diff --git a/.github/workflows/evidence.yml b/.github/workflows/evidence.yml index 3668a2ef..7ed15204 100644 --- a/.github/workflows/evidence.yml +++ b/.github/workflows/evidence.yml @@ -33,6 +33,24 @@ jobs: - name: Build selected executable run: cargo build -p hugit-cli --release --locked + - name: Exercise current baseline deadline and automatic capture + timeout-minutes: 2 + run: | + set -euo pipefail + python3 scripts/acceptance/baseline_oracles.py --exercise --self-test \ + --hugit-bin "$GITHUB_WORKSPACE/target/release/hugit" \ + --subject "$(git rev-parse HEAD)" \ + | tee "$RUNNER_TEMP/hug003-runtime.json" + + - name: Retain current baseline observations even on refusal + if: always() + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + with: + name: hug003-runtime-${{ github.sha }} + path: ${{ runner.temp }}/hug003-runtime.json + if-no-files-found: error + retention-days: 90 + - name: Prove runner and verifier teeth run: | scripts/test-evidence-report.sh @@ -99,6 +117,26 @@ jobs: name: hugit-evidence-${{ github.sha }} path: ${{ runner.temp }}/download + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 + with: + name: hug003-runtime-${{ github.sha }} + path: ${{ runner.temp }}/runtime + + - name: Verify current baseline without executing its contents + run: | + set -euo pipefail + python3 scripts/acceptance/baseline_oracles.py \ + --runtime-report "$RUNNER_TEMP/runtime/hug003-runtime.json" \ + --subject "$(git rev-parse HEAD)" \ + | tee "$RUNNER_TEMP/runtime-verification.json" + python3 - "$RUNNER_TEMP/runtime/hug003-runtime.json" "$RUNNER_TEMP/download/hugit-evidence/data/hugit" <<'PYVERIFY' + import hashlib, json, pathlib, sys + report = json.loads(pathlib.Path(sys.argv[1]).read_text()) + binary = pathlib.Path(sys.argv[2]).read_bytes() + assert hashlib.sha256(binary).hexdigest() == report["binary"]["sha256"] + assert report["product_accepted"] is False + PYVERIFY + - name: Verify downloaded package run: | (cd "$RUNNER_TEMP/download" && sha256sum -c hugit-evidence.tar.sha256) diff --git a/.github/workflows/standalone-plan-validation.yml b/.github/workflows/standalone-plan-validation.yml index daeba56e..3f7622f8 100644 --- a/.github/workflows/standalone-plan-validation.yml +++ b/.github/workflows/standalone-plan-validation.yml @@ -51,6 +51,8 @@ jobs: docs/plan/standalone/v3/work-packages/HUG-013.md \ crates/hugit-queue/src/core/union.rs \ docs/plan/standalone/v3/work-packages/HUG-014.md \ + docs/plan/standalone/v3/work-packages/HUG-009.md \ + docs/plan/standalone/v3/work-packages/HUG-026.md \ | tar -x -C "$SOURCE" python3 scripts/acceptance/baseline_oracles.py \ --report docs/audit/baseline-results.json --root "$SOURCE" --self-test \ diff --git a/docs/audit/baseline-results.json b/docs/audit/baseline-results.json index 94f67534..a1a662a0 100644 --- a/docs/audit/baseline-results.json +++ b/docs/audit/baseline-results.json @@ -1 +1 @@ -{"binary_copy_unchanged":true,"binary_sha256":"52a7c3cb0fab99b0b4f208a32d7c26f6724bb58d06b9f02a5aaf340735023e59","binary_version":"hugit 0.1.7","commands":[{"exit":0,"label":"version","stdout":"hugit 0.1.7\n"},{"exit":0,"label":"git-init","stdout":"Initialized empty Git repository in $OWNED_TMP/real/repo/.git/\n"},{"exit":0,"label":"cache-0","stdout":"{\"already_recorded\":false,\"cache_hit\":false,\"cmd_ignored\":false,\"def\":\"oracle-cache\",\"duration_ms\":20,\"exit\":0,\"local_executions\":1,\"log\":\"$OWNED_TMP/real/events.json\",\"memo_key\":\"59fb2539c456fa6b9ec434662674b01412a6647cfc111580b0a1f427b208d772\",\"ok\":true,\"recorded_kind\":\"check.recorded\",\"saved_ms\":0,\"stored\":true}\n"},{"exit":0,"label":"cache-1","stdout":"{\"already_recorded\":false,\"cache_hit\":true,\"cmd_ignored\":false,\"def\":\"oracle-cache\",\"duration_ms\":0,\"exit\":0,\"local_executions\":0,\"log\":\"$OWNED_TMP/real/events.json\",\"memo_key\":\"59fb2539c456fa6b9ec434662674b01412a6647cfc111580b0a1f427b208d772\",\"ok\":true,\"recorded_kind\":\"check.recorded\",\"saved_ms\":20,\"stored\":true}\n"},{"exit":0,"label":"cache-2","stdout":"{\"already_recorded\":true,\"cache_hit\":true,\"cmd_ignored\":false,\"def\":\"oracle-cache\",\"duration_ms\":0,\"exit\":0,\"local_executions\":0,\"log\":\"$OWNED_TMP/real/events.json\",\"memo_key\":\"59fb2539c456fa6b9ec434662674b01412a6647cfc111580b0a1f427b208d772\",\"ok\":true,\"recorded_kind\":\"check.recorded\",\"saved_ms\":20,\"stored\":true}\n"},{"exit":0,"label":"cache-3","stdout":"{\"already_recorded\":true,\"cache_hit\":true,\"cmd_ignored\":false,\"def\":\"oracle-cache\",\"duration_ms\":0,\"exit\":0,\"local_executions\":0,\"log\":\"$OWNED_TMP/real/events.json\",\"memo_key\":\"59fb2539c456fa6b9ec434662674b01412a6647cfc111580b0a1f427b208d772\",\"ok\":true,\"recorded_kind\":\"check.recorded\",\"saved_ms\":20,\"stored\":true}\n"},{"exit":0,"label":"check-show","stdout":"{\"check_count\":2,\"checks\":[{\"axes\":{\"def_digest\":\"481b5a79eeeb7dd88b04e8ddb84ddca322e07ff4de887ec40d46aec3c4d33320\",\"toolchain_digest\":\"oracle-toolchain-v1\",\"tree_hash\":\"1121578561b728cc207d28e1dece5b815fda3784f65ebd4f0d107f9660148b1c\"},\"cache_hit\":false,\"cache_verdict\":\"MISS\",\"duration_ms\":20,\"memo_key\":\"59fb2539c456fa6b9ec434662674b01412a6647cfc111580b0a1f427b208d772\",\"memo_key_short\":\"59fb2539c456\",\"name\":\"oracle-cache\",\"ok\":true,\"pr_id\":null,\"proof\":null},{\"axes\":{\"def_digest\":\"481b5a79eeeb7dd88b04e8ddb84ddca322e07ff4de887ec40d46aec3c4d33320\",\"toolchain_digest\":\"oracle-toolchain-v1\",\"tree_hash\":\"1121578561b728cc207d28e1dece5b815fda3784f65ebd4f0d107f9660148b1c\"},\"cache_hit\":true,\"cache_verdict\":\"HIT\",\"duration_ms\":20,\"memo_key\":\"59fb2539c456fa6b9ec434662674b01412a6647cfc111580b0a1f427b208d772\",\"memo_key_short\":\"59fb2539c456\",\"name\":\"oracle-cache\",\"ok\":true,\"pr_id\":null,\"proof\":{\"recorded\":false,\"runner_ref\":null,\"stderr_ref\":null,\"stdout_ref\":null}}],\"kpis\":{\"executed\":1,\"hit_rate_pct\":50.0,\"hits\":1,\"saved_ms\":20},\"log\":\"$OWNED_TMP/real/events.json\",\"pr\":null,\"proof_refs_recorded\":false}\n"},{"exit":0,"label":"new-pr-binding","stdout":"{\"already_recorded\":true,\"cache_hit\":true,\"cmd_ignored\":false,\"def\":\"oracle-cache\",\"duration_ms\":0,\"exit\":0,\"local_executions\":0,\"log\":\"$OWNED_TMP/real/events.json\",\"memo_key\":\"59fb2539c456fa6b9ec434662674b01412a6647cfc111580b0a1f427b208d772\",\"ok\":true,\"recorded_kind\":\"check.recorded\",\"saved_ms\":20,\"stored\":true}\n"},{"exit":0,"label":"pr-check-show","stdout":"{\"check_count\":0,\"checks\":[],\"kpis\":{\"executed\":null,\"hit_rate_pct\":null,\"hits\":null,\"saved_ms\":null},\"log\":\"$OWNED_TMP/real/events.json\",\"note\":\"no check.recorded events on this log; the local executor (hugit_checks::run_memoized) returns its CheckOutcome in-process and no porcelain verb appends it yet — KPIs are null, not zero\",\"pr\":\"oracle-pr\",\"proof_refs_recorded\":false}\n"},{"argv":["$OWNED_TMP/hugit","check","run","--def","oracle-cache","--toolchain","oracle-toolchain-v1","--root","$OWNED_TMP/real/repo","--log","$OWNED_TMP/real/events.json","--ac","$OWNED_TMP/real/checks.ac","--store","--cmd","exit 7"],"exit":0,"label":"failed-check","stdout":"{\"already_recorded\":false,\"cache_hit\":false,\"cmd_ignored\":false,\"def\":\"oracle-cache\",\"duration_ms\":20,\"exit\":7,\"local_executions\":1,\"log\":\"$OWNED_TMP/real/events.json\",\"memo_key\":\"011394e1cb9932683998421a1ca731dc47e597977320c0065700d9c5466b369c\",\"ok\":false,\"recorded_kind\":\"check.recorded\",\"saved_ms\":0,\"stored\":true}\n"},{"exit":0,"label":"output-check","stdout":"{\"already_recorded\":false,\"cache_hit\":false,\"cmd_ignored\":false,\"def\":\"oracle-cache\",\"duration_ms\":20,\"exit\":0,\"local_executions\":1,\"log\":\"$OWNED_TMP/real/events.json\",\"memo_key\":\"4ff84fa3110bba90dc350ee1f55f4887b3c5c7a20e15060cc1a0dccc77e8701c\",\"ok\":true,\"recorded_kind\":\"check.recorded\",\"saved_ms\":0,\"stored\":true}\n"},{"exit":0,"label":"output-control","stderr":"ORACLE_STDERR\n","stdout":"ORACLE_STDOUT\n"},{"exit":0,"label":"campaign","stdout":"{\"already_exists\":false,\"campaign\":\"oracle\",\"charter\":\"Controlled baseline\",\"opened\":true,\"owner\":\"human:oracle\"}\n"},{"exit":0,"label":"oracle-goal-0","stdout":"{\"intent_id\":\"oracle-goal-0\",\"already_exists\":false,\"campaign\":\"oracle\",\"agent\":\"main\"}\n"},{"exit":0,"label":"oracle-goal-1","stdout":"{\"intent_id\":\"oracle-goal-1\",\"already_exists\":false,\"campaign\":\"oracle\",\"agent\":\"main\"}\n"},{"exit":0,"label":"oracle-goal-2","stdout":"{\"intent_id\":\"oracle-goal-2\",\"already_exists\":false,\"campaign\":\"oracle\",\"agent\":\"main\"}\n"},{"exit":0,"label":"oracle-goal-3","stdout":"{\"intent_id\":\"oracle-goal-3\",\"already_exists\":false,\"campaign\":\"oracle\",\"agent\":\"main\"}\n"},{"exit":0,"label":"ledger","stdout":"{\"campaigns\":[{\"asked\":4,\"campaign\":\"oracle\",\"done\":4,\"proven\":0,\"rejected\":0}],\"entries\":[{\"campaign\":\"oracle\",\"charter\":\"Controlled goal 0\",\"deep_link_target\":\"oracle-goal-0\",\"intent_id\":\"oracle-goal-0\",\"proven\":false,\"recorded_at\":1789694464882,\"rejected\":false,\"seq\":1,\"verdict\":null},{\"campaign\":\"oracle\",\"charter\":\"Controlled goal 1\",\"deep_link_target\":\"oracle-goal-1\",\"intent_id\":\"oracle-goal-1\",\"proven\":false,\"recorded_at\":1789694464884,\"rejected\":false,\"seq\":2,\"verdict\":null},{\"campaign\":\"oracle\",\"charter\":\"Controlled goal 