From 7fa59a6a5bbb22e4ba6c8aabfa171245e1256cc7 Mon Sep 17 00:00:00 2001 From: Adam Gall Date: Wed, 14 Oct 2026 09:44:21 -0400 Subject: [PATCH] Audit selected generated identities for complete field coverage --- .../README.md | 187 ++++++++++ .../RESULT.json | 309 ++++++++++++++++ .../SOURCES.json | 42 +++ .../TASK.json | 115 ++++++ .../VERIFY.json | 34 ++ .../test_audit.py | 72 ++++ .../verify.py | 337 ++++++++++++++++++ 7 files changed, 1096 insertions(+) create mode 100644 research/selected-generated-identity-audit/README.md create mode 100644 research/selected-generated-identity-audit/RESULT.json create mode 100644 research/selected-generated-identity-audit/SOURCES.json create mode 100644 research/selected-generated-identity-audit/TASK.json create mode 100644 research/selected-generated-identity-audit/VERIFY.json create mode 100755 research/selected-generated-identity-audit/test_audit.py create mode 100755 research/selected-generated-identity-audit/verify.py diff --git a/research/selected-generated-identity-audit/README.md b/research/selected-generated-identity-audit/README.md new file mode 100644 index 0000000000..235c22bac4 --- /dev/null +++ b/research/selected-generated-identity-audit/README.md @@ -0,0 +1,187 @@ +# Selected-lineage generated-identity field audit + +**Exact bounded audit; no defect found, no repair and no new kappa.** The +seven-artifact projection in +[`gauge44-slots-t16/code/generated_identity.py`](../gauge44-slots-t16/code/generated_identity.py) +retains all proof-relevant fields of the reviewed `slots/local` input. Its sole +field exclusion is the root `CLIFFORD-REVIEW.json#/seconds`; four raw file +references are checked before being replaced by content identities. This +package changes no predecessor, immutable archive, source pin or selected record. + +## Concrete result + +The input is the seven `slots/local/` members of +`community-frontier1042-audit/selected-replay.tar.gz`, authenticated by the +archive's exact SHA-256 and the corresponding `RESULT.json` member hashes. +This is the actual R480 selected local input inherited by PR1094, **not** the +historical R492 `gauge44-slots-t16/evidence/local/` directory. The earlier +[selected1042 lineage resolution](../selected1042-lineage-resolution98/README.md) +established this distinction. The audited implementation's hash is also checked +against PR1094's retained selected-source manifest. + +| Artifact | Retained tree nodes | Identity domain | +| --- | ---: | --- | +| `CANONICAL-WORD.json.gz` | 152,706 | All 492,283 decompressed bytes | +| `LOCAL-PROGRAMS.json.gz` | 572,575 | All 2,084,018 decompressed bytes | +| `LOCAL-CHECKS.json` | 31 | Complete canonical JSON | +| `INDEPENDENT-LOCAL-REPLAY.json` | 63 | Complete reference-rebound canonical JSON | +| `CLIFFORD-RECIPES.json` | 211,459 | Complete canonical JSON | +| `CLIFFORD-REVIEW.json` | 16 | Complete reference-rebound JSON except root time | +| `RESIDUAL-ADAPTERS.json` | 2,753 | Complete canonical JSON | +| **Total** | **939,603** | | + +The original trees contain 939,604 nodes. Exactly one node, root phase time, +is removed. Nodes include every object, array and scalar; the census records +object keys and list positions, not merely leaf counts. `RESULT.json` retains +per-artifact type counts, typed-path transcript hashes and artifact identities. + +There are **155 receipt mutation cases**: omit and replace each nonroot node +of both receipts (124 native and 31 phase), except the deliberately permissible +replacement of valid root phase time. This includes all four raw-reference +slots, both orientation profiles, arbitrary-dirty column counts, charged bits, +private-work restoration, every negative-control entry, phase ranks, adapters, +status and scope. All 155 reject. The package does not describe this as 939,603 +separately executed mutations: full-tree identity coverage and the receipt +mutation census are distinct evidence. + +There are **181 negative controls in total**, including stale references after +recompression/reformatting, Boolean-to-integer changes, unfamiliar nested +`seconds` fields, invalid timing, one omitted root field in each artifact with +references correctly rebound, decompressed serialization drift, and truncated +gzip streams. **Nine positive controls** accept the complete independent +identity oracle, three valid root timings, four alternate gzip containers and +reformatted plain JSON with an updated raw recipe reference. + +## Independent oracle and exact boundary + +The oracle does not call the audited canonicalizer or `json.dumps` to construct +an expected identity. It recursively encodes all dictionaries, lists, strings, +integers, Booleans and nulls, with its own JSON string escaping and sorted object +keys. Its supported domain is the actual retained data: the only input float is +the excluded root timing. Unexpected retained floats fail rather than silently +borrowing the primary serializer. This is not a general-purpose JSON library. + +For each of the five plain JSON artifacts, the independently encoded **entire +expected tree** hashes to the actual primary identity. For each gzip artifact, +the entire decompressed byte string hashes to its primary identity; parsing is +used only for the additional tree census, not to relax byte equality. For both +receipt projections, an independent typed-path traversal also compares the +expected and actual projected trees. It distinguishes `true` from `1`, retains +empty containers, and includes every key and index. A focused oracle-fault test +removes the global-phase field from the returned phase projection and requires +this independent tree check to reject it. + +The exact transformation is: + +1. Keep each plain JSON value, including unfamiliar fields, in full. +2. In phase review only, require a finite nonnegative `int` or `float` time + (not `bool`), then remove its root `seconds` field. +3. In native replay, require the literal canonical-word and local-program hashes + to match the current files, then replace them by full decompressed hashes. +4. In phase review, require its canonical-word and recipe hashes to match the + current files, then replace them by the decompressed-word and canonical-recipe + hashes respectively. +5. Hash the resulting complete canonical JSON trees. + +The reference fields are **rebound, not erased**. Under the ordinary SHA-256 +collision-resistance assumption, the two payload identities bind all their +bytes. Recursive canonical encoding binds the complete retained JSON trees; +only key order/whitespace and the declared timing/reference representation +changes are quotiented out. This is a statement about these