From ae1f4b91b7c2b8d2bcadf0a889d056286e9b733f Mon Sep 17 00:00:00 2001 From: Dylan Roy <249851642+d6g8k5htny-coder@users.noreply.github.com> Date: Mon, 5 Oct 2026 16:11:09 -0700 Subject: [PATCH 1/2] Add isolated PR304 replay coverage and execution-custody controls MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit OpenAI / GPT-6 Astra Pro; Dylan Roy — delegated AI work. Four additive engineering/audit files; preserve all ten PR304 scientific files. 20 protocol tests pass in both Python modes, with real subprocess and Git controls. Dedicated hosted jobs replay N=128, reference, source crosschecks, and all tests/. Bind manifest, upstream pins, tool bytes, tested commit, run and attempt; fail closed. Scientific effect NONE; no self-merge, no theorem or independent-review promotion. --- .github/workflows/d3-l4-anisotropic.yml | 64 +++++ .../REPLAY_SCOPE.md | 99 ++++++++ tests/test_d3_l4_replay.py | 229 ++++++++++++++++++ tools/d3_l4_replay.py | 224 +++++++++++++++++ 4 files changed, 616 insertions(+) create mode 100644 .github/workflows/d3-l4-anisotropic.yml create mode 100644 reviews/d3_l4_round2_audit_20261005/REPLAY_SCOPE.md create mode 100644 tests/test_d3_l4_replay.py create mode 100644 tools/d3_l4_replay.py diff --git a/.github/workflows/d3-l4-anisotropic.yml b/.github/workflows/d3-l4-anisotropic.yml new file mode 100644 index 000000000..c841af917 --- /dev/null +++ b/.github/workflows/d3-l4-anisotropic.yml @@ -0,0 +1,64 @@ +name: D3 L4 anisotropic coefficient replay + +'on': + pull_request: + paths: + - 'coefficients/d3_l4_anisotropic_20261005/**' + - 'tools/d3_l4_replay.py' + - 'tests/test_d3_l4_replay.py' + - '.github/workflows/d3-l4-anisotropic.yml' + - 'reviews/iba1_periodic_jet_claude_20261005/periodic_jet_check.py' + - 'coefficients/side24_v1/PROOF.md' + - 'coefficients/side24_v1/ENCLOSURE.json' + - 'imports/lifetime_parent_20260925/UNIFORM_MATRIX_CAP_AND_LIFETIME.md' + push: + branches: [main] + paths: + - 'coefficients/d3_l4_anisotropic_20261005/**' + - 'tools/d3_l4_replay.py' + - 'tests/test_d3_l4_replay.py' + - '.github/workflows/d3-l4-anisotropic.yml' + - 'reviews/iba1_periodic_jet_claude_20261005/periodic_jet_check.py' + - 'coefficients/side24_v1/PROOF.md' + - 'coefficients/side24_v1/ENCLOSURE.json' + - 'imports/lifetime_parent_20260925/UNIFORM_MATRIX_CAP_AND_LIFETIME.md' + workflow_dispatch: + +permissions: + contents: read + +jobs: + d3-l4-replay: + runs-on: ubuntu-latest + timeout-minutes: 30 + strategy: + fail-fast: false + matrix: + mode: [normal, optimized] + name: d3-l4-replay (${{ matrix.mode }}) + steps: + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 + with: + persist-credentials: false + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 + with: + python-version: '3.13.5' + - name: Test replay protocol and execute exact pinned numerical packet + shell: bash + run: | + set -euo pipefail + mkdir -p .d3-l4-protocol-evidence + FLAGS="-B -S" + if [ "${{ matrix.mode }}" = optimized ]; then FLAGS="-B -O -S"; fi + python $FLAGS -m unittest discover -s tests -v 2>&1 | tee ".d3-l4-protocol-evidence/${{ matrix.mode }}.log" + python -B -S tools/d3_l4_replay.py --mode "${{ matrix.mode }}" --output ".d3-l4-evidence/${{ matrix.mode }}" + - name: Preserve success or failure logs + if: always() + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + with: + name: d3-l4-${{ matrix.mode }}-${{ github.run_id }}-${{ github.run_attempt }} + path: | + .d3-l4-evidence/${{ matrix.mode }}/ + .d3-l4-protocol-evidence/ + include-hidden-files: true + if-no-files-found: error diff --git a/reviews/d3_l4_round2_audit_20261005/REPLAY_SCOPE.md b/reviews/d3_l4_round2_audit_20261005/REPLAY_SCOPE.md new file mode 100644 index 000000000..5123654dc --- /dev/null +++ b/reviews/d3_l4_round2_audit_20261005/REPLAY_SCOPE.md @@ -0,0 +1,99 @@ +# D3 L4 replay coverage and execution custody + +Object: R2-D3-L4-EXECUTION-20261005-v1. +Author: OpenAI / GPT-6 Astra Pro, session `d3-l4-round2-audit-20261005`; +Dylan Roy — delegated AI work. Scientific effect NONE. Author will not self-merge. + +## Finding and frozen