From 7af9d183f5c2c80f669ac54413cacdef749977f5 Mon Sep 17 00:00:00 2001 From: Dylan Roy <249851642+d6g8k5htny-coder@users.noreply.github.com> Date: Tue, 6 Oct 2026 05:00:24 -0700 Subject: [PATCH] Integrate reviewed legacy JSON repair and trigger coverage on current main MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dylan Roy — delegated AI integration preparation. Preserve the seven reviewed parent repair blobs from #330/#351 and the reviewed five-file trigger amendment from #361 on current main 11f9127f00ce922e5d39b0da42af76134eb78a21. Scientific effect NONE. Fresh current-candidate checks and final ownership reconciliation required before merge. --- .github/workflows/c6-cluster-law.yml | 37 +-- .github/workflows/far-elder-rate.yml | 32 ++- .github/workflows/local-pairing.yml | 32 ++- .../SCOPE.md | 123 +++++++++ .../legacy_trigger_coverage_20261006/SCOPE.md | 99 ++++++++ tests/test_legacy_json_workflows.py | 234 ++++++++++++++++++ tests/test_legacy_workflow_triggers.py | 138 +++++++++++ tools/legacy_json_contracts.json | 1 + tools/legacy_json_replay.py | 176 +++++++++++++ 9 files changed, 828 insertions(+), 44 deletions(-) create mode 100644 reviews/legacy_json_workflow_repair_20261006/SCOPE.md create mode 100644 reviews/legacy_trigger_coverage_20261006/SCOPE.md create mode 100644 tests/test_legacy_json_workflows.py create mode 100644 tests/test_legacy_workflow_triggers.py create mode 100644 tools/legacy_json_contracts.json create mode 100644 tools/legacy_json_replay.py diff --git a/.github/workflows/c6-cluster-law.yml b/.github/workflows/c6-cluster-law.yml index 85bbd08ea..3a09eabf6 100644 --- a/.github/workflows/c6-cluster-law.yml +++ b/.github/workflows/c6-cluster-law.yml @@ -5,6 +5,12 @@ name: C6 cluster-law checks paths: - 'frontiers/c6_cluster_law_20260929/**' - '.github/workflows/c6-cluster-law.yml' + - 'tools/legacy_json_replay.py' + - 'tools/legacy_json_contracts.json' + - 'tests/test_legacy_json_workflows.py' + - 'tools/**' + - 'tools.py' + - 'tests/test_legacy_workflow_triggers.py' workflow_dispatch: permissions: @@ -21,6 +27,17 @@ jobs: - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 with: python-version: '3.11.16' + - name: Check legacy import-resolution trigger coverage + run: | + python -B -S tests/test_legacy_workflow_triggers.py + python -B -O -S tests/test_legacy_workflow_triggers.py + - name: Exercise the complete shell rejection contract in both modes + env: + LEGACY_TEST_FAMILY: 'c6-cluster' + PYTHONDONTWRITEBYTECODE: '1' + run: | + python -B -S tests/test_legacy_json_workflows.py + python -B -O -S tests/test_legacy_json_workflows.py - name: Verify sources, replay both modes, reject mutants env: PYTHONDONTWRITEBYTECODE: '1' @@ -47,24 +64,8 @@ jobs: blob = hashlib.sha1(b'blob %d\0' % len(data) + data).hexdigest() if len(data) != entry['bytes'] or hashlib.sha256(data).hexdigest() != entry['sha256'] or blob != entry['git_blob']: raise ValueError('consumed source identity mismatch on this tree: ' + entry['path']) - script = str(root / 'cluster_law_check.py') - expected = (root / 'RESULTS.json').read_bytes() - mutants = ['pins-not-critical', 'wrong-pin-hessian', 'drop-sigma-jacobian', 'three-extra-points', 'shear-drop-cubic', 's-bound-constant', - 'cross-term-not-small', 'window-closed', 'index-sign'] - for flags in (['-B', '-S'], ['-B', '-O', '-S']): - out = subprocess.run([sys.executable, *flags, script], - check=True, capture_output=True, timeout=600).stdout - if out != expected: - raise RuntimeError('output differs from RESULTS.json under ' + ' '.join(flags)) - for m in mutants: - rc = subprocess.run([sys.executable, *flags, script, '--mutant', m], - capture_output=True, timeout=600).returncode - if rc != 1: - raise RuntimeError('mutant ' + m + ' not rejected') - rc = subprocess.run([sys.executable, *flags, script, '--mutant', 'unknown'], - capture_output=True, timeout=600).returncode - if rc != 2: - raise RuntimeError('unknown mutant not rejected with rc 2') + from tools.legacy_json_replay import replay + replay('c6-cluster', root) print(json.dumps({'scientific_effect': 'NONE', 'mathematical_acceptance': False})) PY git diff --exit-code diff --git a/.github/workflows/far-elder-rate.yml b/.github/workflows/far-elder-rate.yml index 7be1fdeea..5c1665740 100644 --- a/.github/workflows/far-elder-rate.yml +++ b/.github/workflows/far-elder-rate.yml @@ -5,6 +5,12 @@ name: Far elder rate exact controls paths: - 'frontiers/far_elder_rate_20260930/**' - '.github/workflows/far-elder-rate.yml' + - 'tools/legacy_json_replay.py' + - 'tools/legacy_json_contracts.json' + - 'tests/test_legacy_json_workflows.py' + - 'tools/**' + - 'tools.py' + - 'tests/test_legacy_workflow_triggers.py' workflow_dispatch: permissions: @@ -21,6 +27,17 @@ jobs: - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 with: python-version: '3.11.16' + - name: Check legacy import-resolution trigger coverage + run: | + python -B -S tests/test_legacy_workflow_triggers.py + python -B -O -S tests/test_legacy_workflow_triggers.py + - name: Exercise the complete shell rejection contract in both modes + env: + LEGACY_TEST_FAMILY: 'far-elder' + PYTHONDONTWRITEBYTECODE: '1' + run: | + python -B -S tests/test_legacy_json_workflows.py + python -B -O -S tests/test_legacy_json_workflows.py - name: Verify sources, replay both modes, reject mutants env: PYTHONDONTWRITEBYTECODE: '1' @@ -42,19 +59,8 @@ jobs: framed = b'blob ' + str(len(data)).encode() + b'\0' + data if len(data) != entry['bytes'] or hashlib.sha256(data).hexdigest() != entry['sha256'] or hashlib.sha1(framed).hexdigest() != entry['git_blob']: raise ValueError('merged source drifted: ' + entry['path']) - script = str(root / 'far_elder_check.py') - expected = (root / 'RESULTS.json').read_bytes() - for flags in (['-B', '-S'], ['-B', '-O', '-S']): - out = subprocess.run([sys.executable, *flags, script], check=True, capture_output=True, timeout=600).stdout - if out != expected: - raise RuntimeError('output differs from RESULTS.json under ' + ' '.join(flags)) - for m in ('M1', 'M2', 'M3', 'M4'): - rc = subprocess.run([sys.executable, *flags, script, '--mutant', m], capture_output=True, timeout=600).returncode - if rc != 1: - raise RuntimeError('mutant ' + m + ' not rejected') - rc = subprocess.run([sys.executable, *flags, script, '--mutant', 'M9'], capture_output=True, timeout=600).returncode - if rc != 2: - raise RuntimeError('unknown mutant label not rejected with exit 2') + from tools.legacy_json_replay import replay + replay('far-elder', root) print(json.dumps({'scientific_effect': 'NONE', 'mathematical_acceptance': False})) PY git diff --exit-code diff --git a/.github/workflows/local-pairing.yml b/.github/workflows/local-pairing.yml index 30feada3a..b21aecefd 100644 --- a/.github/workflows/local-pairing.yml +++ b/.github/workflows/local-pairing.yml @@ -5,6 +5,12 @@ name: Local pairing exact controls paths: - 'frontiers/local_pairing_20260930/**' - '.github/workflows/local-pairing.yml' + - 'tools/legacy_json_replay.py' + - 'tools/legacy_json_contracts.json' + - 'tests/test_legacy_json_workflows.py' + - 'tools/**' + - 