cesnimda
149 lines
12 KiB
Python
149 lines
12 KiB
Python
"""Source-bound successor accounting; the one declared frontend addition never masks missing cases."""
|
|
import copy
|
|
import datetime
|
|
import importlib.util
|
|
import hashlib
|
|
import json
|
|
import sys
|
|
import xml.etree.ElementTree as ET
|
|
from pathlib import Path
|
|
|
|
HERE=Path(__file__).resolve().parent
|
|
spec=importlib.util.spec_from_file_location('qualified_reconciliation',HERE.parent/'p9-requal-01/reconcile.py')
|
|
prior=importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(prior)
|
|
ROOT=prior.ROOT
|
|
RAW=ROOT/'.artifacts/p9-remed-02/final'
|
|
prior.RAW=RAW
|
|
ADDED_CASE='focusing a preview retry control keeps its pointer target stationary'
|
|
|
|
def validate_representative(proof,report):
|
|
expected={'long-skills-minimal-en','long-skills-technical-nb'}
|
|
cases=report.get('fixtures',[])
|
|
if (proof.get('status')!='PASS' or proof.get('oracleExitCode')!=0
|
|
or report.get('total')!=2 or report.get('passed')!=2 or len(cases)!=2
|
|
or {case.get('fixture') for case in cases}!=expected
|
|
or any(case.get('pass') is not True or case.get('failures')!=[] for case in cases)
|
|
or proof.get('cases')!=cases):
|
|
raise ValueError('Supplemental PDF membership, oracle outcome or retained cases differ.')
|
|
|
|
def require_unchanged(inputs):
|
|
if any(not Path(name).is_file() or hashlib.sha256(Path(name).read_bytes()).hexdigest()!=digest for name,digest in inputs.items()):
|
|
raise ValueError('Supplemental PDF input/report drift.')
|
|
|
|
def frontend_cases(report,baseline,exit_code):
|
|
reference=copy.deepcopy(baseline)
|
|
suites=[suite for suite in reference['testResults'] if suite['name'].replace('\\','/').endswith('/job-tracker-ui/src/cv-builder-deep-link.test.tsx')]
|
|
if len(suites)!=1: raise ValueError('Missing or ambiguous frontend membership reference.')
|
|
# This adds an expectation, never an execution outcome, to the old934-case multiset.
|
|
suites[0]['assertionResults'].append({'fullName':ADDED_CASE})
|
|
return prior.jest_results(report,reference,exit_code,935)
|
|
|
|
def main():
|
|
results={'backend':prior.collect_trx('backend','backend/backend.trx',1130),
|
|
'mariadb':prior.collect_trx('mariadb','mariadb/mariadb.trx',35)}
|
|
for i in range(1,5): results[f'ordinary-{i}']=prior.collect_browser(f'ordinary-{i}')
|
|
try:
|
|
if any(results[f'ordinary-{i}']['status']!='PASS' for i in range(1,5)): raise ValueError('Incomplete ordinary shards.')
|
|
cases=prior.reconcile_ordinary(prior.load(RAW/'discovery.json'),[results[f'ordinary-{i}']['cases'] for i in range(1,5)])
|
|
if len(cases)!=362: raise ValueError('Unexpected ordinary discovery membership.')
|
|
results['ordinary']={'status':'PASS','passed':362,'discovery':prior.identity(RAW/'discovery.json')}
|
|
except (FileNotFoundError,ValueError) as error: results['ordinary']={'status':'NOT_COMPLETE','reason':str(error)}
|
|
for name,count in {'ai':2,'auth':2,'rate':9,'ingress':6,'pdf-admission':1,'preferences':3,'rd21':6,'diagnostics':18,'volume':3,'rd21-volume':3,'mariadb-browser':1,'mariadb-observations':2}.items():
|
|
results[name]=prior.collect_browser(name,count)
|
|
old_raw=prior.RAW
|
|
prior.RAW=ROOT/'.artifacts/p9-remed-02/final-linux'
|
|
results['linux-renderer']=prior.collect_browser('linux-renderer',5)
|
|
prior.RAW=ROOT/'.artifacts/p9-remed-02/representative-linux'
|
|
representative=prior.collect_browser('linux-renderer',2)
|
|
try:
|
|
proof=prior.load(prior.RAW/'result.json')
|
|
root=prior.RAW/'linux/fidelity'
|
|
report=prior.load(root/'fidelity-results.json')
|
|
validate_representative(proof,report)
|
|
measurements=prior.load(root/'measurements.json')
|
|
if len(measurements['fixtures'])!=2 or {case['fixture'] for case in measurements['fixtures']}!={case['fixture'] for case in report['fixtures']}:
|
|
raise ValueError('Supplemental measurements membership differs.')
