informed-decision/docs/evidence/2026-10-11-zlib-image-release/execution/actuator.py

"""One fixed supervised phase; never run this during source preparation."""
import argparse
import hashlib
import json
import os
from pathlib import Path
import re
import selectors
import stat
import subprocess
import sys
import time

if sys.flags.optimize:
    raise SystemExit('optimized interpreter refused')

PHASES = ('drill-backup', 'drill-copy', 'offline-verify', 'cleanup-offline',
          'cutover-backup', 'cutover-copy', 'release', 'verify', 'rollback', 'rollback-verify')


def require(value, reason):
    if not value:
        raise ValueError(reason)


def sha(path):
    digest = hashlib.sha256()
    with Path(path).open('rb') as stream:
        for block in iter(lambda: stream.read(1024**2), b''):
            digest.update(block)
    return digest.hexdigest()


def private(path, directory=False):
    info = Path(path).lstat()
    require((stat.S_ISDIR(info.st_mode) if directory else stat.S_ISREG(info.st_mode))
            and info.st_uid == os.getuid() and stat.S_IMODE(info.st_mode) == (0o700 if directory else 0o600)
            and (directory or info.st_nlink == 1), 'private owned custody required')

ROOT = Path(__file__).resolve().parent
CASE = ROOT.parent
OWNER = Path('/home/worsch/informed-decision')
CUSTODIAN = Path('/home/worsch/the-custodian')
CUSTODY = CUSTODIAN / '.private-backups/20261011-infd-zlib-r1'
SOCKET = 'unix:///var/run/docker.sock'
IMAGE = 'forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23'
VOLUME = 'infd-zlib-r1-restore-20261011'
MAX_BYTES = 512 * 1024**2


def run(argv, body=None, timeout=90):
    return subprocess.run(argv, input=body, text=True, capture_output=True, timeout=timeout)


def json_result(result):
    try:
        value = json.loads(result.stdout)
    except (ValueError, TypeError):
        raise ValueError('safe phase receipt unavailable; outcome uncertain') from None
    require(result.returncode == 0 and isinstance(value, dict) and value.get('all_checks_pass') is True,
            'phase did not verify complete; raw output withheld; no retry')
    permitted = {'phase', 'all_checks_pass', 'raw_output_withheld', 'native_approval_verified_by_root',
                 'native_authenticated_grant', 'source_readonly_baseline', 'snapshot_readonly',
                 'snapshot_sha256', 'snapshot_bytes', 'snapshot_file', 'native_parent_private',
                 'native_uid', 'pod_name', 'pod_uid', 'live_readonly_schema_integrity_counts',
                 'live_counts_may_include_concurrent_commits', 'operation_requested', 'source_revision',
                 'resources', 'prune', 'rollout_verified', 'latest_live_database_retained',
                 'client_diff_sha256', 'native_rollout_verified', 'current_schema5_database_retained',
                 'private_copy_verified', 'installed_purpose_checks', 'policy_sha256',
                 'policy_mode', 'policy_uid', 'installed_zlib_files', 'zlib_package', 'health_statuses', 'native_provider_probe', 'recovery_verification'}
    require(set(value) <= permitted, 'unexpected output fields withheld')
    from receipt_safety import counts
    for name in ('source_readonly_baseline', 'snapshot_readonly', 'live_readonly_schema_integrity_counts'):
        if name in value:
            counts(value[name])
    for name in ('snapshot_sha256', 'client_diff_sha256'):
        if name in value:
            require(re.fullmatch(r'[a-f0-9]{64}', value[name]) is not None, 'invalid output digest withheld')
    if 'snapshot_bytes' in value:
        require(type(value['snapshot_bytes']) is int and 0 < value['snapshot_bytes'] <= MAX_BYTES,
                'invalid output size withheld')
    if 'snapshot_file' in value:
        require(value['snapshot_file'] in ('drill.sqlite', 'cutover.sqlite'), 'invalid output file withheld')
    return value


def docker(argv, body=None, timeout=120):
    return run(['docker', '--config', str(CUSTODY / 'empty-docker-config'), '--host', SOCKET] + argv,
               body=body, timeout=timeout)