'tools.py' + - 'tests/test_legacy_workflow_triggers.py' workflow_dispatch: permissions: @@ -21,6 +27,17 @@ jobs: - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 with: python-version: '3.11.16' + - name: Check legacy import-resolution trigger coverage + run: | + python -B -S tests/test_legacy_workflow_triggers.py + python -B -O -S tests/test_legacy_workflow_triggers.py + - name: Exercise the complete shell rejection contract in both modes + env: + LEGACY_TEST_FAMILY: 'local-pairing' + PYTHONDONTWRITEBYTECODE: '1' + run: | + python -B -S tests/test_legacy_json_workflows.py + python -B -O -S tests/test_legacy_json_workflows.py - name: Verify sources, replay both modes, reject mutants env: PYTHONDONTWRITEBYTECODE: '1' @@ -55,19 +72,8 @@ jobs: framed = b'blob ' + str(len(data)).encode() + b'\0' + data if len(data) != entry['bytes'] or hashlib.sha256(data).hexdigest() != entry['sha256'] or hashlib.sha1(framed).hexdigest() != entry['git_blob']: raise ValueError('merged source drifted: ' + entry['path']) - script = str(root / 'pairing_check.py') - expected = (root / 'RESULTS.json').read_bytes() - for flags in (['-B', '-S'], ['-B', '-O', '-S']): - out = subprocess.run([sys.executable, *flags, script], check=True, capture_output=True, timeout=600).stdout - if out != expected: - raise RuntimeError('output differs from RESULTS.json under ' + ' '.join(flags)) - for m in ('M1', 'M2', 'M3', 'M4'): - rc = subprocess.run([sys.executable, *flags, script, '--mutant', m], capture_output=True, timeout=600).returncode - if rc != 1: - raise RuntimeError('mutant ' + m + ' not rejected') - rc = subprocess.run([sys.executable, *flags, script, '--mutant', 'M9'], capture_output=True, timeout=600).returncode - if rc != 2: - raise RuntimeError('unknown mutant label not rejected with exit 2') + from tools.legacy_json_replay import replay + replay('local-pairing', root) print(json.dumps({'scientific_effect': 'NONE', 'mathematical_acceptance': False})) PY git diff --exit-code diff --git a/reviews/legacy_json_workflow_repair_20261006/SCOPE.md b/reviews/legacy_json_workflow_repair_20261006/SCOPE.md new file mode 100644 index 000000000..d7fc8d7cd --- /dev/null +++ b/reviews/legacy_json_workflow_repair_20261006/SCOPE.md @@ -0,0 +1,123 @@ +# Three legacy JSON wrappers: authenticate the intended rejection + +Dylan Roy — delegated AI engineering. Actual author OpenAI / GPT-6 Astra Pro, +`legacy-json-repair-continuity-20261006-r8`, pickup Math-#322/6008335661. +Scientific effect NONE; shared-account/provider organizational credit0. +Author-side implementation; separate engineering review and eligible integration +are required. No mathematical acceptance or source-proof correction is asserted. + +## Finding and exact source + +This repairs AUD-LEGACY-MUTANT-01, recorded in #322. The complete genuine-CLI +characterization and two additional full-shell falsifications were delivered by +another session in #322/6008323186; this implementation credits those results. +Source cut for the unchanged contracts: b25cac0bcbb4032d624f14795257d9578c90d105. +Integration base: 4a7a5b771e248123f601578b7d237af924d023a4. Native comparison shows +only unrelated #324/#321 additions between these cuts, not a changed source here. + +| Original workflow | Git blob | +|---|---| +| local-pairing.yml | 30feada3a0c5c771f938b592e23ab0f262264ae8 | +| far-elder-rate.yml | 7be1fdeea1eb13ea6b794b33190971a6081ecc56 | +| c6-cluster-law.yml | 85bbd08ea908d28ffb6eda940f63db3ba1b1a4bb | + +All three admitted any exit1 as an intended mutant rejection and ignored baseline +stderr. An unrelated crash or silent exit could therefore pass. Unknown-label +controls checked exit2 alone. The scientific CLI sources themselves were not +reported to crash, and no theorem is refuted by a wrapper defect. + +## Repair and preservation + +Seven engineering files: the three workflows, tools/legacy_json_replay.py, +tools/legacy_json_contracts.json, tests/test_legacy_json_workflows.py, and this note. +The original scientific source-validation block before child execution and final +tracked Git-diff guard are unchanged. Checker, proof, RESULTS, manifest and source +map files are untouched. Existing action/Python pins, read-only permission, +persist-credentials:false, 10/10/15-minute job budgets and 600-second child budget +remain. Each workflow now triggers on the new helper/reference/test paths and +executes its applicable family of whole-shell regressions in both Python modes. +No #321 helper or #320/#312 source is edited. + +The reference data stores independently measured COMPLETE reports and exact +checker/RESULTS identities. Expected values are never learned from the invocation +under test. Successful baseline: exit0, empty stderr, byte-identical RESULTS. +Mutant: exit1, empty stderr, a single UTF-8 JSON object with the exact recursive +keys/types/values/list order and full information/reason. Duplicate keys, floats, +nonfinite constants, type-confused booleans, missing/extra data or trailing JSON +reject. Harmless JSON whitespace/key order/indentation is permitted for mutants, +not for the frozen successful baseline. Source/reference drift needs a new read. + +Local M3 and M4 each fail TWO checks. Local M1/M2 share a false check but have +different info; neither an exactly-one-false rule nor a failed-name-only predicate +would be correct. C6's failures are exactly error+passed objects from a caught +ValueError; no uncaught-assertion adapter is introduced. + +Local/far invalid labels require exit2, empty stdout and the exact 21-byte message. +C6's full argparse diagnostic is constructed by the PARENT from its frozen +argument grammar, fixed choice order and script basename, using the same Python +interpreter as the child. This accounts for usage wrapping without learning the +expected message from child output or assuming local Python3.13 equals hosted3.11. +Every run emits command-outcome stream lengths/hashes; mismatches, TimeoutExpired +and OSError fail instead of becoming intended-control receipts. No sandbox, +malicious-source defense, complete process-evidence recovery or global source +admission property is claimed. Authenticated source and reviewed reference data +are the trust boundary; legitimate reference changes still require review. + +## Execution and non-vacuous regressions + +Actual local CPython3.13.5; standard library only. The three original scientific +CLIs and RESULTS matched native Git blobs before 46 authentic baseline/mutant/ +unknown-label invocations. All 23 normal/optimized stdout AND stderr pairs match. +All three repaired helper invocations then re-executed their complete authentic +inventories successfully (46 further child executions, not new control types). + +The 12-method regression suite executes real complete workflow verification +shells in committed temporary SYNTHETIC Git repositories: nonempty source pins, +full hash/size guards, both child modes, every original label and final Git diff. +Only synthetic source identity is rebound; the expected output data stays fixed. +No subprocess is mocked. Traces verify the