2\",\"deep_link_target\":\"oracle-goal-2\",\"intent_id\":\"oracle-goal-2\",\"proven\":false,\"recorded_at\":1789694464887,\"rejected\":false,\"seq\":3,\"verdict\":null},{\"campaign\":\"oracle\",\"charter\":\"Controlled goal 3\",\"deep_link_target\":\"oracle-goal-3\",\"intent_id\":\"oracle-goal-3\",\"proven\":false,\"recorded_at\":1789694464890,\"rejected\":false,\"seq\":4,\"verdict\":null}]}\n"}],"counts":{"limit_justified":1,"regression_reproduced":5,"satisfied":0,"static_defect_observed":1},"finding_registry":{"F01":{"correction_packages":["HUG-012","HUG-013"],"disposition":"static_limit_justified_checker_published"},"F02":{"correction_packages":["HUG-014","HUG-043"],"disposition":"static_defect_observed_checker_published"},"F03":{"correction_packages":["HUG-011"],"disposition":"runtime_observed_locally_checker_published"},"F04":{"correction_packages":["HUG-011","HUG-027"],"disposition":"runtime_observed_locally_checker_published"},"F05":{"correction_packages":["HUG-009","HUG-026"],"disposition":"pending_followup_in_HUG003"},"F06":{"correction_packages":["HUG-010"],"disposition":"runtime_observed_locally_checker_published"},"F07":{"correction_packages":["HUG-015","HUG-020","HUG-028"],"disposition":"pending_followup_in_HUG003"},"F08":{"correction_packages":["HUG-020","HUG-039"],"disposition":"pending_followup_in_HUG003"},"F09":{"correction_packages":["HUG-015","HUG-022","HUG-036"],"disposition":"runtime_observed_locally_checker_published"},"F10":{"correction_packages":["HUG-017","HUG-026","HUG-029","HUG-032"],"disposition":"runtime_observed_locally_checker_published"},"F11":{"correction_packages":["HUG-008"],"disposition":"pending_followup_in_HUG003"},"F12":{"correction_packages":["HUG-016","HUG-019","HUG-035","HUG-048"],"disposition":"pending_followup_in_HUG003"},"F13":{"correction_packages":["HUG-004"],"disposition":"pending_followup_in_HUG003"},"F14":{"correction_packages":["HUG-005","HUG-049"],"disposition":"pending_followup_in_HUG003"},"F15":{"correction_packages":["HUG-005","HUG-052","HUG-053"],"disposition":"pending_followup_in_HUG003"},"F16":{"correction_packages":["HUG-019","HUG-026"],"disposition":"pending_followup_in_HUG003"},"F17":{"correction_packages":["HUG-007","HUG-039","HUG-052"],"disposition":"pending_followup_in_HUG003"},"F18":{"correction_packages":["HUG-004","HUG-037","HUG-046"],"disposition":"pending_followup_in_HUG003"},"F19":{"correction_packages":["HUG-006","HUG-049","HUG-052"],"disposition":"pending_followup_in_HUG003"}},"findings":{"F03":{"expected":{"check_count":4,"hit_rate_pct":75.0,"hits":3},"observed":{"check_count":2,"hit_rate_pct":50.0,"hits":1},"outcome":"regression_reproduced"},"F04":{"expected":{"minimum_bound_checks":1},"observed":{"already_recorded":true,"check_count":0},"outcome":"regression_reproduced"},"F06":{"expected":{"shell_gate_nonzero":true},"observed":{"payload_exit":7,"payload_ok":false,"process_exit":0},"outcome":"regression_reproduced"},"F09":{"expected":{"asked":4,"done":0,"proven":0},"observed":{"asked":4,"done":4,"proven":0},"outcome":"regression_reproduced"},"F10":{"expected":{"resolvable_nonempty_refs":true,"stderr_bytes":"ORACLE_STDERR\n","stdout_bytes":"ORACLE_STDOUT\n"},"observed":{"artifacts":[],"stderr_ref":"","stdout_ref":""},"outcome":"regression_reproduced"}},"origin":{"artifact_digest_checked":true,"artifact_id":10527034046,"artifact_sha256":"e5adc5d4cf61eae34deb8f44eb9fc2bd42c522e46ed4128c4bb9f9921db29f99","binary_metadata":{"retained_path":"data/hugit","schema_version":"1.0","selected_path":"/home/runner/work/hugit/hugit/target/release/hugit","sha256":"52a7c3cb0fab99b0b4f208a32d7c26f6724bb58d06b9f02a5aaf340735023e59","source_provenance":"unbound-selected-executable","version_stdout":"hugit 0.1.7"},"causal_scope":"Associated to the workflow head by GitHub metadata. The retained package itself labels source-to-binary binding not_established; no stronger reproducible-build attestation is claimed.","execution_environment":"Linux conversation container; selected artifact binary, not a local Rust rebuild","source_metadata":{"discontinued_runner_boundary":"legacy pr land --dispatch remains source-reachable and was intentionally unexecuted","fixture":"synthetic-local-git","ledger_baseline":"6f9bbfa","network":"no_network_action_configured; absence_not_instrumented","schema_version":"1.0","source_to_binary_binding":"not_established"},"workflow_head_sha":"10a3c8b3cdd780554d78db750975f8e5a2b253b0","workflow_run_id":35293673383},"owned_fixture_removed":true,"persisted_files":{"checks.ac":"{\n \"011394e1cb9932683998421a1ca731dc47e597977320c0065700d9c5466b369c\": {\n \"result\": {\n \"memo_key\": \"011394e1cb9932683998421a1ca731dc47e597977320c0065700d9c5466b369c\",\n \"tree_hash\": \"1121578561b728cc207d28e1dece5b815fda3784f65ebd4f0d107f9660148b1c\",\n \"def_digest\": \"198b2bc22d0dd24eb7dba58ce0b3b41df70882bdcc6f6609d13267bcef9ef81c\",\n \"toolchain_digest\": \"oracle-toolchain-v1\",\n \"exit\": 7,\n \"artifacts\": [],\n \"stdout_ref\": \"\",\n \"stderr_ref\": \"\",\n \"duration_ms\": 20,\n \"runner_ref\": \"local\",\n \"produced_at\": 1789694464853\n },\n \"self_hash\": \"57bff3e84a2086f6fb3c6564a0f3589f8bed9cf4b508986266c25d08e4e5dcb9\"\n },\n \"4ff84fa3110bba90dc350ee1f55f4887b3c5c7a20e15060cc1a0dccc77e8701c\": {\n \"result\": {\n \"memo_key\": \"4ff84fa3110bba90dc350ee1f55f4887b3c5c7a20e15060cc1a0dccc77e8701c\",\n \"tree_hash\": \"1121578561b728cc207d28e1dece5b815fda3784f65ebd4f0d107f9660148b1c\",\n \"def_digest\": \"a12870dea0767c45962237bc2f97d5d5877b9977494d37409547ac20d639357f\",\n \"toolchain_digest\": \"oracle-toolchain-v1\",\n \"exit\": 0,\n \"artifacts\": [],\n \"stdout_ref\": \"\",\n \"stderr_ref\": \"\",\n \"duration_ms\": 20,\n \"runner_ref\": \"local\",\n \"produced_at\": 1789694464876\n },\n \"self_hash\": \"5f5468bcb2eaade0a6e2d1c2bcf377075adc9c9293798e45dc5373644a286c71\"\n },\n \"59fb2539c456fa6b9ec434662674b01412a6647cfc111580b0a1f427b208d772\": {\n \"result\": {\n \"memo_key\": \"59fb2539c456fa6b9ec434662674b01412a6647cfc111580b0a1f427b208d772\",\n \"tree_hash\": \"1121578561b728cc207d28e1dece5b815fda3784f65ebd4f0d107f9660148b1c\",\n \"def_digest\": \"481b5a79eeeb7dd88b04e8ddb84ddca322e07ff4de887ec40d46aec3c4d33320\",\n \"toolchain_digest\": \"oracle-toolchain-v1\",\n \"exit\": 0,\n \"artifacts\": [],\n \"stdout_ref\": \"\",\n \"stderr_ref\": \"\",\n \"duration_ms\": 20,\n \"runner_ref\": \"local\",\n \"produced_at\": 1789694464821\n },\n \"self_hash\": \"519939ca166b76f1ba662bf28f1e8d53371173bb27244e23fd6e6be33e800559\"\n }\n}","events.json":"[\n {\n \"seq\": 0,\n \"prev_hash\": \"0000000000000000000000000000000000000000000000000000000000000000\",\n \"this_hash\": \"1848511cddfbc9d1a9c7fd12992b07971c7297f362b1cb5ae3c525febbe39b41\",\n \"kind\": \"check.recorded\",\n \"principal_chain\": [\n \"orchestrator:hugit\"\n ],\n \"payload\": \"{\\\"cache_hit\\\":false,\\\"def_digest\\\":\\\"481b5a79eeeb7dd88b04e8ddb84ddca322e07ff4de887ec40d46aec3c4d33320\\\",\\\"duration_ms\\\":20,\\\"exit\\\":0,\\\"memo_key\\\":\\\"59fb2539c456fa6b9ec434662674b01412a6647cfc111580b0a1f427b208d772\\\",\\\"name\\\":\\\"oracle-cache\\\",\\\"toolchain_digest\\\":\\\"oracle-toolchain-v1\\\",\\\"tree_hash\\\":\\\"1121578561b728cc207d28e1dece5b815fda3784f65ebd4f0d107f9660148b1c\\\"}\",\n \"recorded_at\": 1789694464821\n },\n {\n \"seq\": 1,\n \"prev_hash\": \"1848511cddfbc9d1a9c7fd12992b07971c7297f362b1cb5ae3c525febbe39b41\",\n \"this_hash\": \"7e64951626f50ed7a77e27238e9d52f28187f93267a1094155751884ff7b8522\",\n \"kind\": \"check.recorded\",\n \"principal_chain\": [\n \"orchestrator:hugit\"\n ],\n \"payload\": \"{\\\"cache_hit\\\":true,\\\"def_digest\\\":\\\"481b5a79eeeb7dd88b04e8ddb84ddca322e07ff4de887ec40d46aec3c4d33320\\\",\\\"duration_ms\\\":20,\\\"exit\\\":0,\\\"memo_key\\\":\\\"59fb2539c456fa6b9ec434662674b01412a6647cfc111580b0a1f427b208d772\\\",\\\"name\\\":\\\"oracle-cache\\\",\\\"toolchain_digest\\\":\\\"oracle-toolchain-v1\\\",\\\"tree_hash\\\":\\\"1121578561b728cc207d28e1dece5b815fda3784f65ebd4f0d107f9660148b1c\\\"}\",\n \"recorded_at\": 1789694464823\n },\n {\n \"seq\": 2,\n \"prev_hash\": \"7e64951626f50ed7a77e27238e9d52f28187f93267a1094155751884ff7b8522\",\n \"this_hash\": \"7f4aafcae35f5b6e98c5bbb13df1f09184891d4b0b93076130d795add816a163\",\n \"kind\": \"check.recorded\",\n \"principal_chain\": [\n \"orchestrator:hugit\"\n ],\n \"payload\": \"{\\\"cache_hit\\\":false,\\\"def_digest\\\":\\\"198b2bc22d0dd24eb7dba58ce0b3b41df70882bdcc6f6609d13267bcef9ef81c\\\",\\\"duration_ms\\\":20,\\\"exit\\\":7,\\\"memo_key\\\":\\\"011394e1cb9932683998421a1ca731dc47e597977320c0065700d9c5466b369c\\\",\\\"name\\\":\\\"oracle-cache\\\",\\\"toolchain_digest\\\":\\\"oracle-toolchain-v1\\\",\\\"tree_hash\\\":\\\"1121578561b728cc207d28e1dece5b815fda3784f65ebd4f0d107f9660148b1c\\\"}\",\n \"recorded_at\": 1789694464853\n },\n {\n \"seq\": 3,\n \"prev_hash\": \"7f4aafcae35f5b6e98c5bbb13df1f09184891d4b0b93076130d795add816a163\",\n \"this_hash\": \"a41ec988011e446b9d1233b3a3e08c857dee0b182ac1a5bdf8755969930b5f36\",\n \"kind\": \"check.recorded\",\n \"principal_chain\": [\n \"orchestrator:hugit\"\n ],\n \"payload\": \"{\\\"cache_hit\\\":false,\\\"def_digest\\\":\\\"a12870dea0767c45962237bc2f97d5d5877b9977494d37409547ac20d639357f\\\",\\\"duration_ms\\\":20,\\\"exit\\\":0,\\\"memo_key\\\":\\\"4ff84fa3110bba90dc350ee1f55f4887b3c5c7a20e15060cc1a0dccc77e8701c\\\",\\\"name\\\":\\\"oracle-cache\\\",\\\"toolchain_digest\\\":\\\"oracle-toolchain-v1\\\",\\\"tree_hash\\\":\\\"1121578561b728cc207d28e1dece5b815fda3784f65ebd4f0d107f9660148b1c\\\"}\",\n \"recorded_at\": 1789694464876\n }\n]","goals.json":"[\n {\n \"seq\": 0,\n \"prev_hash\": \"0000000000000000000000000000000000000000000000000000000000000000\",\n \"this_hash\": \"d9d1f4822b920b3e5b634280fd6a56c10dea48e05e1d07f27fa80805d1dabe4d\",\n \"kind\": \"campaign.opened\",\n \"principal_chain\": [\n \"user:human:oracle\"\n ],\n \"payload\": \"{\\\"campaign\\\":\\\"oracle\\\",\\\"charter\\\":\\\"Controlled baseline\\\",\\\"owner\\\":\\\"human:oracle\\\"}\",\n \"recorded_at\": 0\n },\n {\n \"seq\": 1,\n \"prev_hash\": \"d9d1f4822b920b3e5b634280fd6a56c10dea48e05e1d07f27fa80805d1dabe4d\",\n \"this_hash\": \"0aef97901eb517cd9c2123348a4a0e5fc9b59497797f7ee7e93d1c00f1d85199\",\n \"kind\": \"intent.landed\",\n \"principal_chain\": [\n \"campaign:oracle\",\n \"agent:main\"\n ],\n \"payload\": \"{\\\"campaign\\\":\\\"oracle\\\",\\\"charter\\\":\\\"Controlled goal 0\\\",\\\"intent_id\\\":\\\"oracle-goal-0\\\",\\\"ref\\\":\\\"refs/hugit/intents\\\",\\\"target\\\":\\\"authored:oracle-goal-0\\\"}\",\n \"recorded_at\": 1789694464882\n },\n {\n \"seq\": 2,\n \"prev_hash\": \"0aef97901eb517cd9c2123348a4a0e5fc9b59497797f7ee7e93d1c00f1d85199\",\n \"this_hash\": \"4c9dcf462acbaaa3476ad6e432a3f51a03c0902d2e499b7e5aa7d2705bbd0c4b\",\n \"kind\": \"intent.landed\",\n \"principal_chain\": [\n \"campaign:oracle\",\n \"agent:main\"\n ],\n \"payload\": \"{\\\"campaign\\\":\\\"oracle\\\",\\\"charter\\\":\\\"Controlled goal 1\\\",\\\"intent_id\\\":\\\"oracle-goal-1\\\",\\\"ref\\\":\\\"refs/hugit/intents\\\",\\\"target\\\":\\\"authored:oracle-goal-1\\\"}\",\n \"recorded_at\": 1789694464884\n },\n {\n \"seq\": 3,\n \"prev_hash\": \"4c9dcf462acbaaa3476ad6e432a3f51a03c0902d2e499b7e5aa7d2705bbd0c4b\",\n \"this_hash\": \"9e1663372d8a6b5147972fa939f49d56403fb553b63f0047a2c9cf2306852273\",\n \"kind\": \"intent.landed\",\n \"principal_chain\": [\n \"campaign:oracle\",\n \"agent:main\"\n ],\n \"payload\": \"{\\\"campaign\\\":\\\"oracle\\\",\\\"charter\\\":\\\"Controlled goal 2\\\",\\\"intent_id\\\":\\\"oracle-goal-2\\\",\\\"ref\\\":\\\"refs/hugit/intents\\\",\\\"target\\\":\\\"authored:oracle-goal-2\\\"}\",\n \"recorded_at\": 1789694464887\n },\n {\n \"seq\": 4,\n \"prev_hash\": \"9e1663372d8a6b5147972fa939f49d56403fb553b63f0047a2c9cf2306852273\",\n \"this_hash\": \"4aba44be58f739dc56379f04e5f6b63e6fc5f38874e7cfc67e5ed8b11fc275a7\",\n \"kind\": \"intent.landed\",\n \"principal_chain\": [\n \"campaign:oracle\",\n \"agent:main\"\n ],\n \"payload\": \"{\\\"campaign\\\":\\\"oracle\\\",\\\"charter\\\":\\\"Controlled goal 3\\\",\\\"intent_id\\\":\\\"oracle-goal-3\\\",\\\"ref\\\":\\\"refs/hugit/intents\\\",\\\"target\\\":\\\"authored:oracle-goal-3\\\"}\",\n \"recorded_at\": 1789694464890\n }\n]","repo/.git/oracle-marker":"executed\n","repo/.git/oracle-output-marker":"executed\n"},"product_accepted":false,"publication":{"executor_sha256":"7b2d308ab65fa87fa849c77a0f5b48ec2201134afb42f7ae439ced0471c2d6cc","executor_uploaded":false,"executor_write":"Blocked before reaching GitHub; not retried through another transport.","goal_source_discovered":false,"limitations":["Read-only checker verifies consistency, not authenticity or hash-chain validity.","PR ID is a caller-supplied identifier accepted by check run, not a separately created PR lifecycle.","Observed goal creation uses the declaration API, not the missing automatic hook.","Selected executable has workflow association but its source-to-binary attestation is not established."],"projection":"This file retains full stdout, exit status and selected state files. Complete argv, stderr, timings and controls remain in the external raw report.","published_checker":"Read-only reconstruction of observations from recorded stdout and persisted state. Does not launch the process suite.","raw_report_sha256":"1de27d478eadcb8bd1380d2165dde0f324370a5e0cbae744fc767c30eff7d23e","remaining":["Qualify twelve pending findings with scenarios or justified source inspections and limits.","Add positive automatic Git commit-capture and partial-tamper refusal on the same corpus.","Complete per-assertion acceptance and recovery of the full suite; do not close from this second slice."],"tracking_issue":382},"review":"same_executor","schema_version":1,"scope":"HUG-003 first runtime slice","static_findings":{"F01":{"classification":"limit_justified","correction_packages":["HUG-012","HUG-013"],"evidence":[{"path":"crates/hugit-cli/src/checks/run.rs","requires":["captured_hermetic_env","run_memoized","ad-hoc check"],"sha256":"09e444a498b63e80036df960e08b655a8f1c9fd9b755f9ccaad11959d5560979"},{"path":"docs/review/round13/wedge-decider.md","requires":["finally DRY","OUTSIDE","memoized-CI"],"sha256":"cf4f525fc3c4855e6b41b8b9fa2945a45b7aa9369555d666f3801086896a3659"},{"path":"docs/plan/standalone/v3/work-packages/HUG-012.md","requires":["falso verde F01","Worktree mutável não autoriza skip automático","shell é reexecutado ou reuso negado"],"sha256":"a379962763b1b24e4e8586d11403ad2a48ba28f76e5c8495af278c202350bf9c"},{"path":"docs/plan/standalone/v3/work-packages/HUG-013.md","requires":["shell tests, rede, relógio, randomness e bancos fora do allowlist","Native cache validity pertence ao motor qualificado"],"sha256":"07c143e579dae2fd77c5d646194e3958af2fc0eb431a7e381b468cd567e2725e"}],"evidence_scope":"historical_source_snapshot_not_current_product_acceptance","expected":"Worktree mutável não autoriza skip automático; shell arbitrário deve reexecutar ou ter reuso negado quando seus inputs não são provadamente completos.","limits":["Esta disposição satisfaz HUG-003 como inspeção/limitação; não fecha HUG-012/HUG-013.","Rounds históricos não são nova execução do produto atual.","Bounded-local hardening não transforma shell arbitrário em ação hermética e reutilizável."],"observed":{"current_boundary":"O caminho check continua executando shell em worktree mutável e o plano v3 não considera shell arbitrário um perfil seguro de reuso. HUG-012 exige bypass/reexecução e snapshot explícito; HUG-013 permite apenas outline puro e caches nativos qualificados.","historical_repro":"Rounds 8/11 demonstraram stale-green para inputs não capturados; rounds 9–13 endureceram cwd, env declarado, mode bits e configurações/toolchain bounded-local.","product_fix_claimed":false},"outcome":"limit_justified","source_commit":"ce2fcf1b8243eea2bd1be5aff25dfb3f6571ead4"},"F02":{"classification":"static_defect_observed","correction_packages":["HUG-014","HUG-043"],"evidence":[{"path":"crates/hugit-queue/src/core/union.rs","requires":["let (locus, extra_exec) = bisect_failure(&ids, oracle);","let proceeding: Vec = ids","pub fn outcomes_for_landing","UnionOutcome::Green","return (FailureLocus::SingleItem(ids[i].to_string()), executed);"],"sha256":"b074891b80002c1eeb2ce91e0446e4b92767b40d8c8d09214516a02115ca9e99"},{"path":"docs/plan/standalone/v3/work-packages/HUG-014.md","requires":["Após exclusão de locus, avaliar candidato restante inteiro","A+B e C+D conflitantes não liberam C+D","Remover culpado não prova resto verde."],"sha256":"dcadd6213e4b4f1ff4a327a30c7681faaf98b90736f1a2dee57e129d6238b4c5"}],"evidence_scope":"source_inspection_with_analytic_counterexample_not_runtime_execution","expected":"Diagnosing and excluding one failing locus does not authorize the remainder; evaluate the exact final candidate before returning Green.","limits":["This is a source inspection, not a new runtime reproduction.","No real Git branch promotion was attempted or claimed.","HUG-014/HUG-043 remain responsible for correcting and qualifying promotion behavior."],"observed":{"analytic_counterexample":{"batch":["A","B","C","D"],"conclusion":"The returned remainder remains failing even though it is mapped to Green.","failing_pairs":[["A","B"],["C","D"]],"first_pair_found":["A","B"],"kind":"reasoned_counterexample_not_executed_trace","singletons":"all green","unchecked_remainder":["C","D"]},"product_fix_claimed":false,"source_inspection":"bisect_failure returns the first failing singleton or pair; evaluate_union filters the remaining ids without evaluating that whole set; outcomes_for_landing maps non-excluded ids to Green."},"outcome":"static_defect_observed","source_commit":"ce2fcf1b8243eea2bd1be5aff25dfb3f6571ead4"}},"status":"characterized","subject_claim":"10a3c8b3cdd780554d78db750975f8e5a2b253b0","whole_wp_ready":false} +{"binary_copy_unchanged":true,"binary_sha256":"52a7c3cb0fab99b0b4f208a32d7c26f6724bb58d06b9f02a5aaf340735023e59","binary_version":"hugit 0.1.7","commands":[{"exit":0,"label":"version","stdout":"hugit 0.1.7\n"},{"exit":0,"label":"git-init","stdout":"Initialized empty Git repository in $OWNED_TMP/real/repo/.git/\n"},{"exit":0,"label":"cache-0","stdout":"{\"already_recorded\":false,\"cache_hit\":false,\"cmd_ignored\":false,\"def\":\"oracle-cache\",\"duration_ms\":20,\"exit\":0,\"local_executions\":1,\"log\":\"$OWNED_TMP/real/events.json\",\"memo_key\":\"59fb2539c456fa6b9ec434662674b01412a6647cfc111580b0a1f427b208d772\",\"ok\":true,\"recorded_kind\":\"check.recorded\",\"saved_ms\":0,\"stored\":true}\n"},{"exit":0,"label":"cache-1","stdout":"{\"already_recorded\":false,\"cache_hit\":true,\"cmd_ignored\":false,\"def\":\"oracle-cache\",\"duration_ms\":0,\"exit\":0,\"local_executions\":0,\"log\":\"$OWNED_TMP/real/events.json\",\"memo_key\":\"59fb2539c456fa6b9ec434662674b01412a6647cfc111580b0a1f427b208d772\",\"ok\":true,\"recorded_kind\":\"check.recorded\",\"saved_ms\":20,\"stored\":true}\n"},{"exit":0,"label":"cache-2","stdout":"{\"already_recorded\":true,\"cache_hit\":true,\"cmd_ignored\":false,\"def\":\"oracle-cache\",\"duration_ms\":0,\"exit\":0,\"local_executions\":0,\"log\":\"$OWNED_TMP/real/events.json\",\"memo_key\":\"59fb2539c456fa6b9ec434662674b01412a6647cfc111580b0a1f427b208d772\",\"ok\":true,\"recorded_kind\":\"check.recorded\",\"saved_ms\":20,\"stored\":true}\n"},{"exit":0,"label":"cache-3","stdout":"{\"already_recorded\":true,\"cache_hit\":true,\"cmd_ignored\":false,\"def\":\"oracle-cache\",\"duration_ms\":0,\"exit\":0,\"local_executions\":0,\"log\":\"$OWNED_TMP/real/events.json\",\"memo_key\":\"59fb2539c456fa6b9ec434662674b01412a6647cfc111580b0a1f427b208d772\",\"ok\":true,\"recorded_kind\":\"check.recorded\",\"saved_ms\":20,\"stored\":true}\n"},{"exit":0,"label":"check-show","stdout":"{\"check_count\":2,\"checks\":[{\"axes\":{\"def_digest\":\"481b5a79eeeb7dd88b04e8ddb84ddca322e07ff4de887ec40d46aec3c4d33320\",\"toolchain_digest\":\"oracle-toolchain-v1\",\"tree_hash\":\"1121578561b728cc207d28e1dece5b815fda3784f65ebd4f0d107f9660148b1c\"},\"cache_hit\":false,\"cache_verdict\":\"MISS\",\"duration_ms\":20,\"memo_key\":\"59fb2539c456fa6b9ec434662674b01412a6647cfc111580b0a1f427b208d772\",\"memo_key_short\":\"59fb2539c456\",\"name\":\"oracle-cache\",\"ok\":true,\"pr_id\":null,\"proof\":null},{\"axes\":{\"def_digest\":\"481b5a79eeeb7dd88b04e8ddb84ddca322e07ff4de887ec40d46aec3c4d33320\",\"toolchain_digest\":\"oracle-toolchain-v1\",\"tree_hash\":\"1121578561b728cc207d28e1dece5b815fda3784f65ebd4f0d107f9660148b1c\"},\"cache_hit\":true,\"cache_verdict\":\"HIT\",\"duration_ms\":20,\"memo_key\":\"59fb2539c456fa6b9ec434662674b01412a6647cfc111580b0a1f427b208d772\",\"memo_key_short\":\"59fb2539c456\",\"name\":\"oracle-cache\",\"ok\":true,\"pr_id\":null,\"proof\":{\"recorded\":false,\"runner_ref\":null,\"stderr_ref\":null,\"stdout_ref\":null}}],\"kpis\":{\"executed\":1,\"hit_rate_pct\":50.0,\"hits\":1,\"saved_ms\":20},\"log\":\"$OWNED_TMP/real/events.json\",\"pr\":null,\"proof_refs_recorded\":false}\n"},{"exit":0,"label":"new-pr-binding","stdout":"{\"already_recorded\":true,\"cache_hit\":true,\"cmd_ignored\":false,\"def\":\"oracle-cache\",\"duration_ms\":0,\"exit\":0,\"local_executions\":0,\"log\":\"$OWNED_TMP/real/events.json\",\"memo_key\":\"59fb2539c456fa6b9ec434662674b01412a6647cfc111580b0a1f427b208d772\",\"ok\":true,\"recorded_kind\":\"check.recorded\",\"saved_ms\":20,\"stored\":true}\n"},{"exit":0,"label":"pr-check-show","stdout":"{\"check_count\":0,\"checks\":[],\"kpis\":{\"executed\":null,\"hit_rate_pct\":null,\"hits\":null,\"saved_ms\":null},\"log\":\"$OWNED_TMP/real/events.json\",\"note\":\"no check.recorded events on this log; the local executor (hugit_checks::run_memoized) returns its CheckOutcome in-process and no porcelain verb appends it yet — KPIs are null, not zero\",\"pr\":\"oracle-pr\",\"proof_refs_recorded\":false}\n"},{"argv":["$OWNED_TMP/hugit","check","run","--def","oracle-cache","--toolchain","oracle-toolchain-v1","--root","$OWNED_TMP/real/repo","--log","$OWNED_TMP/real/events.json","--ac","$OWNED_TMP/real/checks.ac","--store","--cmd","exit 7"],"exit":0,"label":"failed-check","stdout":"{\"already_recorded\":false,\"cache_hit\":false,\"cmd_ignored\":false,\"def\":\"oracle-cache\",\"duration_ms\":20,\"exit\":7,\"local_executions\":1,\"log\":\"$OWNED_TMP/real/events.json\",\"memo_key\":\"011394e1cb9932683998421a1ca731dc47e597977320c0065700d9c5466b369c\",\"ok\":false,\"recorded_kind\":\"check.recorded\",\"saved_ms\":0,\"stored\":true}\n"},{"exit":0,"label":"output-check","stdout":"{\"already_recorded\":false,\"cache_hit\":false,\"cmd_ignored\":false,\"def\":\"oracle-cache\",\"duration_ms\":20,\"exit\":0,\"local_executions\":1,\"log\":\"$OWNED_TMP/real/events.json\",\"memo_key\":\"4ff84fa3110bba90dc350ee1f55f4887b3c5c7a20e15060cc1a0dccc77e8701c\",\"ok\":true,\"recorded_kind\":\"check.recorded\",\"saved_ms\":0,\"stored\":true}\n"},{"exit":0,"label":"output-control","stderr":"ORACLE_STDERR\n","stdout":"ORACLE_STDOUT\n"},{"exit":0,"label":"campaign","stdout":"{\"already_exists\":false,\"campaign\":\"oracle\",\"charter\":\"Controlled baseline\",\"opened\":true,\"owner\":\"human:oracle\"}\n"},{"exit":0,"label":"oracle-goal-0","stdout":"{\"intent_id\":\"oracle-goal-0\",\"already_exists\":false,\"campaign\":\"oracle\",\"agent\":\"main\"}\n"},{"exit":0,"label":"oracle-goal-1","stdout":"{\"intent_id\":\"oracle-goal-1\",\"already_exists\":false,\"campaign\":\"oracle\",\"agent\":\"main\"}\n"},{"exit":0,"label":"oracle-goal-2","stdout":"{\"intent_id\":\"oracle-goal-2\",\"already_exists\":false,\"campaign\":\"oracle\",\"agent\":\"main\"}\n"},{"exit":0,"label":"oracle-goal-3","stdout":"{\"intent_id\":\"oracle-goal-3\",\"already_exists\":false,\"campaign\":\"oracle\",\"agent\":\"main\"}\n"},{"exit":0,"label":"ledger","stdout":"{\"campaigns\":[{\"asked\":4,\"campaign\":\"oracle\",\"done\":4,\"proven\":0,\"rejected\":0}],\"entries\":[{\"campaign\":\"oracle\",\"charter\":\"Controlled goal 0\",\"deep_link_target\":\"oracle-goal-0\",\"intent_id\":\"oracle-goal-0\",\"proven\":false,\"recorded_at\":1789694464882,\"rejected\":false,\"seq\":1,\"verdict\":null},{\"campaign\":\"oracle\",\"charter\":\"Controlled goal 1\",\"deep_link_target\":\"oracle-goal-1\",\"intent_id\":\"oracle-goal-1\",\"proven\":false,\"recorded_at\":1789694464884,\"rejected\":false,\"seq\":2,\"verdict\":null},{\"campaign\":\"oracle\",\"charter\":\"Controlled goal 2\",\"deep_link_target\":\"oracle-goal-2\",\"intent_id\":\"oracle-goal-2\",\"proven\":false,\"recorded_at\":1789694464887,\"rejected\":false,\"seq\":3,\"verdict\":null},{\"campaign\":\"oracle\",\"charter\":\"Controlled goal 3\",\"deep_link_target\":\"oracle-goal-3\",\"intent_id\":\"oracle-goal-3\",\"proven\":false,\"recorded_at\":1789694464890,\"rejected\":false,\"seq\":4,\"verdict\":null}]}\n"}],"counts":{"limit_justified":1,"regression_reproduced":5,"satisfied":0,"static_defect_observed":2},"finding_registry":{"F01":{"correction_packages":["HUG-012","HUG-013"],"disposition":"static_limit_justified_checker_published"},"F02":{"correction_packages":["HUG-014","HUG-043"],"disposition":"static_defect_observed_checker_published"},"F03":{"correction_packages":["HUG-011"],"disposition":"runtime_observed_locally_checker_published"},"F04":{"correction_packages":["HUG-011","HUG-027"],"disposition":"runtime_observed_locally_checker_published"},"F05":{"correction_packages":["HUG-009","HUG-026"],"disposition":"static_defect_observed_checker_published"},"F06":{"correction_packages":["HUG-010"],"disposition":"runtime_observed_locally_checker_published"},"F07":{"correction_packages":["HUG-015","HUG-020","HUG-028"],"disposition":"pending_followup_in_HUG003"},"F08":{"correction_packages":["HUG-020","HUG-039"],"disposition":"pending_followup_in_HUG003"},"F09":{"correction_packages":["HUG-015","HUG-022","HUG-036"],"disposition":"runtime_observed_locally_checker_published"},"F10":{"correction_packages":["HUG-017","HUG-026","HUG-029","HUG-032"],"disposition":"runtime_observed_locally_checker_published"},"F11":{"correction_packages":["HUG-008"],"disposition":"pending_followup_in_HUG003"},"F12":{"correction_packages":["HUG-016","HUG-019","HUG-035","HUG-048"],"disposition":"pending_followup_in_HUG003"},"F13":{"correction_packages":["HUG-004"],"disposition":"pending_followup_in_HUG003"},"F14":{"correction_packages":["HUG-005","HUG-049"],"disposition":"pending_followup_in_HUG003"},"F15":{"correction_packages":["HUG-005","HUG-052","HUG-053"],"disposition":"pending_followup_in_HUG003"},"F16":{"correction_packages":["HUG-019","HUG-026"],"disposition":"pending_followup_in_HUG003"},"F17":{"correction_packages":["HUG-007","HUG-039","HUG-052"],"disposition":"pending_followup_in_HUG003"},"F18":{"correction_packages":["HUG-004","HUG-037","HUG-046"],"disposition":"pending_followup_in_HUG003"},"F19":{"correction_packages":["HUG-006","HUG-049","HUG-052"],"disposition":"pending_followup_in_HUG003"}},"findings":{"F03":{"expected":{"check_count":4,"hit_rate_pct":75.0,"hits":3},"observed":{"check_count":2,"hit_rate_pct":50.0,"hits":1},"outcome":"regression_reproduced"},"F04":{"expected":{"minimum_bound_checks":1},"observed":{"already_recorded":true,"check_count":0},"outcome":"regression_reproduced"},"F06":{"expected":{"shell_gate_nonzero":true},"observed":{"payload_exit":7,"payload_ok":false,"process_exit":0},"outcome":"regression_reproduced"},"F09":{"expected":{"asked":4,"done":0,"proven":0},"observed":{"asked":4,"done":4,"proven":0},"outcome":"regression_reproduced"},"F10":{"expected":{"resolvable_nonempty_refs":true,"stderr_bytes":"ORACLE_STDERR\n","stdout_bytes":"ORACLE_STDOUT\n"},"observed":{"artifacts":[],"stderr_ref":"","stdout_ref":""},"outcome":"regression_reproduced"}},"origin":{"artifact_digest_checked":true,"artifact_id":10527034046,"artifact_sha256":"e5adc5d4cf61eae34deb8f44eb9fc2bd42c522e46ed4128c4bb9f9921db29f99","binary_metadata":{"retained_path":"data/hugit","schema_version":"1.0","selected_path":"/home/runner/work/hugit/hugit/target/release/hugit","sha256":"52a7c3cb0fab99b0b4f208a32d7c26f6724bb58d06b9f02a5aaf340735023e59","source_provenance":"unbound-selected-executable","version_stdout":"hugit 0.1.7"},"causal_scope":"Associated to the workflow head by GitHub metadata. The retained package itself labels source-to-binary binding not_established; no stronger reproducible-build attestation is claimed.","execution_environment":"Linux conversation container; selected artifact binary, not a local Rust rebuild","source_metadata":{"discontinued_runner_boundary":"legacy pr land --dispatch remains source-reachable and was intentionally