"""Source-bound successor accounting; the one declared frontend addition never masks missing cases.""" import copy import datetime import importlib.util import hashlib import json import sys import xml.etree.ElementTree as ET from pathlib import Path HERE=Path(__file__).resolve().parent spec=importlib.util.spec_from_file_location('qualified_reconciliation',HERE.parent/'p9-requal-01/reconcile.py') prior=importlib.util.module_from_spec(spec) spec.loader.exec_module(prior) ROOT=prior.ROOT RAW=ROOT/'.artifacts/p9-remed-02/final' prior.RAW=RAW ADDED_CASE='focusing a preview retry control keeps its pointer target stationary' def validate_representative(proof,report): expected={'long-skills-minimal-en','long-skills-technical-nb'} cases=report.get('fixtures',[]) if (proof.get('status')!='PASS' or proof.get('oracleExitCode')!=0 or report.get('total')!=2 or report.get('passed')!=2 or len(cases)!=2 or {case.get('fixture') for case in cases}!=expected or any(case.get('pass') is not True or case.get('failures')!=[] for case in cases) or proof.get('cases')!=cases): raise ValueError('Supplemental PDF membership, oracle outcome or retained cases differ.') def require_unchanged(inputs): if any(not Path(name).is_file() or hashlib.sha256(Path(name).read_bytes()).hexdigest()!=digest for name,digest in inputs.items()): raise ValueError('Supplemental PDF input/report drift.') def frontend_cases(report,baseline,exit_code): reference=copy.deepcopy(baseline) suites=[suite for suite in reference['testResults'] if suite['name'].replace('\\','/').endswith('/job-tracker-ui/src/cv-builder-deep-link.test.tsx')] if len(suites)!=1: raise ValueError('Missing or ambiguous frontend membership reference.') # This adds an expectation, never an execution outcome, to the old934-case multiset. suites[0]['assertionResults'].append({'fullName':ADDED_CASE}) return prior.jest_results(report,reference,exit_code,935) def main(): results={'backend':prior.collect_trx('backend','backend/backend.trx',1130), 'mariadb':prior.collect_trx('mariadb','mariadb/mariadb.trx',35)} for i in range(1,5): results[f'ordinary-{i}']=prior.collect_browser(f'ordinary-{i}') try: if any(results[f'ordinary-{i}']['status']!='PASS' for i in range(1,5)): raise ValueError('Incomplete ordinary shards.') cases=prior.reconcile_ordinary(prior.load(RAW/'discovery.json'),[results[f'ordinary-{i}']['cases'] for i in range(1,5)]) if len(cases)!=362: raise ValueError('Unexpected ordinary discovery membership.') results['ordinary']={'status':'PASS','passed':362,'discovery':prior.identity(RAW/'discovery.json')} except (FileNotFoundError,ValueError) as error: results['ordinary']={'status':'NOT_COMPLETE','reason':str(error)} for name,count in {'ai':2,'auth':2,'rate':9,'ingress':6,'pdf-admission':1,'preferences':3,'rd21':6,'diagnostics':18,'volume':3,'rd21-volume':3,'mariadb-browser':1,'mariadb-observations':2}.items(): results[name]=prior.collect_browser(name,count) old_raw=prior.RAW prior.RAW=ROOT/'.artifacts/p9-remed-02/final-linux' results['linux-renderer']=prior.collect_browser('linux-renderer',5) prior.RAW=ROOT/'.artifacts/p9-remed-02/representative-linux' representative=prior.collect_browser('linux-renderer',2) try: proof=prior.load(prior.RAW/'result.json') root=prior.RAW/'linux/fidelity' report=prior.load(root/'fidelity-results.json') validate_representative(proof,report) measurements=prior.load(root/'measurements.json') if len(measurements['fixtures'])!=2 or {case['fixture'] for case in measurements['fixtures']}!={case['fixture'] for case in report['fixtures']}: raise ValueError('Supplemental measurements membership differs.') binding=prior.RAW/'oracle-inputs.json' inputs=prior.load(binding)['inputs'] if proof.get('inputs')!=inputs or proof.get('reportSha256')!=hashlib.sha256((root/'fidelity-results.json').read_bytes()).hexdigest(): raise ValueError('Supplemental producer input/report binding differs.') oracle=str((ROOT/'scripts/verify-cv-fidelity.py').resolve()) if inputs.get(oracle)!