targeted child was reached and stop +at rejection. Source/pin tampering rejects before any child executes. + +Per outer Python mode: 57 local, 57 far and 87 cluster shell fixtures, 201 total. +The final candidate passed both outer modes: 402 fixtures. These are 12 distinct +methods with family selection, not 72 distinct tests. Against the exact ORIGINAL +workflows, the same suite in normal outer mode produced 48/48/78 false-acceptance +failures, 174 total, with NO test errors; the other 27 cases retained their intended +outcomes. Both target child modes occur in each outer run. Original outer -O was +not separately replayed or claimed. Earlier interrupted partial runs are retained +but excluded from completed-run totals. + +Coverage includes every mutant stage with unrelated crash, silence and wrong +reason; malformed/type-confused/duplicate/trailing JSON; baseline stderr; wrong +unknown diagnostics/stdout; wrong exits; source tampering; and accepted harmless +mutant formatting. The reference-data canonical digest and frozen baseline hashes +are also checked. The suite does not assert a mathematical interpretation of every +reported info value: it verifies exact retention of the existing source contract. + +From repository root: + + python -B -S tests/test_legacy_json_workflows.py + python -B -O -S tests/test_legacy_json_workflows.py + +LEGACY_TEST_FAMILY selects local-pairing, far-elder or c6-cluster, as the dedicated +workflows do. LEGACY_SOURCE_ROOT is test-only and selects the predecessor workflow +for falsification; neither variable changes production helper behavior. + +## Custody and release limits + +Local direct GitHub access fails DNS; execution used authenticated exact-source +subsets recovered from archives/native reads. All 29 unique quoted upstream +sources (34 rows across the three manifests) were recovered by exact identity. +The recovered local-pairing full packet manifest is an older snapshot, so this +session does NOT claim a full contemporary original-packet source-guard replay. +Actual scientific scripts/RESULTS are current and exact; synthetic whole-shell +source guards and direct genuine helper execution are separate evidence. Hosted +candidate workflows must exercise the actual full checkout and pinned3.11.16. + +Current-candidate dedicated workflows plus the required general aggregate must +pass, followed by a source-bound nonauthor engineering read and separate eligible +integration. No old test/CI receipt is rebound after a source change. #322 remains +open until its real repair/integration predicates are fulfilled; this does not +clear the remaining legacy wrappers, scientific qualifications, C6 retractions, +independent formal alignment or other research obligations. Offline delivery is +a new supplement, not alteration of sealed prior archives or proof of a Mac save. diff --git a/reviews/legacy_trigger_coverage_20261006/SCOPE.md b/reviews/legacy_trigger_coverage_20261006/SCOPE.md new file mode 100644 index 000000000..bfe44d57f --- /dev/null +++ b/reviews/legacy_trigger_coverage_20261006/SCOPE.md @@ -0,0 +1,99 @@ +# Legacy package-resolution trigger coverage + +Dylan Roy — delegated AI engineering. Actual author OpenAI / GPT-6 Astra Pro, +`qs-continuation-legacy-trigger-20261006-r6`. Pickup Math-#351/6014859323. +Scientific effect **NONE**; organizational-independence credit 0. No self-merge. + +## Finding and isolated scope + +Native #351 discussion_r4191758835 identifies two repository paths which can +change the meaning of `from tools.legacy_json_replay import replay` without +matching any of the three dedicated workflow filters: `tools/__init__.py` and +root `tools.py`. The original helper lives in an implicit namespace package. +An initializer executes on import; a root module can supersede that namespace +and make the submodule import fail. This is missing trigger coverage, not a +claim that the current numerical result is wrong or that a malicious file exists. + +Base: #351 head `18afecd9e505167b6eb1d9457b17ed9aacee6677`. +This proposal changes only three workflows, adds one regression file, and this +scope note. It is stacked to isolate its delta, NOT permission to merge into +#351's or #330's owner branch. Canonical parent adoption stays with that owner. + +Each workflow retains every original path and adds `tools/**`, `tools.py`, and +`tests/test_legacy_workflow_triggers.py`. The broad subtree intentionally runs +these checks for additional tools changes; it does NOT cover root `tools.py`, +which is therefore explicit. A separate step runs the regression in normal and +optimized Python before the existing full-shell protocol tests. No negative +path patterns, new events, permissions, action/runtime pins, job budgets, +production imports, numerical commands, or acceptance contracts are changed. + +The entire original workflow is recovered by removing exactly the three added +path entries and the four-line new step. The original source preflight, +checker/replay invocation, final JSON statement and Git postflight are byte-exact. +All helper/contracts, original tests, scientific inputs/proofs/RESULTS/manifests, +formal code, scientific registers, premises and review history are unchanged. + +## Test-first execution + +Local: CPython 3.13.5, Git 2.47.3, Linux. GitHub clone failed DNS, so the local +worktree is an authenticated three-file source subset, not a full repository. +All original workflow bytes reconstruct their native Git blob identities: + +| Workflow | Original Git blob | +|---|---| +| local-pairing.yml | 8ea45e74672c42687176462e79df33adaf83c98d | +| far-elder-rate.yml | 37c0dd197e3d6c0fd10a172a656b79f496943aa2 | +| c6-cluster-law.yml | ae5bf02b6358c0e83fe8a52b470eb4734536f113 | + +The five-method new suite against the original workflows fails **15 intended +assertions per outer interpreter mode, zero errors**: nine named resolver-path +coverage cases, three missing self-triggers and three missing two-mode steps. +The actual-import method passes even on the predecessor, establishing the +mechanism independently of the repaired configuration. It executes the exact +import line read from each workflow against a synthetic helper in isolated +subprocesses: three families, two child modes, namespace/initializer/root-module +variants, **18 real children per outer run**. Initializers and root modules leave +observable markers; root-module selection also yields the expected package error. +No import/subprocess implementation is mocked. Child environments are private +and remove ambient PYTHON variables; the caller environment is not changed. + +After the 21-line workflow amendment, **5/5 methods pass in each outer mode**. +Four separately copied configuration mutations then reject in both modes with +exactly 3/6/3/3 assertion failures and zero errors: remove root-module coverage, +remove subtree coverage, remove the test's trigger, or remove its optimized +invocation. Valid old paths and unrelated-path negatives are retained. All three +YAML documents parse and every run block passes `bash -n`; the product test itself +uses only