unexecuted","fixture":"synthetic-local-git","ledger_baseline":"6f9bbfa","network":"no_network_action_configured; absence_not_instrumented","schema_version":"1.0","source_to_binary_binding":"not_established"},"workflow_head_sha":"10a3c8b3cdd780554d78db750975f8e5a2b253b0","workflow_run_id":35293673383},"owned_fixture_removed":true,"persisted_files":{"checks.ac":"{\n \"011394e1cb9932683998421a1ca731dc47e597977320c0065700d9c5466b369c\": {\n \"result\": {\n \"memo_key\": \"011394e1cb9932683998421a1ca731dc47e597977320c0065700d9c5466b369c\",\n \"tree_hash\": \"1121578561b728cc207d28e1dece5b815fda3784f65ebd4f0d107f9660148b1c\",\n \"def_digest\": \"198b2bc22d0dd24eb7dba58ce0b3b41df70882bdcc6f6609d13267bcef9ef81c\",\n \"toolchain_digest\": \"oracle-toolchain-v1\",\n \"exit\": 7,\n \"artifacts\": [],\n \"stdout_ref\": \"\",\n \"stderr_ref\": \"\",\n \"duration_ms\": 20,\n \"runner_ref\": \"local\",\n \"produced_at\": 1789694464853\n },\n \"self_hash\": \"57bff3e84a2086f6fb3c6564a0f3589f8bed9cf4b508986266c25d08e4e5dcb9\"\n },\n \"4ff84fa3110bba90dc350ee1f55f4887b3c5c7a20e15060cc1a0dccc77e8701c\": {\n \"result\": {\n \"memo_key\": \"4ff84fa3110bba90dc350ee1f55f4887b3c5c7a20e15060cc1a0dccc77e8701c\",\n \"tree_hash\": \"1121578561b728cc207d28e1dece5b815fda3784f65ebd4f0d107f9660148b1c\",\n \"def_digest\": \"a12870dea0767c45962237bc2f97d5d5877b9977494d37409547ac20d639357f\",\n \"toolchain_digest\": \"oracle-toolchain-v1\",\n \"exit\": 0,\n \"artifacts\": [],\n \"stdout_ref\": \"\",\n \"stderr_ref\": \"\",\n \"duration_ms\": 20,\n \"runner_ref\": \"local\",\n \"produced_at\": 1789694464876\n },\n \"self_hash\": \"5f5468bcb2eaade0a6e2d1c2bcf377075adc9c9293798e45dc5373644a286c71\"\n },\n \"59fb2539c456fa6b9ec434662674b01412a6647cfc111580b0a1f427b208d772\": {\n \"result\": {\n \"memo_key\": \"59fb2539c456fa6b9ec434662674b01412a6647cfc111580b0a1f427b208d772\",\n \"tree_hash\": \"1121578561b728cc207d28e1dece5b815fda3784f65ebd4f0d107f9660148b1c\",\n \"def_digest\": \"481b5a79eeeb7dd88b04e8ddb84ddca322e07ff4de887ec40d46aec3c4d33320\",\n \"toolchain_digest\": \"oracle-toolchain-v1\",\n \"exit\": 0,\n \"artifacts\": [],\n \"stdout_ref\": \"\",\n \"stderr_ref\": \"\",\n \"duration_ms\": 20,\n \"runner_ref\": \"local\",\n \"produced_at\": 1789694464821\n },\n \"self_hash\": \"519939ca166b76f1ba662bf28f1e8d53371173bb27244e23fd6e6be33e800559\"\n }\n}","events.json":"[\n {\n \"seq\": 0,\n \"prev_hash\": \"0000000000000000000000000000000000000000000000000000000000000000\",\n \"this_hash\": \"1848511cddfbc9d1a9c7fd12992b07971c7297f362b1cb5ae3c525febbe39b41\",\n \"kind\": \"check.recorded\",\n \"principal_chain\": [\n \"orchestrator:hugit\"\n ],\n \"payload\": \"{\\\"cache_hit\\\":false,\\\"def_digest\\\":\\\"481b5a79eeeb7dd88b04e8ddb84ddca322e07ff4de887ec40d46aec3c4d33320\\\",\\\"duration_ms\\\":20,\\\"exit\\\":0,\\\"memo_key\\\":\\\"59fb2539c456fa6b9ec434662674b01412a6647cfc111580b0a1f427b208d772\\\",\\\"name\\\":\\\"oracle-cache\\\",\\\"toolchain_digest\\\":\\\"oracle-toolchain-v1\\\",\\\"tree_hash\\\":\\\"1121578561b728cc207d28e1dece5b815fda3784f65ebd4f0d107f9660148b1c\\\"}\",\n \"recorded_at\": 1789694464821\n },\n {\n \"seq\": 1,\n \"prev_hash\": \"1848511cddfbc9d1a9c7fd12992b07971c7297f362b1cb5ae3c525febbe39b41\",\n \"this_hash\": \"7e64951626f50ed7a77e27238e9d52f28187f93267a1094155751884ff7b8522\",\n \"kind\": \"check.recorded\",\n \"principal_chain\": [\n \"orchestrator:hugit\"\n ],\n \"payload\": \"{\\\"cache_hit\\\":true,\\\"def_digest\\\":\\\"481b5a79eeeb7dd88b04e8ddb84ddca322e07ff4de887ec40d46aec3c4d33320\\\",\\\"duration_ms\\\":20,\\\"exit\\\":0,\\\"memo_key\\\":\\\"59fb2539c456fa6b9ec434662674b01412a6647cfc111580b0a1f427b208d772\\\",\\\"name\\\":\\\"oracle-cache\\\",\\\"toolchain_digest\\\":\\\"oracle-toolchain-v1\\\",\\\"tree_hash\\\":\\\"1121578561b728cc207d28e1dece5b815fda3784f65ebd4f0d107f9660148b1c\\\"}\",\n \"recorded_at\": 1789694464823\n },\n {\n \"seq\": 2,\n \"prev_hash\": \"7e64951626f50ed7a77e27238e9d52f28187f93267a1094155751884ff7b8522\",\n \"this_hash\": \"7f4aafcae35f5b6e98c5bbb13df1f09184891d4b0b93076130d795add816a163\",\n \"kind\": \"check.recorded\",\n \"principal_chain\": [\n \"orchestrator:hugit\"\n ],\n \"payload\": \"{\\\"cache_hit\\\":false,\\\"def_digest\\\":\\\"198b2bc22d0dd24eb7dba58ce0b3b41df70882bdcc6f6609d13267bcef9ef81c\\\",\\\"duration_ms\\\":20,\\\"exit\\\":7,\\\"memo_key\\\":\\\"011394e1cb9932683998421a1ca731dc47e597977320c0065700d9c5466b369c\\\",\\\"name\\\":\\\"oracle-cache\\\",\\\"toolchain_digest\\\":\\\"oracle-toolchain-v1\\\",\\\"tree_hash\\\":\\\"1121578561b728cc207d28e1dece5b815fda3784f65ebd4f0d107f9660148b1c\\\"}\",\n \"recorded_at\": 1789694464853\n },\n {\n \"seq\": 3,\n \"prev_hash\": \"7f4aafcae35f5b6e98c5bbb13df1f09184891d4b0b93076130d795add816a163\",\n \"this_hash\": \"a41ec988011e446b9d1233b3a3e08c857dee0b182ac1a5bdf8755969930b5f36\",\n \"kind\": \"check.recorded\",\n \"principal_chain\": [\n \"orchestrator:hugit\"\n ],\n \"payload\": \"{\\\"cache_hit\\\":false,\\\"def_digest\\\":\\\"a12870dea0767c45962237bc2f97d5d5877b9977494d37409547ac20d639357f\\\",\\\"duration_ms\\\":20,\\\"exit\\\":0,\\\"memo_key\\\":\\\"4ff84fa3110bba90dc350ee1f55f4887b3c5c7a20e15060cc1a0dccc77e8701c\\\",\\\"name\\\":\\\"oracle-cache\\\",\\\"toolchain_digest\\\":\\\"oracle-toolchain-v1\\\",\\\"tree_hash\\\":\\\"1121578561b728cc207d28e1dece5b815fda3784f65ebd4f0d107f9660148b1c\\\"}\",\n \"recorded_at\": 1789694464876\n }\n]","goals.json":"[\n {\n \"seq\": 0,\n \"prev_hash\": \"0000000000000000000000000000000000000000000000000000000000000000\",\n \"this_hash\": \"d9d1f4822b920b3e5b634280fd6a56c10dea48e05e1d07f27fa80805d1dabe4d\",\n \"kind\": \"campaign.opened\",\n \"principal_chain\": [\n \"user:human:oracle\"\n ],\n \"payload\": \"{\\\"campaign\\\":\\\"oracle\\\",\\\"charter\\\":\\\"Controlled baseline\\\",\\\"owner\\\":\\\"human:oracle\\\"}\",\n \"recorded_at\": 0\n },\n {\n \"seq\": 1,\n \"prev_hash\": \"d9d1f4822b920b3e5b634280fd6a56c10dea48e05e1d07f27fa80805d1dabe4d\",\n \"this_hash\": \"0aef97901eb517cd9c2123348a4a0e5fc9b59497797f7ee7e93d1c00f1d85199\",\n \"kind\": \"intent.landed\",\n \"principal_chain\": [\n \"campaign:oracle\",\n \"agent:main\"\n ],\n \"payload\": \"{\\\"campaign\\\":\\\"oracle\\\",\\\"charter\\\":\\\"Controlled goal 0\\\",\\\"intent_id\\\":\\\"oracle-goal-0\\\",\\\"ref\\\":\\\"refs/hugit/intents\\\",\\\"target\\\":\\\"authored:oracle-goal-0\\\"}\",\n \"recorded_at\": 1789694464882\n },\n {\n \"seq\": 2,\n \"prev_hash\": \"0aef97901eb517cd9c2123348a4a0e5fc9b59497797f7ee7e93d1c00f1d85199\",\n \"this_hash\": \"4c9dcf462acbaaa3476ad6e432a3f51a03c0902d2e499b7e5aa7d2705bbd0c4b\",\n \"kind\": \"intent.landed\",\n \"principal_chain\": [\n \"campaign:oracle\",\n \"agent:main\"\n ],\n \"payload\": \"{\\\"campaign\\\":\\\"oracle\\\",\\\"charter\\\":\\\"Controlled goal 1\\\",\\\"intent_id\\\":\\\"oracle-goal-1\\\",\\\"ref\\\":\\\"refs/hugit/intents\\\",\\\"target\\\":\\\"authored:oracle-goal-1\\\"}\",\n \"recorded_at\": 1789694464884\n },\n {\n \"seq\": 3,\n \"prev_hash\": \"4c9dcf462acbaaa3476ad6e432a3f51a03c0902d2e499b7e5aa7d2705bbd0c4b\",\n \"this_hash\": \"9e1663372d8a6b5147972fa939f49d56403fb553b63f0047a2c9cf2306852273\",\n \"kind\": \"intent.landed\",\n \"principal_chain\": [\n \"campaign:oracle\",\n \"agent:main\"\n ],\n \"payload\": \"{\\\"campaign\\\":\\\"oracle\\\",\\\"charter\\\":\\\"Controlled goal 2\\\",\\\"intent_id\\\":\\\"oracle-goal-2\\\",\\\"ref\\\":\\\"refs/hugit/intents\\\",\\\"target\\\":\\\"authored:oracle-goal-2\\\"}\",\n \"recorded_at\": 1789694464887\n },\n {\n \"seq\": 4,\n \"prev_hash\": \"9e1663372d8a6b5147972fa939f49d56403fb553b63f0047a2c9cf2306852273\",\n \"this_hash\": \"4aba44be58f739dc56379f04e5f6b63e6fc5f38874e7cfc67e5ed8b11fc275a7\",\n \"kind\": \"intent.landed\",\n \"principal_chain\": [\n \"campaign:oracle\",\n \"agent:main\"\n ],\n \"payload\": \"{\\\"campaign\\\":\\\"oracle\\\",\\\"charter\\\":\\\"Controlled goal 3\\\",\\\"intent_id\\\":\\\"oracle-goal-3\\\",\\\"ref\\\":\\\"refs/hugit/intents\\\",\\\"target\\\":\\\"authored:oracle-goal-3\\\"}\",\n \"recorded_at\": 1789694464890\n }\n]","repo/.git/oracle-marker":"executed\n","repo/.git/oracle-output-marker":"executed\n"},"product_accepted":false,"publication":{"executor_sha256":"7b2d308ab65fa87fa849c77a0f5b48ec2201134afb42f7ae439ced0471c2d6cc","executor_uploaded":false,"executor_write":"Blocked before reaching GitHub; not retried through another transport.","goal_source_discovered":false,"limitations":["Read-only checker verifies consistency, not authenticity or hash-chain validity.","PR ID is a caller-supplied identifier accepted by check run, not a separately created PR lifecycle.","Observed goal creation uses the declaration API, not the missing automatic hook.","Selected executable has workflow association but its source-to-binary attestation is not established."],"projection":"This file retains full stdout, exit status and selected state files. Complete argv, stderr, timings and controls remain in the external raw report.","published_checker":"Read-only reconstruction of observations from recorded stdout and persisted state. Does not launch the process suite.","raw_report_sha256":"1de27d478eadcb8bd1380d2165dde0f324370a5e0cbae744fc767c30eff7d23e","remaining":["Qualify eleven pending findings (F07/F08/F11-F19) with source inspections, observations or justified limits.","Retain current Linux runtime controls independently of these unchanged historical runtime observations.","Complete full-suite recovery and all HUG-003 assertions; do not close from this