"""Read-only, process-bound finite engineering audit; never a learning gate. Only the optional final JSON is written, exclusively. The recorded successful parent-process exits are authenticated file evidence, not re-observed exits. Old integrity/sealing is deliberately a separate process. No E, U or Torch is imported here; all checkpoint loading shares updated_continuation.C.R. """ from __future__ import annotations import argparse import hashlib import json from pathlib import Path import sys from types import ModuleType import numpy as np import boundary_compare as B import boundary_plan as PLAN import execution_authority as A import isolated_execution as W import updated_continuation as D from prepare_execution import EXP, MODEL, LAB, save N, EDGES = 166700, 25582938 require, read, digest = A.require, A.read, A.digest def canonical(value): return json.dumps(value, sort_keys=True, separators=(',', ':'), ensure_ascii=False, allow_nan=False) def same_json(left, right): return canonical(left) == canonical(right) def verify_pins(pins): require(type(pins) is dict and pins, 'Nonempty input authority required') for path, sha in pins.items(): require(A.pin(path)['sha256'] == sha, 'Pinned file changed: ' + str(path)) def tree(directory): root = Path(directory) require(root.is_dir(), 'Missing output tree') result = {} for p in sorted(root.rglob('*')): require(not any(q.is_symlink() or (hasattr(q, 'is_junction') and q.is_junction()) for q in (p, *p.parents)), 'Linked evidence forbidden') if p.is_file(): result[p.relative_to(root).as_posix()] = dict(sha256=digest(p), bytes=p.stat().st_size) else: require(p.is_dir(), 'Nonregular evidence forbidden') require(result, 'Empty output tree') return result def _helpers(): raw = W.AP.read_bytes() require(hashlib.sha256(raw).hexdigest() == W.AP_SHA, 'Frozen worker helper changed') module = ModuleType('_conditioning_execution_audit_pure_worker_helpers') module.__file__ = str(W.AP) exec(compile(raw, str(W.AP), 'exec'), module.__dict__) return module def expected_processes(plan): calls = {row['call_id']: row for row in plan['calls']} require(len(calls) == len(plan['calls']), 'Duplicate call') kinds = {name: ('brain' if row['runner'] in ('runtime_light', 'fresh_probe') else 'oracle' if row['runner'] == 'boundary_oracle' else 'unchanged' if row['runner'] == 'runtime_continuation' else 'updated') for name, row in calls.items()} for arm in ('D1', 'D0', 'frozen'): kinds['AP-' + arm + '--cpu-verify'] = 'validate_cpu' for name in ('mechanical--fresh-parent', 'performance--natural-light-fresh'): kinds[name + '--original-E'] = 'update' kinds[name + '--cpu-verify'] = 'validate_cpu' kinds['evaluation-inputs'] = 'sample' require(len(kinds) == plan['counts']['total_children'], 'Planned child inventory differs') return kinds def _closure(reg, reg_sha): return {**reg['source_sha256'], **reg['input_sha256'], **reg['prepared_file_sha256'], str(EXP / 'protocol/preregistered.json'): reg_sha} def verify_process(name, kind, reg, reg_sha, process_path, helper): """Recheck actual bytes; never accept worker pass flags as a seal.""" paths = {key: EXP / f'{sub}/{name}{suffix}' for key, sub, suffix in ( ('job', 'jobs', '.json'), ('worker', 'receipts', '.worker.json'), ('process', 'receipts', '.process.json'), ('stdout', 'logs', '.stdout.log'), ('stderr', 'logs', '.stderr.log'))} require(Path(process_path) == paths['process'], 'Wrong fixed process record path') job, receipt, process = (read(paths[k]) for k in ('job', 'worker', 'process')) ap = kind in ('brain', 'update') script = W.AP if ap else MODEL / 'isolated_execution.py' worker_sha = W.AP_SHA if ap else reg['source_sha256'][str(script)] schema = 'phase4ap-isolated-worker-job-v1' if ap else W.SCHEMA require(job['schema'] == schema and job['job_id'] == name and job['kind'] == kind