authenticated inputs +and this pinned implementation, not universal injectivity of SHA-256 or every +possible JSON parser. The audit's fixture reader rejects duplicate keys and +nonfinite constants; it does not claim the inherited reader generally does so. + +The plain-JSON reformatting allowance belongs to the identity function. Caller +checks may impose additional byte pins, so these controls do not claim that the +complete production binder accepts every reformatted artifact. + +**Generated versus immutable:** alternate containers are created only in a +private temporary directory. The original archive and implementation remain +exact raw-hash inputs. A separate test changes only the immutable archive's gzip +MTIME byte and requires source-pin rejection. Recompression permission is never +applied to an immutable source archive. Invalid/truncated streams are not +silently treated as payload equality. + +## Reproduce + +Python 3.12 standard library; run from the repository root with assertions enabled: + +```sh +python3.12 -I -B research/selected-generated-identity-audit/verify.py +python3.12 -I -B research/selected-generated-identity-audit/test_audit.py +python3.12 -B scripts/research_package.py --package research/selected-generated-identity-audit --check-only +python3.12 -B scripts/research_package.py --package research/selected-generated-identity-audit +``` + +With a uv-managed interpreter, prefix commands with +`uv run --python 3.12 --no-project` and use `python` in place of `python3.12`. +The direct marker is: + +```text +PASS_SELECTED_GENERATED_IDENTITY_AUDIT nodes=939603 receipt_mutations=155 positives=9 negatives=181 +``` + +The initial exact experiment used CPython 3.12.12 on macOS arm64 and completed +in 5.85 seconds including the launcher. The default command writes nothing in +the checkout. `--write-result` is an explicit first-generation option that refuses +to overwrite an existing result. `VERIFY.json` registers the direct replay and +five focused test groups. There are no third-party or native dependencies. + +## Overlap, attribution and limits + +Base: `0b1cccf86e2f5132ed286a26ef0a681a495740ea`. Source hashes and Git blobs are +in `SOURCES.json`; the chosen card, recorded scope and exact overlap heads are +in `TASK.json`. The local task card was written before the substantive experiment. +Parent coordination is [discussion 1884](https://github.com/CrocSwap/integer-mult-bounds/discussions/1884). + +Final focused verification used the direct command, `--check-only`, and the +registered package command above in one phase on the same interpreter. All +passed in 16.05 seconds combined in the publication recheck. The registered +command replayed the exact result and ran all five focused tests (`Ran 5 tests in 3.892s`, `OK`), ending +with `PASS_REGISTERED_RESEARCH_PACKAGE research/selected-generated-identity-audit outcome=completed`. + +The publication overlap recheck used the shared cached snapshot offline: 543 +open PRs (including drafts, complete pages, 2026-10-14 13:23Z) and 529 discussion +records (complete pages, 13:25Z). It may miss subsequent changes. Targeted live +queries confirmed PR1559 and PR1824 remained open at the heads below. +The full nearby PR bodies and relevant local notes were read: + +- [PR1559](https://github.com/CrocSwap/integer-mult-bounds/pull/1559), head + `c4f8af1dcf9fc2317c893b6b250007ded5ef879f`, fixes two PR589 gzip `cmp` sites. +- [PR1824](https://github.com/CrocSwap/integer-mult-bounds/pull/1824), head + `ad5b1248f25a71983b20617e2f3a80be22f03990`, replays the selected final stage + across interpreters and compares its outputs. +- [T37 receipt-role binding](../t37-receipt-role-binding/README.md) finds actual + collisions in a different eight-input path normalizer. +- [Joint-prefix validation](../complex-joint-prefix-validation/README.md) + previously compared complete runtime identities across platforms; it does not + supply this independent all-node oracle and exhaustive receipt mutation census. + +No-match is not novelty: these searches exclude code diffs and most closed-PR +bodies. The result is deliberately a separate audit, not another gzip repair. + +This audit does **not** rebuild a supplier, authenticate historical execution, +replay the selected cold construction, prove full caller acceptance, test other +operating systems, discharge inherited theorem assumptions, or improve kappa. +In particular, the producer's raw archive receipt and the generated portable +identity are different evidence domains. No independent human review is claimed. + +Credit Jeremy Kothe, Rohan Arun, Hao Yan and the retained native/compiler/supplier +lineage, and Douglas Colkitt's maintainer replay and identity convention. Credit +Maxime Fleury's gzip reproducibility audit following Antoine Olivier's independent +replay, and the authors of the selected1042 lineage-resolution package for the +correct archived input location. Prepared for Adam Gall (@adamgall) with +substantial OpenAI Codex assistance in audit design, implementation, experiments, +testing and writing. New work is Apache-2.0; predecessor files and notices remain +unchanged. + +## Open next questions + +Do other current normalizers preserve roles and all proof-relevant fields? +This matters because neither this result nor prior gzip portability fixes certify +other projections or caller acceptance logic. A feasible next step is to choose +one distinct overlap-checked comparator, pin its actual input and repeat an +independent all-field oracle plus a bounded omission census. There is no technical +blocker, but it requires a separately scoped audit; this package makes no claim +about those other comparators. The structured question is in `TASK.json`. diff --git a/research/selected-generated-identity-audit/RESULT.json b/research/selected-generated-identity-audit/RESULT.json new file mode 100644 index 0000000000..768f85231e --- /dev/null +++ b/research/selected-generated-identity-audit/RESULT.json @@ -0,0 +1,309 @@ +{ + "status": "PASS_SELECTED_GENERATED_IDENTITY_AUDIT", + "coverage": { + "CANONICAL-WORD.json.gz": { + "nodes": 152706, + "types": { + "NoneType": 176, + "dict": 3, + "int": 109275, + "list": 23583, + "str": 19669 + }, + "typed_path_sha256": "a747371df39d6adb42b6390b86a8dc12096ba999ca36e4580bb7de4e5ec1d234", + "identity_sha256": "4ddb29fb9bc6f27e0c0fbfcf19a2a93a3496ad900d0f6d89059d0305c9576c0c", + "comparison_domain": "complete decompressed bytes", + "payload_bytes": 492283 + }, + "LOCAL-PROGRAMS.json.gz": { + "nodes": 572575, + "types": { + "dict": 1, + "int": 229948, + "list": 166248, + "str": 176378 + }, + "typed_path_sha256": "860772a206b2d7ea8c55c74f6ffa9fdf544555b705f78ee22342c1ea43cf103f", + "identity_sha256": "9f41d53659e9be84e20c661560c5687abbf5cd0660cdecbe01ad5eb29e6b8ee3", + "comparison_domain": "complete decompressed bytes", + "payload_bytes": 2084018 + }, + "LOCAL-CHECKS.json": { + "nodes": 31, + "types": { + "bool": 4, + "dict": 5, + "int": 20, + "str": 2 + }, + "typed_path_sha256": "cf0f597445ffab5c0c020fe8e11304abc17d096c931df5c82ee377713d48557d", + "identity_sha256": "18f09b79835aa352f04d27041d86d1338c5ad0094b888588c1c05af2dc399ffd", + "comparison_domain": "complete canonical JSON tree", + "payload_bytes": null + }, + "INDEPENDENT-LOCAL-REPLAY.json": { + "nodes": 63, + "types": { + "bool": 2, + "dict": 7, + "int": 22, + "list": 1, + "str": 31 + }, + "typed_path_sha256": "482b79f39612989f04cb1f3bd1458a84523c5637a9cc6b51a864eb2c001c536b", + "identity_sha256": "2d4680965c62db1fde1236c4857b19bf7bc97af58805e6b4109afbc452f0fdd8", + "comparison_domain": "complete canonical JSON tree", + "payload_bytes": null + }, + "CLIFFORD-RECIPES.json": { + "nodes": 211459, + "types": { + "NoneType": 224, + "dict": 9137, + "int": 183824, + "list": 18050, + "str": 224 + }, + "typed_path_sha256": "02efc05022927f6a2c6d961ee9ebcc8a317b9228eb30d4592d167efdcc48a7a7", + "identity_sha256": "d0768f2164d5f64a2fdbec422f1cfde4e400818792f1904ca541958377243731", + "comparison_domain": "complete canonical JSON tree", + "payload_bytes": null + }, + "CLIFFORD-REVIEW.json": { + "nodes": 16, + "types": { + "bool": 1, + "dict": 2, + "int": 9, + "str": 4 + }, + "typed_path_sha256": "38e7c11aba8b698270cb4dd685335597da73767b75a73334b10bc71ccd7b5f54", + "identity_sha256": "4960fd1215509b5347ef7f0092868f79aea0f8e24fb84352da9a1033e4394007", + "comparison_domain": "complete canonical JSON tree", + "payload_bytes": null + }, + "RESIDUAL-ADAPTERS.json": { + "nodes": 2753, + "types": { + "dict": 110, + "int": 2376, + "list": 266, + "str": 1 + }, + "typed_path_sha256": "9ce0c31a9020667042344371b050f4a3e11f5fdebfe4ab397b28799a67633157", + "identity_sha256": "c682e9ff1b347f89771c6800f46ad98c2bb92b91c5c88452d53a9e7f0180c35f", + "comparison_domain": "complete canonical JSON tree", + "payload_bytes": null + } + }, + "receipt_mutation_census": { + "INDEPENDENT-LOCAL-REPLAY.json": 124, + "CLIFFORD-REVIEW.json": 31 + }, + "raw_reference_slots": { + "INDEPENDENT-LOCAL-REPLAY.json": { + "canonical_word_sha256": "CANONICAL-WORD.json.gz", + "local_programs_sha256": "LOCAL-PROGRAMS.json.gz" + }, + "CLIFFORD-REVIEW.json": { + "canonical_word_sha256": "CANONICAL-WORD.json.gz", + "recipe_sha256": "CLIFFORD-RECIPES.json" + } + }, + "excluded_pointer": "CLIFFORD-REVIEW.json#/seconds", + "positive_controls": [ + "independent_all_field_identity_and_typed_path_projection", + "phase_valid_seconds:0", + "phase_valid_seconds:1.25", + "phase_valid_seconds:100000", + "CANONICAL-WORD.json.gz:recompressed:level1", + "LOCAL-PROGRAMS.json.gz:recompressed:level1", + "CANONICAL-WORD.json.gz:recompressed:level9", + "LOCAL-PROGRAMS.json.gz:recompressed:level9", + "all_plain_JSON_reformatted_with_bound_recipe_reference" + ], + "negative_controls": [ + "INDEPENDENT-LOCAL-REPLAY.json:omit:('canonical_word_sha256',)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('canonical_word_sha256',)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('cold_hyperplane_ended_helpers',)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('cold_hyperplane_ended_helpers',)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('entering_helpers',)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('entering_helpers',)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('helpers',)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('helpers',)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('local',)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('local',)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('local', 'backward')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('local', 'backward')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('local', 'backward', 'all_exact_columns')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('local', 'backward', 'all_exact_columns')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('local', 'backward', 'charged_payload_bits')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('local', 'backward', 'charged_payload_bits')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('local', 'backward', 'prefix_bits_upper')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('local', 'backward', 'prefix_bits_upper')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('local', 'backward', 'prefix_l1_upper')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('local', 'backward', 'prefix_l1_upper')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('local', 'backward', 'private_work_erased')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('local', 'backward', 'private_work_erased')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('local', 'forward')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('local', 'forward')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('local', 'forward', 'all_exact_columns')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('local', 'forward', 'all_exact_columns')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('local', 'forward', 'charged_payload_bits')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('local', 'forward', 'charged_payload_bits')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('local', 'forward', 'prefix_bits_upper')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('local', 'forward', 'prefix_bits_upper')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('local', 'forward', 'prefix_l1_upper')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('local', 'forward', 'prefix_l1_upper')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('local', 'forward', 'private_work_erased')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('local', 'forward', 'private_work_erased')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('local_programs_sha256',)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('local_programs_sha256',)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected',)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected',)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 0)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 0)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 1)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 1)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 2)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 2)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 