tegwick
47881fc1ff
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
37 lines
5.3 KiB
Python
37 lines
5.3 KiB
Python
from pathlib import Path
|
|
import json,hashlib,datetime,importlib.util,sys
|
|
R=Path('/home/worsch/informed-decision');P=Path('/tmp/infd-zlib-native-completed-evidence');O=Path('/tmp/infd-zlib-native-product-acceptance-stage');H=lambda b:hashlib.sha256(b).hexdigest()
|
|
raw=(P/'manifest.json').read_bytes();assert H(raw)=='0e4799f709e097312c18ef0124afc153003efef0627902591939a218dbd66d4d';entries=json.loads(raw);assert len(entries)==20
|
|
for e in entries:assert H((P/e['path']).read_bytes())==e['sha256']
|
|
d={e['path']:json.loads((P/e['path']).read_text()) for e in entries if e['path'].endswith('.json')};phases=['drill-backup','drill-copy','offline-verify','cleanup-offline','cutover-backup','cutover-copy','release','verify']
|
|
for phase in phases:assert d[phase+'.json']['all_checks_pass'] is True
|
|
for phase in ['drill','cutover']:
|
|
a=d[phase+'-backup.json'];b=d[phase+'-copy.json']
|
|
for k in ['snapshot_file','snapshot_bytes','snapshot_sha256','snapshot_readonly']:assert a[k]==b[k]
|
|
assert b['off_cluster_private_copy_verified'] and not b['snapshot_contents_output']
|
|
o=d['offline-verify.json'];assert o['offline_readonly']==o['offline_post_admin_readonly']==d['drill-copy.json']['snapshot_readonly']
|
|
for k in ['schema_version','lifecycle','outbox','submissions']:assert o['admin_counts'][k]==o['offline_readonly'][k]
|
|
assert o['network']=='none' and not o['runtime_tokens_or_config_mounted'] and not o['service_entrypoint_started'] and o['original_snapshot_hash_unchanged']
|
|
v=d['verify.json'];assert v['live_readonly_schema_integrity_counts']==d['cutover-copy.json']['snapshot_readonly'] and v['zlib_package']=='1.3.2-r1' and v['native_rollout_verified'] and v['current_schema5_database_retained']
|
|
expected=json.loads((R/'docs/evidence/2026-10-11-zlib-image-release/installed-zlib-proof.json').read_text())
|
|
for n,h in v['installed_zlib_files'].items():assert h==expected['files'][n][4]
|
|
assert v['policy_sha256']==H((R/'informed_decision/policy.py').read_bytes())=='9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62'
|
|
assert v['installed_purpose_checks']=={'installed_image_purpose_variants':10,'binding_forms_allowed':2,'advisory_or_malformed_refused':8,'synthetic_only':True,'native_provider':False}
|
|
prov=d['canonical-provider-verification.json'];a=prov['before'];b=prov['after'];native=prov['native_provider']
|
|
for k in ['pod_uid','image','image_id','application_revision','deployment_uid','generation','ready_replicas']:assert a[k]==b[k]
|
|
assert a['pod_uid']==v['pod_uid']=='1153f806-1e05-4596-baf3-a4fa8adf08be' and a['generation']==26 and a['ready_replicas']==1 and a['application_revision']=='312ab97e876e17341bf16f9e95397e14c2ac2720'
|
|
assert native['http_status']==200 and native['native_authenticated_canonical_lifecycle_outcomes'] and not native['approval_inferred'] and not native['dispositions_interpreted'];assert a['observed_at']<native['observed_at']<b['observed_at']
|
|
assert d['release.json']['resources']==[{'group':'apps','kind':'Deployment','name':'informed-decision','namespace':'informed-decision'}] and d['release.json']['prune'] is False
|
|
scan=d['fresh-scan-receipt.json'];report=d['fresh-scan-full.json'];assert scan['full_report_sha256']==H((P/'fresh-scan-full.json').read_bytes()) and scan['image']==a['image']
|
|
E=R/'docs/evidence/2026-10-11-zlib-image-release/execution';spec=importlib.util.spec_from_file_location('closure_authority',E/'authority_journal.py');mod=importlib.util.module_from_spec(spec);spec.loader.exec_module(mod)
|
|
mod.fresh_scan(scan,report,json.loads((E.parent/'fresh-scan-contract.json').read_text()),datetime.datetime.fromisoformat(native['observed_at']))
|
|
count=sum(len(x['Packages']) for x in report['Results']);assert count==44 and not [v for x in report['Results'] for v in x.get('Vulnerabilities',[])]
|
|
auth=d['confirmed-root-authority.json'];assert auth['memo_sha256']==H((E.parent/'memo.json').read_bytes()) and auth['source_revision']==a['application_revision'];assert auth['executor_plan_sha256']==H((E/'execution-plan.json').read_bytes())
|
|
plan=json.loads((E/'execution-plan.json').read_text())
|
|
for n,h in plan['executor_files'].items():assert H((E/n).read_bytes())==h
|
|
for n,h in plan['owner_source_files'].items():assert H((R/n).read_bytes())==h
|
|
assert auth['approval_id']=='b5ce337c-5d7d-44fa-864d-706b54039f7c' and auth['disposition_id']=='disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f' and auth['accepted_at']=='2026-10-11T10:40:55Z'
|
|
for n in ['prephase-refusal-first.json','prephase-refusal-second.json','prephase-refusal-traced.json']:assert not d[n]['all_checks_pass']
|
|
intakes=(R/'intakes/intakes.md').read_text();assert 'id: INFD-IN-0010' in intakes and 'promotion: not-promoted' in intakes
|
|
(O/'validation.json').write_text(json.dumps(dict(all20_original_receipt_hashes_verified=True,all8_phase_receipts_pass=True,drill_and_cutover_private_copies_equal=True,offline_pre_admin_post_equal=True,native_current_schema_counts_equal_cutover=True,installed_fixed_package_and_hashes=True,sameReadyPod_source_image_before_after_real_provider=True,actual_canonical_provider_HTTP200=True,synthetic_purpose_forms_remain_separate=True,full44_zero_scan_at_actual_verification_fresh=True,approved_owner_executor_render_plan_unchanged=True,original3_prephase_refusals_preserved=True,existing_residualIN10_unpromoted=True,native_actions_by_reviewer=False),indent=2)+'\n')
|
|
print('20 hashes, all8 phases, native installed/canonical-provider proof, fresh full44 scan and unchanged approved source verified.')
|