diff --git a/research/selected-binding-coverage-seeda342/EXPECTED.json b/research/selected-binding-coverage-seeda342/EXPECTED.json new file mode 100644 index 0000000000..c83902caa9 --- /dev/null +++ b/research/selected-binding-coverage-seeda342/EXPECTED.json @@ -0,0 +1,172 @@ +{ + "binding_counts": { + "NONE": 4, + "checkpoint-self-binding": 1, + "manifest-roots-inventory": 8, + "record-certificate-sha256": 1, + "record-proof-supplement": 5, + "record-root-of-trust": 1 + }, + "consumed": [ + { + "binding": "record-root-of-trust", + "cls": "fast-path", + "exists": true, + "path": "certificates/selected-result.json", + "sha256": "10b9e340fd8e354a37a0c4813c90e5de1dd42044b5f6aca4a3fc5a42b685fa32" + }, + { + "binding": "record-certificate-sha256", + "cls": "fast-path", + "exists": true, + "path": "research/community-frontier1094-audit/ASSEMBLY.json", + "sha256": "1122cb3a575f8c788345fc1bf4c108ac7c3250fb81a5988671f5eb04b3ab3045" + }, + { + "binding": "NONE", + "cls": "fast-path", + "exists": true, + "path": "research/community-frontier1094-audit/SELECTED-SOURCE.json", + "sha256": "79b3de5db3dbcb9829789ba58e9e45758926031e2a7d80667a08429d369be53b" + }, + { + "binding": "record-proof-supplement", + "cls": "fast-path", + "exists": true, + "path": "docs/research/community-batch1099-review.md", + "sha256": "7e76d2c38e5fce30587835b7251df1430488ae4dd372611ef69a3f03f476b6cb" + }, + { + "binding": "NONE", + "cls": "fast-path", + "exists": true, + "path": "docs/research/community-batch1099-integration.json", + "sha256": "684c50d1ac69863e1fcc0a34bf76c54bac576f6bbde79b3c67d8432a495c8c1c" + }, + { + "binding": "NONE", + "cls": "reproduce-driver", + "exists": true, + "path": "scripts/verify_selected_result.py", + "sha256": "d7fd929726b326aeeaf0a3996475adec88eee9aac09ae0bebeeaa0bc1fc8f199" + }, + { + "binding": "record-proof-supplement", + "cls": "reproduce-driver", + "exists": true, + "path": "scripts/verify_frontier1094.py", + "sha256": "c7e20f59968ed5736fb859735de4de207de3418083e37012310ebcded946b949" + }, + { + "binding": "record-proof-supplement", + "cls": "reproduce-driver", + "exists": true, + "path": "scripts/verify_frontier1042.py", + "sha256": "700fdcaeb6e8f57f6e63c71c2dd1652fc5b183e8d706cd092779bdc0d271e854" + }, + { + "binding": "record-proof-supplement", + "cls": "reproduce-driver", + "exists": true, + "path": "scripts/verify_replay_coverage.py", + "sha256": "babe5941d7e6dac4248613ef01f950ee7bb6199e7355021aea4cf854fd1b91c5" + }, + { + "binding": "checkpoint-self-binding", + "cls": "reproduce-driver", + "exists": true, + "path": "certificates/checkpoints/frontier1042.json", + "sha256": "207d1f49f113c585024b9d3c17eadbb8b1be17c1321e3d190aabe2f18ce1c5b7" + }, + { + "binding": "NONE", + "cls": "reproduce-driver", + "exists": true, + "path": "research/community-frontier1042-audit/RESULT.json", + "sha256": "bf12c6ed3b412539638b76addb40591a631609b2ab9e5ee0db1f6bbe067d0ec0" + }, + { + "binding": "record-proof-supplement", + "cls": "reproduce-driver", + "exists": true, + "path": "research/community-batch1099-audit/check_frontier1094.py", + "sha256": "2608ef213260a43d09a40b3429742f7a5f280861b54acae66400a7c29a123f51" + }, + { + "binding": "manifest-roots-inventory", + "cls": "frozen-complex-chain", + "exists": true, + "path": "research/complex-t16-rare-pattern-exchanges/verify.py", + "sha256": "b8c2f76b305c5c9ceb42df203deef564857d17f1f8182d0745dda9ab96e3d4de" + }, + { + "binding": "manifest-roots-inventory", + "cls": "frozen-complex-chain", + "exists": true, + "path": "research/complex-t16-rare-pattern-exchanges/MANIFEST.json", + "sha256": "16a964621e718c8da4c859ccbb280c3c00816ca72874e955910fdf0ef27a0adc" + }, + { + "binding": "manifest-roots-inventory", + "cls": "frozen-complex-chain", + "exists": true, + "path": "research/complex-t16-rare-pattern-exchanges/SOURCE.json", + "sha256": "4cfd44cebfe88f4450294239fbea8feecb564338dc3027b76065227f5d19cb6f" + }, + { + "binding": "manifest-roots-inventory", + "cls": "frozen-complex-chain", + "exists": true, + "path": "research/complex-t16-rare-pattern-exchanges/CANDIDATE.json", + "sha256": "e5fe28718bd517bbb2e9cd377778bf76bd89012b71e48889784ea45e4dfd7dd4" + }, + { + "binding": "manifest-roots-inventory", + "cls": "frozen-complex-chain", + "exists": true, + "path": "research/complex-t16-rare-pattern-exchanges/upstream1087.tar.gz", + "sha256": "d4acf04daef85d4514f80ec5fcd2492d0c60e5d6c49fa71b3e6523f8db2dea86" + }, + { + "binding": "manifest-roots-inventory", + "cls": "frozen-complex-chain", + "exists": true, + "path": "research/complex-t16-rare-pattern-exchanges/data/OWNERS.json.gz", + "sha256": "87902c528dfab7d503dcf8a784260e3ab6fb7424c418a1820f7261f25be7b6bc" + }, + { + "binding": "manifest-roots-inventory", + "cls": "frozen-complex-chain", + "exists": true, + "path": "research/complex-t16-rare-pattern-exchanges/data/PLAN.json", + "sha256": "7bd786ba8e66408f02aa9ef446eaf20c1bfe981ea2e4dd1e5a929f0aa7767bc0" + }, + { + "binding": "manifest-roots-inventory", + "cls": "frozen-complex-chain", + "exists": true, + "path": "research/complex-t16-rare-pattern-exchanges/data/SPEC.json", + "sha256": "8cb51f25a5da4a29d3783853025b73ff1f452429d4fdb30c599e598bcab0e71d" + } + ], + "fixtures": { + "consistent_manifest_forgery_accepted": true, + "decimal_mutation": "Selected decimal differs from exact kappa", + "existence_only_mutation_accepted": true, + "healthy_accepted": true, + "inventory_mutation": "Selected package inventory or bytes changed", + "supplement_mutation": "Selected proof supplement changed: research/toy-side/PROOF.md", + "unbound_sidecar_accepted": true, + "uncovered_proof": "Selected primary proof is not covered by a verified digest" + }, + "script_literals_outside_enumeration": [], + "selected_record_sha256": "10b9e340fd8e354a37a0c4813c90e5de1dd42044b5f6aca4a3fc5a42b685fa32", + "selected_source_sha256": "79b3de5db3dbcb9829789ba58e9e45758926031e2a7d80667a08429d369be53b", + "status": "PASS_SELECTED_BINDING_COVERAGE_AUDIT", + "unbound_consumed": [ + "docs/research/community-batch1099-integration.json", + "research/community-frontier1042-audit/RESULT.json", + "research/community-frontier1094-audit/SELECTED-SOURCE.json", + "scripts/verify_selected_result.py" + ] +} diff --git a/research/selected-binding-coverage-seeda342/README.md b/research/selected-binding-coverage-seeda342/README.md new file mode 100644 index 0000000000..96c1fd5ea7 --- /dev/null +++ b/research/selected-binding-coverage-seeda342/README.md @@ -0,0 +1,134 @@ +# Selected binding coverage: which check pins each consumed source? + +**Scoped adversarial audit of one acceptance obligation; no new kappa.** The +selected record carries a `source_manifest` whose inventory check ("Selected +package inventory or bytes changed") is what binds the audited supplier +sources. This package traces that obligation to its actual source-bound checks: +for every repository input consumed by the selected fast acceptance +(`scripts/verify_selected_result.py`) and by the documented reproduce driver +(`scripts/verify_frontier1094.py`, including its `--baseline1042` reuse mode and +the frozen `research/complex-t16-rare-pattern-exchanges` chain), it names the +check that pins the bytes, and it exercises the real `check()` acceptance +function on fixtures that are semantically invalid but superficially +well-formed. + +Prepared by **Aaron Wang**, with help from opencode. Apache-2.0. Substantial AI +assistance is disclosed in [TASK.json](TASK.json); this is not independent human +review. + +## Reproduce + +From the repository root, standard library only (Python 3.10+; the registered +replay uses 3.12): + +```sh +python3 -B research/selected-binding-coverage-seeda342/verify.py +``` + +Expected final line: + +```text +PASS_SELECTED_BINDING_COVERAGE_AUDIT unbound=4 fixtures=7 +``` + +## Result + +Of the 20 consumed repository inputs: + +| Binding class | Count | Examples | +| --- | ---: | --- | +| manifest-roots inventory (1,579 pinned files over 13 package roots) | 8 | the whole frozen complex chain, including `upstream1087.tar.gz` | +| record `proof_supplements` digests | 5 | `verify_frontier1094.py`, `verify_frontier1042.py`, `verify_replay_coverage.py`, `check_frontier1094.py`, the batch1099 review | +| record `certificate_sha256` | 1 | `ASSEMBLY.json` | +| checkpoint self-binding (its own record re-enters `check()`) | 1 | `certificates/checkpoints/frontier1042.json` | +| record root of trust | 1 | `certificates/selected-result.json` | +| **NONE** | 4 | see below | + +The four unbound consumed inputs: + +1. `research/community-frontier1094-audit/SELECTED-SOURCE.json` — the inventory + anchor itself. `check()` binds all 1,579 inventory files to the manifest's + digest list, but the record has no `source_manifest_sha256`, so the manifest's + own bytes are read unverified. Fixture 7 shows the consequence: a + semantically invalid but superficially well-formed forgery that changes an + inventory file **and** the manifest digest list consistently passes the + acceptance unchanged. +2. `scripts/verify_selected_result.py` — the acceptance checker's own bytes are + pinned by no record-level check (root-of-trust observation). +3. `research/community-frontier1042-audit/RESULT.json` — the published baseline + receipt that `verify_frontier1094.py --baseline1042` compares its supplied + work directory against. The comparison target is unbound at record level; the + receipt's *claims* are still constrained downstream (the driver checks its + stage list, kappa constant and recorded script hashes against the live + repository scripts), but the anchor bytes are trusted. +4. `docs/research/community-batch1099-integration.json` — an existence-only + publication pointer by documented design ("Other publication pointers retain + their existence check"). + +## Fixtures (through the real `check()` of `scripts/verify_selected_result.py`) + +| Fixture | Outcome | Exact error / note | +| --- | --- | --- | +| healthy synthetic record | accepted | — | +| mutate one manifest-inventory file | rejected | `Selected package inventory or bytes changed` | +| mutate one proof-supplement file | rejected | `Selected proof supplement changed: ...` | +| proof with no covering digest | rejected | `Selected primary proof is not covered by a verified digest` | +| wrong `decimal` | rejected | `Selected decimal differs from exact kappa` | +| mutate existence-only pointer | **accepted** | documented boundary | +| mutate unbound sidecar | **accepted** | no check covers it | +| consistent manifest-anchor forgery | **accepted** | the pin mechanism cannot bind its own anchor | + +So the obligation "the audited sources are the consumed sources" does follow +from source-bound checks for the entire frozen supplier payload (all 1,579 +manifest files, both upstream archives via package MANIFEST self-pins, and the +five pinned harness scripts), and does not follow for the four items above. No +selected certificate, supplier, or frontier value is affected; this changes no +kappa. + +## Scope, method and controls + +- Exact base `0b1cccf86e2f5132ed286a26ef0a681a495740ea`; selected-record SHA-256 + `10b9e340fd8e354a37a0c4813c90e5de1dd42044b5f6aca4a3fc5a42b685fa32`. + Pins: [SOURCES.json](SOURCES.json); task card: [TASK.json](TASK.json). +- The consumed set is enumerated from the pinned scripts' literal path reads and + subprocess calls. A control regex-scans both pinned scripts for path literals + resolving to repository files and requires every one to sit inside the + enumeration or the record's `proof_supplements`; the receipt records the + (empty) remainder. +- Fixtures run the imported production `check()` in a temporary directory; the + working tree is read-only. The receipt is deterministic and compared to + [EXPECTED.json](EXPECTED.json). +- Not checked: the mathematical content of any supplier obligation, the full + cold replay (`make frontier1094-verify`, whose make target could not run on + this host; make is not installed), CI, and any proposed record change. The + enumeration covers the fast acceptance and the documented reproduce driver; + deeper frozen-chain internals are classified by their package pins, not + line-audited. + +## Nearest prior work and what this adds + +`research/selected-source-coverage-audit` (seed 97 consolidation note) maps +*review* coverage of the selected record's `source_prs` list against the PR +ledger; it asks whether dispositions exist. This package asks a different +question: which check pins the *bytes* of each consumed input, with fixtures +against the live acceptance function. `research/frontier1094-ancestry-binding-seed69` +(Sagar Thakrar) reproduces the PR799/PR741 ancestry binding of the reuse path +through `check_selected`; that binding is counted here as `checkpoint-self-binding` +and not re-audited. `research/retained-bit-supplier-binding` guards the bit +supplier identity across committed assemblies; this package does not touch that +identity. Credit to the `research/owner-boundary-audit` line (Tekalign) for the +"trace one obligation, then try to break it with one fixture" method. + +## Open next questions + +- **Should the selected record pin the bytes of its source manifest?** + Why it matters: the inventory anchor is currently trusted, and fixture 7 + shows a consistent forgery passes. First step: add `source_manifest_sha256` + to `certificates/selected-result.json` and one `require()` in + `scripts/verify_selected_result.py`. Blocked by: maintainer authorization to + change the selected record and its acceptance script. +- **Should the `--baseline1042` comparison target and the acceptance checker + itself be record-pinned?** Why it matters: both are unbound anchors of the + documented acceptance. First step: add the two digests to `proof_supplements` + and re-run this trace. Blocked by: maintainer authorization, and a decision + on whether a checker should pin itself inside the record it verifies. diff --git a/research/selected-binding-coverage-seeda342/SOURCES.json b/research/selected-binding-coverage-seeda342/SOURCES.json new file mode 100644 index 0000000000..44dcdae252 --- /dev/null +++ b/research/selected-binding-coverage-seeda342/SOURCES.json @@ -0,0 +1,31 @@ +{ + "base_commit": "0b1cccf86e2f5132ed286a26ef0a681a495740ea", + "files": [ + { + "git_blob": "ae6a99f28aa468649eb66a361e764d769363bf11", + "path": "certificates/selected-result.json", + "sha256": "10b9e340fd8e354a37a0c4813c90e5de1dd42044b5f6aca4a3fc5a42b685fa32", + "usage": "input" + }, + { + "git_blob": "6a75493790b4eff9c4a98051ef8b01d6aad0d5a8", + "path": "research/community-frontier1094-audit/SELECTED-SOURCE.json", + "sha256": "79b3de5db3dbcb9829789ba58e9e45758926031e2a7d80667a08429d369be53b", + "usage": "input" + }, + { + "git_blob": "c755b76e0d44ba4917aa94440ebe54daefce5b2a", + "path": "scripts/verify_selected_result.py", + "sha256": "d7fd929726b326aeeaf0a3996475adec88eee9aac09ae0bebeeaa0bc1fc8f199", + "usage": "input" + }, + { + "git_blob": "06c96f5579bb67ed1b86d334e78fbed7da6945f1", + "path": "docs/research/agent-task-catalog.json", + "sha256": "6686ad58f1fbdbc87134a78901b60fd53a20d3984355e91defbbebc9e9fa8075", + "usage": "provenance" + } + ], + "note": "Pins are Git blobs and SHA-256 at the exact base commit. The consumed-input classification target is certificates/selected-result.json plus its SELECTED-SOURCE.json inventory; scripts/verify_selected_result.py provides the real check() acceptance function used by the fixtures. The task catalogue is pinned for card provenance only.", + "schema_version": 1 +} diff --git a/research/selected-binding-coverage-seeda342/TASK.json b/research/selected-binding-coverage-seeda342/TASK.json new file mode 100644 index 0000000000..e942ed2caf --- /dev/null +++ b/research/selected-binding-coverage-seeda342/TASK.json @@ -0,0 +1,66 @@ +{ + "actual_scope": "Binding-coverage boundary of the selected acceptance: for every repository input consumed by the selected fast acceptance (scripts/verify_selected_result.py) and the documented reproduce driver (scripts/verify_frontier1094.py including --baseline1042 reuse and the frozen complex-t16 chain), which source-bound check pins its bytes; smallest rejection/acceptance fixtures through the real check() for each pin class.", + "ai_assistance": "Prepared by Aaron Wang with help from opencode (substantial AI assistance in task selection, implementation, verification and writing). The author reviewed and is responsible for the result; no independent human review is claimed.", + "author": "Aaron Wang", + "base_commit": "0b1cccf86e2f5132ed286a26ef0a681a495740ea", + "bottleneck_link": "Reliability side result, no kappa: it