Nick
347c2b4256
Contract ADMIT-2026-10-15T22:10:31Z-4b1306-substrate-worker (headless
admission, user:phase-0C-substrate dispatch). Code enforces; spec records.
- 0.12 schemas/boundary/v1 (7 INITIAL message types) + gen_boundary_types.py
emitting BOTH sides (tui/boundary/gen + src/rust/boundary_types crate);
check_boundary_codegen.py gate — hand-edits RED, stale regen RED, corpus
corruption RED (all red-tested first)
- 0.13 unified_check.py (make check): 103 rust crates + pinned pytest suite +
go vet/build/test + corpus round-trip both sides + codegen gate + binary
gate; single exit; per-sha JSON manifest; partial green impossible (tested)
- 0.14 build_paired.sh one build id stamped both sides; build_attestation
verify_build_pairing() raises on mismatch (proven by live tampering)
- 0.15 check_landing.py — refuses landings lacking fresh green runner
evidence or committing binaries (6014 files swept: zero tracked binaries)
- First full verdict RED (correct): surfaced pre-existing prompt_sync
arithmetic-overflow (src/rust/prompt_sync/src/difflib.rs:107, 3 tests,
never swept before — reported, not fixed, queued for bounded repair).
Honest baselines recorded (verification/unified-baseline.json): 120
pytest + 1 crate known-sick; AMBER = baseline-only, 0 new; baseline-diff
comparison only (flaky edges 118-120 observed).
- Judgment calls (logged for owner): suite-refreshed store/spine/current.json
LEFT in place (restoring re-arms an order-dependent false RED; spine was
stale vs c8926ef8). 0.10/0.11 members declared as named SKIPs (fold next).
106 lines
3.5 KiB
Python
106 lines
3.5 KiB
Python
#!/usr/bin/env python3
|
|
"""check_no_committed_binaries.py — phase 0C task 0.14 repo-hygiene gate.
|
|
|
|
RED on any compiled artifact tracked by git. D26: "No compiled artifacts
|
|
are committed to the repo — builds are produced at landing/CI time from
|
|
source." Two detectors so renames cannot smuggle one past:
|
|
|
|
1. extension: .so .a .o .dll .dylib .exe .pyd .node .wasm .class .obj .lib
|
|
2. magic bytes from the tracked blob itself: ELF (\\x7fELF), PE (MZ),
|
|
Mach-O (feedface/feedfacf/cafebabe), ar archive (!<arch>).
|
|
|
|
Reads blobs via `git ls-files -s` + `git cat-file` so the verdict reflects
|
|
what is COMMITTED, not what sits untracked in the working tree (local
|
|
build output under target/ etc. is fine).
|
|
|
|
Usage: python scripts/check_no_committed_binaries.py [--repo-root PATH]
|
|
Exit 0 = clean (list printed even when empty); 1 = RED with the list.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import subprocess
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
BINARY_EXTENSIONS = {
|
|
".so", ".a", ".o", ".dll", ".dylib", ".exe", ".pyd", ".node",
|
|
".wasm", ".class", ".obj", ".lib",
|
|
}
|
|
|
|
MAGICS = [
|
|
b"\x7fELF", # ELF (linux .so/.a members/executables)
|
|
b"MZ", # PE (windows .exe/.dll)
|
|
b"\xfe\xed\xfa\xce", # Mach-O 32
|
|
b"\xfe\xed\xfa\xcf", # Mach-O 64
|
|
b"\xca\xfe\xba\xbe", # Mach-O fat / Java class
|
|
b"!<arch>\n", # ar archive (.a)
|
|
]
|
|
|
|
|
|
def git(root: Path, *args: str) -> subprocess.CompletedProcess:
|
|
return subprocess.run(["git", "-C", str(root), *args],
|
|
capture_output=True, text=True)
|
|
|
|
|
|
def tracked_files(root: Path) -> list[tuple[str, str]]:
|
|
"""[(path, blob_sha)] for every file tracked by git."""
|
|
r = git(root, "ls-files", "-s", "--")
|
|
if r.returncode != 0:
|
|
raise RuntimeError(f"git ls-files failed: {r.stderr.strip()}")
|
|
out = []
|
|
for line in r.stdout.splitlines():
|
|
meta, _, path = line.partition("\t")
|
|
fields = meta.split()
|
|
if len(fields) >= 2 and path:
|
|
out.append((path, fields[1]))
|
|
return out
|
|
|
|
|
|
def blob_magic(root: Path, sha: str) -> bytes:
|
|
r = subprocess.run(["git", "-C", str(root), "cat-file", "blob", sha],
|
|
capture_output=True)
|
|
return r.stdout[:16]
|
|
|
|
|
|
def find_committed_binaries(root: Path) -> list[str]:
|
|
offenders = []
|
|
for path, sha in tracked_files(root):
|
|
ext = Path(path).suffix.lower()
|
|
if ext in BINARY_EXTENSIONS:
|
|
offenders.append(f"{path} (extension {ext})")
|
|
continue
|
|
head = blob_magic(root, sha)
|
|
for magic in MAGICS:
|
|
if head.startswith(magic):
|
|
offenders.append(f"{path} (magic {magic!r})")
|
|
break
|
|
return offenders
|
|
|
|
|
|
def main(argv=None) -> int:
|
|
ap = argparse.ArgumentParser(description="no-committed-binaries gate (task 0.14)")
|
|
ap.add_argument("--repo-root", default=str(Path(__file__).resolve().parent.parent))
|
|
args = ap.parse_args(argv)
|
|
root = Path(args.repo_root).resolve()
|
|
|
|
try:
|
|
offenders = find_committed_binaries(root)
|
|
except RuntimeError as exc:
|
|
print(f"RED: {exc}")
|
|
return 1
|
|
|
|
if offenders:
|
|
print("RED: compiled artifacts tracked by git (D26: builds are "
|
|
"produced at landing/CI time, never committed):")
|
|
for o in offenders:
|
|
print(f" - {o}")
|
|
return 1
|
|
print("GREEN: no compiled artifacts tracked by git "
|
|
f"({len(tracked_files(root))} tracked files checked)")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|