and job['registration_sha256'] == reg_sha and job['worker_sha256'] == worker_sha, 'Actual job identity differs') require(process['schema'] == 'conditioning-execution-process-v1' and process['complete'] is True and process['exit_code'] == 0 and type(process['exit_code']) is int and process['timed_out'] is False and process['name'] == name and process['kind'] == kind and process['registration_sha256'] == reg_sha, 'Missing successful recorded process exit') job_sha = digest(paths['job']) require(process['job_sha256'] == job_sha and process['worker_receipt_sha256'] == digest(paths['worker']) and all(process[k + '_sha256'] == digest(paths[k]) for k in ('stdout', 'stderr')), 'Process file chain changed') argv = process['argv'] require(type(argv) is list and len(argv) == (8 if ap else 7) and type(argv[0]) is str and bool(argv[0]), 'Recorded process command is incomplete') require(argv[1:] == ['-B', str(script), *([kind] if ap else []), '--job', str(paths['job']), '--job-sha256', job_sha], 'Recorded command differs from pinned worker/job') expected_schema = 'phase4ap-isolated-worker-receipt-v1' if ap else 'conditioning-isolated-execution-receipt-v1' require(receipt['schema'] == expected_schema and receipt['complete'] is True and all(receipt[k] == job[k] for k in ('job_id', 'kind', 'registration_sha256', 'worker_sha256')) and receipt['job_sha256'] == job_sha and receipt['process_exit_independently_observed'] is False, 'Worker receipt identity/scope differs') closure = _closure(reg, reg_sha) require(all(job['input_sha256'].get(p) == s for p, s in closure.items()), 'Registered input closure omitted') inputs = dict(closure) if kind == 'brain': roles = ('runtime_light', 'runtime_continuation') case = Path(job['case_dir']) extra = [case / 'spec.json', case / 'requests.npz', Path(job['overlay_file']), Path(job['overlay_manifest'])] inputs.update({str(p): digest(p) for p in extra}) else: authority = Path(job['authority_file']) require(digest(authority) == job['authority_sha256'], 'Worker authority changed') inputs[str(authority)] = job['authority_sha256'] value = read(authority) if kind == 'sample': require(authority == EXP / 'protocol/preregistered.json' and job['authority_sha256'] == reg_sha, 'Sampler is not bound to actual registration') else: inputs.update(A.files_from_authority(value)) if kind == 'validate_cpu': update = Path(job['update_dir']) require({p.name for p in update.iterdir()} == set(D.UPDATE_FILES), 'Update must contain exact four files') inputs.update({str(p): digest(p) for p in update.iterdir()}) require(job['chain_sha256'] == digest(update / 'chain-receipt.json'), 'CPU chain pin differs') if kind == 'oracle': case = Path(job['oracle_case']) for filename, key in (('spec.json', 'oracle_spec_sha256'), ('requests.npz', 'oracle_requests_sha256')): require(digest(case / filename) == job[key], 'Live oracle case pin differs') inputs[str(case / filename)] = job[key] roles = ('conditioning_epoch',) if kind == 'update' else () require(job['input_sha256'] == inputs, 'Actual job has missing/undeclared input authority') pins = {**inputs, str(paths['job']): job_sha, str(script): worker_sha} if ap: expected_sources = {n: dict(path=str(LAB / (n + '.py')), sha256=helper.SOURCE_PINS[n]) for n in roles} require(job['sources'] == expected_sources and receipt['source_files'] == expected_sources, 'Frozen process source differs') pins.update({v['path']: v['sha256'] for v in expected_sources.values()}) else: require(set(job['source_sha256']) == W.SOURCES[kind], 'New worker source inventory differs') for filename, sha in job['source_sha256'].items(): require(reg['source_sha256'][str(MODEL / filename)] == sha, 'New source not registered') pins[str(MODEL / filename)] = sha pins[str(W.AP)] = W.AP_SHA require(receipt['verified_input_sha256' if ap