def remote(phase, revision, approved, snapshot_identity=None, operation_intent=None, outage_recovery=False, recovery_release_started_at=None):
    # Fixed module imported only after main verifies every executor source hash.
    from native_program import PROGRAM
    payload = {'snapshot_identity': snapshot_identity, 'operation_intent': operation_intent, 'outage_recovery': outage_recovery, 'recovery_release_started_at': recovery_release_started_at, 'phase': phase, 'source_revision': revision, 'approval': approved,
               'sealed': json.loads((CASE / 'sealed-live-deployment.json').read_text()),
               'dependencies': json.loads((CASE / 'sealed-native-dependencies.json').read_text()),
               'candidate': json.loads((CASE / 'candidate-deployment.json').read_text()),
               'rollback': json.loads((CASE / 'rollback-deployment.json').read_text()),
               'receipt_safety': (ROOT / 'receipt_safety.py').read_text(),
               'purpose_checks': (CASE / 'check_installed.py').read_text(),
               'installed_zlib': json.loads((CASE / 'installed-zlib-proof.json').read_text()), 'readonly': (CASE / 'sqlite_readonly.py').read_text()}
    script = PROGRAM.replace('__PAYLOAD__', repr(json.dumps(payload))).replace(
        '__GUARD__', repr((CASE / 'change_guard.py').read_text()))
    return json_result(run(['ssh', 'railiance01', 'python3 -'], script, timeout=200))


def copy_snapshot(phase, revision, approved, journal):
    backup_phase = 'drill-backup' if phase == 'drill-copy' else 'cutover-backup'
    prior = journal.data['phases'][backup_phase]['result']
    metadata = remote(phase, revision, approved, snapshot_identity=prior)
    for key in ('snapshot_sha256', 'snapshot_bytes', 'snapshot_file', 'snapshot_readonly'):
        require(metadata[key] == prior[key], 'closed frozen snapshot changed')
    name = metadata['snapshot_file']
    require(name in ('drill.sqlite', 'cutover.sqlite') and 0 < metadata['snapshot_bytes'] <= MAX_BYTES,
            'fixed bounded snapshot required')
    pod = metadata['pod_name']
    require(re.fullmatch(r'[a-z0-9]([-a-z0-9]*[a-z0-9])?', pod) is not None, 'fixed owner pod name required')
    local = CUSTODY / name
    fd = os.open(local, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
    # Binary snapshot stdout goes only to a private file, never tool/chat/log output.
    # Snapshot schema/count metadata was validated before opening this destination.
    with os.fdopen(fd, 'wb') as destination:
        command = ('kubectl exec -n informed-decision ' + pod +
                   ' -c informed-decision -- cat /data/private/zlib85091-r1/' + name)
        transfer = subprocess.Popen(['ssh', 'railiance01', command], stdout=subprocess.PIPE,
                                    stderr=subprocess.DEVNULL)
        selector = selectors.DefaultSelector()
        selector.register(transfer.stdout, selectors.EVENT_READ)
        deadline = time.monotonic() + 150
        received = 0
        try:
            while True:
                remaining = deadline - time.monotonic()
                require(remaining > 0 and selector.select(remaining), 'private transfer timed out')
                block = os.read(transfer.stdout.fileno(), 1024**2)
                if not block:
                    break
                received += len(block)
                require(received <= metadata['snapshot_bytes'] and received <= MAX_BYTES,
                        'private copy exceeds frozen snapshot size')
                destination.write(block)
            transfer.wait(timeout=max(1, deadline - time.monotonic()))
        finally:
            selector.close()
            transfer.stdout.close()
            if transfer.poll() is None:
                transfer.kill()
                transfer.wait()
        destination.flush()
        os.fsync(destination.fileno())
    private(local)
    require(transfer.returncode == 0 and local.stat().st_size == metadata['snapshot_bytes']
            and sha(local) == metadata['snapshot_sha256'], 'private copy incomplete/uncertain; retain, no retry')
    # Re-read identity/hash after transfer. This is verification, not a write retry.
    after = remote(phase, revision, approved, snapshot_identity=prior)
    require(after['pod_uid'] == metadata['pod_uid'] and after['snapshot_sha256'] == metadata['snapshot_sha256'],
            'source identity/snapshot changed during transfer')
    return {**metadata, 'off_cluster_private_copy_verified': True, 'snapshot_contents_output': False}


