BASE'] + if len(bases) != 1: + raise RuntimeError('unique fixture BASE path initializer required') + original = bases[0].value + if not (isinstance(original, ast.Call) and isinstance(original.func, ast.Name) and original.func.id == 'Path' and len(original.args) == 1 and isinstance(original.args[0], ast.Constant) and type(original.args[0].value) is str and not original.keywords): + raise RuntimeError('only fixture path initializer may be rebound') + bases[0].value = ast.copy_location(ast.Call(func=ast.Name(id='Path', ctx=ast.Load()), args=[ast.Constant(str(PACKAGE))], keywords=[]), original) + ast.fix_missing_locations(tree) + if frozen_functions != [ast.dump(n, include_attributes=True) for n in tree.body if isinstance(n, (ast.FunctionDef, ast.ClassDef))]: + raise RuntimeError('fixture function/class/assertion AST changed') + fixture = ModuleType('entry_export_new_fixture') + fixture.__file__ = str(fixture_path) + exec(compile(tree, str(fixture_path), 'exec', dont_inherit=True, optimize=sys.flags.optimize), fixture.__dict__) + if Path(fixture.m.__file__).resolve() != (PACKAGE / 'implementation/predecessor_entry.py').resolve(): + raise RuntimeError('nonlocal NEW entry source') + graph = json.loads((PACKAGE / 'SOURCE-GRAPH-v1.json').read_bytes()) + paths = {row['copy_path']: PACKAGE / 'prerequisites' / Path(row['copy_path']).name for row in graph['modules']} + real_path = Path + def fixture_path_binding(value, *parts): + if type(value) is not str or parts: + raise RuntimeError('fixture paths require one exact string and no extra parts') + if value in paths: + return paths[value] + if not value.startswith('/') or not all(32 <= ord(c) < 127 for c in value) or any(part in ('', '.', '..') for part in value.split('/')[1:]): + raise RuntimeError('fixture path must be canonical absolute spelling') + candidate = real_path(value) + if not (candidate.is_relative_to(PACKAGE) or candidate.is_relative_to(scratch)): + raise RuntimeError('unmapped host path outside explicit package/scratch roots') + return candidate + with tempfile.TemporaryDirectory(prefix='.entry-export-fixture-', dir=Path.cwd()) as temporary: + scratch = Path(temporary) + (scratch / 'fixtures').mkdir() + (scratch / 'SOURCE-GRAPH-v1.json').write_bytes((PACKAGE / 'SOURCE-GRAPH-v1.json').read_bytes()) + fixture.BASE = scratch + fixture.Path = fixture_path_binding + for historical, mapped in paths.items(): + if fixture_path_binding(historical) != mapped: + raise RuntimeError('historical input mapping failed') + try: + fixture_path_binding(historical, 'extra-child') + except RuntimeError: + pass + else: + raise RuntimeError('historical path extra-part bypass') + for refused in ('/home/d3lerium/not-a-mapped-copy', '/etc/passwd', '/tmp/unowned-entry-fixture', str(scratch) + '/../outside'): + try: + fixture_path_binding(refused) + except RuntimeError: + pass + else: + raise RuntimeError('unmapped host path accepted') + owned = str(scratch / 'fixtures' / 'new-owned-file') + if fixture_path_binding(owned) != real_path(owned): + raise RuntimeError('owned fixture path refused') + print('PASS_ADAPTER_PATH_BOUNDARY exact_mappings=15 extra_parts_refused=15 unknown_paths_refused=4 owned_path=PASS', flush=True) + suite = unittest.defaultTestLoader.loadTestsFromModule(fixture) + if suite.countTestCases() != 12: + raise RuntimeError('exact twelve frozen NEW methods required') + result = unittest.TextTestRunner(verbosity=2).run(suite) + if not result.wasSuccessful(): + return 1 + print('PASS_TWELVE_FROZEN_NEW_ENTRY_METHODS optimized=' + str(sys.flags.optimize), flush=True) + return 0 + + +if __name__ == '__main__': + raise SystemExit(main()) diff --git a/research/h25-v03-authenticated-prefix-entry/verify.py b/research/h25-v03-authenticated-prefix-entry/verify.py new file mode 100644 index 0000000000..e38bc5ffcc --- /dev/null +++ b/research/h25-v03-authenticated-prefix-entry/verify.py @@ -0,0 +1,84 @@ +#!