names exactly which check binds each consumed input of the selected acceptance and which four are unbound (the manifest anchor, the acceptance checker itself, the published PR1042 baseline receipt, and the existence-only integration pointer), with fixtures showing what the pin mechanism does and does not reject.", + "budget_minutes": 60, + "evidence": "verify.py prints PASS_SELECTED_BINDING_COVERAGE_AUDIT unbound=4 fixtures=7 on Python 3.12 and 3.13 in about 3 s: 20 consumed inputs classified (8 manifest-roots, 5 record-proof-supplement, 1 record-certificate-sha256, 1 checkpoint-self-binding, 1 record-root-of-trust, 4 NONE); synthetic fixtures through the real check() reject inventory, supplement, uncovered-proof and decimal mutations with their exact errors and accept existence-only, unbound-sidecar and consistent manifest-anchor forgeries; a literal scan of the pinned verify_frontier1094.py/verify_selected_result.py leaves no consumed file outside the enumeration.", + "open_questions": [ + { + "blocked_by": "Maintainer authorization to change the selected record and its acceptance script; both are pinned inputs of many packages, so the change needs the usual review.", + "first_step": "Add a source_manifest_sha256 field to certificates/selected-result.json and one require() in scripts/verify_selected_result.py.check; regenerate the record under maintainer authorization and re-run make selected-record-check (the make target's underlying script since make is unavailable on some hosts).", + "question": "Should the selected record pin the bytes of its source manifest (a source_manifest_sha256 field, mirroring certificate_sha256), so the inventory anchor is bound rather than trusted?", + "why_it_matters": "The inventory equality check binds all 1,579 supplier files to the manifest, but the manifest's own bytes are read unverified; fixture 7 shows a consistent manifest-plus-file forgery is accepted. Binding the anchor closes the loop at zero cost to normal use." + }, + { + "blocked_by": "Maintainer authorization to change the selected record; also decide whether self-pinning a checker inside the record it verifies is the intended trust model.", + "first_step": "Add the two digests to proof_supplements in the selected record and re-run the binding trace here to confirm the unbound class shrinks to the documented existence-only pointers.", + "question": "Should the --baseline1042 reuse comparison target (research/community-frontier1042-audit/RESULT.json) be record-pinned, and should scripts/verify_selected_result.py itself be added to proof_supplements?", + "why_it_matters": "The reuse mode compares the supplied baseline receipt against this unbound repository copy, and the acceptance checker's own bytes are unconstrained by every record-level pin; both are root-of-trust or comparison anchors today." + } + ], + "original_card": { + "acceptance_gate": "Pin the current sources and one obligation; the historical owner audit is an example, not evidence of a current bug.", + "allowed_variations": [ + "Audit one named current condition using a new semantic counterexample." + ], + "bottleneck_link": "Closing a current acceptance gap or proof obligation strengthens reliability even without changing kappa.", + "first_experiment": "Choose one current supplier obligation and trace whether its acceptance depends on an independent check.", + "first_step": { + "command": [ + "python3", + "-B", + "research/owner-boundary-audit/verify.py" + ], + "expected": "PASS_PR626_NEXT_TOUCH_BOUNDARY_AUDIT", + "inspect": "Identify why the timing-only omission passes but the full production controller still rejects it.", + "scope": "Positive control / source-bound orientation only; this is not a new construction or full cold replay." + }, + "id": "supplier-boundary-audit", + "methods": [ + "Trace one hypothesis through the source, checker and complete caller.", + "Construct one semantically invalid but superficially well-formed fixture and test rejection." + ], + "overlap_terms": [ + "owner boundary", + "bridge omission", + "hosting" + ], + "question": "Does one selected supplier obligation follow from its actual source-bound