def offline_verify(journal):
    from receipt_safety import counts
    snapshot = CUSTODY / 'drill.sqlite'
    private(snapshot)
    previous = journal.data['phases']['drill-copy']['result']
    require(sha(snapshot) == previous['snapshot_sha256'], 'protected snapshot bytes changed')
    identity = docker(['info', '--format', '{{json .Name}}'])
    require(identity.returncode == 0 and json.loads(identity.stdout) == 'bnt-lap001',
            'local offline Docker engine identity changed')
    listed = docker(['volume', 'ls', '--format', '{{.Name}}'])
    require(listed.returncode == 0 and VOLUME not in listed.stdout.splitlines(),
            'disposable volume absence not verified')
    nonce = journal.data['phases']['offline-verify']['attempt_id']
    labels = {'informed-decision.case': 'infd-zlib-20261011-r1',
              'informed-decision.use': 'offline-restore-only', 'informed-decision.attempt': nonce}
    created = docker(['volume', 'create', '--driver', 'local', '--label', 'informed-decision.case=infd-zlib-20261011-r1',
                      '--label', 'informed-decision.attempt=' + nonce,
                      '--label', 'informed-decision.use=offline-restore-only', VOLUME])
    require(created.returncode == 0 and created.stdout.strip() == VOLUME, 'volume creation uncertain; no retry')
    inspected = docker(['volume', 'inspect', VOLUME])
    require(inspected.returncode == 0, 'new volume identity unavailable')
    volume = json.loads(inspected.stdout)
    require(len(volume) == 1 and volume[0]['Name'] == VOLUME and volume[0].get('Labels') == labels
            and volume[0].get('Driver') == 'local' and not volume[0].get('Options')
            and volume[0].get('Scope') == 'local', 'new isolated volume identity changed')
    identity = {key: volume[0][key] for key in ('Name', 'Labels', 'Driver', 'Scope', 'CreatedAt')}
    journal.note('offline-verify', 'created_volume_identity', identity)
    # One-time UID0/CAP_CHOWN initialization is isolated to the NEW named volume.
    # No host/live PVC/config/token mount exists; this detail needs packet review.
    initializer = """import hashlib,os,stat,sys
if sys.flags.optimize:raise RuntimeError('optimized interpreter refused')
folder='/restore';expected=EXPECTED
if os.listdir(folder):raise ValueError('new empty private volume required')
os.chmod(folder,0o700)
fd=os.open(folder+'/review.sqlite',os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW|os.O_WRONLY,0o600)
digest=hashlib.sha256();size=0
with os.fdopen(fd,'wb') as target:
 while True:
  block=sys.stdin.buffer.read(1024**2)
  if not block:break
  size+=len(block)
  if size>512*1024**2:raise ValueError('private restore size exceeds bound')
  target.write(block);digest.update(block)
 target.flush();os.fsync(target.fileno())
if digest.hexdigest()!=expected:raise ValueError('private copied snapshot differs')
os.chown(folder+'/review.sqlite',10001,10001);os.chown(folder,10001,10001)
print('{"all_checks_pass":true,"private_copy_verified":true}')
""".replace('EXPECTED', repr(previous['snapshot_sha256']))
    with snapshot.open('rb') as source:
        argv = ['docker', '--config', str(CUSTODY / 'empty-docker-config'), '--host', SOCKET,
                'run', '--rm', '-i', '--network', 'none', '--read-only', '--cpus', '1', '--memory', '128m',
                '--user', '0:0', '--cap-drop', 'ALL', '--cap-add', 'CHOWN',
                '--security-opt', 'no-new-privileges', '--mount', 'type=volume,src=' + VOLUME + ',dst=/restore',
                '--entrypoint', 'python', IMAGE, '-c', initializer]
        copied = subprocess.run(argv, stdin=source, text=True, capture_output=True, timeout=150)
    json_result(copied)
    options = ['run', '--rm', '-i', '--network', 'none', '--read-only', '--cpus', '1', '--memory', '128m',
               '--user', '10001:10001', '--cap-drop', 'ALL', '--security-opt', 'no-new-privileges',
               '--mount', 'type=volume,src=' + VOLUME + ',dst=/restore']
    readonly = docker(options + ['--entrypoint', 'python', IMAGE, '-', '--db', '/restore/review.sqlite'],
                      (CASE / 'sqlite_readonly.py').read_text())
    require(readonly.returncode == 0, 'offline pre-open schema/integrity gate refused; never open Store')
    checked = counts(json.loads(readonly.stdout))
    require(checked == previous['snapshot_readonly'], 'frozen snapshot/clone readonly counts differ')
    admin = docker(options + ['--entrypoint', 'informed-decision-admin', IMAGE,
                              'inspect', '--db', '/restore/review.sqlite'])
    require(admin.returncode == 0, 'offline admin result uncertain')
    admin_counts = json.loads(admin.stdout)
    require(admin_counts == {key: checked[key] for key in ('schema_version', 'lifecycle', 'outbox', 'submissions')},
            'offline admin changed frozen snapshot counters')
    # Admin Store construction must not silently alter schema/integrity/counters.
    post = docker(options + ['--entrypoint', 'python', IMAGE, '-', '--db', '/restore/review.sqlite'],
                  (CASE / 'sqlite_readonly.py').read_text())
    require(post.returncode == 0, 'offline post-admin readonly integrity gate refused')
    post_checked = counts(json.loads(post.stdout))
    require(post_checked == checked == previous['snapshot_readonly'],
            'offline admin altered frozen snapshot proof')
    private(snapshot)
    require(sha(snapshot) == previous['snapshot_sha256'], 'original protected snapshot changed during drill')
    return {'all_checks_pass': True, 'offline_volume': VOLUME, 'offline_readonly': checked,
            'offline_post_admin_readonly': post_checked, 'original_snapshot_hash_unchanged': True,
            'created_volume_identity': identity,
            'admin_counts': admin_counts, 'network': 'none', 'runtime_tokens_or_config_mounted': False,
            'service_entrypoint_started': False, 'original_snapshot_retained': True}


