197 lines
11 KiB
Python
197 lines
11 KiB
Python
#!/usr/bin/env python3
|
|
"""Freeze the oracle truth for the GO port of src/rune/verification_layer.py
|
|
(dichotomy wave #2479, GO). Every public function, every branch, against the
|
|
LIVE oracle (which delegates to the Rust evidence_provenance core — parity
|
|
already proven 33/33). Rows pin the full VerificationResult field set AND the
|
|
byte-exact json.dumps(to_dict()) rendering. handle_hook + PLUGIN pinned too.
|
|
|
|
HERMETIC (truth-battery environment-neutrality law): the file_exists rows
|
|
observe paths under the repo root, but the frozen artifact must never bake
|
|
the generation host's root (an old worktree root broke parity in every later
|
|
checkout). Every occurrence of the repo root — in inputs AND expectations —
|
|
is frozen as the {{ROOT}} placeholder; the Go battery substitutes its own
|
|
runtime root at replay time (see truth_test.go loadTruth).
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
import os
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
sys.path.insert(0, str(ROOT / "src"))
|
|
|
|
from rune import verification_layer as vl # noqa: E402
|
|
|
|
FIXTURE = ROOT / "src/go/verification_layer/.fixtures/exists.txt"
|
|
|
|
rows: list[dict] = []
|
|
|
|
|
|
def row(name, fn, verifier_type, result):
|
|
got = getattr(vl, fn)(dict(result), verifier_type) if fn == "verify" \
|
|
else getattr(vl, fn)(dict(result))
|
|
rows.append({
|
|
"name": name,
|
|
"fn": fn,
|
|
"verifier_type": verifier_type,
|
|
"result": result,
|
|
"want": got.to_dict(),
|
|
"want_json": json.dumps(got.to_dict()),
|
|
})
|
|
|
|
|
|
def hook_row(name, event, data=None):
|
|
got = vl.handle_hook(event) if data is None else vl.handle_hook(event, data)
|
|
rows.append({
|
|
"name": name,
|
|
"fn": "handle_hook",
|
|
"verifier_type": "",
|
|
"result": {"event": event, "data": data},
|
|
"want": got,
|
|
"want_json": json.dumps(got, sort_keys=True),
|
|
})
|
|
|
|
|
|
# ── verify_exit_code: every branch ──────────────────────────────────────────
|
|
row("exit_code:absent-defaults-0", "verify_exit_code", "exit_code", {})
|
|
row("exit_code:zero-pass", "verify_exit_code", "exit_code", {"exit_code": 0})
|
|
row("exit_code:one-fail", "verify_exit_code", "exit_code", {"exit_code": 1})
|
|
row("exit_code:negative-fail", "verify_exit_code", "exit_code", {"exit_code": -3})
|
|
row("exit_code:float-zero-pass", "verify_exit_code", "exit_code", {"exit_code": 0.0})
|
|
row("exit_code:float-integral-fail", "verify_exit_code", "exit_code", {"exit_code": 2.0})
|
|
row("exit_code:float-negative-integral-fail", "verify_exit_code", "exit_code", {"exit_code": -3.0})
|
|
row("exit_code:float-exponent-fail", "verify_exit_code", "exit_code", {"exit_code": 1e20})
|
|
row("exit_code:float-frac-fail", "verify_exit_code", "exit_code", {"exit_code": 0.5})
|
|
row("exit_code:bool-true-fails", "verify_exit_code", "exit_code", {"exit_code": True})
|
|
row("exit_code:bool-false-passes", "verify_exit_code", "exit_code", {"exit_code": False})
|
|
row("exit_code:str-zero-not-equal", "verify_exit_code", "exit_code", {"exit_code": "0"})
|
|
row("exit_code:null-not-equal", "verify_exit_code", "exit_code", {"exit_code": None})
|
|
row("exit_code:big-int-evidence", "verify_exit_code", "exit_code", {"exit_code": 91247})
|
|
|
|
# ── verify_unit_test ────────────────────────────────────────────────────────
|
|
row("unit_test:all-defaults-total-zero-fails", "verify_unit_test", "unit_test", {})
|
|
row("unit_test:pass", "verify_unit_test", "unit_test",
