Prepare independently reviewed zlib-only image candidate

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

tools/zlib_overlay/compare_runtime.py

@@ -0,0 +1,16 @@
+"""Metadata only; no database, provider or native action."""
+import json,sys
+
+def compare(a,b):
+    for field in ('app_file_sha256','policy_sha256','policy_uid','policy_mode','uid','gid','apk_world_sha256','apk_keys_sha256','python_dependencies','openssl'):
+        if a[field]!=b[field]:raise ValueError('unrelated delta: '+field)
+    changed={name:[a['apk_packages'].get(name),b['apk_packages'].get(name)] for name in set(a['apk_packages'])|set(b['apk_packages']) if a['apk_packages'].get(name)!=b['apk_packages'].get(name)}
+    if changed!={'zlib':['1.3.2-r0','1.3.2-r1']}:raise ValueError('not exact zlib-only delta')
+    if b['policy_sha256']!='9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62' or b['uid']!=10001 or b['gid']!=10001 or b['policy_uid']!=0 or b['policy_mode']!='0o644':raise ValueError('purpose/identity differs')
+    if b['compression_vectors_pass']!=4 or b['malformed_zlib_refusals']!=3 or b['crypto_jwt_waitress_smoke'] is not True:raise ValueError('backend smoke differs')
+    if b['database_opened'] is not False or b['network_accessed'] is not False or b['provider_or_customer_data_used'] is not False:raise ValueError('unbounded smoke scope')
+    return {'zlib_only_delta':True,'app_files_identical':len(b['app_file_sha256']),'no_database_or_provider':True}
+
+if __name__=='__main__':
+    try:print(json.dumps(compare(json.loads(sys.argv[1]),json.loads(sys.argv[2]))))
+    except Exception:raise SystemExit('bounded runtime comparison refused') from None