def cleanup_offline(journal):
    inspected = docker(['volume', 'inspect', VOLUME])
    require(inspected.returncode == 0, 'owned disposable volume identity unverified')
    value = json.loads(inspected.stdout)
    expected = journal.data['phases']['offline-verify']['result']['created_volume_identity']
    require(len(value) == 1 and {key: value[0].get(key) for key in expected} == expected
            and not value[0].get('Options'), 'volume ownership/recreation changed')
    removed = docker(['volume', 'rm', VOLUME])
    require(removed.returncode == 0 and removed.stdout.strip() == VOLUME
            and docker(['volume', 'inspect', VOLUME]).returncode != 0,
            'cleanup outcome ambiguous; do not retry')
    return {'all_checks_pass': True, 'only_disposable_offline_volume_removed': VOLUME,
            'native_and_offcluster_original_snapshots_retained': True}


def main():
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument('--phase', choices=PHASES, required=True)
    parser.add_argument('--root-authority-receipt', type=Path, required=True)
    parser.add_argument('--root-native-outcome', type=Path, required=True)
    parser.add_argument('--source-revision', required=True)
    parser.add_argument('--root-fresh-scan-receipt', type=Path, required=True)
    parser.add_argument('--root-recovery-receipt', type=Path)
    args = parser.parse_args()
    require(args.root_authority_receipt == Path('/tmp/security-infd-zlib-root-authority.json')
            and args.root_native_outcome == Path('/tmp/security-infd-zlib-native-outcome-latest.json'),
            'fixed supervised receipt paths required')
    require(re.fullmatch(r'[0-9a-f]{40}', args.source_revision) is not None, 'exact source commit required')
    # Verify all prepared executor/input bytes before reading authority or dispatching.
    plan = json.loads((ROOT / 'execution-plan.json').read_text())
    require(plan.get('state') == 'prepared-unapproved' and plan.get('published_artifact_verified') is True, 'unfrozen proposal cannot execute')
    require(set(plan['executor_files']) == {'actuator.py', 'authority_journal.py', 'native_program.py', 'receipt_safety.py'},
            'fixed executor sources required')
    require(set(plan['owner_source_files']) == {'deploy/lifecycle/admission.candidate.json',
                                              'deploy/lifecycle/service.candidate.json',
                                              'deploy/lifecycle/kustomization.yaml',
                                              'deploy/lifecycle/registries.candidate.json'},
            'fixed owner image sources required')
    for relative, digest in plan['executor_files'].items():
        target = ROOT / relative
        require(not target.is_symlink() and sha(target) == digest, 'executor source bytes changed')
    for relative, digest in plan['case_files'].items():
        require(not Path(relative).is_absolute() and '..' not in Path(relative).parts,
                'case source path escaped')
        target = CASE / relative
        require(not target.is_symlink() and sha(target) == digest, 'case source bytes changed')
    for relative, digest in plan['owner_source_files'].items():
        target = OWNER / relative
        require(not target.is_symlink() and sha(target) == digest, 'owner image-only source changed')
        committed = subprocess.run(['git', '-C', str(OWNER), 'show', args.source_revision + ':' + relative],
                                   capture_output=True)
        require(committed.returncode == 0 and hashlib.sha256(committed.stdout).hexdigest() == digest,
                'committed owner render source differs from approved inputs')
    head = run(['git', '-C', str(OWNER), 'rev-parse', 'HEAD'])
    require(head.returncode == 0 and head.stdout.strip() == args.source_revision, 'owner source HEAD differs')
    from authority_journal import Journal, authority, fresh_scan, recovery_authority
    private(args.root_authority_receipt)
    private(args.root_native_outcome)
    receipt = json.loads(args.root_authority_receipt.read_text())
    require(receipt.get('native_outcome_sha256') == sha(args.root_native_outcome), 'native outcome bytes changed')
    require(receipt.get('executor_plan_sha256') == sha(ROOT / 'execution-plan.json'),
            'root verified executor plan differs')
    outage_recovery=False;recovery_receipt=None;release_cache=None
    try:
        if args.root_recovery_receipt is not None:
            require(args.phase in ('rollback','rollback-verify') and args.root_recovery_receipt==Path('/tmp/security-infd-zlib-root-recovery-receipt.json'),'outage receipt is recovery-only at fixed path')
            private(args.root_recovery_receipt)
            supplied_outage=json.loads(args.root_recovery_receipt.read_text())
            import datetime
            root_verified=datetime.datetime.fromisoformat(receipt['verified_at'].replace('Z','+00:00'))
            outage_observed=datetime.datetime.fromisoformat(supplied_outage['observed_at'].replace('Z','+00:00'))
            require(root_verified.tzinfo is not None and outage_observed.tzinfo is not None,'typed outage observation required')