='64f82e622cc11483c33307d987e969f6cf27f82ab6bdbd72c2aeb1bfbceade87': raise ValueError('Supplemental original oracle identity differs.') for case in report['fixtures']: for name in ['render.html','export.pdf','measurements.json']: if str((root/case['fixture']/name).resolve()) not in inputs: raise ValueError('Supplemental required artifact missing.') require_unchanged(inputs) representative['oracle']=proof representative['oracleEvidence']=prior.identity(prior.RAW/'result.json') representative['inputBinding']=prior.identity(binding) representative['report']=prior.identity(root/'fidelity-results.json') except FileNotFoundError as error: representative.update(status='NOT_COMPLETE',reason=str(error)) except ValueError as error: representative.update(status='FAIL',reason=str(error)) results['pdf-representative']=representative prior.RAW=old_raw try: path=RAW/'frontend.json';data=prior.load(path);process=prior.load(RAW/'frontend-exit.json') reference=ROOT/'.artifacts/p9-requal-01/frontend.json' accepted=prior.load(HERE.parent/'p9-requal-01/validation.json')['results']['frontend']['report']['sha256'] if prior.identity(reference)['sha256']!=accepted: raise ValueError('Historical frontend reference changed.') if f"test('{ADDED_CASE}'" not in (ROOT/'job-tracker-ui/src/cv-builder-deep-link.test.tsx').read_text(encoding='utf-8'): raise ValueError('Declared added regression is absent from source.') cases=frontend_cases(data,prior.load(reference),process['exitCode']) expected={'numPassedTests':935,'numTotalTests':935,'numFailedTests':0,'numPendingTests':0,'numTodoTests':0,'numPassedTestSuites':105,'numTotalTestSuites':105,'numFailedTestSuites':0} if any(data.get(k)!=v for k,v in expected.items()): raise ValueError('Frontend aggregate counts differ.') results['frontend']={'status':'PASS','passed':935,'suites':105,'cases':cases,'report':prior.identity(path),'process':process,'membershipReference':prior.identity(reference),'declaredAddedCase':ADDED_CASE} except FileNotFoundError as error: results['frontend']={'status':'NOT_RUN','reason':str(error)} except ValueError as error: results['frontend']={'status':'FAIL','reason':str(error)} for name in ['types','lint','build','sidecar']: try: process=prior.load(RAW/(name+'-exit.json')) result={'status':'PASS' if process['exitCode']==0 else 'FAIL','process':process,'log':prior.identity(RAW/(name+'.log'))} if name=='sidecar': result['cases']=prior.sidecar_results(ET.parse(RAW/'sidecar.xml').getroot(),58) result['report']=prior.identity(RAW/'sidecar.xml') results[name]=result except FileNotFoundError as error: results[name]={'status':'NOT_RUN','reason':str(error)} except ValueError as error: results[name]={'status':'FAIL','reason':str(error)} for name,path in [('performance',RAW/'performance/result.json'),('windows-pdf',RAW/'native-pdf.json'),('linux-pdf',ROOT/'.artifacts/p9-remed-02/final-linux/linux-pdf.json')]: try: data=prior.load(path) if name.endswith('pdf'): if hashlib.sha256((ROOT/'scripts/verify-cv-fidelity.py').read_bytes()).hexdigest()!='64f82e622cc11483c33307d987e969f6cf27f82ab6bdbd72c2aeb1bfbceade87': raise ValueError('Original PDF oracle changed.') if data.get('inputDrift') or any(hashlib.sha256(Path(file).read_bytes()).hexdigest()!=digest for file,digest in data['inputs'].items()): raise ValueError('PDF inputs changed after qualification.') if len(data['lanes'])!=2 or any(lane['status']!='PASS' or lane['exitCode']!=0 or hashlib.sha256(Path(lane['report']).read_bytes()).hexdigest()!