/usr/bin/env python3 +# SPDX-License-Identifier: Apache-2.0 +"""Raw archive/frozen source checks only; no original imports or execution.""" +from pathlib import Path, PurePosixPath +import ast +import hashlib +import json + +ROOT = Path(__file__).resolve().parent + + +def need(value, message): + if value is not True: + raise RuntimeError(message) + + +def digest(raw): + return hashlib.sha256(raw).hexdigest() + + +def local(spelling): + need(type(spelling) is str, 'archive path type') + p = PurePosixPath(spelling) + need(not p.is_absolute() and p.as_posix() == spelling and all(v not in ('', '.', '..') for v in p.parts), 'archive path') + out = ROOT / spelling + need(not any(q.is_symlink() for q in (out, *out.parents) if q.is_relative_to(ROOT)), 'archive alias') + return out + + +def literal(tree, name): + nodes = [n.value for n in tree.body if isinstance(n, ast.Assign) and len(n.targets) == 1 and isinstance(n.targets[0], ast.Name) and n.targets[0].id == name] + need(len(nodes) == 1, 'literal source field: ' + name) + return ast.literal_eval(nodes[0]) + + +def main(): + manifest = json.loads(local('ARTIFACTS.json').read_text()) + seen = set() + for row in manifest['files']: + need(row['path'] not in seen, 'duplicate artifact') + seen.add(row['path']) + raw = local(row['path']).read_bytes() + need((len(raw), digest(raw)) == (row['bytes'], row['sha256']), 'raw artifact: ' + row['path']) + actual = {p.relative_to(ROOT).as_posix() for p in ROOT.rglob('*') if p.is_file() and '__pycache__' not in p.parts} + need(actual == seen | {'ARTIFACTS.json'}, 'archive file set') + entry = local('implementation/predecessor_entry.py').read_bytes() + fixture = local('fixtures/test_bootstrap_new_v1.py').read_bytes() + need((len(entry), digest(entry)) == (21857, 'b783c6812a6295069456cfb4187d4e09bb7acbcb20fffd76e0c10267f90c1201'), 'frozen entry bytes') + need((len(fixture), digest(fixture)) == (6532, '19c1b08d4daeaf0c2d40357b0e117fcb2ca2f632f627e290fe7442abf49b3504'), 'frozen fixture bytes') + graph_raw = local('SOURCE-GRAPH-v1.json').read_bytes() + need((len(graph_raw), digest(graph_raw)) == (132763, 'f999a6bfc9ac9048b248d9b029b7676ba04dea5c559228d5286e49d269ca3597'), 'fixed graph bytes') + graph = json.loads(graph_raw) + rows = graph['modules'] + expected = {r['module']: (r['sha256'], r['bytes']) for r in rows} + tree = ast.parse(entry) + need(literal(tree, 'PROJECT_PINS') == expected and literal(tree, 'PROJECT_ORDER') == tuple(graph['topological_initialization_order']), 'entry/graph selection') + need(len(rows) == 15 and sum(r['bytes'] for r in rows) == 379241, 'inner source bill') + for row in rows: + raw = local('prerequisites/' + Path(row['copy_path']).name).read_bytes() + need((digest(raw), len(raw)) == expected[row['module']], 'inert graph input identity') + tests = ast.parse(fixture) + classes = [n for n in tests.body if isinstance(n, ast.ClassDef) and n.name == 'Tests'] + need(len(classes) == 1, 'fixture class') + methods = [n for n in classes[0].body if isinstance(n, ast.FunctionDef) and n.name.startswith('test_')] + need(len(methods) == 12 and any(n.name == 'test_fixed_original_graph_is_parsed_only_and_ordered' for n in methods), 'exact twelve fixture scope') + need(not any(isinstance(n, ast.Call) and isinstance(n.func, ast.Attribute) and isinstance(n.func.value, ast.Name) and n.func.value.id == 'm' and n.func.attr in ('main', 'entry_operation') for n in ast.walk(tests)), 'forbidden full entry fixture call') + close_raw = local('evidence/SOURCE-CLOSE-v1.json').read_bytes() + need(digest(close_raw) == '7cac80142264ca41f80be6fa7ea4a0b268cd2ce6c44ff2755f0cb3294c59fd9b', 'source close identity') + close = json.loads(close_raw) + need(close['accepted_checkpoints'] == ['U6.1', 'U6.2'] and close['accepted_count'] == 2 and close['fixed_local_denominator'] == 4, 'closed partial denominator') + need(close['original_C05'] is False and close['original_V03'] is False and close['runtime_qualified'] is False and close['original_activity_credit_added'] == 0 and close['costs'] == 'OPEN_NOT_ZERO', 'original acceptance boundary') + review = local('evidence/review-loader-source-v2.json').read_bytes() + need(digest(review) == '7ed7ef8896abdaab443473038992f652a5054f43c4ea41a0f0aa0f028079b799', 'entry review identity') + caller = local('evidence/review-caller-source-v2.json').read_bytes() + need(digest(caller) == '37c9f79c9f836fa14ea88d1ae5790b2ce350361699e848f35e2faebe6549c8b6', 'caller partial review identity') + reconstruction = json.loads(local('evidence/review-loader-initial-reconstruction-v1.json').read_text()) + initial = local('history/initial-draft-VERIFIED-RECONSTRUCTION-d751.py.txt').read_bytes() + need(initial == reconstruction['reconstructed_source_text'].encode() and digest(initial) == reconstruction['reconstructed_sha256'], 'verified reconstruction identity') + need(local('history/reviewed-entry-final-b783.py.txt').read_bytes() == entry and local('history/reviewed-tests-final-19c1.py.txt').read_bytes() == fixture, 'direct final snapshots') + print('PASS_AUTHENTICATED_ENTRY_ARCHIVE_ONLY files=' + str(len(seen)) + ' inert_sources=15 bytes=379241 fixture_methods=12', flush=True) + + +if __name__ == '__main__': + main()