            require(root_verified>=outage_observed,'pre-outage historical acceptance is not current native readback')
        approved = authority(receipt, json.loads(args.root_native_outcome.read_text()), sha(CASE / 'memo.json'),args.source_revision,args.phase)
    except ValueError:
        current_outcome=json.loads(args.root_native_outcome.read_text())
        require(current_outcome.get('http_status') not in (401,403) and current_outcome.get('explicit_revoked') is not True and current_outcome.get('current_conflict') is not True and current_outcome.get('identity_or_scope_mismatch') is not True and current_outcome.get('review',{}).get('stale') is not True,'current denial revocation conflict or mismatch forbids recovery fallback')
        require(args.phase in ('rollback','rollback-verify') and args.root_recovery_receipt==Path('/tmp/security-infd-zlib-root-recovery-receipt.json'),'fresh authority required; no general fallback')
        private(args.root_recovery_receipt);private(CUSTODY,directory=True)
        cache_path=CUSTODY/'release-authority-cache.json';journal_path=CUSTODY/'execution-journal.json';private(cache_path);private(journal_path)
        release_cache=json.loads(cache_path.read_text());prior_journal=json.loads(journal_path.read_text());recovery_receipt=json.loads(args.root_recovery_receipt.read_text())
        require(sha(cache_path)==recovery_receipt.get('cache_sha256'),'retained pre-release authority cache bytes changed')
        require(prior_journal['identity']=={'proposal':plan['proposal_id'],'source_revision':args.source_revision,'memo_sha256':sha(CASE/'memo.json'),'plan_sha256':sha(ROOT/'execution-plan.json')},'recovery journal exact trial identity required')
        approved=recovery_authority(recovery_receipt,release_cache,prior_journal,sha(CASE/'memo.json'),args.source_revision,json.loads((CASE/'sealed-live-deployment.json').read_text()),json.loads((CASE/'sealed-native-dependencies.json').read_text()),args.phase)
        outage_recovery=True
    if args.phase in ('release', 'verify'):
        require(args.root_fresh_scan_receipt == Path('/tmp/security-infd-zlib-fresh-scan-receipt.json'), 'fixed fresh scan receipt path required')
        private(args.root_fresh_scan_receipt)
        scan_receipt=json.loads(args.root_fresh_scan_receipt.read_text())
        report_path=Path('/tmp/security-infd-zlib-fresh-scan-full.json');private(report_path)
        require(sha(report_path)==scan_receipt.get('full_report_sha256'), 'fresh scan report bytes changed')
        fresh_scan(scan_receipt,json.loads(report_path.read_text()),json.loads((CASE/'fresh-scan-contract.json').read_text()))
    parent = CUSTODY.parent
    private(parent, directory=True)
    ignored = run(['git', '-C', str(CUSTODIAN), 'check-ignore', '--no-index', str(CUSTODY / 'drill.sqlite')])
    require(ignored.returncode == 0, 'offcluster custody is not ignored')
    if not CUSTODY.exists():
        require(args.phase == 'drill-backup', 'first approved phase must create unique private custody')
        os.mkdir(CUSTODY, 0o700)
    private(CUSTODY, directory=True)
    capacity = os.statvfs(CUSTODY)
    require(capacity.f_bavail * capacity.f_frsize >= 2 * MAX_BYTES + 16 * 1024**2,
            'independent protected custody headroom insufficient')
    os.makedirs(CUSTODY / 'empty-docker-config', mode=0o700, exist_ok=True)
    private(CUSTODY / 'empty-docker-config', directory=True)
    require(not list((CUSTODY / 'empty-docker-config').iterdir()), 'public Docker read config must stay empty')
    journal = Journal(CUSTODY, {'proposal': plan['proposal_id'], 'source_revision': args.source_revision,
                               'memo_sha256': sha(CASE / 'memo.json'), 'plan_sha256': sha(ROOT / 'execution-plan.json')})
    try:
        if args.phase=='release':
            cache={'root_authority':receipt,'native_outcome':json.loads(args.root_native_outcome.read_text()),'memo_sha256':sha(CASE/'memo.json'),'source_revision':args.source_revision,'plan_sha256':sha(ROOT/'execution-plan.json')}
            cache_path=CUSTODY/'release-authority-cache.json'
            fd=os.open(cache_path,os.O_WRONLY|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o600)
            with os.fdopen(fd,'w') as stream:
                json.dump(cache,stream,indent=2);stream.write('\n');stream.flush();os.fsync(stream.fileno())
            private(cache_path);directory=os.open(CUSTODY,os.O_DIRECTORY|os.O_RDONLY)
            try:os.fsync(directory)
            finally:os.close(directory)
        journal.start(args.phase, approved) # fsynced RUNNING before any phase effect.
        if args.phase=='release':journal.note(args.phase,'release_authority_cache_sha256',sha(cache_path))
        if outage_recovery:
            require(sha(CUSTODY/'release-authority-cache.json')==recovery_receipt['cache_sha256'],'release authority cache changed')
            journal.note(args.phase,'outage_recovery_receipt_sha256',sha(args.root_recovery_receipt))
            journal.note(args.phase,'outage_recovery_anchor',recovery_receipt)