mathematical input + +AUD-D3L4-EXEC-001: the green general checks on Math-#304 did not execute the +new coefficient calculation. Run 37383541867 had downstream, formal and aggregate +jobs, but no dedicated `d3-l4` replay. Those successful checks are valid at their +own scope, not numerical execution evidence for this packet. + +This is an isolated follow-on to Math-#304. Keep its head +`5059e6d7049c5d65cd1e813545310bc71b86a12f` and all ten files under +`coefficients/d3_l4_anisotropic_20261005/` unchanged while its nonauthor mathematical +read is active. Claude's actual pickup is Math-#304 comment 6004751792; the +acknowledgment and separate engineering scope are comment 6004801985. + +The frozen `SOURCE_FILES.json` has SHA-256 +`bba2ab2e351b644bbd3eec3b468ab88a2969242db9345f619294d4a8770a2f34`. +It names nine packet payload files and four upstream pins. The driver authenticates +that manifest before reading its instructions, verifies exact directory membership, +all payload sizes/hashes/git blobs, all upstream git blobs, and the additional +upstream SHA-256 when supplied. Symlinks and path aliases/traversals are rejected. +This manifest is a custody root; neither a hash nor a replay is mathematical review. + +## Execution contract + +The dedicated workflow runs on relevant pull requests and main pushes, with path +coverage for the entire packet, the replay machinery and every named upstream +source. It also allows manual diagnostics. It has read-only contents permission, +no persisted checkout credentials, full-commit action pins and Python 3.13.5. +It does not edit a ruleset, change the general aggregate, or convert a manual run +into required-PR evidence. + +Each of the normal and optimized matrix jobs runs the full repository `tests/` +unittest discovery. It then executes the original seven packet tests, full N=128 +coefficient calculation, N=4 nonperiodic reference calculation, and source crosscheck. +The main coefficient and reference outputs must match their frozen files byte for +byte, with exit zero and empty stderr. A test process must actually report seven +successful tests; zero collected tests do not count as a pass. + +For crosschecks, all interval strings, gamma strings, booleans, keys and other +fields must match exactly. Only the five fields explicitly named +`independent_disk_midpoint_diagnostic` may vary by at most 1e-10 across libm builds. +These are already labeled noncertificate floating diagnostics in the source; +this portability allowance is NOT added to or substituted for any certificate +error. Nonfinite values, including exponent overflow such as `1e999`, are rejected. +Duplicate JSON keys, malformed payloads and wrong JSON types are rejected. + +The execution driver, regression file and workflow are checked against the actual +Git HEAD before and after replay. The driver must execute from that checkout. +On GitHub the recorded HEAD must equal GITHUB_SHA, and repository/run/attempt +identity must be present and consistent. A dirty execution tool cannot claim a +clean tested commit. Source pins are verified again after execution. + +Commands have bounded timeouts. A crash, wrong exit, unexpected stderr, changed +result or timeout is failure, never a successful negative control. Raw stdout, +stderr and process metadata are retained, including a failed receipt on failures +after evidence-directory creation. Existing evidence directories are not reused +or overwritten. Workflow logs/artifacts survive failures through `if: always()`. +The receipt always leaves scientific acceptance and independent review false. + +## Fresh local evidence and limits + +Twenty replay-protocol test methods pass under both `-B -S` and `-B -O -S`. +They include real Python processes for success, crash, wrong exit, stderr, +timeout and CLI-failure receipts, plus a temporary real Git repository to test +dirty execution-source rejection. The source fixtures are explicitly synthetic, +not a substitute for the mathematical packet. + +The initial 17-method suite failed because the driver was absent. A subsequent +JSON