Admit reviewed receiver evidence batch 10

docs/changes/netkingdom-target-2026-10-17/verify_rollout_owner_bindings.py

@@ -0,0 +1,34 @@
+"""Read-only final source/remote/Hub binding check, retaining only public identifiers."""
+from pathlib import Path
+import hashlib,json,re,subprocess,urllib.request,yaml
+here=Path(__file__).resolve().parent
+specs=[('state-hub','STATE-WP-0095','4c03c9d2c6a47f5c7247473f74b2e2f188b787bd',10),('repo-manager','RMGR-WP-0019','1dacdd4a31c8e9b1bb1ddfb0c349dfb87e29e8cd',6),('repo-manager','RMGR-WP-0021','1dacdd4a31c8e9b1bb1ddfb0c349dfb87e29e8cd',5),('railiance-cluster','RCLUSTER-WP-0018','6ae3f847c83da3402883453ee7110457bfb2d0d6',5)]
+def git(root,*a):return subprocess.check_output(['git','--no-optional-locks','-C',str(root),*a],stderr=subprocess.PIPE,timeout=30).decode().strip()
+def get(path):return json.load(urllib.request.urlopen('http://127.0.0.1:8000'+path,timeout=20))
+health=get('/state/health');assert health['instance_role']=='primary' and health['instance_label']=='railiance01'
+rows=[];snapshots={};targets={'NK-WP-0049-T33':'56c8d469-7a10-5d50-a30e-95cbf3cd4756'}
+for repo,wp,head,count in specs:
+ root=Path('/home/worsch')/repo;assert git(root,'rev-parse','HEAD')==head
+ paths=list((root/'workplans').glob(wp+'-*.md'));assert len(paths)==1;path=paths[0];raw=path.read_text();assert git(root,'show',head+':'+str(path.relative_to(root)))==raw.strip()
+ front=yaml.safe_load(raw.split('---',2)[1]);tasks=[yaml.safe_load(v) for v in re.findall(r'```task\n(.*?)\n```',raw,re.S)];assert len(tasks)==count
+ for task in tasks:targets[task['id']]=task['state_hub_task_id']
+ rows.append(dict(repo=repo,wp=wp,head=head,source_path=str(path),front=front,tasks=tasks,source_sha256=hashlib.sha256(path.read_bytes()).hexdigest()))
+result=[]
+for item in rows:
+ repo=item['repo'];root=Path('/home/worsch')/repo
+ remote=git(root,'ls-remote','origin','refs/heads/main').split()[0];assert remote==item['head']
+ snapshot=snapshots.setdefault(repo,get('/repos/'+repo+'/work-record-projection/snapshot'))
+ plan=next(p for p in snapshot['workplans'] if p['id']==item['front']['state_hub_workstream_id']);assert plan['status']==item['front']['status']
+ actual=[t for t in snapshot['tasks'] if t.get('workplan_id',t.get('workstream_id'))==plan['id']];assert len(actual)==len(item['tasks']);byid={t['id']:t for t in actual}
+ for task in item['tasks']:
+  t=byid[task['state_hub_task_id']];assert t['record_id']==task['id'] and t['status']==task['status']
+  if 'needs_human' in task:assert bool(t.get('needs_human'))==task['needs_human']
+ expected={(t['state_hub_task_id'],targets[d],'starts_after') for t in item['tasks'] for d in t.get('depends_on',[]) if d in targets}
+ edges=[e for e in snapshot['dependencies'] if e['from_workplan_id']==plan['id'] and e.get('from_task_id')]
+ observed={(e['from_task_id'],e.get('to_task_id'),e['relationship_type']) for e in edges}
+ assert observed<=expected,'undeclared-projected-edge'
+ required_pairs={'RMGR-WP-0019':[('RMGR-WP-0019-T06','STATE-WP-0095-T10')],'STATE-WP-0095':[('STATE-WP-0095-T07','STATE-WP-0095-T10')],'RCLUSTER-WP-0018':[('RCLUSTER-WP-0018-T03','RCLUSTER-WP-0018-T02'),('RCLUSTER-WP-0018-T04','RCLUSTER-WP-0018-T02'),('RCLUSTER-WP-0018-T04','RCLUSTER-WP-0018-T03')]}
+ assert all((targets[a],targets[b],'starts_after') in observed for a,b in required_pairs.get(item['wp'],[])),'required-current-edge-missing'
+ result.append({'repo':repo,'workplan_id':item['wp'],'commit':item['head'],'remote_exact':True,'source_sha256':item['source_sha256'],'status':plan['status'],'tasks':[{k:t[k] for k in ['id','record_id','status','needs_human'] if k in t} for t in actual],'projected_edges':[{'from_task_id':a,'to_task_id':b,'relationship_type':c} for a,b,c in sorted(observed)],'unprojected_source_declarations':[{'from_task_id':a,'to_task_id':b,'relationship_type':c} for a,b,c in sorted(expected-observed)]})
+v={'schema':'custodian.rollout-owner-bindings.v1','status':'verified','primary':'primary/railiance01','task_bindings':sum(len(r['tasks']) for r in result),'rows':result,'runtime_deployed_source':'51bc70d1ff8f25450a8650d8e50caf053093a02e','successor_runtime_source_not_deployed':'c103cbf3c8bed5dba87a03e320595ddded9301a3','native_target_gates_closed':0}
+(here/'rollout-owner-bindings.json').write_text(json.dumps(v,indent=2)+'\n');print(json.dumps({'status':'verified','task_bindings':v['task_bindings']}))