increment."],"tracking_issue":382},"review":"same_executor","schema_version":1,"scope":"HUG-003 first runtime slice","static_findings":{"F01":{"classification":"limit_justified","correction_packages":["HUG-012","HUG-013"],"evidence":[{"path":"crates/hugit-cli/src/checks/run.rs","requires":["captured_hermetic_env","run_memoized","ad-hoc check","Ok(Some(status)) => break Ok(status.code().unwrap_or(-1))","if poll_result.is_ok()","let _ = t.join();"],"sha256":"09e444a498b63e80036df960e08b655a8f1c9fd9b755f9ccaad11959d5560979"},{"path":"docs/review/round13/wedge-decider.md","requires":["finally DRY","OUTSIDE","memoized-CI"],"sha256":"cf4f525fc3c4855e6b41b8b9fa2945a45b7aa9369555d666f3801086896a3659"},{"path":"docs/plan/standalone/v3/work-packages/HUG-012.md","requires":["falso verde F01","Worktree mutável não autoriza skip automático","shell é reexecutado ou reuso negado"],"sha256":"a379962763b1b24e4e8586d11403ad2a48ba28f76e5c8495af278c202350bf9c"},{"path":"docs/plan/standalone/v3/work-packages/HUG-013.md","requires":["shell tests, rede, relógio, randomness e bancos fora do allowlist","Native cache validity pertence ao motor qualificado"],"sha256":"07c143e579dae2fd77c5d646194e3958af2fc0eb431a7e381b468cd567e2725e"}],"evidence_scope":"historical_source_snapshot_not_current_product_acceptance","expected":"Worktree mutável não autoriza skip automático; shell arbitrário deve reexecutar ou ter reuso negado quando seus inputs não são provadamente completos.","limits":["Esta disposição satisfaz HUG-003 como inspeção/limitação; não fecha HUG-012/HUG-013.","Rounds históricos não são nova execução do produto atual.","Bounded-local hardening não transforma shell arbitrário em ação hermética e reutilizável."],"observed":{"current_boundary":"O caminho check continua executando shell em worktree mutável e o plano v3 não considera shell arbitrário um perfil seguro de reuso. HUG-012 exige bypass/reexecução e snapshot explícito; HUG-013 permite apenas outline puro e caches nativos qualificados.","historical_repro":"Rounds 8/11 demonstraram stale-green para inputs não capturados; rounds 9–13 endureceram cwd, env declarado, mode bits e configurações/toolchain bounded-local.","original_counterexample":"Original F01: input.txt is fail when the key is captured, becomes pass while the check executes, then fail is restored and a warm HIT reuses the wrong green. Earlier cwd/env/config fixes do not refute this concurrent-mutation case.","product_fix_claimed":false},"outcome":"limit_justified","source_commit":"ce2fcf1b8243eea2bd1be5aff25dfb3f6571ead4"},"F02":{"classification":"static_defect_observed","correction_packages":["HUG-014","HUG-043"],"evidence":[{"path":"crates/hugit-queue/src/core/union.rs","requires":["let (locus, extra_exec) = bisect_failure(&ids, oracle);","let proceeding: Vec = ids","pub fn outcomes_for_landing","UnionOutcome::Green","return (FailureLocus::SingleItem(ids[i].to_string()), executed);"],"sha256":"b074891b80002c1eeb2ce91e0446e4b92767b40d8c8d09214516a02115ca9e99"},{"path":"docs/plan/standalone/v3/work-packages/HUG-014.md","requires":["Após exclusão de locus, avaliar candidato restante inteiro","A+B e C+D conflitantes não liberam C+D","Remover culpado não prova resto verde."],"sha256":"dcadd6213e4b4f1ff4a327a30c7681faaf98b90736f1a2dee57e129d6238b4c5"}],"evidence_scope":"source_inspection_with_analytic_counterexample_not_runtime_execution","expected":"Diagnosing and excluding one failing locus does not authorize the remainder; evaluate the exact final candidate before returning Green.","limits":["This is a source inspection, not a new runtime reproduction.","No real Git branch promotion was attempted or claimed.","HUG-014/HUG-043 remain responsible for correcting and qualifying promotion behavior."],"observed":{"analytic_counterexample":{"batch":["A","B","C","D"],"conclusion":"The returned remainder remains failing even though it is mapped to Green.","failing_pairs":[["A","B"],["C","D"]],"first_pair_found":["A","B"],"kind":"reasoned_counterexample_not_executed_trace","singletons":"all green","unchecked_remainder":["C","D"]},"product_fix_claimed":false,"source_inspection":"bisect_failure returns the first failing singleton or pair; evaluate_union filters the remaining ids without evaluating that whole set; outcomes_for_landing maps non-excluded ids to Green."},"outcome":"static_defect_observed","source_commit":"ce2fcf1b8243eea2bd1be5aff25dfb3f6571ead4"},"F05":{"classification":"static_defect_observed","correction_packages":["HUG-009","HUG-026"],"evidence":[{"path":"crates/hugit-cli/src/checks/run.rs","requires":["captured_hermetic_env","run_memoized","ad-hoc check","Ok(Some(status)) => break Ok(status.code().unwrap_or(-1))","if poll_result.is_ok()","let _ = t.join();"],"sha256":"09e444a498b63e80036df960e08b655a8f1c9fd9b755f9ccaad11959d5560979"},{"path":"docs/plan/standalone/v3/work-packages/HUG-009.md","requires":["deadline completo","Filho encerra antes de neto soltar pipe"],"sha256":"a8b44310b60741ad630ca43a218066394f8e04e128f23383df53ca08dad482e8"},{"path":"docs/plan/standalone/v3/work-packages/HUG-026.md","requires":["neto com pipe aberto","EOF verdadeiro completa"],"sha256":"8a8749f812dfec632b3145ea34f96e73194685969ee8c23b62c292fe6dec52bb"}],"evidence_scope":"source_inspection_deadline_excludes_successful_child_pipe_joins","expected":"One monotonic end-to-end deadline covers process, descendants, pipe readers and cleanup; child exit alone does not establish EOF.","limits":["Static inspection is not a fresh runtime measurement.","Linux CI execution is reported separately with its selected binary hash, trace and fixture barriers.","This does not implement the HUG-009 supervisor or qualify every platform/process lifecycle."],"observed":{"join":"Both stream reader joins on poll_result.is_ok() have no remaining deadline. A descendant retaining a pipe can keep the CLI waiting after the direct child exits.","poll":"Ok(Some(status)) leaves the deadline loop immediately.","product_fix_claimed":false,"source_span":"crates/hugit-cli/src/checks/run.rs:985-1047"},"outcome":"static_defect_observed","source_commit":"ce2fcf1b8243eea2bd1be5aff25dfb3f6571ead4"}},"status":"characterized","subject_claim":"10a3c8b3cdd780554d78db750975f8e5a2b253b0","whole_wp_ready":false} diff --git a/scripts/acceptance/baseline_oracles.py b/scripts/acceptance/baseline_oracles.py index e549fbf8..2085053e 100644 --- a/scripts/acceptance/baseline_oracles.py +++ b/scripts/acceptance/baseline_oracles.py @@ -1,7 +1,9 @@ #!/usr/bin/env python3 """Read-only HUG-003 oracles over retained CLI observations. -This program never runs a command, reducer, hook, or content from the input. +Verification never executes commands, hooks, reducers, or text from a report. +Explicit --exercise mode runs only hard-coded private Linux fixtures using +the binary selected by the caller; it never runs commands supplied by a report. Exit 0 verifies characterization, NOT product acceptance. --product-gate returns 1 for a reproduced regression; malformed/incomplete evidence returns 2. The record is historical evidence for its selected executable, not a new run. @@ -21,7 +23,7 @@ import sys FINDINGS = ('F03', 'F04', 'F06', 'F09', 'F10') -STATIC_FINDINGS = ('F01', 'F02') +STATIC_FINDINGS = ('F01', 'F02', 'F05') MAX_INPUT = 1024 * 1024 MAX_SOURCE = 1024 * 1024 STATIC_SOURCE_COMMIT = "ce2fcf1b8243eea2bd1be5aff25dfb3f6571ead4" @@ -29,7 +31,7 @@ STATIC_SOURCES = {'crates/hugit-cli/src/checks/run.rs': {'sha256': '09e444a498b63e80036df960e08b655a8f1c9fd9b755f9ccaad11959d5560979', 'requires': ['captured_hermetic_env', 'run_memoized', - 'ad-hoc check']}, + 'ad-hoc check', 'Ok(Some(status)) => break Ok(status.code().unwrap_or(-1))', 'if poll_result.is_ok()', 'let _ = t.join();']}, 'docs/review/round13/wedge-decider.md': {'sha256': 'cf4f525fc3c4855e6b41b8b9fa2945a45b7aa9369555d666f3801086896a3659', 'requires': ['finally DRY', 'OUTSIDE', 'memoized-CI']}, 'docs/plan/standalone/v3/work-packages/HUG-012.md': {'sha256': 'a379962763b1b24e4e8586d11403ad2a48ba28f76e5c8495af278c202350bf9c', @@ -76,6 +78,22 @@ 'disposition': 'static_defect_observed_checker_published', 'evidence_scope': 'source_inspection_with_analytic_counterexample_not_runtime_execution'}} + +STATIC_SOURCES.update({'docs/plan/standalone/v3/work-packages/HUG-009.md': {'requires': ['deadline completo', + 'Filho encerra antes de neto ' + 'soltar pipe'], + 'sha256': 'a8b44310b60741ad630ca43a218066394f8e04e128f23383df53ca08dad482e8'}, + 'docs/plan/standalone/v3/work-packages/HUG-026.md': {'requires': ['neto com pipe aberto', + 'EOF verdadeiro completa'], + 'sha256': '8a8749f812dfec632b3145ea34f96e73194685969ee8c23b62c292fe6dec52bb'}}) +STATIC_POLICIES['F05'] = {'correction_packages': ['HUG-009', 'HUG-026'], + 'disposition': 'static_defect_observed_checker_published', + 'evidence_scope': 'source_inspection_deadline_excludes_successful_child_pipe_joins', + 'outcome': 'static_defect_observed', + 'sources': ['crates/hugit-cli/src/checks/run.rs', + 'docs/plan/standalone/v3/work-packages/HUG-009.md', + 'docs/plan/standalone/v3/work-packages/HUG-026.md']} + class EvidenceError(ValueError): pass @@ -334,6 +352,9 @@ def false_as_zero(r): 'F02_false_fix': lambda r: r['static_findings']['F02']['observed'].update(product_fix_claimed=True), 'F02_false_runtime_claim': lambda r: r['static_findings']['F02'].update(evidence_scope='runtime_reproduced'), 'F02_unverified_reclassification': lambda r: r['static_findings']['F02'].update(outcome='limit_justified'), + 'omitted_F05_inspection': lambda r: r['static_findings'].pop('F05'), + 