exponent-overflow test and execution-source binding test each failed before +their guards were implemented. An intermediate test-only module-reload exception- +identity error was corrected by caching the imported test module; no numerical +source was changed. These local development failures are retained in the audit +bundle rather than represented as historical successes. + +The original N=128 numerical calculation and the source crosscheck were also +freshly run in both modes in this round; their outputs match the delivered files +exactly. This is author-side execution, not the provider-distinct mathematical +review requested on #304. + +A complete local repository checkout could not be downloaded in this environment; +therefore complete local repository tests and an end-to-end local run of the new +CLI with all four upstream payloads are NOT claimed. The hosted jobs are designed +to supply that missing execution evidence. Their actual conclusions and tested +commits must be read before integration; configured coverage is not a passed run. + +## Review and integration + +Review this engineering delta separately from the frozen coefficient proof. +After #304 lands, the follow-on owner must reconcile the base, verify that all ten +packet identities and four upstream pins are preserved, obtain fresh applicable +hosted checks and the scoped nonauthor disposition, then hand off to an eligible +integrator. Do not merge this proposal into the live mathematical-review branch. +No audit verdict, theorem flag, original proof, parent workflow or scientific +status register is changed by this proposal. diff --git a/tests/test_d3_l4_replay.py b/tests/test_d3_l4_replay.py new file mode 100644 index 000000000..6bf0cfe7e --- /dev/null +++ b/tests/test_d3_l4_replay.py @@ -0,0 +1,229 @@ +"""Real-process replay-protocol tests; synthetic fixtures are not coefficient evidence.""" +import hashlib +import importlib.util +import json +from pathlib import Path +import subprocess +import sys +import tempfile +import unittest + +ROOT = Path(__file__).resolve().parents[1] +DRIVER = ROOT / 'tools' / 'd3_l4_replay.py' + + +class ReplayTests(unittest.TestCase): + def load(self): + self.assertTrue(DRIVER.is_file(), 'source-bound d3 L4 replay driver is missing') + if hasattr(self, '_module'): + return self._module + spec = importlib.util.spec_from_file_location('d3_l4_replay', DRIVER) + module = importlib.util.module_from_spec(spec) + spec.loader.exec_module(module) + self._module = module + return module + + def fixture(self, module, root): + packet = root / module.PACKET + packet.mkdir(parents=True) + records = [] + for name in module.FILE_NAMES: + data = ('synthetic protocol fixture: ' + name + '\n').encode() + (packet / name).write_bytes(data) + records.append({'path': name, 'bytes': len(data), + 'sha256': hashlib.sha256(data).hexdigest(), + 'git_blob': module.git_blob(data)}) + (root / 'source.txt').write_bytes(b'synthetic upstream\n') + manifest = {'object': module.OBJECT, 'scientific_effect': 'NONE', + 'source_commit': module.SOURCE_COMMIT, + 'source_repository': module.REPOSITORY, + 'files': records, + 'upstream_pins': [{'path': 'source.txt', + 'git_blob': module.git_blob(b'synthetic upstream\n')}]} + raw = (json.dumps(manifest, sort_keys=True) + '\n').encode() + (packet / 'SOURCE_FILES.json').write_bytes(raw) + return packet, hashlib.sha256(raw).hexdigest() + + def test_00_driver_exists(self): + self.assertTrue(DRIVER.is_file(), 'source-bound d3 L4 replay driver is missing') + + def test_valid_synthetic_snapshot(self): + m = self.load() + with tempfile.TemporaryDirectory() as t: + root = Path(t); _, pin = self.fixture(m, root) + self.assertEqual(len(m.validate_snapshot(root, pin)['files']), 9) + + def test_manifest_pin_required(self): + m = self.load() + with tempfile.TemporaryDirectory() as t: + root = Path(t); self.fixture(m, root) + with self.assertRaisesRegex(m.ReplayError, 'manifest_pin'): + m.validate_snapshot(root, '0' * 64) + + def test_corrupt_missing_extra_and_directory(self): + m = self.load() + for mutation in ('corrupt', 