|
|
{"tests_passed": 10, "tests_failed": 0, "tests_total": 10})
|
|
row("unit_test:two-fail", "verify_unit_test", "unit_test",
|
|
{"tests_passed": 3, "tests_failed": 2, "tests_total": 5})
|
|
row("unit_test:failed-zero-total-positive", "verify_unit_test", "unit_test",
|
|
{"tests_failed": 0, "tests_total": 7})
|
|
row("unit_test:bool-failed-false-total-true", "verify_unit_test", "unit_test",
|
|
{"tests_failed": False, "tests_total": True})
|
|
row("unit_test:failed-true-counts-1", "verify_unit_test", "unit_test",
|
|
{"tests_failed": True, "tests_total": 1})
|
|
row("unit_test:str-total-ignored", "verify_unit_test", "unit_test",
|
|
{"tests_total": "5", "tests_failed": 0})
|
|
|
|
# ── verify_schema ───────────────────────────────────────────────────────────
|
|
row("schema:defaults-pass", "verify_schema", "schema", {})
|
|
row("schema:valid-true-no-errors", "verify_schema", "schema", {"schema_valid": True})
|
|
row("schema:invalid-fail", "verify_schema", "schema", {"schema_valid": False})
|
|
row("schema:errors-fail", "verify_schema", "schema",
|
|
{"schema_valid": True, "schema_errors": ["bad type at $.a", "missing $.b"]})
|
|
row("schema:empty-errors-pass", "verify_schema", "schema",
|
|
{"schema_valid": True, "schema_errors": []})
|
|
row("schema:errors-nonlist-ignored", "verify_schema", "schema",
|
|
{"schema_valid": True, "schema_errors": "nope"})
|
|
row("schema:errors-with-nested-values", "verify_schema", "schema",
|
|
{"schema_valid": False, "schema_errors": [3, {"path": "$.x", "msg": "type"}, True]})
|
|
row("schema:valid-null-defaults-true", "verify_schema", "schema",
|
|
{"schema_valid": None})
|
|
row("schema:valid-zero-falsy", "verify_schema", "schema", {"schema_valid": 0})
|
|
row("schema:valid-truthy-str", "verify_schema", "schema", {"schema_valid": "yes"})
|
|
row("schema:unicode-error-escaping", "verify_schema", "schema",
|
|
{"schema_valid": False, "schema_errors": ["ungültig bei „$.pfad“"]})
|
|
|
|
# ── verify_file_exists (fixture file is committed next to the port) ────────
|
|
row("file_exists:exists-pass", "verify_file_exists", "file_exists",
|
|
{"file_path": str(FIXTURE)})
|
|
row("file_exists:missing-fail", "verify_file_exists", "file_exists",
|
|
{"file_path": str(ROOT / "src/go/verification_layer/.fixtures/definitely_missing.txt")})
|
|
row("file_exists:empty-path-fail", "verify_file_exists", "file_exists",
|
|
{"file_path": ""})
|
|
row("file_exists:dir-counts", "verify_file_exists", "file_exists",
|
|
{"file_path": str(ROOT / "src/go/verification_layer/.fixtures")})
|
|
row("file_exists:absent-key-fail", "verify_file_exists", "file_exists", {})
|
|
|
|
# ── verify_file_changed ─────────────────────────────────────────────────────
|
|
row("file_changed:empty-expected-pass", "verify_file_changed", "file_changed",
|
|
{"file_path": "a.txt", "expected_hash": "", "actual_hash": "deadbeef"})
|
|
row("file_changed:match-pass", "verify_file_changed", "file_changed",
|
|
{"file_path": "a.txt", "expected_hash": "cafe", "actual_hash": "cafe"})
|
|
row("file_changed:mismatch-fail", "verify_file_changed", "file_changed",
|
|
{"file_path": "a.txt", "expected_hash": "cafe", "actual_hash": "beef"})
|
|
row("file_changed:no-keys-pass", "verify_file_changed", "file_changed", {})
|
|
|
|
# ── verify_tool_receipt ─────────────────────────────────────────────────────
|
|
row("tool_receipt:default-pass", "verify_tool_receipt", "tool_receipt", {})
|
|
row("tool_receipt:success-true", "verify_tool_receipt", "tool_receipt",