3)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 3)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 4)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 4)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 5)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 5)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 6)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 6)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 7)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 7)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 8)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 8)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 9)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 9)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 10)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 10)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 11)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 11)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 12)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 12)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 13)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 13)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 14)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 14)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 15)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 15)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 16)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 16)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 17)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 17)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 18)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 18)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 19)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 19)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 20)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 20)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 21)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 21)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 22)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 22)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 23)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 23)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('negative_controls_rejected', 24)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('negative_controls_rejected', 24)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('paid_profiles',)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('paid_profiles',)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('paid_profiles', 'backward')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('paid_profiles', 'backward')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('paid_profiles', 'backward', '1')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('paid_profiles', 'backward', '1')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('paid_profiles', 'backward', '2')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('paid_profiles', 'backward', '2')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('paid_profiles', 'backward', '3')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('paid_profiles', 'backward', '3')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('paid_profiles', 'backward', '4')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('paid_profiles', 'backward', '4')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('paid_profiles', 'backward', '5')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('paid_profiles', 'backward', '5')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('paid_profiles', 'backward', '8')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('paid_profiles', 'backward', '8')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('paid_profiles', 'forward')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('paid_profiles', 'forward')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('paid_profiles', 'forward', '1')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('paid_profiles', 'forward', '1')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('paid_profiles', 'forward', '2')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('paid_profiles', 'forward', '2')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('paid_profiles', 'forward', '3')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('paid_profiles', 'forward', '3')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('paid_profiles', 'forward', '4')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('paid_profiles', 'forward', '4')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('paid_profiles', 'forward', '5')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('paid_profiles', 'forward', '5')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('paid_profiles', 'forward', '8')", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('paid_profiles', 'forward', '8')", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('scope',)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('scope',)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('status',)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('status',)", + "INDEPENDENT-LOCAL-REPLAY.json:omit:('v',)", + "INDEPENDENT-LOCAL-REPLAY.json:replace:('v',)", + "CLIFFORD-REVIEW.json:omit:('all_child_equalities_include_global_phase',)", + "CLIFFORD-REVIEW.json:replace:('all_child_equalities_include_global_phase',)", + "CLIFFORD-REVIEW.json:omit:('canonical_word_sha256',)", + "CLIFFORD-REVIEW.json:replace:('canonical_word_sha256',)", + "CLIFFORD-REVIEW.json:omit:('directed_edges',)", + "CLIFFORD-REVIEW.json:replace:('directed_edges',)", + "CLIFFORD-REVIEW.json:omit:('endpoint_adapters',)", + "CLIFFORD-REVIEW.json:replace:('endpoint_adapters',)", + "CLIFFORD-REVIEW.json:omit:('frames',)", + "CLIFFORD-REVIEW.json:replace:('frames',)", + "CLIFFORD-REVIEW.json:omit:('ranks',)", + "CLIFFORD-REVIEW.json:replace:('ranks',)", + "CLIFFORD-REVIEW.json:omit:('ranks', '1')", + "CLIFFORD-REVIEW.json:replace:('ranks', '1')", + "CLIFFORD-REVIEW.json:omit:('ranks', '2')", + "CLIFFORD-REVIEW.json:replace:('ranks', '2')", + "CLIFFORD-REVIEW.json:omit:('ranks', '3')", + "CLIFFORD-REVIEW.json:replace:('ranks', '3')", + "CLIFFORD-REVIEW.json:omit:('ranks', '4')", + "CLIFFORD-REVIEW.json:replace:('ranks', '4')", + "CLIFFORD-REVIEW.json:omit:('ranks', '5')", + "CLIFFORD-REVIEW.json:replace:('ranks', '5')", + "CLIFFORD-REVIEW.json:omit:('ranks', '8')", + "CLIFFORD-REVIEW.json:replace:('ranks', '8')", + "CLIFFORD-REVIEW.json:omit:('recipe_sha256',)", + "CLIFFORD-REVIEW.json:replace:('recipe_sha256',)", + "CLIFFORD-REVIEW.json:omit:('scope',)", + "CLIFFORD-REVIEW.json:replace:('scope',)", + "CLIFFORD-REVIEW.json:omit:('seconds',)", + "CLIFFORD-REVIEW.json:omit:('status',)", + "CLIFFORD-REVIEW.json:replace:('status',)", + "INDEPENDENT-LOCAL-REPLAY.json:boolean_to_integer", + "CLIFFORD-REVIEW.json:boolean_to_integer", + "INDEPENDENT-LOCAL-REPLAY.json:unfamiliar_nested_seconds", + "CLIFFORD-REVIEW.json:unfamiliar_nested_seconds", + "phase_invalid_seconds:-1", + "phase_invalid_seconds:True", + "phase_invalid_seconds:'1'", + "phase_invalid_seconds:None", + "phase_invalid_seconds:inf", + "phase_invalid_seconds:nan", + "CANONICAL-WORD.json.gz:stale_raw_reference:level1", + "LOCAL-PROGRAMS.json.gz:stale_raw_reference:level1", + "CANONICAL-WORD.json.gz:stale_raw_reference:level9", + "LOCAL-PROGRAMS.json.gz:stale_raw_reference:level9", + "recipe_reformatted_with_stale_raw_reference", + "CANONICAL-WORD.json.gz:omitted_root_field_with_rebound_references:A", + "LOCAL-PROGRAMS.json.gz:omitted_root_field_with_rebound_references:backward", + "LOCAL-CHECKS.json:omitted_root_field_with_rebound_references:forward", + "INDEPENDENT-LOCAL-REPLAY.json:omitted_root_field_with_rebound_references:status", + "CLIFFORD-RECIPES.json:omitted_root_field_with_rebound_references:children", + "CLIFFORD-REVIEW.json:omitted_root_field_with_rebound_references:status", + "RESIDUAL-ADAPTERS.json:omitted_root_field_with_rebound_references:recipes", + "CANONICAL-WORD.json.gz:decompressed_serialization_drift", + "CANONICAL-WORD.json.gz:truncated_gzip", + "LOCAL-PROGRAMS.json.gz:decompressed_serialization_drift", + "LOCAL-PROGRAMS.json.gz:truncated_gzip" + ], + "scope": "Exact retained-input projection audit; no supplier rerun, cross-OS replay, full theorem or new kappa." +} diff --git a/research/selected-generated-identity-audit/SOURCES.json b/research/selected-generated-identity-audit/SOURCES.json new file mode 100644 index 0000000000..222c6ca7d2 --- /dev/null +++ b/research/selected-generated-identity-audit/SOURCES.json @@ -0,0 +1,42 @@ +{ + "schema_version": 1, + "base_commit": "0b1cccf86e2f5132ed286a26ef0a681a495740ea", + "files": [ + { + "path": "certificates/selected-result.json", + "usage": "provenance", + "git_blob": "ae6a99f28aa468649eb66a361e764d769363bf11", + "sha256": "10b9e340fd8e354a37a0c4813c90e5de1dd42044b5f6aca4a3fc5a42b685fa32" + }, + { + "path": "docs/research/agent-task-catalog.json", + "usage": "provenance", + "git_blob": "06c96f5579bb67ed1b86d334e78fbed7da6945f1", + "sha256": "6686ad58f1fbdbc87134a78901b60fd53a20d3984355e91defbbebc9e9fa8075" + }, + { + "path": "research/community-frontier1042-audit/RESULT.json", + "usage": "input", + "git_blob": "8182d0818c0cbda7e52c10120f15b2c3a2c8f933", + "sha256": "bf12c6ed3b412539638b76addb40591a631609b2ab9e5ee0db1f6bbe067d0ec0" + }, + { + "path": "research/community-frontier1042-audit/selected-replay.tar.gz", + "usage": "input", + "git_blob": "6f4dc6fe7631d8aacf8081fcaecf32197181685b", + "sha256": "22c3f4dce4b897a1d423d1388801933e288b6a6b1906cb15e1b16a5eb68db754" + }, + { + "path": "research/community-frontier1094-audit/SELECTED-SOURCE.json", + "usage": "input", + "git_blob": "6a75493790b4eff9c4a98051ef8b01d6aad0d5a8", + "sha256": "79b3de5db3dbcb9829789ba58e9e45758926031e2a7d80667a08429d369be53b" + }, + { + "path": "research/gauge44-slots-t16/code/generated_identity.py", + "usage": "input", + "git_blob": "74a9b604793f21a9f064c78874341e287ded7a68", + "sha256": "c8af22719c0f3097a991a3f6ccac8f090afd2faba554745733d9ea88f2c25708" + } + ] +} diff --git a/research/selected-generated-identity-audit/TASK.json b/research/selected-generated-identity-audit/TASK.json new file mode 100644 index 0000000000..84fe8c7051 --- /dev/null +++ b/research/selected-generated-identity-audit/TASK.json @@ -0,0 +1,115 @@ +{ + "schema_version": 1, + "task_id": "portable-replay", + "priority_revision": 3, + "base_commit": "0b1cccf86e2f5132ed286a26ef0a681a495740ea", + "original_card": { + "id": "portable-replay", + "question": "Can one reproducible environment or artifact-comparison failure be repaired?", + "starting_points": [ + "research/gzip-container-reproducibility/README.md", + "docs/ci-verification.md" + ], + "methods": [ + "Reproduce one portability failure and add a minimal cross-environment fix.", + "Audit one canonical-payload comparison for omitted proof-relevant fields." + ], + "acceptance_gate": "Preserve immutable source hashes and proof-relevant content; a different compressed byte stream alone is not a mathematical mismatch.", + "first_step": { + "command": [ + "python3", + "-B", + "scripts/research_baseline.py" + ], + "expected": "PASS_RESEARCH_BASELINE_BINDINGS_ONLY", + "inspect": "Read the gzip-container reproducibility examples and distinguish frozen source bytes from regenerated payloads.", + "scope": "Positive control / source-bound orientation only; this is not a new construction or full cold replay." + }, + "first_experiment": "Reproduce one specific mismatch or audit one canonical comparison for omitted proof-relevant fields.", + "bottleneck_link": "Portable exact checks prevent environment failures from blocking valid contributions.", + "allowed_variations": [ + "One interpreter/version mismatch or one payload field comparison." + ], + "scope_change_triggers": [ + "Removing immutable-source pins because generated compressed bytes differ." + ], + "overlap_terms": [ + "gzip container", + "reproducibility", + "canonical payload" + ] + }, + "scope_status": "refined", + "actual_scope": "Exact seven-artifact generated_identity.py field-coverage audit on the retained PR1042 slots/local input used by the selected PR1094 lineage; no defect or repair claimed.", + "scope_change_reason": "Refine the canonical-comparison card to one frozen comparator and actual reviewed R480 local input, not stale historical evidence/local. Audit all retained tree nodes independently and exhaust receipt omissions/replacements.", + "bottleneck_link": "Verification engineering only: establish that portability normalization preserves proof-relevant fields and source bindings; no recursive-cost or kappa claim.", + "budget_minutes": 60, + "stop_rule": "One seven-artifact comparator audit, four reference slots and one documented timing exclusion; no cold supplier build, selected-frontier edit or new mechanism.", + "outcome": "completed", + "evidence": "RESULT.json: 939603 retained typed tree nodes, 155 receipt omission/replacement negatives, 181 total negative and 9 positive controls; no proof-relevant omission found.", + "author": "Adam Gall (@adamgall)", + "ai_assistance": "Prepared