the standard library, not the auxiliary YAML inspection dependency. + +From the repository root: + +```sh +python -B -S tests/test_legacy_workflow_triggers.py +python -B -O -S tests/test_legacy_workflow_triggers.py +``` + +## Evidence and integration boundaries + +The test uses a deliberately restricted reader for the actual positive, +single-quoted path lists, and literal/subtree patterns. It rejects unsupported +syntax rather than claiming to implement GitHub's full YAML/glob evaluator. +These checks establish configured coverage and real Python import behavior; +they do NOT constitute a hosted changed-path-only scheduling experiment, a +hostile-source sandbox, an exhaustive import-dependency audit, or a theorem. +GitHub's own changed-file/diff limits remain. Arbitrary future loader hooks, +root standard-library shadows and installed dependencies are outside this fix. + +Full original legacy tests and source-authenticated numerical replays were not +executed locally. Actual dedicated and applicable general hosted checks on the +published candidate, a bounded nonauthor delta review, and an explicit owner +adoption/reconciliation are still required. No earlier #330/#351 review transfers +to changed YAML merely because the numerical block is preserved. Keep the native +finding open until its actual source/review disposition is satisfied. A stacked +success is not a current-main integration receipt. Parent and later #348/signing +branches must not be overwritten; reconcile their real ordering and source. + +Primary technical references consulted 2026-10-06: +- https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax + (`on..paths`, diff limits, literal and `**` path patterns). +- https://docs.python.org/3.13/reference/import.html + (regular/namespace packages and submodule import resolution). diff --git a/tests/test_legacy_json_workflows.py b/tests/test_legacy_json_workflows.py new file mode 100644 index 000000000..3dd05f3b2 --- /dev/null +++ b/tests/test_legacy_json_workflows.py @@ -0,0 +1,234 @@ +"""Whole-shell regression tests; every repository and checker here is synthetic. + +The fixture commits source/manifest/upstream bytes, then runs the actual workflow +verification block with real subprocesses. Child stdout uses the independently +measured report fixtures. This is protocol coverage, not a field calculation. +""" +from __future__ import annotations +import hashlib +import json +import os +from pathlib import Path +import shutil +import subprocess +import sys +import tempfile +import textwrap +import unittest + +ROOT = Path(__file__).resolve().parents[1] +SOURCE = Path(os.environ.get('LEGACY_SOURCE_ROOT', str(ROOT))) +CONTRACTS = json.loads((ROOT/'tools/legacy_json_contracts.json').read_text()) +WORKFLOWS = {'local-pairing':'local-pairing.yml','far-elder':'far-elder-rate.yml','c6-cluster':'c6-cluster-law.yml'} +ACTIVE = {k:v for k,v in CONTRACTS['families'].items() if not os.environ.get('LEGACY_TEST_FAMILY') or k == os.environ['LEGACY_TEST_FAMILY']} +if not ACTIVE: + raise SystemExit('unknown test family') +UNKNOWN = {'local-pairing':'M9','far-elder':'M9','c6-cluster':'unknown'} +CHOICES = ('pins-not-critical','wrong-pin-hessian','drop-sigma-jacobian', + 'three-extra-points','cross-term-not-small','window-closed','index-sign', + 'shear-drop-cubic','s-bound-constant') + +def digest(data): + return hashlib.sha256(data).hexdigest() + +def blob(data): + return hashlib.sha1(b'blob %d\0'%len(data)+data).hexdigest() + +def row(path, data): + return {'path':path,'bytes':len(data),'sha256':digest(data),'git_blob':blob(data)} + +def verification_shell(path): + lines=path.read_text().splitlines() + start=next(i for i,line in enumerate(lines) if 'name: Verify sources,' in line) + start=next(i for i in range(start,len(lines)) if lines[i].strip()=='run: |')+1 + end=start + while end2 else 'baseline' +mode = 'optimized' if sys.flags.optimize else 'normal' +with open(os.environ['LEGACY_TRACE'], 'a') as f: + f.write(json.dumps([label,mode])+'\n') +if label == 'baseline': + output = baseline + rc = 0 +elif label == unknown: + if family == 'c6-cluster': + import io, contextlib + parser=argparse.ArgumentParser(prog=Path(__file__).name) + parser.add_argument('--mutant', choices=CHOICES) + stream=io.StringIO() + try: + with contextlib.redirect_stderr(stream):parser.parse_args(['--mutant',unknown]) + except SystemExit as exc: + if exc.code != 2:raise + diagnostic=stream.getvalue() + else: diagnostic='unknown mutant label\n' + if os.environ.get('LEGACY_TARGET')==label and os.environ.get('LEGACY_MODE')==mode: + kind=os.environ.get('LEGACY_FAULT','') + if kind=='unknown-wrong':diagnostic='unrelated permission failure\n' + elif kind=='unknown-stdout':print('extra stdout') + sys.stderr.write(diagnostic) + sys.exit(2) +else: + output=json.dumps(reports[label],sort_keys=True)+'\n';rc=1 +if os.environ.get('LEGACY_TARGET')==label and os.environ.get('LEGACY_MODE')==mode: + kind=os.environ.get('LEGACY_FAULT','') + if kind=='crash':raise RuntimeError('unrelated fixture crash') + if kind=='silent':sys.exit(rc) + if kind=='stderr':sys.stderr.write('unexpected diagnostic\n') + if kind=='wrong-exit':rc=0 if label!='baseline' else 1 + if kind=='wrong-reason': + value=json.loads(output) + if 'error' in value:value['error']='unrelated mathematical check' + else: + name=next(k for k,v in value['checks'].items() if v['passed'] is False) + value['checks'][name]['info']='unrelated mathematical check' + output=json.dumps(value)+'\n' + if kind=='format':output=' \n'+json.dumps(json.loads(output),indent=4,sort_keys=False)+'\n\t' + if kind=='duplicate':output=output.rstrip()[:-1]+', "passed": false}\n' + if kind=='bool-int':output=output.replace('false','0') + if kind=='bool-float':output=output.replace('false','0.0') + if kind=='nonfinite':output=output.rstrip()[:-1]+', "unexpected": NaN}\n' + if kind=='trailing':output+='{}\n' + if kind=='extra': + value=json.loads(output);value['unexpected']='x';output=json.dumps(value)+'\n' + if kind=='missing': + value=json.loads(output);del value['passed'];output=json.dumps(value)+'\n' + if kind=='malformed':output='not JSON\n' +sys.stdout.write(output) +sys.exit(rc) +''' + +class LegacyWorkflowTests(unittest.TestCase): + maxDiff=None + def case(self,family,label='baseline',mode='normal',fault='',tamper=None): + with tempfile.TemporaryDirectory(prefix='legacy-json-test-') as td: + outside=Path(td);repo=outside/'repo';repo.mkdir() + trace=outside/'trace';contract=json.loads(json.dumps(CONTRACTS)) + entry=contract['families'][family];directory=repo/entry['directory'];directory.mkdir(parents=True) + base=(ROOT/entry['directory']/'RESULTS.json').read_bytes() if (ROOT/entry['directory']/'RESULTS.json').exists() else BASELINES[family].encode() + script=CHILD.replace('FAMILY',repr(family)).replace('REPORTS',repr(entry['mutants'])).replace('BASELINE',repr(base.decode())).replace('UNKNOWN',repr(UNKNOWN[family])).replace('CHOICES',repr(CHOICES)) + data=script.encode();(directory/entry['script']).write_bytes(data) + (directory/'RESULTS.json').write_bytes(base) + upstream=b'synthetic