tricu

bootstrap_acceptance.py (5183B)

---

 #!/usr/bin/env python3
 """Strict opt-in stable bootstrap acceptance, independent of cached fixture checks.
 Run only after two successful fresh-store generations. This audits existing
 outputs; it does not compile source. Failed verification never accepts a baseline.
 """
 import argparse
 import hashlib
 import json
 from pathlib import Path
 from process_rss import run_guarded
 import sys
 from bootstrap_generations import source_map, snapshot
 
 REPO = Path(__file__).resolve().parent.parent
 ARTIFACTS = ('rebuilt-compiler.arboricx', 'build.arboricx', 'build-stable.arboricx')
 
 
 def sha(path):
     return hashlib.sha256(path.read_bytes()).hexdigest()
 
 
 def verify_generation(run, runtime, source_root=None, execution_host='haskell'):
     """Authenticate and independently audit one full fresh compiler generation.
 
     Execution host is caller-selected, never inferred from untrusted provenance.
     Pair acceptance below remains explicitly Haskell-only.
     """
     status = json.loads((run / 'status.json').read_text())
     inputs = json.loads((run / 'inputs.json').read_text())
     if not status.get('complete') or status.get('backend') != 'stable':
         raise ValueError('completed stable generations required')
     if not inputs.get('fresh_store') or not status.get('fresh_store'):
         raise ValueError('fresh-store execution evidence required; seeded checkpoints are not reproduction')
     if any(status.get(key) != value for key, value in inputs.items()):
         raise ValueError('status/input provenance mismatch')
     if inputs.get('execution_host', 'haskell') != execution_host:
         raise ValueError('execution host mismatch')
     root = source_root or Path(inputs['source_root'])
     text, entries, _ = source_map(run / 'source-map.v1', root, 'source_map')
     actual = snapshot(text, entries, root)
     if inputs.get('root') != 'source_map' or any(inputs.get(k) != v for k, v in actual.items()):
         raise ValueError('frozen source/map fingerprint mismatch')
     if sha(runtime) != inputs['runtime_sha256']:
         raise ValueError('runtime identity mismatch')
     if sha(run / 'compiler.arboricx') != inputs['compiler_bundle_sha256']:
         raise ValueError('compiler bundle identity mismatch')
     if sha(run / 'io-adapter.arboricx') != inputs['adapter_sha256']:
         raise ValueError('adapter identity mismatch')
     for name in ARTIFACTS:
         if sha(run / name) != status['artifacts'][name]['sha256']:
             raise ValueError('packaged artifact identity mismatch: ' + name)
     command = [sys.executable, str(REPO / 'test/bootstrap_store_check.py'), str(run)]
     if source_root:
         command += ['--source-root', str(source_root)]
     audit, _ = run_guarded(command, memory_mib=8192, seconds=600)
     return inputs, status, audit
 
 
 def verify(first, second, tricu, source_root=None):
     first, second = first.resolve(), second.resolve()
     if first == second:
         raise ValueError('two independent generation directories required')
     records = []
     audits = []
     for run in (first, second):
         inputs, _, audit = verify_generation(run, tricu, source_root)
         audits.append(audit)
         records.append(inputs)
     for key in ('sources', 'map_sha256', 'backend', 'root', 'runtime_sha256', 'adapter_sha256'):
         if records[0][key] != records[1][key]:
             raise ValueError('generation inputs differ: ' + key)
     if sha(first / 'rebuilt-compiler.arboricx') != records[1]['compiler_bundle_sha256']:
         raise ValueError('second generation did not execute the first rebuilt compiler')
     for name in ARTIFACTS:
         if sha(first / name) != sha(second / name):
             raise ValueError('artifact reproduction failure: ' + name)
     # Check actual manifests, not the runner's recorded comparison booleans.
     for alias in records[0]['sources']:
         a = (first / 'cas/cache/source-build' / alias).read_text().split('\t')[2]
         b = (second / 'cas/cache/source-build' / alias).read_text().split('\t')[2]
         if a != b:
             raise ValueError('manifest reproduction failure: ' + alias)
     return dict(accepted=True, backend='stable', generations=[str(first), str(second)],
                 inputs=records, audits=audits,
                 artifacts={name: sha(second / name) for name in ARTIFACTS})
 
 
 def main():
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument('first', type=Path)
     parser.add_argument('second', type=Path)
     parser.add_argument('--tricu', type=Path, required=True)
     parser.add_argument('--source-root', type=Path, help='explicit relocated frozen source for restore validation')
     parser.add_argument('--output', type=Path, required=True, help='new acceptance evidence file; never overwritten')
     args = parser.parse_args()
     if args.output.exists():
         parser.error('acceptance evidence already exists; do not overwrite')
     evidence = verify(args.first, args.second, args.tricu.resolve(), args.source_root)
     args.output.write_text(json.dumps(evidence, indent=2) + '\n')
     print('Accepted independently audited fresh-store stable reproduction: ' + str(args.output))
 
 
 if __name__ == '__main__':
     main()