|
|
binding=prior.RAW/'oracle-inputs.json'
|
|
inputs=prior.load(binding)['inputs']
|
|
if proof.get('inputs')!=inputs or proof.get('reportSha256')!=hashlib.sha256((root/'fidelity-results.json').read_bytes()).hexdigest():
|
|
raise ValueError('Supplemental producer input/report binding differs.')
|
|
oracle=str((ROOT/'scripts/verify-cv-fidelity.py').resolve())
|
|
if inputs.get(oracle)!='64f82e622cc11483c33307d987e969f6cf27f82ab6bdbd72c2aeb1bfbceade87':
|
|
raise ValueError('Supplemental original oracle identity differs.')
|
|
for case in report['fixtures']:
|
|
for name in ['render.html','export.pdf','measurements.json']:
|
|
if str((root/case['fixture']/name).resolve()) not in inputs: raise ValueError('Supplemental required artifact missing.')
|
|
require_unchanged(inputs)
|
|
representative['oracle']=proof
|
|
representative['oracleEvidence']=prior.identity(prior.RAW/'result.json')
|
|
representative['inputBinding']=prior.identity(binding)
|
|
representative['report']=prior.identity(root/'fidelity-results.json')
|
|
except FileNotFoundError as error: representative.update(status='NOT_COMPLETE',reason=str(error))
|
|
except ValueError as error: representative.update(status='FAIL',reason=str(error))
|
|
results['pdf-representative']=representative
|
|
prior.RAW=old_raw
|
|
try:
|
|
path=RAW/'frontend.json';data=prior.load(path);process=prior.load(RAW/'frontend-exit.json')
|
|
reference=ROOT/'.artifacts/p9-requal-01/frontend.json'
|
|
accepted=prior.load(HERE.parent/'p9-requal-01/validation.json')['results']['frontend']['report']['sha256']
|
|
if prior.identity(reference)['sha256']!=accepted: raise ValueError('Historical frontend reference changed.')
|
|
if f"test('{ADDED_CASE}'" not in (ROOT/'job-tracker-ui/src/cv-builder-deep-link.test.tsx').read_text(encoding='utf-8'): raise ValueError('Declared added regression is absent from source.')
|
|
cases=frontend_cases(data,prior.load(reference),process['exitCode'])
|
|
expected={'numPassedTests':935,'numTotalTests':935,'numFailedTests':0,'numPendingTests':0,'numTodoTests':0,'numPassedTestSuites':105,'numTotalTestSuites':105,'numFailedTestSuites':0}
|
|
if any(data.get(k)!=v for k,v in expected.items()): raise ValueError('Frontend aggregate counts differ.')
|
|
results['frontend']={'status':'PASS','passed':935,'suites':105,'cases':cases,'report':prior.identity(path),'process':process,'membershipReference':prior.identity(reference),'declaredAddedCase':ADDED_CASE}
|
|
except FileNotFoundError as error: results['frontend']={'status':'NOT_RUN','reason':str(error)}
|
|
except ValueError as error: results['frontend']={'status':'FAIL','reason':str(error)}
|
|
for name in ['types','lint','build','sidecar']:
|
|
try:
|
|
process=prior.load(RAW/(name+'-exit.json'))
|
|
result={'status':'PASS' if process['exitCode']==0 else 'FAIL','process':process,'log':prior.identity(RAW/(name+'.log'))}
|
|
if name=='sidecar':
|
|
result['cases']=prior.sidecar_results(ET.parse(RAW/'sidecar.xml').getroot(),58)
|
|
result['report']=prior.identity(RAW/'sidecar.xml')
|
|
results[name]=result
|
|
except FileNotFoundError as error: results[name]={'status':'NOT_RUN','reason':str(error)}
|
|
except ValueError as error: results[name]={'status':'FAIL','reason':str(error)}
|
|
for name,path in [('performance',RAW/'performance/result.json'),('windows-pdf',RAW/'native-pdf.json'),('linux-pdf',ROOT/'.artifacts/p9-remed-02/final-linux/linux-pdf.json')]:
|
|
try:
|
|
data=prior.load(path)
|
|
if name.endswith('pdf'):
|
|
if hashlib.sha256((ROOT/'scripts/verify-cv-fidelity.py').read_bytes()).hexdigest()!='64f82e622cc11483c33307d987e969f6cf27f82ab6bdbd72c2aeb1bfbceade87': raise ValueError('Original PDF oracle changed.')
|
|
if data.get('inputDrift') or any(hashlib.sha256(Path(file).read_bytes()).hexdigest()!=digest for file,digest in data['inputs'].items()): raise ValueError('PDF inputs changed after qualification.')
|
|
if len(data['lanes'])!=2 or any(lane['status']!='PASS' or lane['exitCode']!=0 or hashlib.sha256(Path(lane['report']).read_bytes()).hexdigest()!=lane['reportSha256'] for lane in data['lanes']): raise ValueError('PDF lane/report failure or drift.')