upstream; no scientific authority\n' + (repo/'upstream.txt').write_bytes(upstream) + pin=row('upstream.txt',upstream) + files=[row(entry['script'],data),row('RESULTS.json',base)] + if family=='c6-cluster': + sm=json.dumps({'inputs':[pin],'planar_sources_behind_DL':[]}).encode() + (directory/'SOURCE_MAP.json').write_bytes(sm) + files.append(row('SOURCE_MAP.json',sm)) + (directory/'SOURCE_FILES.json').write_text(json.dumps({'files':files})) + else: + (directory/'SOURCES.json').write_text(json.dumps({'files':files,'consumed':[pin],'cited_only':[]})) + (repo/'tools').mkdir() + helper=SOURCE/'tools/legacy_json_replay.py' + if helper.exists():shutil.copyfile(helper,repo/'tools/legacy_json_replay.py') + entry['script_git_blob']=blob(data) + # Only source authentication is re-bound for this synthetic fixture. + (repo/'tools/legacy_json_contracts.json').write_text(json.dumps(contract)) + env=os.environ.copy();env.update({'LEGACY_TRACE':str(trace),'LEGACY_TARGET':label,'LEGACY_MODE':mode,'LEGACY_FAULT':fault,'PYTHONDONTWRITEBYTECODE':'1','PYTHONHASHSEED':'0'}) + for cmd in [['git','init','-q'],['git','add','.'],['git','-c','user.name=Fixture','-c','user.email=fixture@example.invalid','commit','-qm','synthetic fixture']]: + subprocess.run(cmd,cwd=repo,check=True,capture_output=True,timeout=15,env=env) + if tamper=='packet':(directory/entry['script']).write_bytes(data+b'\n') + if tamper=='upstream':(repo/'upstream.txt').write_bytes(upstream+b'x') + shell=verification_shell(SOURCE/'.github/workflows'/WORKFLOWS[family]) + result=subprocess.run(['bash','-c',shell],cwd=repo,env=env,capture_output=True,timeout=45) + events=[json.loads(s) for s in trace.read_text().splitlines()] if trace.exists() else [] + return result,events + + def rejected(self,fam,label,mode,fault): + result,events=self.case(fam,label,mode,fault) + self.assertNotEqual(result.returncode,0,(fam,label,mode,fault,'false acceptance',events)) + self.assertEqual(events[-1],[label,mode],(fam,label,mode,fault,events,result.stderr.decode(errors='replace'))) + + def test_reference_custody(self): + canonical=json.dumps(CONTRACTS['families'],sort_keys=True,separators=(',',':')).encode() + self.assertEqual(digest(canonical),'2aa3e27caf5adf27646d5a762ab6bd12974235aa8e0390450504f399aa02417d') + for fam,entry in ACTIVE.items(): + self.assertEqual(digest(BASELINES[fam].encode()),entry['baseline_sha256']) + + def test_valid_complete_inventory(self): + for fam,entry in ACTIVE.items(): + with self.subTest(family=fam): + p,events=self.case(fam) + self.assertEqual(p.returncode,0,p.stderr.decode(errors='replace')) + labels=['baseline',*ORDERS[fam],UNKNOWN[fam]] + self.assertEqual(events,[[label,mode] for mode in ['normal','optimized'] for label in labels]) + + def test_crashes_each_mutant_each_mode(self): + for fam,entry in ACTIVE.items(): + for label in entry['mutants']: + for mode in ['normal','optimized']: + with self.subTest(family=fam,label=label,mode=mode):self.rejected(fam,label,mode,'crash') + + def test_wrong_reasons_each_mutant_each_mode(self): + for fam,entry in ACTIVE.items(): + for label in entry['mutants']: + for mode in ['normal','optimized']: + with self.subTest(family=fam,label=label,mode=mode):self.rejected(fam,label,mode,'wrong-reason') + + def test_silent_each_mutant_each_mode(self): + for fam,entry in ACTIVE.items(): + for label in entry['mutants']: + for mode in ['normal','optimized']: + with self.subTest(family=fam,label=label,mode=mode):self.rejected(fam,label,mode,'silent') + + def test_baseline_stderr(self): + for fam in ACTIVE: + for mode in ['normal','optimized']: + with self.subTest(family=fam,mode=mode):self.rejected(fam,'baseline',mode,'stderr') + + def test_json_contract(self): + for fam in ACTIVE: + label=ORDERS[fam][0] + for fault in ['stderr','duplicate','bool-int','bool-float','nonfinite','trailing','extra','missing','malformed']: + for mode in ['normal','optimized']: + with self.subTest(family=fam,fault=fault,mode=mode):self.rejected(fam,label,mode,fault) + + def test_unknown_diagnostics(self): + for fam in ACTIVE: + for mode in ['normal','optimized']: + for fault in ['unknown-wrong','unknown-stdout']: + with self.subTest(family=fam,mode=mode,fault=fault):self.rejected(fam,UNKNOWN[fam],mode,fault) + + def test_harmless_mutant_json_formatting(self): + for fam in ACTIVE: + for mode in ['normal','optimized']: + with self.subTest(family=fam,mode=mode): + p,events=self.case(fam,ORDERS[fam][0],mode,'format') + self.assertEqual(p.returncode,0,p.stderr.decode(errors='replace')) + + def test_wrong_exit_remains_rejected(self): + for fam in ACTIVE: + for mode in ['normal','optimized']: + with self.subTest(family=fam,mode=mode):self.rejected(fam,ORDERS[fam][0],mode,'wrong-exit') + + def test_source_guards_before_children(self): + for fam in ACTIVE: + for what in ['packet','upstream']: + with self.subTest(family=fam,what=what): + p,events=self.case(fam,tamper=what) + self.assertNotEqual(p.returncode,0) + self.assertEqual(events,[]) + + def test_baseline_bytes_remain_exact(self): + for fam in ACTIVE: + for mode in ['normal','optimized']: + with self.subTest(family=fam,mode=mode):self.rejected(fam,'baseline',mode,'format') + +ORDERS={'local-pairing':['M1','M2','M3','M4'],'far-elder':['M1','M2','M3','M4'],'c6-cluster':['pins-not-critical','wrong-pin-hessian','drop-sigma-jacobian','three-extra-points','shear-drop-cubic','s-bound-constant','cross-term-not-small','window-closed','index-sign']} +# BASELINES inserted below from native RESULTS, independently hash-bound above. +BASELINES = {'c6-cluster': '{\n "groups": [\n "NF",\n "RS",\n "EX",\n "BD",\n "EU",\n "SH",\n "TW",\n "LG"\n ],\n "ledger": {\n "cross_term_exponent": "9/2",\n "hadamard_row_factors": {\n "3": 6,\n "4": 8\n },\n "soft_slice_exponent": 3,\n "ui_tail": "1/(M-1)"\n },\n "mathematical_acceptance": false,\n "object": "CL-C6-CLUSTER-LAW-20260929-v1.2",\n "passed": true,\n "q2_terms": 12,\n "schema": 1,\n "scientific_effect": "NONE",\n "scope": "exact identities, exact configurations and exponent bookkeeping only",\n "typed_window": {\n "family_size": 201720,\n "typed_in_window": 2590\n }\n}\n', 'far-elder': '{\n "checks": {\n "B1_barrier_polynomial": {\n "info": {\n "K": "22",\n "R": "1/11",\n "grid_points_in_ball": 1793,\n "lambda": "2"\n },\n "passed": true\n },\n "B2_algebra_and_constants": {\n "info": {\n "L=1": {\n "a_L": "1/4",\n "c_L": "1/48"\n },\n "L=2": {\n "a_L": "1/2",\n "c_L": "1/12"\n },\n "L=24": {\n "a_L": "1",\n "c_L": "1/3"\n },\n "L=4": {\n "a_L": "1",\n "c_L": "1/3"\n }\n },\n "passed": true\n },\n "I1_split_integral": {\n "info": {\n "q=2,u=1/100": "149/1000000",\n "q=2,u=1/4": "5/64",\n "q=2,u=1/9": "25/1458",\n "q=4,u=1/100": "299999999/4000000000000",\n "q=4,u=1/4": "767/16384",\n "q=4,u=1/9": "9841/1062882"\n },\n "passed": true\n },\n "I2_exponent_ledger": {\n "info": {\n "count exponent": "5/3",\n "inverse moment threshold": "-5/3",\n "u^2 exponent of ell": "2/3"\n },\n "passed": true\n },\n "N1_near_consistency": {\n "info": {\n "6*sqrt(6 c_L) < 12 for c_L <= 1/3": true\n },\n "passed": true\n }\n },\n "object": "CL-FAR-ELDER-RATE-20260930-v1",\n "passed": true,\n "scientific_effect": "NONE"\n}\n', 'local-pairing': '{\n "checks": {\n "I0_I3_identities": {\n "info": 144,\n "passed": true\n },\n "N1_n0_grid": {\n "info": {\n "n0_points_with_U_hypothesis": 0,\n "n0_typed_grid_points": 135\n },\n "passed": true\n },\n "P1_path_cases": {\n "info": {\n "cases": {\n "U": 2160,\n "V": 4680,\n "V_at_other_root": 2160\n },\n "min_margin": "1/1200",\n "samples": 6840\n },\n "passed": true\n },\n "P2_elder_witness": {\n "info": {\n "Z1_squared": "15/8",\n "n": 2,\n "saddle_height": "-7/32",\n "u0": "-3/4",\n "vertical_line_constant": true\n },\n "passed": true\n }\n },\n "object": "CL-LOCAL-PAIRING-20260930-v1",\n "passed": true,\n "scientific_effect": "NONE"\n}\n'} + +if __name__ == "__main__": + unittest.main(verbosity=2) diff --git a/tests/test_legacy_workflow_triggers.py b/tests/test_legacy_workflow_triggers.py new file mode 100644 index 000000000..296bd0893 --- /dev/null +++ b/tests/test_legacy_workflow_triggers.py @@ -0,0 +1,138 @@ +"""Named legacy import-resolution triggers; real imports, not a GitHub scheduler. + +The loader below intentionally accepts only these workflows' simple, positive, +single-quoted path lists and literal/prefix/** patterns. Unsupported syntax fails +rather than pretending to implement the general GitHub glob/YAML language. +Synthetic helper bodies demonstrate resolution only, not numerical correctness. +""" +from pathlib import Path +import os +import re +import subprocess +import sys +import tempfile +import unittest + +ROOT = Path(__file__).resolve().parents[1] +SELF = 'tests/test_legacy_workflow_triggers.py' +FAMILIES = { + 'local-pairing.yml': 'frontiers/local_pairing_20260930', + 'far-elder-rate.yml': 'frontiers/far_elder_rate_20260930', + 'c6-cluster-law.yml': 'frontiers/c6_cluster_law_20260929', +} +STEP = ( + ' - name: Check legacy import-resolution trigger coverage\n' + ' run: |\n' + ' python -B -S ' + SELF + '\n' + ' python -B -O -S ' + SELF + '\n' +) + + +def workflow_text(name): + return (ROOT / '.github' / 'workflows' / name).read_text(encoding='utf-8') + + +def trigger_paths(text): + start = "'on':\n pull_request:\n paths:\n" + if text.count(start) != 1: + raise ValueError('expected one plain pull-request path list') + rows = text.split(start, 1)[1].split(' workflow_dispatch:\n', 1) + if len(rows) != 2: + raise ValueError('expected workflow-dispatch after path list') + found = [] + for line in rows[0].splitlines(): + match = re.fullmatch(r" - '([^']+)'", line) + if not match or match[1].startswith('!'): + raise ValueError('unsupported path-list syntax') + pattern = match[1] + plain = pattern[:-3] if pattern.endswith('/**') else pattern + if any(c in plain for c in '*?[]{}!'): + raise ValueError('unsupported path pattern') + found.append(pattern) + if not found or len(found) != len(set(found)): + raise ValueError('empty or duplicate path list') + return found + + +def covered(patterns, path): + # Only literal names or whole subtrees, as validated by trigger_paths. + return any(path.startswith(p[:-2]) if p.endswith('/**') else path == p + for p in patterns) + + +class LegacyTriggerTests(unittest.TestCase): + def test_package_and_root_module_changes_are_covered(self): + for name in FAMILIES: + paths = trigger_paths(workflow_text(name)) + for path in ('tools/__init__.py', 'tools.py', 'tools/nested/input.py'): + with self.subTest(workflow=name, path=path): + self.assertTrue(covered(paths, path), 'resolver change lacks replay trigger') + + def test_original_paths_and_new_regression_remain_covered(self): + for name, packet in FAMILIES.items(): + paths = trigger_paths(workflow_text(name)) + for path in (packet + '/checker.py', '.github/workflows/' + name, + 'tools/legacy_json_replay.py', 'tools/legacy_json_contracts.json', + 'tests/test_legacy_json_workflows.py', SELF): + with self.subTest(workflow=name, path=path): + self.assertTrue(covered(paths, path), 'consumed or regression path is uncovered') + for path in ('README.md', 'unrelated/tools.py', 'tools_extra/file.py'): + with self.subTest(workflow=name, unrelated=path): + self.assertFalse(covered(paths, path), 'unexpected unrelated trigger') + + def test_new_checks_run_in_both_modes_before_existing_replay(self): + for name in FAMILIES: + text = workflow_text(name) + with self.subTest(workflow=name): + self.assertEqual(text.count(STEP), 1, 'missing exact two-mode trigger-test step') + self.assertLess(text.index(STEP), text.index( + ' - name: Exercise the complete shell rejection contract in both modes\n')) + + def test_original_import_actually_uses_both_resolver_inputs(self): + for name in FAMILIES: + lines = [s.strip() for s in workflow_text(name).splitlines() + if s.strip().startswith('from tools.')] + self.assertEqual(lines, ['from tools.legacy_json_replay import replay']) + program = lines[0] + "\nprint(replay())\n" + for flags in (['-B', '-S'], ['-B', '-O', '-S']): + for variant in ('namespace', 'initializer', 'root-module'): + with self.subTest(workflow=name, flags=flags, variant=variant), \ + tempfile.TemporaryDirectory() as directory: + root = Path(directory) + (root / 'tools').mkdir() + (root / 'tools/legacy_json_replay.py').write_text( + "def replay(): return 'SYNTHETIC_HELPER'\n", encoding='utf-8') + if variant != 'namespace': + target = ('tools/__init__.py' if variant == 'initializer' + else 'tools.py') + (root / target).write_text( + "from pathlib import Path\n" + "Path('resolver.marker').write_text('executed')\n", + encoding='utf-8') + # Private process environment; do not alter caller configuration. + env = {k: v for k, v in os.environ.items() if not k.startswith('PYTHON')} + child = subprocess.run([sys.executable, *flags, '-'], input=program.encode(), + cwd=root, env=env, capture_output=True, timeout=10) + marker = root / 'resolver.marker' + self.assertEqual(marker.exists(), variant != 'namespace') + if marker.exists(): + self.assertEqual(marker.read_text(), 'executed') + if variant == 'root-module': + self.assertEqual(child.returncode, 1) + self.assertEqual(child.stdout, b'') + self.assertIn(b'ModuleNotFoundError', child.stderr) + self.assertIn(b"'tools' is not a package", child.stderr) + else: + self.assertEqual((child.returncode, child.stdout, child.stderr), + (0, b'SYNTHETIC_HELPER\n', b'')) + + def test_limited_path_reader_rejects_unsupported_syntax(self): + template = "'on':\n pull_request:\n paths:\n%s workflow_dispatch:\n" + for rows in (" - '!tools.py'\n", " - tools.py\n", + " - 'tools.