'F05_false_fix': lambda r: r['static_findings']['F05']['observed'].update(product_fix_claimed=True), + 'F05_false_runtime_claim': lambda r: r['static_findings']['F05'].update(evidence_scope='runtime_reproduced'), }) for name, mutate in mutations.items(): altered = copy.deepcopy(report); mutate(altered) @@ -403,15 +424,344 @@ def refused(name, action, code): outcomes['supplied_snapshot_unchanged'] = 'passed' return outcomes +# Explicit execution mode is separate from all read-only verification paths. +RUNTIME_SCHEMA = 'hugit.baseline-runtime/1' +RUNTIME_LABELS = ('version', 'git-init', 'git-root', 'health-before', 'attach', + 'git-add', 'git-commit', 'git-head', 'health-after', + 'read-valid', 'read-tampered', 'git-status', 'deadline') +HOLDER = '''import os, pathlib, time +root = pathlib.Path(__file__).parent +r, w = os.pipe() +pid = os.fork() +if pid == 0: + os.close(r) + (root / 'holder-ready').write_text('ready') + os.write(w, b'R'); os.close(w) + until = time.monotonic() + 6 + while not (root / 'release').exists() and time.monotonic() < until: + time.sleep(0.01) + (root / 'holder-finished').write_text('finished') + os._exit(0) +os.close(w) +assert os.read(r, 1) == b'R' +os.close(r) +(root / 'parent-exiting').write_text('ready') +os._exit(0) +''' + +def observed_command(argv, cwd, env, label, records, tick=None): + """Fixed fixture commands only. Bounded pipes/time; never execute report text.""" + import selectors + import subprocess + import time + start = time.monotonic() + output = [bytearray(), bytearray()] + row = dict(label=label, argv=[str(x) for x in argv]) + records.append(row) + with subprocess.Popen(argv, cwd=cwd, env=env, stdin=subprocess.DEVNULL, + stdout=subprocess.PIPE, stderr=subprocess.PIPE) as child: + try: + with selectors.DefaultSelector() as sel: + for i, stream in enumerate((child.stdout, child.stderr)): + os.set_blocking(stream.fileno(), False) + sel.register(stream, selectors.EVENT_READ, i) + while sel.get_map() or child.poll() is None: + elapsed = time.monotonic() - start + need(elapsed < 12, 'fixture_command_timeout:' + label) + if tick: + tick(elapsed, child.poll()) + for key, _ in sel.select(0.02): + data = os.read(key.fileobj.fileno(), 65536) + if not data: + sel.unregister(key.fileobj) + else: + need(len(output[key.data]) + len(data) <= 512 * 1024, + 'fixture_output_budget:' + label) + output[key.data].extend(data) + row['exit'] = child.wait(timeout=1) + finally: + if child.poll() is None: + child.kill() # Only the directly owned process, never a group. + child.wait(timeout=2) + row.update(elapsed_ms=round((time.monotonic() - start) * 1000, 3), + stdout=output[0].decode('utf-8', errors='replace'), + stderr=output[1].decode('utf-8', errors='replace')) + return row + +def runtime_json(row): + data = parse(row['stdout']) + need(isinstance(data, dict), 'runtime_json_shape') + return data + +def verify_runtime(report, subject): + """Reconstruct observed assertions, not merely stored outcome flags.""" + need(isinstance(report, dict) and report.get('schema') == RUNTIME_SCHEMA, 'runtime_schema') + need(report.get('status') == 'characterized' and report.get('subject_claim') == subject + and re.fullmatch('[0-9a-f]{40,64}', subject) is not None, 'runtime_subject') + need(report.get('product_accepted') is False and report.get('whole_wp_ready') is False, + 'runtime_authority') + binary = report['binary'] + need(re.fullmatch('[0-9a-f]{64}', binary['sha256']) is not None + and binary['sha256'] == binary['copy_sha256'] == binary['after_sha256'], 'runtime_binary') + need(report['environment']['system'] == 'Linux', 'runtime_cell') + rows = report['commands'] + need(isinstance(rows, list) and len(rows) == len(RUNTIME_LABELS), 'runtime_commands') + need([r['label'] for r in rows] == list(RUNTIME_LABELS), 'runtime_command_set') + commands = {r['label']: r for r in rows} + need(all(type(r['exit']) is int and isinstance(r['stdout'], str) + and isinstance(r['stderr'], str) and type(r['elapsed_ms']) in (int, float) + and 0 <= r['elapsed_ms'] < 12000 for r in rows), 'runtime_command_shape') + need(commands['version']['stdout'].strip() == binary['version'] + and binary['version'].startswith('hugit '), 'runtime_version') + need(all(commands[n]['exit'] == 0 for n in RUNTIME_LABELS if n != 'read-tampered'), + 'runtime_command_failure') + need(runtime_json(commands['health-before'])['mode'] == 'inactive' + and runtime_json(commands['attach'])['attached'] is True, 'runtime_setup') + after = runtime_json(commands['health-after']) + need(after['mode'] == 'active' and after['log']['state'] == 'valid', 'runtime_capture_health') + oid = commands['git-head']['stdout'].strip() + need(re.fullmatch('[0-9a-f]{40}|[0-9a-f]{64}', oid) is not None, 'runtime_commit_oid') + log = parse(report['event_log']) + need(isinstance(log, list) and 0 < len(log) < 100, 'runtime_log_shape') + matching = [i for i, e in enumerate(log) if e['kind'] == 'ref.update' + and parse(e['payload']).get('target') == oid + and parse(e['payload']).get('ref') == 'refs/heads/main'] + need(bool(matching), 'runtime_commit_not_captured') + need(not any(e['kind'].startswith(('intent.', 'goal.')) for e in log), 'runtime_invented_goal') + tampered = copy.deepcopy(log) + payload = parse(tampered[matching[0]]['payload']) + payload['target'] = '0' * len(oid) + tampered[matching[0]]['payload'] = json.dumps(payload, sort_keys=True, separators=(',', ':')) + need(parse(report['tampered_log']) == tampered, 'runtime_tamper_not_partial') + error = runtime_json(commands['read-tampered']) + need(commands['read-tampered']['exit'] == 2 + and error.get('error', {}).get('kind') == 'chain_broken', 'runtime_tamper_not_refused') + need(commands['git-status']['stdout'] == '', 'runtime_worktree_changed') + # Match the fixture specification, not a report-selected deadline or outcome. + deadline = commands['deadline'] + result = runtime_json(deadline) + need('--timeout-secs' in deadline['argv'] + and deadline['argv'][deadline['argv'].index('--timeout-secs') + 1] == '1', 'runtime_deadline_drift') + need(result.get('cache_hit') is False and result.get('local_executions') == 1 + and result.get('ok') is True and type(result.get('exit')) is int + and result['exit'] == 0, 'runtime_deadline_behavior_changed_requires_review') + need(report['barrier'] == {'parent_exiting': 'ready', 'holder_ready': 'ready', + 'holder_finished': 'finished', 'release_after_ms': 3000}, 'runtime_barrier') + need(2500 <= deadline['elapsed_ms'] < 10000, 'runtime_deadline_not_reproduced') + need(report['owned_fixture_removed'] is True, 'runtime_cleanup') + need(report.get('helper_sha256') == hashlib.sha256(HOLDER.encode()).hexdigest(), 'runtime_helper') + return {'F05': {'expected': {'timeout_secs': 1, 'end_to_end_ceiling_ms': 1500}, + 'observed': {'elapsed_ms': deadline['elapsed_ms'], 'process_exit': deadline['exit'], + 'payload_exit': result['exit'], 'payload_ok': result['ok']}, + 'outcome': 'regression_reproduced'}, + 'automatic_commit_capture': {'oid': oid, 'outcome': 'satisfied'}, + 'partial_tamper_refusal': {'exit': 2, 'error': 'chain_broken', 'outcome': 'satisfied'}} + +def _exercise_runtime(binary, subject, git_override, records): + """Linux-only finite fixture. Changes exclusively its own TemporaryDirectory.""" + import platform + import shutil + import time + need(platform.system() == 'Linux', 'runtime_requires_linux') + need(isinstance(subject, str) and re.fullmatch('[0-9a-f]{40,64}', subject), 'runtime_subject') + binary = binary.resolve(strict=True) + binary_bytes = read_bounded_regular(binary, 128 * 1024 * 1024) + digest = hashlib.sha256(binary_bytes).hexdigest() + git = git_override or shutil.which('git', path=os.defpath) + need(git is not None, 'runtime_git_missing') + with tempfile.TemporaryDirectory(prefix='hugit-baseline-runtime-') as owned: + root = Path(owned) + repo = root / 'repo'; repo.mkdir() + home = root / 'home'; home.mkdir() + template = root / 'empty-template'; template.mkdir() + bindir = root / 'bin'; bindir.mkdir() + executable = bindir / 'hugit'; executable.write_bytes(binary_bytes); executable.chmod(0o700) + env = {'PATH': str(bindir) + os.pathsep + os.defpath, 'HOME': str(home), + 'XDG_CONFIG_HOME': str(home / 'xdg'), 'GIT_CONFIG_NOSYSTEM': '1', + 'GIT_CONFIG_GLOBAL': os.devnull, 'GIT_TEMPLATE_DIR': str(template), + 'GIT_TERMINAL_PROMPT': '0', 'LC_ALL': 'C', 'TZ': 'UTC', + 'GIT_AUTHOR_NAME': 'Baseline Fixture', 'GIT_AUTHOR_EMAIL': 'fixture@example.invalid', + 'GIT_COMMITTER_NAME': 'Baseline Fixture', 'GIT_COMMITTER_EMAIL': 'fixture@example.invalid', + 'GIT_AUTHOR_DATE': '2000-01-01T00:00:00Z', 'GIT_COMMITTER_DATE': '2000-01-01T00:00:00Z'} + def run(label, args, tick=None): + return observed_command([str(x) for x in args], repo, env, label, records, tick) + def ok(label, args): + r = run(label, args); need(r['exit'] == 0, 'runtime_setup:' + label); return r + version = ok('version', [executable, '--version'])['stdout'].strip() + need(version.startswith('hugit '), 'runtime_version_missing') + ok('git-init', [git, 'init', '-b', 'main']) + located = ok('git-root', [git, 'rev-parse', '--show-toplevel'])['stdout'].strip() + need(located == str(repo.resolve()), 'runtime_setup_git_root') + need(runtime_json(ok('health-before', [executable, 'health']))['mode'] == 'inactive', 'runtime_setup_health') + ok('attach', [executable, 'attach']) + manifest = repo / '.git/hugit-runtime/hooks-v1/manifest.json' + need(manifest.exists(), 'runtime_missing_hook_manifest') + read_bounded_regular(manifest, MAX_INPUT) # Always-zero/JSON-only