|
|
{"tool_success": True, "tool_name": "grep"})
|
|
row("tool_receipt:fail-with-error", "verify_tool_receipt", "tool_receipt",
|
|
{"tool_success": False, "tool_error": "boom: exit 2"})
|
|
row("tool_receipt:fail-empty-error", "verify_tool_receipt", "tool_receipt",
|
|
{"tool_success": False})
|
|
row("tool_receipt:zero-falsy", "verify_tool_receipt", "tool_receipt",
|
|
{"tool_success": 0, "tool_error": "falsy rc"})
|
|
row("tool_receipt:error-str-truthy", "verify_tool_receipt", "tool_receipt",
|
|
{"tool_success": "ok"})
|
|
|
|
# ── verify_constraint_check ─────────────────────────────────────────────────
|
|
row("constraint:default-pass", "verify_constraint_check", "constraint_check", {})
|
|
row("constraint:met-true-pass", "verify_constraint_check", "constraint_check",
|
|
{"constraints_met": True})
|
|
row("constraint:unmet-fail", "verify_constraint_check", "constraint_check",
|
|
{"constraints_met": False})
|
|
row("constraint:violations-fail", "verify_constraint_check", "constraint_check",
|
|
{"constraints_met": True, "constraint_violations": ["no secrets in diff"]})
|
|
row("constraint:violations-nested", "verify_constraint_check", "constraint_check",
|
|
{"constraints_met": False,
|
|
"constraint_violations": [{"rule": "R1", "at": 7}, 12, None]})
|
|
|
|
# ── verify dispatch (named + unknown) ───────────────────────────────────────
|
|
for vt in ("exit_code", "unit_test", "schema", "file_exists", "file_changed",
|
|
"tool_receipt", "constraint_check"):
|
|
row(f"dispatch:{vt}", "verify", vt, {})
|
|
row("dispatch:unknown-verifier", "verify", "nonexistent_verifier", {})
|
|
row("dispatch:unknown-empty-name", "verify", "", {})
|
|
row("dispatch:unknown-case-sensitive", "verify", "Exit_Code", {"exit_code": 0})
|
|
|
|
# ── handle_hook ─────────────────────────────────────────────────────────────
|
|
hook_row("hook:event-only", "verification.request")
|
|
hook_row("hook:event-with-data", "verification.done", {"passed": True})
|
|
|
|
# ── PLUGIN manifest ─────────────────────────────────────────────────────────
|
|
rows.append({
|
|
"name": "plugin:manifest",
|
|
"fn": "plugin",
|
|
"verifier_type": "",
|
|
"result": {},
|
|
"want": vl.PLUGIN,
|
|
"want_json": json.dumps(vl.PLUGIN, sort_keys=True),
|
|
})
|
|
|
|
doc = {
|
|
"frozen_ts": "2026-10-16T00:00:00+00:00",
|
|
"generator": "scripts/gen_verification_layer_truth.py — live oracle "
|
|
"src/rune/verification_layer.py (Rust evidence_provenance core); "
|
|
"regenerated hermetically ({{ROOT}} placeholder)",
|
|
"placeholders": {
|
|
"{{ROOT}}": "absolute repo root at replay time "
|
|
"(src/go/verification_layer is <ROOT>/src/go/verification_layer)",
|
|
},
|
|
"rows": rows,
|
|
}
|
|
text = json.dumps(doc, indent=1, ensure_ascii=False) + "\n"
|
|
# Freeze the repo root as the {{ROOT}} placeholder — every occurrence, in
|
|
# inputs AND expectations (want + want_json) alike.
|
|
text = text.replace(str(ROOT), "{{ROOT}}")
|
|
# Hermetic self-check: the generation host's root must not leak (inputs,
|
|
# expectations, want_json — none may carry it past this line).
|
|
assert str(ROOT) not in text, "generation-time repo root leaked into truth.json"
|
|
assert "/mnt/" not in text and "/home/" not in text, "host root leaked into truth.json"
|
|
assert "{{ROOT}}" in text, "file_exists rows lost their {{ROOT}} placeholder"
|
|
out = ROOT / "src/go/verification_layer/truth.json"
|
|
out.write_text(text, encoding="utf-8")
|
|
print(f"frozen {len(rows)} rows → {out} ({{ROOT}}-hermetic)")
|