'missing', 'extra', 'directory'): + with self.subTest(mutation=mutation), tempfile.TemporaryDirectory() as t: + root = Path(t); p, pin = self.fixture(m, root) + path = p / 'PROOF.md' + if mutation == 'corrupt': path.write_text('changed') + elif mutation == 'missing': path.unlink() + elif mutation == 'extra': (p / 'unlisted.txt').write_text('extra') + else: path.unlink(); path.mkdir() + with self.assertRaises(m.ReplayError): m.validate_snapshot(root, pin) + + def test_symlink_file_and_parent_rejected(self): + m = self.load() + for parent in (False, True): + with self.subTest(parent=parent), tempfile.TemporaryDirectory() as t: + root = Path(t); p, pin = self.fixture(m, root) + path = p.parent if parent else p / 'PROOF.md' + moved = root / 'displaced' + path.rename(moved); path.symlink_to(moved, target_is_directory=parent) + with self.assertRaisesRegex(m.ReplayError, 'symlink'): + m.validate_snapshot(root, pin) + + def test_upstream_corruption(self): + m = self.load() + with tempfile.TemporaryDirectory() as t: + root = Path(t); _, pin = self.fixture(m, root) + (root / 'source.txt').write_text('corrupt') + with self.assertRaisesRegex(m.ReplayError, 'git_blob'): + m.validate_snapshot(root, pin) + + def test_paths_reject_escape_absolute_and_aliases(self): + m = self.load() + with tempfile.TemporaryDirectory() as t: + for path in ('../x', '/x', './x', 'a/../x', 'a//x', 'a\\x', ''): + with self.subTest(path=path), self.assertRaises(m.ReplayError): + m.safe_file(Path(t), path) + + def test_json_duplicate_and_nonfinite_rejected(self): + m = self.load() + for value in (b'{"a":1,"a":2}', b'{"a":NaN}', b'{"a":Infinity}', b'{"a":1e999}', b'{} trailing'): + with self.subTest(value=value), self.assertRaises(m.ReplayError): m.strict_json(value) + + def test_exact_result_mismatch_not_accepted(self): + m = self.load() + with self.assertRaisesRegex(m.ReplayError, 'stdout_mismatch'): + m.compare_output(b'{"coefficient":1}\n', b'{"coefficient":2}\n', 'exact') + + def crosscheck(self): + return {'source_sha256': 'abc', 'rows': [{'D_interval': ['2.3','2.4'], + 'disk_diagnostic_is_certificate': False, + 'independent_disk_midpoint_diagnostic': 2.35}], 'reference_checks': {}} + + def test_crosscheck_diagnostic_float_portability_only(self): + m = self.load(); expected = self.crosscheck(); actual = self.crosscheck() + actual['rows'][0]['independent_disk_midpoint_diagnostic'] = 2.3500000000000005 + m.compare_output(json.dumps(actual).encode(), json.dumps(expected).encode(), 'crosschecks') + actual['rows'][0]['D_interval'] = ['2.2','2.4'] + with self.assertRaisesRegex(m.ReplayError, 'crosscheck_exact_fields'): + m.compare_output(json.dumps(actual).encode(), json.dumps(expected).encode(), 'crosschecks') + + def test_crosscheck_bad_diagnostic_rejected(self): + m = self.load(); expected = self.crosscheck() + for diagnostic in (float('nan'), float('inf'), 5, '2.35', True): + actual = self.crosscheck(); actual['rows'][0]['independent_disk_midpoint_diagnostic'] = diagnostic + with self.subTest(diagnostic=diagnostic), self.assertRaises(m.ReplayError): + m.compare_output(json.dumps(actual).encode(), json.dumps(expected).encode(), 'crosschecks') + + def test_unittest_summary_required(self): + m = self.load() + for stderr in (b'', b'Ran 0 tests\n\nOK\n', b'Ran 7 tests\n\nFAILED\n'): + with self.assertRaisesRegex(m.ReplayError, 'test_summary'): + m.compare_output(b'', None, 'tests', stderr) + m.compare_output(b'', None, 'tests', b'.......\n----------------------------------------------------------------------\nRan 7 tests in 0.2s\n\nOK\n') + + def run_fixture(self, source, expected=b'ok\n', timeout=5): + m = self.load() + with tempfile.TemporaryDirectory() as t: + root = Path(t); script = root / 'fixture.py'; script.write_text(source) + logs = root / 'logs'; logs.mkdir() + return m.run_step([sys.executable, '-B', '-S', str(script)], root, logs, + 'fixture', expected, 'exact', timeout) + + def test_real_process_success(self): + self.assertEqual(self.run_fixture("print('ok')")['returncode'], 0) + + def test_real_process_crash_wrong_exit_and_stderr(self): + m = self.load() + for source, code in [("raise RuntimeError('not a mathematical rejection')", 'exit'), + ("print('ok');raise SystemExit(1)", 'exit'), + ("import sys;print('bad',file=sys.stderr);print('ok')", 'stderr')]: + with self.subTest(source=source), self.assertRaisesRegex(m.ReplayError, code): + self.run_fixture(source) + + def test_real_process_timeout_fails_closed(self): + m = self.load() + with self.assertRaisesRegex(m.ReplayError, 'timeout'): + self.run_fixture('import time;time.sleep(30)', timeout=0.1) + + def test_cli_invalid_mode_is_refused(self): + self.load() + run = subprocess.run([sys.executable, '-B', '-S', str(DRIVER), '--mode', 'pretend-pass'], + capture_output=True) + self.assertEqual(run.returncode, 2) + + def test_execution_identities_reject_dirty_tool(self): + m = self.load() + self.assertTrue(hasattr(m, 'execution_identities'), 'execution-source binding is missing') + with tempfile.TemporaryDirectory() as t: + root = Path(t) + for name in ('tools/d3_l4_replay.py', 'tests/test_d3_l4_replay.py', + '.github/workflows/d3-l4-anisotropic.yml'): + p = root / name; p.parent.mkdir(parents=True, exist_ok=True) + p.write_text('synthetic execution-source fixture\n') + def git(*args): + return subprocess.run(['git', *args], cwd=root, check=True, capture_output=True).stdout.decode().strip() + git('init', '-q'); git('add', '.') + git('-c', 'user.name=Protocol fixture', '-c', 'user.email=fixture@example.invalid', + '-c', 'commit.gpgsign=false', 'commit', '-qm', 'synthetic fixture') + head = git('rev-parse', 'HEAD') + self.assertEqual(len(m.execution_identities(root, head)), 3) + (root / 'tools/d3_l4_replay.py').write_text('dirty execution source') + with self.assertRaisesRegex(m.ReplayError, 'execution_source_drift'): + m.execution_identities(root, head) + + def test_cli_missing_source_retains_failed_receipt(self): + self.load() + for mode in ('normal', 'optimized'): + with self.subTest(mode=mode), tempfile.TemporaryDirectory() as t: + root = Path(t); output = root / 'evidence' + run = subprocess.run([sys.executable, '-B', '-S', str(DRIVER), + '--mode', mode, '--root', str(root), '--output', str(output)], + capture_output=True) + self.assertNotEqual(run.returncode, 0) + self.assertEqual(run.stdout, b'') + receipt = json.loads((output / 'receipt.json').read_text()) + self.assertEqual(receipt['status'], 'FAIL') + self.assertEqual(receipt['mode'], mode) + self.assertIn('missing_or_nonregular_source', receipt['failure']) + + def test_cli_refuses_reusing_existing_evidence(self): + self.load() + with tempfile.TemporaryDirectory() as t: + root = Path(t); output = root / 'evidence'; output.mkdir() + old = output / 'receipt.json'; old.write_text('historical receipt') + run = subprocess.run([sys.executable, '-B', '-S', str(DRIVER), '--mode', 'normal', + '--root', str(root), '--output', str(output)], capture_output=True) + self.assertNotEqual(run.returncode, 0) + self.assertIn(b'evidence_directory_already_exists', run.stderr) + self.assertEqual(old.read_text(), 'historical receipt') + + def test_workflow_covers_packet_dependencies_and_both_modes(self): + self.load(); wf = ROOT / '.github/workflows/d3-l4-anisotropic.yml' + self.assertTrue(wf.is_file()) + text = wf.read_text() + for target in ('coefficients/d3_l4_anisotropic_20261005/**', + 'coefficients/side24_v1/PROOF.md', 'coefficients/side24_v1/ENCLOSURE.json', + 'imports/lifetime_parent_20260925/UNIFORM_MATRIX_CAP_AND_LIFETIME.md', + 'reviews/iba1_periodic_jet_claude_20261005/periodic_jet_check.py', + 'tests/test_d3_l4_replay.py', 'tools/d3_l4_replay.py', + "mode: [normal, optimized]", 'contents: read', + 'persist-credentials: false', 'if: always()', '--mode "${{ matrix.mode }}"'): + self.assertIn(target, text) + self.assertNotIn('pull_request_target:', text) + + +if __name__ == '__main__': unittest.main() diff --git a/tools/d3_l4_replay.py b/tools/d3_l4_replay.py new file mode 100644 index 000000000..aed704e7f --- /dev/null +++ b/tools/d3_l4_replay.py @@ -0,0 +1,224 @@ +#!