*'\n", " - 'tools.py'\n - 'tools.py'\n", ''): + with self.subTest(rows=rows), self.assertRaises(ValueError): + trigger_paths(template % rows) + + +if __name__ == '__main__': + unittest.main() diff --git a/tools/legacy_json_contracts.json b/tools/legacy_json_contracts.json new file mode 100644 index 000000000..349fc3276 --- /dev/null +++ b/tools/legacy_json_contracts.json @@ -0,0 +1 @@ +{"families":{"c6-cluster":{"baseline_bytes":601,"baseline_sha256":"26f0af06567ea8f33497bf64fbfff07f0e9154017c9a3e280c49100a9247a197","directory":"frontiers/c6_cluster_law_20260929","mutants":{"cross-term-not-small":{"error":"near-far cross term is o(r^3)","passed":false},"drop-sigma-jacobian":{"error":"exponent: r (soft slice) . r^4 (weight) / r^2 (normalizer) = r^3","passed":false},"index-sign":{"error":"pin weights","passed":false},"pins-not-critical":{"error":"F_0(M) must be 0","passed":false},"s-bound-constant":{"error":"(-s - 2|B|)_+^3 <= 32 k D^2 (Lemma 3.6)","passed":false},"shear-drop-cubic":{"error":"shear identity (3.12) with k cleared","passed":false},"three-extra-points":{"error":"quotient degree","passed":false},"window-closed":{"error":"N_oo of a configuration","passed":false},"wrong-pin-hessian":{"error":"pin Hessian block","passed":false}},"script":"cluster_law_check.py","script_git_blob":"91f485f529e09bebcd92f5a8f41d87bf01efc6d6"},"far-elder":{"baseline_bytes":1111,"baseline_sha256":"6ef4152058bd186766c97aba47a8a3485f5b033943d3d1d134c427a6702c4947","directory":"frontiers/far_elder_rate_20260930","mutants":{"M1":{"checks":{"B1_barrier_polynomial":{"info":"barrier (1.1) fails at z=(1/3,-1/12)","passed":false},"B2_algebra_and_constants":{"info":{"L=1":{"a_L":"1/4","c_L":"1/48"},"L=2":{"a_L":"1/2","c_L":"1/12"},"L=24":{"a_L":"1","c_L":"1/3"},"L=4":{"a_L":"1","c_L":"1/3"}},"passed":true},"I1_split_integral":{"info":{"q=2,u=1/100":"149/1000000","q=2,u=1/4":"5/64","q=2,u=1/9":"25/1458","q=4,u=1/100":"299999999/4000000000000","q=4,u=1/4":"767/16384","q=4,u=1/9":"9841/1062882"},"passed":true},"I2_exponent_ledger":{"info":{"count exponent":"5/3","inverse moment threshold":"-5/3","u^2 exponent of ell":"2/3"},"passed":true},"N1_near_consistency":{"info":{"6*sqrt(6 c_L) < 12 for c_L <= 1/3":true},"passed":true}},"object":"CL-FAR-ELDER-RATE-20260930-v1","passed":false,"scientific_effect":"NONE"},"M2":{"checks":{"B1_barrier_polynomial":{"info":{"K":"22","R":"1/11","grid_points_in_ball":1793,"lambda":"2"},"passed":true},"B2_algebra_and_constants":{"info":"core inequality fails at lam=1/3 K=1/3 t=5/8","passed":false},"I1_split_integral":{"info":{"q=2,u=1/100":"149/1000000","q=2,u=1/4":"5/64","q=2,u=1/9":"25/1458","q=4,u=1/100":"299999999/4000000000000","q=4,u=1/4":"767/16384","q=4,u=1/9":"9841/1062882"},"passed":true},"I2_exponent_ledger":{"info":{"count exponent":"5/3","inverse moment threshold":"-5/3","u^2 exponent of ell":"2/3"},"passed":true},"N1_near_consistency":{"info":{"6*sqrt(6 c_L) < 12 for c_L <= 1/3":true},"passed":true}},"object":"CL-FAR-ELDER-RATE-20260930-v1","passed":false,"scientific_effect":"NONE"},"M3":{"checks":{"B1_barrier_polynomial":{"info":{"K":"22","R":"1/11","grid_points_in_ball":1793,"lambda":"2"},"passed":true},"B2_algebra_and_constants":{"info":{"L=1":{"a_L":"1/4","c_L":"1/48"},"L=2":{"a_L":"1/2","c_L":"1/12"},"L=24":{"a_L":"1","c_L":"1/3"},"L=4":{"a_L":"1","c_L":"1/3"}},"passed":true},"I1_split_integral":{"info":"split integral exceeds its bound at u=1/4 q=2","passed":false},"I2_exponent_ledger":{"info":{"count exponent":"5/3","inverse moment threshold":"-5/3","u^2 exponent of ell":"2/3"},"passed":true},"N1_near_consistency":{"info":{"6*sqrt(6 c_L) < 12 for c_L <= 1/3":true},"passed":true}},"object":"CL-FAR-ELDER-RATE-20260930-v1","passed":false,"scientific_effect":"NONE"},"M4":{"checks":{"B1_barrier_polynomial":{"info":{"K":"22","R":"1/11","grid_points_in_ball":1793,"lambda":"2"},"passed":true},"B2_algebra_and_constants":{"info":{"L=1":{"a_L":"1/4","c_L":"1/48"},"L=2":{"a_L":"1/2","c_L":"1/12"},"L=24":{"a_L":"1","c_L":"1/3"},"L=4":{"a_L":"1","c_L":"1/3"}},"passed":true},"I1_split_integral":{"info":{"q=2,u=1/100":"149/1000000","q=2,u=1/4":"5/64","q=2,u=1/9":"25/1458","q=4,u=1/100":"299999999/4000000000000","q=4,u=1/4":"767/16384","q=4,u=1/9":"9841/1062882"},"passed":true},"I2_exponent_ledger":{"info":"u^2 monomial wrong for q=2: (Fraction(2, 3), Fraction(2, 3))","passed":false},"N1_near_consistency":{"info":{"6*sqrt(6 c_L) < 12 for c_L <= 1/3":true},"passed":true}},"object":"CL-FAR-ELDER-RATE-20260930-v1","passed":false,"scientific_effect":"NONE"}},"script":"far_elder_check.py","script_git_blob":"58ff10f85cb89566433500855f385bc87f87e916"},"local-pairing":{"baseline_bytes":796,"baseline_sha256":"c012b374ac07c9d51dbab6e2168194b6b27afed6c8f489da5c376230044546b4","directory":"frontiers/local_pairing_20260930","mutants":{"M1":{"checks":{"I0_I3_identities":{"info":144,"passed":true},"N1_n0_grid":{"info":{"n0_points_with_U_hypothesis":0,"n0_typed_grid_points":135},"passed":true},"P1_path_cases":{"info":"chart sample not typed/n>=1 at (Fraction(1, 1), Fraction(-7, 5), Fraction(2109, 200), Fraction(-2, 1), Fraction(-2, 1))","passed":false},"P2_elder_witness":{"info":{"Z1_squared":"15/8","n":2,"saddle_height":"-7/32","u0":"-3/4","vertical_line_constant":true},"passed":true}},"object":"CL-LOCAL-PAIRING-20260930-v1","passed":false,"scientific_effect":"NONE"},"M2":{"checks":{"I0_I3_identities":{"info":144,"passed":true},"N1_n0_grid":{"info":{"n0_points_with_U_hypothesis":0,"n0_typed_grid_points":135},"passed":true},"P1_path_cases":{"info":"root not in the strict window","passed":false},"P2_elder_witness":{"info":{"Z1_squared":"15/8","n":2,"saddle_height":"-7/32","u0":"-3/4","vertical_line_constant":true},"passed":true}},"object":"CL-LOCAL-PAIRING-20260930-v1","passed":false,"scientific_effect":"NONE"},"M3":{"checks":{"I0_I3_identities":{"info":"I1 conic identity fails at u=-3/2 Z=-2","passed":false},"N1_n0_grid":{"info":{"n0_points_with_U_hypothesis":0,"n0_typed_grid_points":135},"passed":true},"P1_path_cases":{"info":{"cases":{"U":2160,"V":4680,"V_at_other_root":2160},"min_margin":"1/1200","samples":6840},"passed":true},"P2_elder_witness":{"info":{"Z1_squared":"15/8","n":2,"saddle_height":"-7/32","u0":"-3/4","vertical_line_constant":true},"passed":false}},"object":"CL-LOCAL-PAIRING-20260930-v1","passed":false,"scientific_effect":"NONE"},"M4":{"checks":{"I0_I3_identities":{"info":144,"passed":true},"N1_n0_grid":{"info":{"n0_points_with_U_hypothesis":1,"n0_typed_grid_points":135},"passed":false},"P1_path_cases":{"info":"nonpositive margin","passed":false},"P2_elder_witness":{"info":{"Z1_squared":"15/8","n":2,"saddle_height":"-7/32","u0":"-3/4","vertical_line_constant":true},"passed":true}},"object":"CL-LOCAL-PAIRING-20260930-v1","passed":false,"scientific_effect":"NONE"}},"script":"pairing_check.py","script_git_blob":"6a3aec4d4bfaca39d10cb95a2691a6894348c737"}},"provenance":"Native unchanged CLI outputs; independently characterized in Math-#322 comment6008323186. This file is an engineering reference, not mathematical acceptance.","schema":1,"source_cut":"b25cac0bcbb4032d624f14795257d9578c90d105"} diff --git a/tools/legacy_json_replay.py b/tools/legacy_json_replay.py new file mode 100644 index 000000000..7f10e0c54 --- /dev/null +++ b/tools/legacy_json_replay.py @@ -0,0 +1,176 @@ +#!