|
|
results[name]={'status':data['status'],'record':data,'evidence':prior.identity(path)}
|
|
except FileNotFoundError as error: results[name]={'status':'NOT_RUN','reason':str(error)}
|
|
except ValueError as error: results[name]={'status':'FAIL','reason':str(error)}
|
|
try:
|
|
path=RAW/'security/commands.json';commands=prior.load(path)
|
|
passed,vulnerabilities=prior.security_results(commands,prior.load(RAW/'security/frontend-audit.json'),prior.load(RAW/'security/nuget-advisories.log'))
|
|
results['security-helpers']={'status':'PASS' if passed else 'FAIL','commands':commands,'evidence':prior.identity(path),'nugetVulnerabilities':vulnerabilities,'scope':'Twelve bounded helpers/audits; not Python advisory closure.'}
|
|
except FileNotFoundError as error: results['security-helpers']={'status':'NOT_RUN','reason':str(error)}
|
|
except ValueError as error: results['security-helpers']={'status':'FAIL','reason':str(error)}
|
|
security=prior.load(HERE/'security/validation.json')
|
|
if prior.identity(ROOT/security['dependencyGraph']['lock']['path'])['sha256']!=security['dependencyGraph']['lock']['sha256']: raise ValueError('Python lock changed after assessment.')
|
|
python_result={'status':'NOT_COMPLETE','gate':security['gate'],'accounting':security['accounting'],'evidence':prior.identity(HERE/'security/validation.json'),'inventory':prior.identity(HERE/'security/advisory-inventory.json')}
|
|
refresh=ROOT/'.artifacts/p9-remed-02/security-refresh-20261025/comparison.json'
|
|
try:
|
|
latest=prior.load(refresh)
|
|
if not latest['sameLock']: raise ValueError('Refreshed advisory lock differs.')
|
|
python_result.update(status='FINDINGS' if latest['sameAdvisoryIdentities'] else 'FINDINGS_UPDATED',refresh=latest,refreshEvidence=prior.identity(refresh))
|
|
except FileNotFoundError: python_result['reason']='Final exact-pin advisory refresh not complete.'
|
|
results['python-advisories']=python_result
|
|
results['hosted-mariadb']={'status':'BLOCKED','executedMariaDbCases':0,'evidence':prior.identity(HERE/'ci-isolation.json'),'metadataRefresh':prior.identity(HERE/'ci-refresh.json'),'scope':'Historical host-network/socket blocker; current metadata supplies no live private-isolation or database-execution proof.'}
|
|
manifest=prior.load(RAW/'source-freeze.json')
|
|
drift=[name for name,digest in manifest['inputs'].items() if not (ROOT/name).is_file() or hashlib.sha256((ROOT/name).read_bytes()).hexdigest()!=digest]
|
|
helpers=prior.load(RAW/'qualification-inputs.json')
|
|
helper_drift=[name for name,digest in helpers['inputs'].items() if not (ROOT/name).is_file() or hashlib.sha256((ROOT/name).read_bytes()).hexdigest()!=digest]
|
|
local={k:v for k,v in results.items() if k not in ['python-advisories','hosted-mariadb']}
|
|
record={'schemaVersion':1,'observedUtc':datetime.datetime.now(datetime.timezone.utc).isoformat(),'collectionOnly':'--collect-only' in sys.argv,'baseline':'3727a723e8d0d9066ef3a0a4eed3e5313ff9cc28','branch':'fix/p9-pdf-security-requalification','sourceIdentity':prior.identity(RAW/'source-freeze.json'),'applicationCheckpoint':manifest['applicationCheckpoint'],'frozenInputCount':len(manifest['inputs']),'runtimeDrift':drift,'helperIdentity':prior.identity(RAW/'qualification-inputs.json'),'frozenHelperCount':len(helpers['inputs']),'helperDrift':helper_drift,'countPolicy':'Separate lanes; focused/predecessor executions are not added to complete successor totals. Frontend expects historical934 multiset plus one declared regression.','localFunctionalComplete':not drift and not helper_drift and all(v['status']=='PASS' for v in local.values()),'automationComplete':not drift and not helper_drift and all(v['status']=='PASS' for v in results.values()),'results':results}
|
|
(HERE/'validation.json').write_text(json.dumps(record,indent=2)+'\n',encoding='utf-8')
|
|
print(json.dumps({name:value['status'] for name,value in results.items()}))
|
|
if drift or helper_drift: raise SystemExit('Frozen runtime/helper input drift: '+str(drift+helper_drift))
|
|
if '--collect-only' not in sys.argv:
|
|
try: prior.require_complete(results)
|
|
except ValueError as error: raise SystemExit(str(error))
|
|
|
|
if __name__=='__main__':main()
|