Publish sealed updated-boundary audit and truthful learning status

2026-09-30 20:17:50 +08:00
parent a9c5918445
commit 3e30934a55
574 changed files with 218421 additions and 0 deletions
@@ -0,0 +1,139 @@
+"""Build explicit file-bound authorities; does not run a brain or prove a process.
+
+The registered coordinator authenticates source/input bytes and actual exits.
+All output here is a new dictionary; existing authority files are never edited.
+"""
+from __future__ import annotations
+
+import copy
+import hashlib
+import json
+from pathlib import Path
+
+import numpy as np
+
+
+def require(ok, message):
+    if not ok: raise ValueError(message)
+
+
+def digest(path):
+    h=hashlib.sha256()
+    with Path(path).open('rb') as stream:
+        for block in iter(lambda:stream.read(8<<20),b''):h.update(block)
+    return h.hexdigest()
+
+
+def read(path):
+    def unique(items):
+        value={}
+        for k,v in items:
+            require(k not in value,'Duplicate JSON key');value[k]=v
+        return value
+    return json.loads(Path(path).read_text(encoding='utf-8'),object_pairs_hook=unique,
+        parse_constant=lambda x: (_ for _ in ()).throw(ValueError('Nonfinite JSON')))
+
+
+def pin(path):
+    p=Path(path)
+    require(p.is_absolute() and p.is_file() and not any(x.is_symlink() for x in (p,*p.parents)),
+            'Absolute unlinked regular source required')
+    return dict(path=str(p.resolve()),sha256=digest(p))
+
+
+def files_from_authority(value):
+    """Exact direct closure. Parent full payload is additionally checked by loader."""
+    result={}
+    def add(path,sha):
+        require(path not in result or result[path]==sha,'Conflicting input pin')
+        result[path]=sha
+    def visit(item):
+        if type(item)is dict:
+            if set(item)=={'path','sha256'}:add(item['path'],item['sha256'])
+            else:
+                for key,value in item.items():
+                    if key=='frozen_inputs':
+                        for path,sha in value.items():add(path,sha)
+                    else:visit(value)
+        elif type(item)is list:
+            for value in item:visit(value)
+    visit(value)
+    if 'parent' in value:
+        p=value['parent'];add(str(Path(p['directory'])/'checkpoint-manifest.json'),p['checkpoint_manifest_sha256'])
+    if 'checkpoint_dir' in value:
+        add(str(Path(value['checkpoint_dir'])/'checkpoint-manifest.json'),value['checkpoint_manifest_sha256'])
+    return result
+
+
+def effective_hash(spec,overlay_file):
+    """Independent original-base bridge, exact SI arithmetic and APL fast mask."""
+    graph=Path(spec['graph_dir'])
+    weights=np.load(graph/'weights.npy',allow_pickle=False)
+    src=np.load(graph/'src.npy',allow_pickle=False,mmap_mode='r')
+    ids=np.load(graph/'edge_id.npy',allow_pickle=False,mmap_mode='r')
+    try:
+        require(weights.dtype==np.float64 and weights.shape==(25582938,) and
+                src.dtype==np.int32 and src.shape==weights.shape and ids.dtype==np.int64 and ids.shape==weights.shape,
+                'Full canonical graph required')
+        apl=np.load(Path(spec['apl_bundle_dir'])/'apl_globals.npy',allow_pickle=False)
+        require(apl.dtype==np.int32 and apl.shape==(2,),'Two canonical APL IDs required')
+        fast=np.isin(src,apl);require(int(fast.sum())==5845,'Original fast-APL mask differs')
+        weights[fast]=np.float64(0)
+        with np.load(overlay_file,allow_pickle=False) as f:
+            require(set(f.files)=={'edge_id','plastic_delta_mv'},'Overlay array fields differ')
+            mask=f['edge_id'];delta=f['plastic_delta_mv']
+        require(mask.dtype==np.int64 and mask.shape==(14232,) and delta.dtype==np.float32 and delta.shape==mask.shape and
+                np.all((mask>=0)&(mask<len(weights))) and np.all(mask[1:]>mask[:-1]) and
+                np.array_equal(ids[mask],mask) and not fast[mask].any() and np.isfinite(delta).all() and np.all(delta<=0),