for Adam Gall with substantial OpenAI Codex assistance in audit design, implementation, experiments, tests and writing. No independent human review claimed.", + "open_questions": [ + { + "question": "Do other current receipt normalizers preserve input roles and every proof-relevant field as this comparator does?", + "why_it_matters": "The result covers one comparator and does not certify other normalizers or later call-site acceptance logic.", + "first_step": "Choose a distinct comparator with its explicit projection contract and immutable fixture, then repeat an all-field independent tree oracle and targeted omission census.", + "blocked_by": "No technical blocker; needs distinct overlap-checked scope. This package does not expand its claim to other normalizers." + } + ], + "chooser": { + "seed": "78b5283995ccab93f0533db3a901e7d7", + "track": "verifier-engineering", + "scope_key": "91a9a2afec282c926282" + }, + "coordination": "https://github.com/CrocSwap/integer-mult-bounds/discussions/1884", + "overlap": { + "coverage": { + "open_prs": { + "records": 543, + "complete_pagination": true, + "fetched_at": "2026-10-14T13:23:53.012964+00:00" + }, + "discussions": { + "records": 529, + "complete_pagination": true, + "fetched_at": "2026-10-14T13:25:07.056183+00:00" + } + }, + "queries": [ + "portable-replay", + "canonical payload", + "omitted field", + "bind_providers_portable", + "generated_identity", + "phase_value", + "omitted proof-relevant", + "selected generated identity" + ], + "closest": [ + { + "pr": 1559, + "head": "c4f8af1dcf9fc2317c893b6b250007ded5ef879f", + "difference": "Two PR589 byte-cmp gzip sites, not this seven-artifact projection." + }, + { + "pr": 1824, + "head": "ad5b1248f25a71983b20617e2f3a80be22f03990", + "difference": "Cross-interpreter selected final-stage replay output comparison, not exhaustive projection field coverage." + }, + { + "path": "research/t37-receipt-role-binding", + "difference": "Eight-input provenance role normalization with actual collisions, not this checked four-reference projection." + }, + { + "path": "research/complex-joint-prefix-validation", + "difference": "Prior full cross-platform provider identity agreement; no exhaustive node census or independent canonical encoder." + }, + { + "path": "research/selected1042-lineage-resolution98", + "difference": "Locates and authenticates actual selected R480 artifacts; credited input-resolution precursor, not this projection audit." + } + ], + "limitations": "Publication recheck used the shared cached snapshot offline, so it may miss later changes. Targeted live checks confirmed PR1559 and PR1824 still open at the recorded heads. Full nearby PR bodies and local READMEs read. Search covers open PR bodies and discussion records, not code diffs or all closed PR bodies; no-match is not novelty. Claims are advisory." + } +} diff --git a/research/selected-generated-identity-audit/VERIFY.json b/research/selected-generated-identity-audit/VERIFY.json new file mode 100644 index 0000000000..4683362554 --- /dev/null +++ b/research/selected-generated-identity-audit/VERIFY.json @@ -0,0 +1,34 @@ +{ + "schema_version": 1, + "status": "ready", + "python": "3.12", + "requirements": [], + "inputs": [ + "research/community-frontier1042-audit/RESULT.json", + "research/community-frontier1042-audit/selected-replay.tar.gz", + "research/community-frontier1094-audit/SELECTED-SOURCE.json", + "research/gauge44-slots-t16/code/generated_identity.py" + ], + "commands": [ + { + "argv": [ + "{python}", + "-I", + "-B", + "{package}/verify.py" + ], + "timeout_seconds": 120, + "checks": "Strict input pins, seven complete identity oracles and typed-tree census, 155 exhaustive receipt mutations, 181 negatives and 9 positives." + }, + { + "argv": [ + "{python}", + "-I", + "-B", + "{package}/test_audit.py" + ], + "timeout_seconds": 120, + "checks": "Independent encoder exact bytes, typed-tree sensitivity, immutable gzip header drift, missing-phase-field oracle fault and strict fixture JSON parsing." + } + ] +} diff --git a/research/selected-generated-identity-audit/test_audit.py b/research/selected-generated-identity-audit/test_audit.py new file mode 100755 index 0000000000..04fa58b8a0 --- /dev/null +++ b/research/selected-generated-identity-audit/test_audit.py @@ -0,0 +1,72 @@ +#!/usr/bin/env python3 +"""Focused tests for the independent audit, not the inherited supplier checker.""" +import importlib.util +from pathlib import Path +import tempfile +import unittest +from unittest import mock + +HERE = Path(__file__).resolve().parent +spec = importlib.util.spec_from_file_location('selected_identity_audit', HERE / 'verify.py') +audit = importlib.util.module_from_spec(spec) +spec.loader.exec_module(audit) + + +class AuditTests(unittest.TestCase): + def test_independent_encoder_known_bytes(self): + value = {'z': [None, True, False, 1, -2], 'a': '\"\\\n\t\x7f\u00e9\U0001f642'} + expected = b'{"a":"\\\"\\\\\\n\\t\\u007f\\u00e9\\ud83d\\ude42","z":[null,true,false,1,-2]}' + self.assertEqual(b''.join(audit.encode(value)), expected) + self.assertNotEqual(audit.identity(True), audit.identity(1)) + with self.assertRaisesRegex(ValueError, 'outside audited scalar domain'): + audit.identity(1.0) + + def test_tree_includes_containers_keys_and_indices(self): + value = {'empty': {}, 'list': [[], True]} + self.assertEqual(audit.tree(value)['nodes'], 5) + self.assertNotEqual(audit.tree(value), audit.tree({'empty': [], 'list': [[], True]})) + self.assertNotEqual(audit.tree(value), audit.tree({'empty': {}, 'list': [True, []]})) + self.assertNotEqual(audit.tree(value), audit.tree({'other': {}, 'list': [[], True]})) + self.assertNotEqual(audit.tree(value), audit.tree({'empty': {}, 'list': [[], 1]})) + + def test_immutable_container_header_drift_rejects(self): + with tempfile.TemporaryDirectory(prefix='identity-source-control-') as temporary: + root = Path(temporary) + for name in audit.INPUTS: + target = root / name + target.parent.mkdir(parents=True, exist_ok=True) + target.write_bytes((audit.ROOT / name).read_bytes()) + archive = root / audit.ARCHIVE + raw = bytearray(archive.read_bytes()) + self.assertEqual(raw[:2], b'\x1f\x8b') + raw[4] ^= 1 # Gzip MTIME only; immutable source identity is still strict. + archive.write_bytes(raw) + with self.assertRaisesRegex(ValueError, 'immutable source pin: ' + audit.ARCHIVE): + audit.bind_sources(root) + + def test_independent_tree_oracle_detects_missing_phase_field(self): + original_loader = audit.runpy.run_path + + def altered_loader(path): + source = original_loader(path) + original_phase = source['phase_value'] + + def omit_field(*args, **kwargs): + value = original_phase(*args, **kwargs) + del value['all_child_equalities_include_global_phase'] + return value + source['phase_value'] = omit_field + return source + + with mock.patch.object(audit.runpy, 'run_path', side_effect=altered_loader): + with self.assertRaisesRegex(ValueError, 'typed-path projection coverage: CLIFFORD-REVIEW.json'): + audit.audit() + + def test_strict_fixture_parser_rejects_ambiguous_json(self): + for raw in ('{"x":1,"x":2}', '{"x":NaN}', '{"x":Infinity}'): + with self.assertRaises(ValueError): + audit.load(raw) + + +if __name__ == '__main__': + unittest.main() diff --git a/research/selected-generated-identity-audit/verify.py b/research/selected-generated-identity-audit/verify.py new file mode 100755 index 0000000000..40bf3953fe --- /dev/null +++ b/research/selected-generated-identity-audit/verify.py @@ -0,0 +1,337 @@ +#!