        if args.phase in ('drill-copy', 'cutover-copy'):
            result = copy_snapshot(args.phase, args.source_revision, approved, journal)
        elif args.phase == 'offline-verify':
            result = offline_verify(journal)
        elif args.phase == 'cleanup-offline':
            result = cleanup_offline(journal)
        else:
            result = remote(args.phase, args.source_revision, approved, operation_intent=journal.data['phases'].get('rollback' if args.phase == 'rollback-verify' else 'release') if args.phase in ('verify', 'rollback-verify') else None, outage_recovery=outage_recovery, recovery_release_started_at=journal.data['phases']['release']['started_at'] if outage_recovery else None)
        journal.finish(args.phase, result)
        print(json.dumps(result)) # Only count/hash/identity receipts, never snapshot bytes.
    except BaseException as error:
        safe = {'all_checks_pass': False, 'phase': args.phase, 'failure_class': type(error).__name__,
                'failure': 'fixed phase outcome uncertain; original evidence retained; no retry',
                'raw_output_withheld': True}
        if journal.data['phases'].get(args.phase, {}).get('state') == 'RUNNING':
            journal.finish(args.phase, safe)
        print(json.dumps(safe))
        raise SystemExit(1) from None
    finally:
        journal.close()


if __name__ == '__main__':
    try:
        main()
    except Exception:
        raise SystemExit('supervised execution refused before phase; raw output withheld') from None