+                'Original candidate overlay contract differs')
+        nz=delta!=np.float32(0)
+        rows=mask[nz]
+        weights[rows]=np.add(weights[rows],np.multiply(delta[nz].astype(np.float64),np.float64(.001)))
+        require(np.isfinite(weights).all() and np.all(weights[mask]>0),'Effective candidate sign/nonfinite failure')
+        return hashlib.sha256(weights.astype('<f8',copy=False).tobytes()).hexdigest()
+    finally:
+        src._mmap.close();ids._mmap.close()
+
+
+def epoch_authority(template,*,case,checkpoint,overlay,epoch_id,us_tick,d_command=1.,frozen=False):
+    value=copy.deepcopy(template)
+    require(value['schema']=='phase4an-epoch-postprocess-authority-v1','Wrong epoch template')
+    case,checkpoint=Path(case),Path(checkpoint)
+    spec=read(case/'spec.json');summary=read(checkpoint/'summary.json')
+    require(type(us_tick)is int and 0<=us_tick<spec['steps'] and summary['steps']==spec['steps'],'Invalid epoch clock')
+    value.update(epoch_id=epoch_id,diagnostic_mode=summary['diagnostic_mode'],checkpoint_dir=str(checkpoint),
+                 checkpoint_manifest_sha256=digest(checkpoint/'checkpoint-manifest.json'))
+    value['command']=dict(steps=spec['steps'],compartment="y5B'2a",us_tick=us_tick,
+                          d_command=d_command,frozen=frozen,trace_backend='torch')
+    for role,path in dict(spec=case/'spec.json',requests=case/'requests.npz',state=checkpoint/'state.npz',
+                         overlay_before=overlay['overlay_file'],overlay_manifest_before=overlay['overlay_manifest']).items():
+        value['files'][role]=pin(path)
+    return value
+
+
+def boundary_authority(*,boundary_id,registration_sha256,case,parent,transition,input_policy,mode,
+                       before_overlay,after_overlay,source_files,frozen_inputs,epoch=None,update_dir=None,cpu_receipt=None):
+    require(transition in ('epoch_update','idle') and mode in ('reference','light'),'Invalid transition/mode')
+    case,parent=Path(case),Path(parent);spec=read(case/'spec.json');summary=read(parent/'summary.json')
+    offset=summary.get('global_next_tick',summary['steps'])
+    require(spec['global_tick_offset']==offset and spec['parent_checkpoint_manifest_sha256']==digest(parent/'checkpoint-manifest.json'),
+            'Case does not identify exact parent/clock')
+    before=effective_hash(spec,before_overlay['overlay_file']);after=effective_hash(spec,after_overlay['overlay_file'])
+    require(before==summary['effective_weights_raw_sha256'],'Before effective weight is not parent installation')
+    update=None
+    if transition=='epoch_update':
+        require(epoch is not None and update_dir is not None and cpu_receipt is not None,'Missing actual update evidence')
+        update=dict(epoch_authority=pin(epoch),files={n:pin(Path(update_dir)/n) for n in
+            ('chain-receipt.json','update-receipt.json','delta-after.npz','overlay-manifest.json')})
+    else:
+        require(epoch is update_dir is cpu_receipt is None and before==after,'Idle cannot include a new update')
+    return dict(schema='conditioning-updated-boundary-v1',boundary_id=boundary_id,registration_sha256=registration_sha256,
+        transition=transition,diagnostic_mode=mode,input_policy=input_policy,
+        case=dict(spec=pin(case/'spec.json'),requests=pin(case/'requests.npz')),
+        parent=dict(directory=str(parent),checkpoint_manifest_sha256=digest(parent/'checkpoint-manifest.json')),
+        global_tick_offset=offset,
+        overlay_before=dict(file=pin(before_overlay['overlay_file']),manifest=pin(before_overlay['overlay_manifest'])),
+        overlay_after=dict(file=pin(after_overlay['overlay_file']),manifest=pin(after_overlay['overlay_manifest'])),
+        expected_effective_weight_before_sha256=before,expected_effective_weight_after_sha256=after,
+        update=update,cpu_validation=None if cpu_receipt is None else pin(cpu_receipt),
+        source_files=copy.deepcopy(source_files),frozen_inputs=copy.deepcopy(frozen_inputs))