substitutes cannot pass. + (repo / 'fixture.txt').write_text('controlled baseline commit\n') + ok('git-add', [git, 'add', 'fixture.txt']) + ok('git-commit', [git, 'commit', '-m', 'baseline automatic capture fixture']) + oid = ok('git-head', [git, 'rev-parse', 'HEAD'])['stdout'].strip() + logpath = repo / '.git/hugit/event-log.json' + until = time.monotonic() + 10 + while True: + raw = read_bounded_regular(logpath, MAX_INPUT) if logpath.exists() else b'[]' + events = parse(raw) + if any(e['kind'] == 'ref.update' and parse(e['payload']).get('target') == oid for e in events): + break + need(time.monotonic() < until, 'runtime_capture_not_observed') + time.sleep(0.02) # Predicate polling, not a sleep-only synchronization assumption. + ok('health-after', [executable, 'health']) + good = root / 'valid.json'; good.write_bytes(raw) + tampered = copy.deepcopy(events) + index = next(i for i, e in enumerate(events) if e['kind'] == 'ref.update' + and parse(e['payload']).get('target') == oid) + payload = parse(tampered[index]['payload']); payload['target'] = '0' * len(oid) + tampered[index]['payload'] = json.dumps(payload, sort_keys=True, separators=(',', ':')) + badraw = json.dumps(tampered, sort_keys=True).encode() + bad = root / 'tampered.json'; bad.write_bytes(badraw) + ok('read-valid', [executable, 'check', 'show', '--log', good]) + run('read-tampered', [executable, 'check', 'show', '--log', bad]) + need(good.read_bytes() == raw and bad.read_bytes() == badraw, 'runtime_reader_mutated_copy') + ok('git-status', [git, 'status', '--porcelain=v1', '--untracked-files=all']) + helper = repo / '.git/pipe-fixture'; helper.mkdir() + helperfile = helper / 'holder.py'; helperfile.write_text(HOLDER) + (root / 'deadline-log.json').write_text('[]\n') + ready_at = [None] + def release(elapsed, status): + if (helper / 'holder-ready').exists() and ready_at[0] is None: + ready_at[0] = elapsed + if ready_at[0] is not None and elapsed - ready_at[0] >= 3: + (helper / 'release').touch(exist_ok=True) + import shlex + command = 'exec ' + shlex.quote(sys.executable) + ' ' + shlex.quote(str(helperfile)) + try: + run('deadline', [executable, 'check', 'run', '--def', 'deadline-fixture', + '--toolchain', 'baseline-fixture-v1', '--root', repo, + '--log', root / 'deadline-log.json', '--ac', root / 'deadline.ac', + '--timeout-secs', '1', '--cmd', command], release) + finally: + (helper / 'release').touch(exist_ok=True) + # The child is finite (6 s maximum) and always receives release on error. + until = time.monotonic() + 7 + while (helper / 'holder-ready').exists() and not (helper / 'holder-finished').exists(): + need(time.monotonic() < until, 'runtime_holder_cleanup_unconfirmed') + time.sleep(0.02) + result = dict(schema=RUNTIME_SCHEMA, status='characterized', subject_claim=subject, + product_accepted=False, whole_wp_ready=False, + binary=dict(sha256=digest, copy_sha256=hashlib.sha256(executable.read_bytes()).hexdigest(), + version=version, source_to_binary_binding='caller_selected_executable; CI build identity recorded externally'), + environment=dict(system=platform.system(), release=platform.release(), + machine=platform.machine(), python=platform.python_version(), + inherited_environment=False, network_prohibition_instrumented=False), + commands=records, event_log=raw.decode(), tampered_log=badraw.decode(), + helper_sha256=hashlib.sha256(HOLDER.encode()).hexdigest(), + barrier={name.replace('-', '_'): (helper / name).read_text() + for name in ('parent-exiting', 'holder-ready', 'holder-finished')}) + result['barrier']['release_after_ms'] = 3000 + # Synthetic-only paths are retained: rewriting log bytes would change their hashes. + result['fixture_root'] = str(root) + result['owned_fixture_removed'] = not root.exists() + result['binary']['after_sha256'] = hashlib.sha256(read_bounded_regular(binary, 128 * 1024 * 1024)).hexdigest() + result['assertions'] = verify_runtime(result, subject) + return result + +class RuntimeFixtureError(EvidenceError): + def __init__(self, code, records): + super().__init__(code) + self.records = records + +def exercise_runtime(binary, subject, git_override=None): + import subprocess + records = [] + try: + return _exercise_runtime(binary, subject, git_override, records) + except (EvidenceError, OSError, ValueError, KeyError, TypeError, IndexError, + subprocess.SubprocessError) as error: + code = str(error)[:120] if isinstance(error, EvidenceError) else 'runtime_invalid_or_missing_evidence' + raise RuntimeFixtureError(code, records) from error + +def check_runtime_document(report, subject): + assertions = verify_runtime(report, subject) + need(report.get('assertions') == assertions, 'runtime_forged_assertions') + return assertions + +def runtime_self_test(binary, subject, result): + outcomes = {} + for name, change in { + 'runtime_forged_verdict': lambda r: r['assertions']['F05'].update(outcome='satisfied'), + 'runtime_false_green': lambda r: r.update(product_accepted=True), + 'runtime_lost_command': lambda r: r['commands'].pop(), + 'runtime_wrong_oid': lambda r: r['commands'][7].update(stdout='0'*40+'\n'), + 'runtime_not_partial': lambda r: r.update(tampered_log=r['event_log']), + 'runtime_omitted_log': lambda r: r.update(event_log='[]'), + 'runtime_cleanup_missing': lambda r: r.update(owned_fixture_removed=False), + 'runtime_deadline_weakened': lambda r: r['commands'][-1]['argv'].__setitem__( + r['commands'][-1]['argv'].index('--timeout-secs')+1, '300'), + 'runtime_unobserved_barrier': lambda r: r['barrier'].update(holder_ready=''), + }.items(): + altered = copy.deepcopy(result); change(altered) + try: + check_runtime_document(altered, subject) + except (EvidenceError, KeyError, ValueError, TypeError, IndexError): + outcomes[name] = 'rejected' + else: + raise EvidenceError('runtime_mutation_accepted:' + name) + with tempfile.TemporaryDirectory(prefix='hugit-baseline-substitute-') as tmp: + path = Path(tmp) / 'fake-hugit' + for name, content in { + 'always_zero_executable': '#!/bin/sh\nexit 0\n', + 'invented_json_no_effects': '#!/bin/sh\ncase "$1" in\n--version) echo "hugit fake";;\nhealth) echo \'{"mode":"inactive"}\';;\nattach) echo \'{"attached":true}\';;\nesac\n', + }.items(): + path.write_text(content); path.chmod(0o700) + try: + exercise_runtime(path, subject) + except RuntimeFixtureError as error: + expected = ('runtime_version_missing' if name == 'always_zero_executable' + else 'runtime_missing_hook_manifest') + need(str(error) == expected, 'wrong_substitute_refusal:' + name) + outcomes[name] = {'outcome': 'rejected', 'error': str(error), 'commands': error.records} + else: + raise EvidenceError('runtime_substitute_accepted:' + name) + path.write_text('#!/bin/sh\nexit 0\n') + try: + exercise_runtime(binary, subject, git_override=str(path)) + except RuntimeFixtureError as error: + need(str(error) == 'runtime_setup_git_root', 'wrong_setup_refusal') + outcomes['malformed_git_setup'] = {'outcome': 'rejected', 'error': str(error), 'commands': error.records} + else: + raise EvidenceError('runtime_setup_accepted') + need(not Path(tmp).exists(), 'runtime_substitute_cleanup') + outcomes['substitute_fixture_cleanup'] = 'passed' + return outcomes + def main(): ap = argparse.ArgumentParser(description=__doc__) - ap.add_argument('--report', type=Path, required=True) + modes = ap.add_mutually_exclusive_group(required=True) + modes.add_argument('--report', type=Path) + modes.add_argument('--exercise', action='store_true') + modes.add_argument('--runtime-report', type=Path) + ap.add_argument('--hugit-bin', type=Path) + ap.add_argument('--subject') ap.add_argument('--root', type=Path, default=Path('.'), help='source snapshot at ' + STATIC_SOURCE_COMMIT + '; not the evolving checkout') ap.add_argument('--self-test', action='store_true') ap.add_argument('--product-gate', action='store_true') args = ap.parse_args() try: + if args.exercise: + need(args.hugit_bin is not None and args.subject is not None, 'runtime_arguments') + result = exercise_runtime(args.hugit_bin, args.subject) + if args.self_test: + result['controls'] = runtime_self_test(args.hugit_bin, args.subject, result) + print(json.dumps(result, sort_keys=True)) + return 1 if args.product_gate else 0 + if args.runtime_report is not None: + raw = read_bounded_regular(args.runtime_report, MAX_INPUT) + assertions = check_runtime_document(parse(raw), args.subject) + print(json.dumps(dict(evidence_consistent=True, product_accepted=False, + whole_wp_ready=False, report_sha256=hashlib.sha256(raw).hexdigest(), + assertions=assertions, scope='read_only_runtime_report_verification'), sort_keys=True)) + return 1 if args.product_gate else 0 raw = read_bounded_regular(args.report, MAX_INPUT) report = parse(raw) results, static = verify(report, args.root) @@ -425,6 +775,10 @@ def main(): controls=tests, scope='retained_runtime_observations_and_static_inspection; no product executed'), sort_keys=True)) return 1 if args.product_gate and counts['regression_reproduced'] else 0 + except RuntimeFixtureError as error: + print(json.dumps(dict(status='setup_or_observation_error', product_accepted=False, + whole_wp_ready=False, error=str(error), commands=error.records), sort_keys=True)) + return 2 except (OSError, EvidenceError, KeyError, ValueError, TypeError, IndexError, AttributeError, RecursionError) as error: code = str(error)[:120] if isinstance(error, EvidenceError) else 'invalid_or_missing_evidence' print(json.dumps(dict(evidence_consistent=False, product_accepted=False, error=code)))