/usr/bin/env python3 +"""Audit the selected-lineage seven-artifact projection, not supplier mathematics. + +Prepared with substantial OpenAI Codex assistance. Apache-2.0. +""" +import argparse +from collections import Counter +import copy +import gzip +import hashlib +import json +from pathlib import Path +import runpy +import tarfile +import tempfile + +HERE = Path(__file__).resolve().parent +ROOT = HERE.parents[1] +CODE = 'research/gauge44-slots-t16/code/generated_identity.py' +ARCHIVE = 'research/community-frontier1042-audit/selected-replay.tar.gz' +RECEIPT = 'research/community-frontier1042-audit/RESULT.json' +MANIFEST = 'research/community-frontier1094-audit/SELECTED-SOURCE.json' +FILES = ('CANONICAL-WORD.json.gz', 'LOCAL-PROGRAMS.json.gz', 'LOCAL-CHECKS.json', + 'INDEPENDENT-LOCAL-REPLAY.json', 'CLIFFORD-RECIPES.json', + 'CLIFFORD-REVIEW.json', 'RESIDUAL-ADAPTERS.json') +NATIVE, PHASE = FILES[3], FILES[5] +REFERENCES = {NATIVE: {'canonical_word_sha256': FILES[0], 'local_programs_sha256': FILES[1]}, + PHASE: {'canonical_word_sha256': FILES[0], 'recipe_sha256': FILES[4]}} +INPUTS = {CODE, ARCHIVE, RECEIPT, MANIFEST} + + +def need(condition, message): + if not condition: + raise ValueError(message) + + +def digest(raw): + return hashlib.sha256(raw).hexdigest() + + +def load(raw): + def pairs(items): + result = {} + for key, value in items: + need(key not in result, 'duplicate JSON key') + result[key] = value + return result + + def invalid(value): + raise ValueError('nonfinite JSON constant: ' + value) + return json.loads(raw, object_pairs_hook=pairs, parse_constant=invalid) + + +def quoted(value): + """Independent ASCII JSON string encoder, including UTF-16 surrogate pairs.""" + escapes = {'"': '\\"', '\\': '\\\\', '\b': '\\b', '\f': '\\f', + '\n': '\\n', '\r': '\\r', '\t': '\\t'} + yield b'"' + for char in value: + code = ord(char) + if char in escapes: + yield escapes[char].encode('ascii') + elif 32 <= code < 127: + yield char.encode('ascii') + elif code <= 0xffff: + yield ('\\u%04x' % code).encode('ascii') + else: + code -= 0x10000 + yield ('\\u%04x\\u%04x' % (0xd800 + (code >> 10), 0xdc00 + (code & 1023))).encode('ascii') + yield b'"' + + +def encode(value): + """All-field canonical encoder for the actual retained scalar domain. + + This does not call json.dumps or any function from the audited module. + The only float in the input trees is the explicitly excluded phase time. + """ + if value is None: + yield b'null' + elif type(value) is bool: + yield b'true' if value else b'false' + elif type(value) is int: + yield str(value).encode('ascii') + elif type(value) is str: + yield from quoted(value) + elif type(value) is list: + yield b'[' + for index, child in enumerate(value): + if index: + yield b',' + yield from encode(child) + yield b']' + elif type(value) is dict: + need(all(type(key) is str for key in value), 'non-string object key') + yield b'{' + for index, key in enumerate(sorted(value)): + if index: + yield b',' + yield from quoted(key) + yield b':' + yield from encode(value[key]) + yield b'}' + else: + raise ValueError('outside audited scalar domain: ' + type(value).__name__) + + +def identity(value): + result = hashlib.sha256() + for chunk in encode(value): + result.update(chunk) + return result.hexdigest() + + +def walk(value, path=()): + """Visit every node, including containers, keys and list positions.""" + yield path, value + if type(value) is dict: + for key in sorted(value): + yield from walk(value[key], path + (key,)) + elif type(value) is list: + for index, child in enumerate(value): + yield from walk(child, path + (index,)) + + +def tree(value): + """Independent typed-path census; distinguishes true, 1 and container shapes.""" + transcript = hashlib.sha256() + kinds = Counter() + for path, node in walk(value): + kind = type(node).__name__ + kinds[kind] += 1 + content = sorted(node) if kind == 'dict' else len(node) if kind == 'list' else node + for chunk in encode([list(path), kind, content]): + transcript.update(chunk) + transcript.update(b'\n') + return {'nodes': sum(kinds.values()), 'types': dict(sorted(kinds.items())), + 'typed_path_sha256': transcript.hexdigest()} + + +def expected_value(name, objects, raw): + value = copy.deepcopy(objects[name]) + if name == PHASE: + del value['seconds'] + for field, target in REFERENCES.get(name, {}).items(): + need(value[field] == digest(raw[target]), 'reference fixture mismatch: ' + field) + value[field] = digest(gzip.decompress(raw[target])) if target.endswith('.gz') else identity(objects[target]) + return value + + +def bind_sources(root=ROOT): + sources = load((HERE / 'SOURCES.json').read_bytes()) + inputs = {row['path']: row['sha256'] for row in sources['files'] if row['usage'] == 'input'} + need(set(inputs) == INPUTS, 'mandatory input inventory') + for name, expected in inputs.items(): + need(digest((root / name).read_bytes()) == expected, 'immutable source pin: ' + name) + manifest = load((root / MANIFEST).read_bytes()) + need(manifest['files'][CODE] == inputs[CODE], 'selected-lineage implementation binding') + + +def materialize(directory): + receipt = load((ROOT / RECEIPT).read_bytes()) + raw = {} + with tarfile.open(ROOT / ARCHIVE) as archive: + for member in archive: + if member.name not in {'slots/local/' + name for name in FILES}: + continue + name = member.name.removeprefix('slots/local/') + need(member.isfile() and name not in raw, 'regular unique chosen archive member') + raw[name] = archive.extractfile(member).read() + need(digest(raw[name]) == receipt['artifacts'][member.name], 'archived artifact pin: ' + name) + need(set(raw) == set(FILES), 'complete seven-artifact input') + for name, data in raw.items(): + (directory / name).write_bytes(data) + return raw + + +def audit(): + need(__debug__, 'audited implementation requires enabled