/usr/bin/env python3 +"""Authenticate the three fixed legacy checkers' success and rejection reports. + +Called AFTER each workflow's unchanged scientific source/manifest guards. The +reference file holds measured, source-bound reports, never outputs learned from +the invocation being tested. Structural JSON comparison permits formatting only; +all keys, types, values, lists and intended information must still match exactly. +This is an engineering protocol, not a sandbox or mathematical acceptance test. +""" +from __future__ import annotations + +import argparse +import contextlib +import hashlib +import io +import json +from pathlib import Path +import re +import subprocess +import sys +from typing import Any + +INVENTORIES = { + 'local-pairing': ('M1', 'M2', 'M3', 'M4'), + 'far-elder': ('M1', 'M2', 'M3', 'M4'), + 'c6-cluster': ('pins-not-critical', 'wrong-pin-hessian', 'drop-sigma-jacobian', + 'three-extra-points', 'shear-drop-cubic', 's-bound-constant', + 'cross-term-not-small', 'window-closed', 'index-sign'), +} +# The CLI's argparse choice order is distinct from the workflow execution order. +C6_CHOICES = ('pins-not-critical', 'wrong-pin-hessian', 'drop-sigma-jacobian', + 'three-extra-points', 'cross-term-not-small', 'window-closed', + 'index-sign', 'shear-drop-cubic', 's-bound-constant') + + +class ProtocolError(RuntimeError): + """The supplied process is not the expected source-bound observation.""" + + +def _object(pairs: list[tuple[str, Any]]) -> dict[str, Any]: + result: dict[str, Any] = {} + for name, value in pairs: + if name in result: + raise ProtocolError('duplicate JSON key: ' + name) + result[name] = value + return result + + +def _not_integer(text: str) -> Any: + raise ProtocolError('floating/nonfinite JSON number is outside this contract: ' + text) + + +def strict_json(raw: bytes) -> Any: + if len(raw) > 256 * 1024: + raise ProtocolError('JSON output exceeds the fixed contract limit') + try: + return json.loads(raw.decode('utf-8'), object_pairs_hook=_object, + parse_float=_not_integer, parse_constant=_not_integer) + except (ValueError, UnicodeError, RecursionError) as exc: + raise ProtocolError('invalid single JSON report') from exc + + +def _same(actual: Any, expected: Any) -> bool: + # In particular Python's False == 0 is not accepted as JSON type equality. + if type(actual) is not type(expected): + return False + if type(expected) is dict: + return actual.keys() == expected.keys() and all( + _same(actual[key], value) for key, value in expected.items()) + if type(expected) is list: + return len(actual) == len(expected) and all( + _same(a, b) for a, b in zip(actual, expected)) + return actual == expected + + +def _contract(family: str) -> dict[str, Any]: + if family not in INVENTORIES: + raise ProtocolError('unknown checker family') + data = strict_json(Path(__file__).with_name('legacy_json_contracts.json').read_bytes()) + if (type(data) is not dict or type(data.get('schema')) is not int + or data['schema'] != 1 or type(data.get('families')) is not dict + or set(data['families']) != set(INVENTORIES)): + raise ProtocolError('invalid reference inventory') + entry = data['families'][family] + keys = {'directory', 'script', 'script_git_blob', 'baseline_sha256', + 'baseline_bytes', 'mutants'} + if type(entry) is not dict or set(entry) != keys: + raise ProtocolError('invalid family reference schema') + if (type(entry['mutants']) is not dict + or set(entry['mutants']) != set(INVENTORIES[family])): + raise ProtocolError('missing, extra, or repeated mutant reference') + if (type(entry['script']) is not str + or Path(entry['script']).name != entry['script'] + or type(entry['directory']) is not str + or type(entry['baseline_bytes']) is not int or entry['baseline_bytes'] < 0): + raise ProtocolError('invalid script or baseline metadata') + for key, size in [('script_git_blob', 40), ('baseline_sha256', 64)]: + if type(entry[key]) is not str or not re.fullmatch('[0-9a-f]{%d}' % size, entry[key]): + raise ProtocolError('invalid reference digest') + for report in entry['mutants'].values(): + if type(report) is not dict or report.get('passed') is not False: + raise ProtocolError('reference is not a rejection report') + return entry + + +def _unknown_stderr(family: str, script_name: str) -> bytes: + if family != 'c6-cluster': + return b'unknown mutant label\n' + # Reproduce only argparse's frozen grammar in the parent process. This does + # NOT execute or learn from the checker. Its version-specific usage wrapping + # matches the child because both use the exact same Python interpreter. + parser = argparse.ArgumentParser(prog=script_name) + parser.add_argument('--mutant', choices=C6_CHOICES) + stream = io.StringIO() + try: + with contextlib.redirect_stderr(stream): + parser.parse_args(['--mutant', 'unknown']) + except SystemExit as exc: + if exc.code != 2: + raise ProtocolError('reference argument grammar did not reject') from exc + else: + raise ProtocolError('reference argument grammar unexpectedly accepted') + return stream.getvalue().encode('utf-8') + + +def replay(family: str, root: Path, *, timeout: float = 600) -> list[dict[str, Any]]: + """Run the complete fixed inventory in both modes, or fail immediately. + + root is the already source-verified packet directory. Timeout/OSError is a + failed run, never an intended negative-control receipt. All child inputs stay + unchanged; no synthetic output, package rehash, or checker amendment occurs. + """ + entry = _contract(family) + root = Path(root).resolve() + script = root / entry['script'] + if script.is_symlink() or not script.is_file(): + raise ProtocolError('regular source checker required') + data = script.read_bytes() + if hashlib.sha1(b'blob %d\0' % len(data) + data).hexdigest() != entry['script_git_blob']: + raise ProtocolError('checker differs from the characterized source') + expected = (root / 'RESULTS.json').read_bytes() + if (len(expected) != entry['baseline_bytes'] + or hashlib.sha256(expected).hexdigest() != entry['baseline_sha256']): + raise ProtocolError('baseline differs from the characterized source') + unknown = 'unknown' if family == 'c6-cluster' else 'M9' + unknown_stderr = _unknown_stderr(family, script.name) + records: list[dict[str, Any]] = [] + for mode, flags in [('normal', ['-B', '-S']), ('optimized', ['-B', '-O', '-S'])]: + for label in [None, *INVENTORIES[family], unknown]: + command = [sys.executable, *flags, str(script)] + if label is not None: + command += ['--mutant', label] + child = subprocess.run(command, capture_output=True, timeout=timeout) + record = {'family': family, 'mode': mode, 'label': label, + 'returncode': child.returncode, + 'stdout_bytes': len(child.stdout), 'stderr_bytes': len(child.stderr), + 'stdout_sha256': hashlib.sha256(child.stdout).hexdigest(), + 'stderr_sha256': hashlib.sha256(child.stderr).hexdigest()} + if label is None: + ok = child.returncode == 0 and not child.stderr and child.stdout == expected + elif label == unknown: + ok = child.returncode == 2 and not child.stdout and child.stderr == unknown_stderr + else: + ok = child.returncode == 1 and not child.stderr + if ok: + try: + ok = _same(strict_json(child.stdout), entry['mutants'][label]) + except ProtocolError: + ok = False + record['protocol_ok'] = ok + print(json.dumps(record, sort_keys=True), flush=True) + if not ok: + raise ProtocolError('legacy protocol mismatch: %s/%s/%s' % + (family, mode, label or 'baseline')) + records.append(record) + return records