/usr/bin/env python3 +"""Fail-closed execution of the frozen PR304 coefficient packet (stdlib only). + +This verifies source custody and actual execution, not mathematical acceptance. +The ten scientific packet files are immutable inputs, never updated by this tool. +""" +import argparse +import hashlib +import json +import math +import os +from pathlib import Path, PurePosixPath +import re +import subprocess +import sys +import time + +REPOSITORY = 'd6g8k5htny-coder/Math-' +OBJECT = 'D3-L4-ANISOTROPIC-20261005-v1' +SOURCE_COMMIT = '2f8d721e300850e36ab17464dc541c977b3ffcbf' +PACKET = 'coefficients/d3_l4_anisotropic_20261005' +MANIFEST_SHA256 = 'bba2ab2e351b644bbd3eec3b468ab88a2969242db9345f619294d4a8770a2f34' +FILE_NAMES = ('README.md', 'PROOF.md', 'certificate.py', 'test_certificate.py', + 'source_crosscheck.py', 'RESULTS.json', 'REFERENCE.json', + 'CROSSCHECKS.json', 'VALIDATION.json') +UPSTREAM = 'reviews/iba1_periodic_jet_claude_20261005/periodic_jet_check.py' + + +class ReplayError(ValueError): + """Named protocol failure; a crash is never a successful negative control.""" + + +def require(condition, code): + if not condition: + raise ReplayError(code) + + +def git_blob(data): + return hashlib.sha1(b'blob %d\0' % len(data) + data).hexdigest() + + +def strict_json(data): + def pairs(items): + result = {} + for key, value in items: + require(key not in result, 'json_duplicate_key') + result[key] = value + return result + def constant(_): + raise ReplayError('json_nonfinite') + def floating(token): + value = float(token) + require(math.isfinite(value), 'json_nonfinite') + return value + try: + return json.loads(data, object_pairs_hook=pairs, parse_constant=constant, parse_float=floating) + except (UnicodeError, json.JSONDecodeError, TypeError) as exc: + raise ReplayError('json_malformed') from exc + + +def safe_file(root, relative): + require(isinstance(relative, str) and relative and '\\' not in relative, 'unsafe_path') + path = PurePosixPath(relative) + require(not path.is_absolute() and all(p not in ('', '.', '..') for p in relative.split('/')), + 'unsafe_path') + current = root + for part in path.parts: + current = current / part + require(not current.is_symlink(), 'symlink_in_source_path') + require(current.is_file(), 'missing_or_nonregular_source') + return current + + +def validate_snapshot(root, expected_manifest_sha=MANIFEST_SHA256): + """Alternate digest is for explicitly synthetic unit fixtures; CLI has no override.""" + root = Path(root).resolve() + raw = safe_file(root, PACKET + '/SOURCE_FILES.json').read_bytes() + require(hashlib.sha256(raw).hexdigest() == expected_manifest_sha, 'manifest_pin_mismatch') + meta = strict_json(raw) + require(isinstance(meta, dict) and meta.get('object') == OBJECT + and meta.get('scientific_effect') == 'NONE' + and meta.get('source_commit') == SOURCE_COMMIT + and meta.get('source_repository') == REPOSITORY, 'manifest_scope') + records = meta.get('files') + require(isinstance(records, list) and len(records) == len(FILE_NAMES), 'manifest_membership') + require(all(isinstance(e, dict) for e in records), 'manifest_record_type') + require(sorted(e.get('path', '') for e in records) == sorted(FILE_NAMES), 'manifest_membership') + packet = root / PACKET + require(sorted(p.name for p in packet.iterdir()) == sorted(FILE_NAMES + ('SOURCE_FILES.json',)), + 'packet_membership') + for entry in records: + data = safe_file(root, PACKET + '/' + entry['path']).read_bytes() + require(type(entry.get('bytes')) is int and len(data) == entry['bytes'], 'source_size') + require(hashlib.sha256(data).hexdigest() == entry.get('sha256'), 'source_sha256') + require(git_blob(data) == entry.get('git_blob'), 'source_git_blob') + pins = meta.get('upstream_pins') + require(isinstance(pins, list) and pins, 'upstream_pins_missing') + seen = set() + for entry in pins: + require(isinstance(entry, dict) and isinstance(entry.get('path'), str), 'upstream_pin_type') + require(entry['path'] not in seen, 'upstream_duplicate') + seen.add(entry['path']) + data = safe_file(root, entry['path']).read_bytes() + require(git_blob(data) == entry.get('git_blob'), 'upstream_git_blob') + if 'sha256' in entry: + require(hashlib.sha256(data).hexdigest() == entry['sha256'], 'upstream_sha256') + return meta + + +def compare_output(actual, expected, kind, stderr=b''): + if kind == 'tests': + require(actual == b'' and re.search(rb'\nRan 7 tests in [0-9.]