=lane['reportSha256'] for lane in data['lanes']): raise ValueError('PDF lane/report failure or drift.') results[name]={'status':data['status'],'record':data,'evidence':prior.identity(path)} except FileNotFoundError as error: results[name]={'status':'NOT_RUN','reason':str(error)} except ValueError as error: results[name]={'status':'FAIL','reason':str(error)} try: path=RAW/'security/commands.json';commands=prior.load(path) passed,vulnerabilities=prior.security_results(commands,prior.load(RAW/'security/frontend-audit.json'),prior.load(RAW/'security/nuget-advisories.log')) results['security-helpers']={'status':'PASS' if passed else 'FAIL','commands':commands,'evidence':prior.identity(path),'nugetVulnerabilities':vulnerabilities,'scope':'Twelve bounded helpers/audits; not Python advisory closure.'} except FileNotFoundError as error: results['security-helpers']={'status':'NOT_RUN','reason':str(error)} except ValueError as error: results['security-helpers']={'status':'FAIL','reason':str(error)} security=prior.load(HERE/'security/validation.json') if prior.identity(ROOT/security['dependencyGraph']['lock']['path'])['sha256']!=security['dependencyGraph']['lock']['sha256']: raise ValueError('Python lock changed after assessment.') python_result={'status':'NOT_COMPLETE','gate':security['gate'],'accounting':security['accounting'],'evidence':prior.identity(HERE/'security/validation.json'),'inventory':prior.identity(HERE/'security/advisory-inventory.json')} refresh=ROOT/'.artifacts/p9-remed-02/security-refresh-20261025/comparison.json' try: latest=prior.load(refresh) if not latest['sameLock']: raise ValueError('Refreshed advisory lock differs.') python_result.update(status='FINDINGS' if latest['sameAdvisoryIdentities'] else 'FINDINGS_UPDATED',refresh=latest,refreshEvidence=prior.identity(refresh)) except FileNotFoundError: python_result['reason']='Final exact-pin advisory refresh not complete.' results['python-advisories']=python_result results['hosted-mariadb']={'status':'BLOCKED','executedMariaDbCases':0,'evidence':prior.identity(HERE/'ci-isolation.json'),'metadataRefresh':prior.identity(HERE/'ci-refresh.json'),'scope':'Historical host-network/socket blocker; current metadata supplies no live private-isolation or database-execution proof.'} manifest=prior.load(RAW/'source-freeze.json') drift=[name for name,digest in manifest['inputs'].items() if not (ROOT/name).is_file() or hashlib.sha256((ROOT/name).read_bytes()).hexdigest()!=digest] helpers=prior.load(RAW/'qualification-inputs.json') helper_drift=[name for name,digest in helpers['inputs'].items() if not (ROOT/name).is_file() or hashlib.sha256((ROOT/name).read_bytes()).hexdigest()!=digest] local={k:v for k,v in results.items() if k not in ['python-advisories','hosted-mariadb']} record={'schemaVersion':1,'observedUtc':datetime.datetime.now(datetime.timezone.utc).isoformat(),'collectionOnly':'--collect-only' in sys.argv,'baseline':'3727a723e8d0d9066ef3a0a4eed3e5313ff9cc28','branch':'fix/p9-pdf-security-requalification','sourceIdentity':prior.identity(RAW/'source-freeze.json'),'applicationCheckpoint':manifest['applicationCheckpoint'],'frozenInputCount':len(manifest['inputs']),'runtimeDrift':drift,'helperIdentity':prior.identity(RAW/'qualification-inputs.json'),'frozenHelperCount':len(helpers['inputs']),'helperDrift':helper_drift,'countPolicy':'Separate lanes; focused/predecessor executions are not added to complete successor totals. Frontend expects historical934 multiset plus one declared regression.','localFunctionalComplete':not drift and not helper_drift and all(v['status']=='PASS' for v in local.values()),'automationComplete':not drift and not helper_drift and all(v['status']=='PASS' for v in results.values()),'results':results} (HERE/'validation.json').write_text(json.dumps(record,indent=2)+'\n',encoding='utf-8') print(json.dumps({name:value['status'] for name,value in results.items()})) if drift or helper_drift: raise SystemExit('Frozen runtime/helper input drift: '+str(drift+helper_drift)) if '--collect-only' not in sys.argv: try: prior.require_complete(results) except ValueError as error: raise SystemExit(str(error)) if __name__=='__main__':main()