checks?", + "scope_change_triggers": [ + "Reporting the historical timing-only diagnostic as a new current acceptance bug." + ], + "starting_points": [ + "certificates/selected-result.json", + "research/owner-boundary-audit/README.md" + ] + }, + "outcome": "completed", + "priority_revision": 3, + "schema_version": 1, + "scope_change_reason": "The card asks for one selected supplier obligation traced through its source-bound checks with one semantically invalid but well-formed fixture. The traced obligation is the source-binding/coverage obligation of the selected record (the audited sources are the consumed sources), narrowed to the pin boundary of the acceptance path; the historical owner audit example (bridge-omission timing blind spot) was already spent on PR626 and its current-chain successor is covered by adjacent packages, while the byte-coverage question is untouched by any live claim found at 2026-10-14 12:01 UTC.", + "scope_status": "refined", + "stop_rule": "Stop after the deterministic binding table, the seven fixtures through the real check() (three rejections of bound mutations, one uncovered-proof rejection, one decimal rejection, three acceptances of unbound mutations) and the literal-scan control; no full cold replay, no pinned-verifier edits, no further mutation classes.", + "task_id": "supplier-boundary-audit" +} diff --git a/research/selected-binding-coverage-seeda342/VERIFY.json b/research/selected-binding-coverage-seeda342/VERIFY.json new file mode 100644 index 0000000000..1c7a56cdcb --- /dev/null +++ b/research/selected-binding-coverage-seeda342/VERIFY.json @@ -0,0 +1,22 @@ +{ + "commands": [ + { + "argv": [ + "{python}", + "-B", + "{package}/verify.py" + ], + "checks": "Classifies all 20 consumed inputs of the selected fast acceptance and reproduce driver by their binding check, runs seven synthetic fixtures through the real verify_selected_result.check() (bound mutations rejected, unbound mutations accepted), scans the pinned driver scripts' literal paths for consumed files outside the enumeration, and compares the deterministic receipt to EXPECTED.json.", + "timeout_seconds": 120 + } + ], + "inputs": [ + "certificates/selected-result.json", + "research/community-frontier1094-audit/SELECTED-SOURCE.json", + "scripts/verify_selected_result.py" + ], + "python": "3.12", + "requirements": [], + "schema_version": 1, + "status": "ready" +} diff --git a/research/selected-binding-coverage-seeda342/verify.py b/research/selected-binding-coverage-seeda342/verify.py new file mode 100644 index 0000000000..a46d513f0d --- /dev/null +++ b/research/selected-binding-coverage-seeda342/verify.py @@ -0,0 +1,241 @@ +"""Binding-coverage trace of the selected acceptance, with real-check fixtures. + +Question (adversarial-audit / supplier-boundary-audit, refined): does the +selected supplier obligation "the audited sources are the consumed sources" +follow from the actual source-bound checks? This checker + +1. enumerates the repository inputs consumed by the selected fast acceptance + (scripts/verify_selected_result.py) and by the documented reproduce driver + (scripts/verify_frontier1094.py, including its --baseline1042 reuse mode and + the frozen research/complex-t16-rare-pattern-exchanges chain), +2. classifies every consumed path by the check that binds its bytes: + manifest-roots inventory, record proof_supplements, record certificate hash, + package-internal MANIFEST pins, checkpoint self-binding, or NONE, +3. exercises the real check() acceptance function from + scripts/verify_selected_result.py on synthetic fixtures: bound-file + mutations must be rejected, unbound-file mutations must be accepted, +4. compares the deterministic receipt to EXPECTED.json. + +Read-only on the working tree; fixtures live in a temporary directory. +Python 3.10+, standard library only. Aaron Wang, with help from opencode. +""" +import json +import hashlib +import re +import shutil +import sys +import tempfile +from fractions import Fraction +from pathlib import Path + +ROOT = Path(__file__).resolve().parents[2] +sys.path.insert(0, str(ROOT / "scripts")) +import verify_selected_result as vsr # noqa: E402 (real acceptance function) + + +def sha(path): + return hashlib.sha256(path.read_bytes()).hexdigest() + + +def load(name): + return json.loads((ROOT / name).read_text(encoding="utf-8")) + + +# Consumed repository inputs of the selected acceptance paths. Derived from +# the pinned scripts' literal path reads and subprocess calls; the scan_lits() +# control below re-derives every literal path those scripts mention. +CONSUMED = { + "fast-path": [ + "certificates/selected-result.json", + "research/community-frontier1094-audit/ASSEMBLY.json", + "research/community-frontier1094-audit/SELECTED-SOURCE.json", + "docs/research/community-batch1099-review.md", + "docs/research/community-batch1099-integration.json", + ], + "reproduce-driver": [ + "scripts/verify_selected_result.py", + "scripts/verify_frontier1094.py", + "scripts/verify_frontier1042.py", + "scripts/verify_replay_coverage.py", + "certificates/checkpoints/frontier1042.json", + "research/community-frontier1042-audit/RESULT.json", + "research/community-batch1099-audit/check_frontier1094.py", + ], + "frozen-complex-chain": [ + "research/complex-t16-rare-pattern-exchanges/verify.py", + "research/complex-t16-rare-pattern-exchanges/MANIFEST.json", + "research/complex-t16-rare-pattern-exchanges/SOURCE.json", + "research/complex-t16-rare-pattern-exchanges/CANDIDATE.json", + "research/complex-t16-rare-pattern-exchanges/upstream1087.tar.gz", + "research/complex-t16-rare-pattern-exchanges/data/OWNERS.json.gz", + "research/complex-t16-rare-pattern-exchanges/data/PLAN.json", + "research/complex-t16-rare-pattern-exchanges/data/SPEC.json", + ], +} + + +def scan_lits(paths): + """Every '...' literal in the pinned scripts that resolves to a repo file.""" + out = set() + for name in paths: + text = (ROOT / name).read_text(encoding="utf-8", errors="replace") + for lit in re.findall(r"['\"]([A-Za-z0-9_./+-]+\.[A-Za-z0-9]{2,6})['\"]", text): + if (ROOT / lit).is_file(): + out.add(lit) + return out + + +def classify(record, manifest): + roots = manifest.get("package_roots", []) + manifest_files = set(manifest["files"]) + supplements = set(record["proof_supplements"]) + rows = [] + for cls, names in CONSUMED.items(): + for name in names: + path = ROOT / name + if name == "certificates/selected-result.json": + bound = "record-root-of-trust" + elif name == "research/community-frontier1094-audit/SELECTED-SOURCE.json": + bound = "NONE" + elif name in manifest_files: + bound = "manifest-roots-inventory" + elif name in supplements: + bound = "record-proof-supplement" + elif name == record["certificate"]: + bound = "record-certificate-sha256" + elif any(name.startswith(r + "/") for r in roots) and name.endswith( + ("MANIFEST.json", "SOURCE.json") + ): + bound = "package-internal-pin-root" + elif any(name.startswith(r + "/") for r in roots): + bound = "package-manifest-self-pin" + elif name.startswith("certificates/checkpoints/"): + bound = "checkpoint-self-binding" + elif name.startswith("scripts/") and name in supplements: + bound = "record-proof-supplement" + else: + bound = "NONE" + rows.append(dict(cls=cls, path=name, binding=bound, exists=path.is_file(), + sha256=sha(path) if path.is_file() else None)) + return rows + + +def expect_error(fn, fragment): + try: + fn() + except ValueError as error: + assert fragment in str(error), f"wrong rejection {error!r} for {fragment!r}" + return str(error) + raise AssertionError("fixture was accepted but must be rejected: " + fragment) + + +def fixtures(): + """Synthetic fixtures through the real vsr.check acceptance function.""" + with tempfile.TemporaryDirectory() as tmp: + root = Path(tmp) + pkg = root / "research/toy-audit" + pkg.mkdir(parents=True) + (root / "research/toy-side").mkdir() + cert = {"kappa": "3/2000"} + (pkg / "CERTIFICATE.json").write_text(json.dumps(cert)) + (pkg / "inventory-file.txt").write_text("pinned payload\n") + (pkg / "SELECTED-SOURCE.json").write_text(json.dumps({ + "files": { + "CERTIFICATE.json": sha(pkg / "CERTIFICATE.json"), + "inventory-file.txt": sha(pkg / "inventory-file.txt"), + }})) + proof = root / "research/toy-side/PROOF.md" + proof.write_text("proof bytes\n") + review = root / "research/toy-side/REVIEW.md" + review.write_text("existence-only pointer\n") + record = { + "kappa": "3/2000", "decimal": "3/2000", + "certificate": "research/toy-audit/CERTIFICATE.json", + "certificate_sha256": sha(pkg / "CERTIFICATE.json"), + "source_manifest": "research/toy-audit/SELECTED-SOURCE.json", + "proof": "research/toy-side/PROOF.md", + "proof_supplements": {"research/toy-side/PROOF.md": sha(proof)}, + "review": "research/toy-side/REVIEW.md", + "validation": "research/toy-side/REVIEW.md", + } + outcomes = {} + vsr.check(record, root) + outcomes["healthy_accepted"] = True + # 1. bound inventory mutation is rejected + (pkg / "inventory-file.txt").write_text("corrupted payload\n") + outcomes["inventory_mutation"] = expect_error( + lambda: vsr.check(record, root), "Selected package inventory or bytes changed") + (pkg / "inventory-file.txt").write_text("pinned payload\n") + # 2. proof-supplement mutation is rejected + proof.write_text("corrupted proof\n") + outcomes["supplement_mutation"] = expect_error( + lambda: vsr.check(record, root), "Selected proof supplement changed") + proof.write_text("proof bytes\n") + # 3. proof without a covering digest is rejected + record2 = dict(record, proof_supplements={"research/toy-side/REVIEW.md": sha(review)}) + outcomes["uncovered_proof"] = expect_error( + lambda: vsr.check(record2, root), "Selected primary proof is not covered") + # 4. existence-only pointer mutation is accepted + review.write_text("semantically wrong review text\n") + vsr.check(record, root) + outcomes["existence_only_mutation_accepted"] = True + review.write_text("existence-only pointer\n") + # 5. decimal/kappa disagreement is rejected + record3 = dict(record, decimal="3/1000") + outcomes["decimal_mutation"] = expect_error( + lambda: vsr.check(record3, root), "Selected decimal differs") + # 6. unbound sidecar consumed by nothing in check() is accepted + side = root / "research/toy-side/UNBOUND-RECEIPT.json" + side.write_text("{}") + vsr.check(record, root) + side.write_text('{"forged": true}') + vsr.check(record, root) + outcomes["unbound_sidecar_accepted"] = True + # 7. the manifest anchor is unbound: consistent forgery of an + # inventory file and the manifest's own digest list is accepted + (pkg / "inventory-file.txt").write_text("forged payload\n") + (pkg / "SELECTED-SOURCE.json").write_text(json.dumps({ + "files": { + "CERTIFICATE.json": sha(pkg / "CERTIFICATE.json"), + "inventory-file.txt": sha(pkg / "inventory-file.txt"), + }})) + vsr.check(record, root) + outcomes["consistent_manifest_forgery_accepted"] = True + return outcomes + + +def main(): + assert __debug__, "assertions required" + record = load("certificates/selected-result.json") + manifest = load("research/community-frontier1094-audit/SELECTED-SOURCE.json") + rows = classify(record, manifest) + assert all(r["exists"] for r in rows), "missing consumed input" + lits = scan_lits(["scripts/verify_frontier1094.py", "scripts/verify_selected_result.py"]) + enumerated = {r["path"] for r in rows} | set(record["proof_supplements"]) + unenumerated = sorted(lits for lits in lits if lits not in enumerated) + counts = {} + for r in rows: + counts[r["binding"]] = counts.get(r["binding"], 0) + 1 + unbound = sorted(r["path"] for r in rows if r["binding"] == "NONE") + fx = fixtures() + receipt = { + "status": "PASS_SELECTED_BINDING_COVERAGE_AUDIT", + "selected_record_sha256": sha(ROOT / "certificates/selected-result.json"), + "selected_source_sha256": sha(ROOT / "research/community-frontier1094-audit/SELECTED-SOURCE.json"), + "consumed": rows, + "binding_counts": counts, + "unbound_consumed": unbound, + "script_literals_outside_enumeration": unenumerated, + "fixtures": fx, + } + if "--emit" in sys.argv: + print(json.dumps(receipt, indent=2, sort_keys=True)) + return + expected = json.loads((ROOT / "research/selected-binding-coverage-seeda342/EXPECTED.json").read_text()) + assert receipt == expected, "receipt differs from EXPECTED.json" + print(json.dumps(receipt, indent=2, sort_keys=True)) + print("PASS_SELECTED_BINDING_COVERAGE_AUDIT unbound=%d fixtures=7" % len(unbound)) + + +if __name__ == "__main__": + main()