+s\n\nOK\n\Z', stderr), + 'test_summary_missing_or_wrong') + return + require(stderr == b'', 'unexpected_stderr') + if kind == 'exact': + require(actual == expected, 'stdout_mismatch') + return + require(kind == 'crosschecks', 'unknown_output_contract') + got, want = strict_json(actual), strict_json(expected) + require(isinstance(got, dict) and isinstance(want, dict), 'crosscheck_shape') + require(isinstance(got.get('rows'), list) and isinstance(want.get('rows'), list) + and len(got['rows']) == len(want['rows']), 'crosscheck_shape') + # ONLY the explicitly noncertificate disk diagnostic is allowed libm last-bit variation. + # Every interval string, all other fields, and their JSON types must match exactly. + for row, reference in zip(got['rows'], want['rows']): + require(isinstance(row, dict) and isinstance(reference, dict), 'crosscheck_shape') + key = 'independent_disk_midpoint_diagnostic' + x, y = row.pop(key, None), reference.pop(key, None) + require(type(x) is float and type(y) is float and math.isfinite(x) and math.isfinite(y) + and abs(x - y) <= 1e-10, 'crosscheck_diagnostic') + require(row.get('disk_diagnostic_is_certificate') is False, 'diagnostic_scope') + canonical = lambda value: json.dumps(value, sort_keys=True, separators=(',', ':'), allow_nan=False) + require(canonical(got) == canonical(want), 'crosscheck_exact_fields') + + +def run_step(argv, cwd, logs, name, expected, kind, timeout=900): + started = time.monotonic() + try: + run = subprocess.run(argv, cwd=cwd, capture_output=True, timeout=timeout, + env={**os.environ, 'PYTHONDONTWRITEBYTECODE': '1'}) + except subprocess.TimeoutExpired as exc: + (logs / (name + '.stdout')).write_bytes(exc.stdout or b'') + (logs / (name + '.stderr')).write_bytes(exc.stderr or b'') + raise ReplayError(name + ': timeout') from exc + (logs / (name + '.stdout')).write_bytes(run.stdout) + (logs / (name + '.stderr')).write_bytes(run.stderr) + record = dict(command=argv, returncode=run.returncode, + elapsed_seconds=round(time.monotonic() - started, 6), + stdout_sha256=hashlib.sha256(run.stdout).hexdigest(), + stderr_sha256=hashlib.sha256(run.stderr).hexdigest()) + (logs / (name + '.process.json')).write_text(json.dumps(record, indent=2, sort_keys=True) + '\n') + require(run.returncode == 0, name + ': unexpected_exit') + compare_output(run.stdout, expected, kind, run.stderr) + return record + + +def execution_identities(root, head): + identities = {} + for relative in ('tools/d3_l4_replay.py', 'tests/test_d3_l4_replay.py', + '.github/workflows/d3-l4-anisotropic.yml'): + data = safe_file(root, relative).read_bytes() + committed = subprocess.run(['git', 'rev-parse', head + ':' + relative], cwd=root, + check=True, capture_output=True, text=True).stdout.strip() + require(git_blob(data) == committed, 'execution_source_drift') + identities[relative] = dict(git_blob=committed, sha256=hashlib.sha256(data).hexdigest()) + return identities + + +def main(): + ap = argparse.ArgumentParser(description=__doc__) + ap.add_argument('--mode', choices=('normal', 'optimized'), required=True) + ap.add_argument('--root', type=Path, default=Path('.')) + ap.add_argument('--output', type=Path, required=True) + args = ap.parse_args() + root = args.root.resolve(); packet = root / PACKET + logs = args.output.resolve() + require(not logs.is_relative_to(packet), 'evidence_must_not_modify_packet') + # Never overwrite a former run's receipt or silently reuse its output. + require(not logs.exists(), 'evidence_directory_already_exists') + logs.mkdir(parents=True) + receipt = dict(object=OBJECT, repository=REPOSITORY, source_commit=SOURCE_COMMIT, + mode=args.mode, manifest_sha256=MANIFEST_SHA256, + scientific_acceptance=False, independent_review=False, + github_run_id=os.environ.get('GITHUB_RUN_ID'), + github_run_attempt=os.environ.get('GITHUB_RUN_ATTEMPT'), + github_event=os.environ.get('GITHUB_EVENT_NAME'), + status='FAIL', steps={}) + try: + validate_snapshot(root) + head = subprocess.run(['git', 'rev-parse', 'HEAD'], cwd=root, check=True, + capture_output=True, text=True).stdout.strip() + require(re.fullmatch('[0-9a-f]{40}', head), 'tested_commit_missing') + receipt['tested_commit'] = head + require(Path(__file__).resolve() == (root / 'tools/d3_l4_replay.py').resolve(), + 'execution_driver_location') + receipt['execution_sources'] = execution_identities(root, head) + if os.environ.get('GITHUB_ACTIONS') == 'true': + require(os.environ.get('GITHUB_SHA') == head + and os.environ.get('GITHUB_REPOSITORY') == REPOSITORY, 'host_identity_mismatch') + require(receipt['github_run_id'] and receipt['github_run_attempt'], 'run_identity_missing') + flags = ['-B'] + (['-O'] if args.mode == 'optimized' else []) + ['-S'] + command = [sys.executable] + flags + specs = [('tests', ['-m', 'unittest', 'test_certificate', '-v'], None, 'tests'), + ('coefficient', ['certificate.py', '--n', '128'], 'RESULTS.json', 'exact'), + ('reference', ['certificate.py', '--reference', '--n', '4'], 'REFERENCE.json', 'exact'), + ('crosschecks', ['source_crosscheck.py', '--source', str(root / UPSTREAM)], + 'CROSSCHECKS.json', 'crosschecks')] + for name, tail, expected_name, kind in specs: + expected = None if expected_name is None else (packet / expected_name).read_bytes() + receipt['steps'][name] = run_step(command + tail, packet, logs, name, expected, kind) + validate_snapshot(root) + require(execution_identities(root, head) == receipt['execution_sources'], 'execution_source_drift') + receipt['status'] = 'PASS' + except Exception as exc: + receipt['failure'] = type(exc).__name__ + ': ' + str(exc) + raise + finally: + (logs / 'receipt.json').write_text(json.dumps(receipt, sort_keys=True, indent=2) + '\n') + print(json.dumps(receipt, sort_keys=True, indent=2)) + + +if __name__ == '__main__': + main() From 5adce1960db6b0f16821b3be6e266f6ce266fd7a Mon Sep 17 00:00:00 2001 From: Dylan Roy <249851642+d6g8k5htny-coder@users.noreply.github.com> Date: Mon, 5 Oct 2026 16:18:28 -0700 Subject: [PATCH 2/2] Fix d3 L4 workflow history prerequisite exposed by full hosted tests Run37387089137 used shallow checkout and failed 24 proof-reachability cases plus 4 CLI subcases on missing historical commit0fda855b8ee0c26d597bb033e0b4cdfb6d07e5e6. Fetch complete history; retain all tests and all scientific inputs unchanged. New checkout regression fails before the fix; 21 local protocol tests pass in normal and optimized modes after it. Fresh hosted full replay remains required. Scientific effect NONE; prior failed run remains a failure, not reclassified. --- .github/workflows/d3-l4-anisotropic.yml | 1 + tests/test_d3_l4_replay.py | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/.github/workflows/d3-l4-anisotropic.yml b/.github/workflows/d3-l4-anisotropic.yml index c841af917..8e208add4 100644 --- a/.github/workflows/d3-l4-anisotropic.yml +++ b/.github/workflows/d3-l4-anisotropic.yml @@ -40,6 +40,7 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 with: persist-credentials: false + fetch-depth: 0 - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 with: python-version: '3.13.5' diff --git a/tests/test_d3_l4_replay.py b/tests/test_d3_l4_replay.py index 6bf0cfe7e..47c538b16 100644 --- a/tests/test_d3_l4_replay.py +++ b/tests/test_d3_l4_replay.py @@ -211,6 +211,12 @@ def test_cli_refuses_reusing_existing_evidence(self): self.assertIn(b'evidence_directory_already_exists', run.stderr) self.assertEqual(old.read_text(), 'historical receipt') + def test_workflow_fetches_history_for_proof_reachability(self): + text = (ROOT / '.github/workflows/d3-l4-anisotropic.yml').read_text() + checkout = text.split('uses: actions/checkout@', 1)[1].split(' - ', 1)[0] + self.assertIn('fetch-depth: 0', checkout, + 'proof-reachability tests consume historical Git objects') + def test_workflow_covers_packet_dependencies_and_both_modes(self): self.load(); wf = ROOT / '.github/workflows/d3-l4-anisotropic.yml' self.assertTrue(wf.is_file())