assertions') + bind_sources() + source = runpy.run_path(str(ROOT / CODE)) + need(tuple(source['FILES']) == FILES, 'artifact inventory changed') + controls = [] + positives = [] + with tempfile.TemporaryDirectory(prefix='selected-generated-identity-') as temporary: + directory = Path(temporary) + raw = materialize(directory) + objects = {name: load(gzip.decompress(data) if name.endswith('.gz') else data) + for name, data in raw.items()} + baseline = source['artifact_identities'](directory) + coverage = {} + for name in FILES: + value = expected_value(name, objects, raw) + # Payloads intentionally bind byte serialization, not parsed JSON. + expected = digest(gzip.decompress(raw[name])) if name.endswith('.gz') else identity(value) + need(baseline[name] == expected, 'independent complete-tree identity: ' + name) + if name in REFERENCES: + actual = source['phase_value' if name == PHASE else 'native_value'](directory) + need(tree(actual) == tree(value), 'typed-path projection coverage: ' + name) + coverage[name] = {**tree(value), 'identity_sha256': expected, + 'comparison_domain': 'complete decompressed bytes' if name.endswith('.gz') else 'complete canonical JSON tree', + 'payload_bytes': len(gzip.decompress(raw[name])) if name.endswith('.gz') else None} + positives.append('independent_all_field_identity_and_typed_path_projection') + + def rejected(label, action): + try: + action() + except (AssertionError, KeyError, ValueError): + controls.append(label) + else: + raise ValueError('accepted negative control: ' + label) + + def receipt_equal(name, value): + projected = source['phase_value' if name == PHASE else 'native_value'](directory, value) + need(source['json_identity'](projected) == baseline[name], 'changed receipt identity') + + census = {} + for name in (NATIVE, PHASE): + before = len(controls) + for path, value in walk(objects[name]): + if not path: + continue + for operation in ('omit', 'replace'): + if name == PHASE and path == ('seconds',) and operation == 'replace': + continue # Valid timing changes are a documented positive control. + changed = copy.deepcopy(objects[name]) + parent = changed + for part in path[:-1]: + parent = parent[part] + if operation == 'omit': + del parent[path[-1]] + else: + parent[path[-1]] = 0 if value is None else None + label = name + ':' + operation + ':' + repr(path) + rejected(label, lambda n=name, v=changed: receipt_equal(n, v)) + census[name] = len(controls) - before + for name, path in ((NATIVE, ('local', 'forward', 'private_work_erased')), + (PHASE, ('all_child_equalities_include_global_phase',))): + changed = copy.deepcopy(objects[name]) + parent = changed + for part in path[:-1]: + parent = parent[part] + parent[path[-1]] = 1 + rejected(name + ':boolean_to_integer', lambda n=name, v=changed: receipt_equal(n, v)) + for name in (NATIVE, PHASE): + changed = copy.deepcopy(objects[name]) + changed['unfamiliar'] = {'seconds': 1, 'proof': True} + rejected(name + ':unfamiliar_nested_seconds', lambda n=name, v=changed: receipt_equal(n, v)) + for value in (-1, True, '1', None, float('inf'), float('nan')): + changed = dict(objects[PHASE], seconds=value) + rejected('phase_invalid_seconds:' + repr(value), lambda v=changed: receipt_equal(PHASE, v)) + for value in (0, 1.25, 100000): + receipt_equal(PHASE, dict(objects[PHASE], seconds=value)) + positives.append('phase_valid_seconds:' + repr(value)) + + def restore(): + for name, data in raw.items(): + (directory / name).write_bytes(data) + + def rebind(): + for name, references in REFERENCES.items(): + value = load((directory / name).read_bytes()) + for field, target in references.items(): + value[field] = digest((directory / target).read_bytes()) + (directory / name).write_text(json.dumps(value), encoding='utf-8') + + def equal(): + need(source['artifact_identities'](directory) == baseline, 'changed artifact identities') + + for level in (1, 9): + for name in FILES[:2]: + restore() + fresh = gzip.compress(gzip.decompress(raw[name]), compresslevel=level, mtime=123) + need(fresh != raw[name], 'recompression control must change container') + (directory / name).write_bytes(fresh) + rejected(name + ':stale_raw_reference:level' + str(level), equal) + rebind() + equal() + positives.append(name + ':recompressed:level' + str(level)) + restore() + for name in FILES[2:]: + (directory / name).write_text(json.dumps(objects[name], sort_keys=True, indent=3), encoding='utf-8') + rejected('recipe_reformatted_with_stale_raw_reference', equal) + rebind() + equal() + positives.append('all_plain_JSON_reformatted_with_bound_recipe_reference') + for name in FILES: + restore() + changed = copy.deepcopy(objects[name]) + key = next(iter(changed)) + del changed[key] + data = json.dumps(changed).encode() + (directory / name).write_bytes(gzip.compress(data, mtime=0) if name.endswith('.gz') else data) + rebind() # Do not let stale references substitute for detecting lost content. + rejected(name + ':omitted_root_field_with_rebound_references:' + key, equal) + for name in FILES[:2]: + restore() + # Even harmless JSON whitespace is proof-payload byte drift here. + (directory / name).write_bytes(gzip.compress(gzip.decompress(raw[name]) + b'\n', mtime=0)) + rebind() + rejected(name + ':decompressed_serialization_drift', equal) + restore() + (directory / name).write_bytes(raw[name][:-8]) + rebind() + try: + equal() + except (EOFError, gzip.BadGzipFile): + controls.append(name + ':truncated_gzip') + else: + raise ValueError('accepted truncated gzip') + return {'status': 'PASS_SELECTED_GENERATED_IDENTITY_AUDIT', + 'coverage': coverage, 'receipt_mutation_census': census, + 'raw_reference_slots': REFERENCES, + 'excluded_pointer': 'CLIFFORD-REVIEW.json#/seconds', + 'positive_controls': positives, 'negative_controls': controls, + 'scope': 'Exact retained-input projection audit; no supplier rerun, cross-OS replay, full theorem or new kappa.'} + + +def main(): + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument('--write-result', action='store_true') + args = parser.parse_args() + result = audit() + target = HERE / 'RESULT.json' + if args.write_result: + need(not target.exists(), 'refusing to overwrite audit result') + target.write_text(json.dumps(result, indent=2) + '\n', encoding='utf-8') + else: + need(identity(result) == identity(load(target.read_bytes())), 'stored result mismatch') + print(result['status'], 'nodes=' + str(sum(row['nodes'] for row in result['coverage'].values())), + 'receipt_mutations=' + str(sum(result['receipt_mutation_census'].values())), + 'positives=' + str(len(result['positive_controls'])), + 'negatives=' + str(len(result['negative_controls']))) + + +if __name__ == '__main__': + main()