else 'input_sha256'] == pins, 'Worker did not check the complete actual closure') verify_pins(pins) if kind == 'unchanged': W.bind_unchanged_authority(helper, job, dict(authority=Path(job['authority_file']), checkpoint=Path(job['checkpoint_dir']), case=Path(job['case_dir']), overlay_file=Path(job['overlay_file']), overlay_manifest=Path(job['overlay_manifest'])), {Path(p): sha for p, sha in pins.items()}) expected_output = EXP / ('updates' if kind == 'update' else 'runs') / name.removesuffix('--original-E') require(Path(job['output_dir']) == expected_output and receipt['output_dir'] == str(expected_output) and job['receipt_file'] == str(paths['worker']), 'Output or receipt escaped fixed inventory') outputs = tree(expected_output) hashes = {k: v['sha256'] for k, v in outputs.items()} require(hashes == receipt['output_files_sha256'] and process['output_bytes'] == sum(v['bytes'] for v in outputs.values()) and process['output_inventory_sha256'] == hashlib.sha256(json.dumps(hashes, sort_keys=True).encode()).hexdigest(), 'Full output inventory changed') attempt = Path(str(paths['worker']) + '.attempt.json') require(digest(attempt) == receipt['attempt_sha256'], 'Attempt record changed') av = read(attempt) require(av['complete'] is False and av['job_sha256'] == job_sha and av['no_automatic_retry'] is True, 'Attempt record does not bind actual invocation') require(receipt.get('scientific_learning_pass_claimed', receipt.get('scientific_gate_pass_claimed')) is False, 'Worker claims a scientific gate') for key in ('child_wall_seconds', 'end_to_end_seconds', 'validation_wall_seconds'): require(type(process[key]) in (float, int) and np.isfinite(process[key]) and process[key] >= 0, 'Invalid recorded timing') evidence = {str(p): digest(p) for p in (*paths.values(), attempt)} return dict(name=name, kind=kind, paths=paths, job=job, receipt=receipt, process=process, output=expected_output, output_inventory=outputs, evidence_sha256=evidence, input_pins=pins) def _npz(path): with np.load(path, allow_pickle=False) as archive: return {name: archive[name].copy() for name in archive.files} def _pair(left, right): B._complete(left); B._complete(right) checks, observed = B.C._pair_checks(left, right) exact = all(checks.values()) return dict(numerical_exact=exact, pass_all=exact, checks=checks, failed_checks=[k for k, v in checks.items() if not v], observed=observed, light_intermediate_states_observed=False, learning_pass_claimed=False) def _parent(reg, complete, role): record = complete['parents'][role] if role in reg['parent_records']: original = reg['parent_records'][role] require(all(same_json(record[k], v) for k, v in original.items()), 'Imported parent declaration changed') return record def _update_check(parent, verified, cpu_name): """Bind actual CPU recomputation process to original E four-file evidence.""" cpu = verified[cpu_name] require(cpu['kind'] == 'validate_cpu', 'Missing independent CPU update verification process') directory = Path(parent['update_dir']); hashes = {n: digest(directory / n) for n in D.UPDATE_FILES} require(set(p.name for p in directory.iterdir()) == set(D.UPDATE_FILES), 'Unexpected update inventory') require(parent['after_overlay'] == dict(overlay_file=str(directory / 'delta-after.npz'), overlay_manifest=str(directory / 'overlay-manifest.json')), 'After snapshot paths leave actual E update') authority = parent['epoch_authority']; epoch = read(authority['path']) require(A.pin(authority['path']) == authority and cpu['job']['authority_file'] == authority['path'] and cpu['job']['authority_sha256'] == authority['sha256'] and Path(cpu['job']['update_dir']) == directory and cpu['job']['chain_sha256'] == hashes['chain-receipt.json'], 'CPU verification points to another update') chain, update = (read(directory / name) for name in ('chain-receipt.json', 'update-receipt.json')) report = read(cpu['output'] / 'validation.json') require(same_json(report, cpu['receipt']['result']) and report['schema'] == 'conditioning-update-cpu-validation-v1' and report['complete'] is True and report['epoch_authority_sha256'] == authority['sha256'] and report['parent_checkpoint_manifest_sha256'] == parent['checkpoint_sha256'] and report['update_files_sha256'] == hashes and report['frozen_U_verify_receipt_recomputed'] is True and report['actual_sealed_events_used'] is True and report['full_candidate_mapping_verified'] is True and report['brain_executed'] is False and report['learning_pass_claimed'] is False and report['frozen_U_source_sha256'] == D.SOURCE_PINS['conditioning_update_source'] and report['validator_source'] == A.pin(MODEL / 'validate_update_cpu.py'), 'CPU recomputation receipt mismatch') require(chain.get('schema') == 'phase4an-epoch-postprocess-chain-v1' and chain['complete'] is True and all(chain[k] is False for k in ('weights_installed', 'brain_executed', 'learning_pass_claimed', 'candidate_generated')) and chain['authority_sha256'] == authority['sha256'] and chain['source_neural_checkpoint_dir'] == parent['directory'] and chain['source_neural_checkpoint_manifest_sha256'] == parent['checkpoint_sha256'] and chain['output_files_sha256'] == {k: v for k, v in hashes.items() if k != 'chain-receipt.json'} and chain['update_receipt_payload_sha256'] == report['update_receipt_payload_sha256'] == update['payload_sha256'], 'Original E chain no longer binds the same update') before = _npz(parent['before_overlay']['overlay_file']); after = _npz(parent['after_overlay']['overlay_file']) require(set(before) == set(after) == {'edge_id', 'plastic_delta_mv'} and B.bit_equal(before['edge_id'], after['edge_id']), 'Overlay identity changed') require(report['before_overlay_sha256'] == digest(parent['before_overlay']['overlay_file']) and report['before_manifest_sha256'] == digest(parent['before_overlay']['overlay_manifest']) and report['after_overlay_sha256'] == hashes['delta-after.npz'] and report['after_manifest_sha256'] == hashes['overlay-manifest.json'] and report['before_delta_raw_sha256'] == B._raw(before['plastic_delta_mv']) and report['after_delta_raw_sha256'] == B._raw(after['plastic_delta_mv']), 'Actual delta differs from CPU verification') require(update['payload_sha256'] == hashlib.sha256(canonical({k: v for k, v in update.items() if k != 'payload_sha256'}).encode()).hexdigest(), 'Update receipt payload changed') require(epoch['checkpoint_dir'] == parent['directory'] and epoch['checkpoint_manifest_sha256'] == parent['checkpoint_sha256'], 'Update is not from actual neural parent') return dict(pass_all=True, CPU_process=cpu_name, update_files_sha256=hashes, before_delta_raw_sha256=report['before_delta_raw_sha256'], after_delta_raw_sha256=report['after_delta_raw_sha256'], U_receipt_payload_sha256=update['payload_sha256'], U_recomputed_in_this_audit=False, U_recomputation_from_authenticated_separate_CPU_process=True) def outcome(checks, pending): """Numerical failure and missing nonvacuous coverage are not equivalent.""" require(type(checks) is dict and bool(checks) and all(type(v) is bool for v in checks.values()), 'Explicit nonempty numerical/lineage checks required') require(set(pending) == {'D1', 'mechanical'}, 'Both predetermined pending-edge audits required') exact = all(checks.values()) coverage = pending['mechanical']['accepted_changed_edge_witness_verified'] is True status = 'FAIL-NUMERICAL-OR-LINEAGE' if not exact else ('PASS-EXACT-UPDATED-BOUNDARY-ENGINEERING-NOT-LEARNING' if coverage else 'INCOMPLETE-CHANGED-EDGE-COVERAGE') return exact, coverage, status def _pending(parent, child, parent_descriptor): epoch = read(parent_descriptor['epoch_authority']['path']); spec = read(epoch['files']['spec']['path']) graph = Path(spec['graph_dir']); apl_dir = Path(spec['apl_bundle_dir']); arrays = {} try: for name in ('ptr', 'src', 'dst', 'edge_id', 'weights'): arrays[name] = np.load(graph / (name + '.npy'), mmap_mode='r', allow_pickle=False) apl = np.load(apl_dir / 'apl_globals.npy', allow_pickle=False) before = _npz(parent_descriptor['before_overlay']['overlay_file']) after = _npz(parent_descriptor['after_overlay']['overlay_file']) require(B.bit_equal(before['edge_id'], after['edge_id']), 'Changed witness candidate mask differs') paths = [graph / (n + '.npy') for n in arrays] + [apl_dir / 'apl_globals.npy', Path(parent_descriptor['before_overlay']['overlay_file']), Path(parent_descriptor['after_overlay']['overlay_file'])] return B.audit_changed_pending(parent, child, ptr=arrays['ptr'], src=arrays['src'], dst=arrays['dst'], edge_id=arrays['edge_id'], base_weights=arrays['weights'], apl_mask=np.isin(arrays['src'], apl), candidate_edge_id=before['edge_id'], delta_before=before['plastic_delta_mv'], delta_after=after['plastic_delta_mv'], input_pins={str(p): digest(p) for p in paths}) finally: for value in arrays.values(): value._mmap.close() def _lineage(reg, complete, verified, records): """Actual advancing idle chain plus non-feedback probes, not memory success.""" checks = {}; probe_rows = [] base = reg['parent_records'][reg['plan']['imported_parents']['D1']['role']] delta = {k: digest(v) for k, v in base['after_overlay'].items()} sampler = verified['evaluation-inputs']; sr = read(sampler['output'] / 'sampler-receipt.json') require(same_json(sr, sampler['receipt']['result']) and sr['complete'] is True and sr['registration_sha256'] == sampler['job']['registration_sha256'] and sr['uniform_batch_calls'] == 2 and sr['US_added'] is False and sr['brain_executed'] is False, 'Sampler receipt changed or wrong scope') for cue in ('A', 'B'): sample = sampler['output'] / (cue + '-requests.npz') rows = [r for r in sr['rows'] if r['cue'] == cue] require(len(rows) == 1 and rows[0]['saved_requests_sha256'] == digest(sample), 'Sampler cue binding differs') req = _npz(sample); rates = _npz(EXP / f'inputs/static/{cue}-rates.npz') require(set(req) == {'tick', 'neuron_idx'} and req['tick'].dtype == req['neuron_idx'].dtype == np.int32 and req['tick'].shape == req['neuron_idx'].shape and np.all((req['tick'] >= 0) & (req['tick'] < 1000)) and np.isin(req['neuron_idx'], rates['targets']).all(), 'Probe contains non-CS or out-of-window input') require(rows[0]['stream']['seed'] == reg['plan']['evaluation_streams'][cue]['seed'] and rows[0]['stream']['semantic_key'] == reg['plan']['evaluation_streams'][cue]['key'] and rows[0]['stream']['split'] == 'evaluation', 'Probe seed semantic binding differs') for label in ('t0', 't1', 't10'): name = f'D1--probe--{label}--{cue}'; call = next(c for c in reg['plan']['calls'] if c['call_id'] == name) job = verified[name]['job']; auth = read(job['authority_file']) case = Path(auth['case']['requests']['path']) parent = _parent(reg, complete, call['parent']) checks[name + '.input_bytes'] = digest(case) == digest(sample) checks[name + '.parent_clock'] = auth['parent'] == dict(directory=parent['directory'], checkpoint_manifest_sha256=parent['checkpoint_sha256']) and auth['global_tick_offset'] == call['global_tick_offset'] checks[name + '.fixed_delta'] = auth['overlay_after']['file']['sha256'] == delta['overlay_file'] and auth['overlay_after']['manifest']['sha256'] == delta['overlay_manifest'] checks[name + '.no_update_US_backflow'] = call['US'] is call['plastic_update'] is call['feedback_to_idle'] is False and not records[name]['summary']['within_trial_weight_updates'] probe_rows.append(dict(call_id=name, global_tick_offset=records[name]['global_tick_offset'], actual_CS_requests=len(req['tick']), actual_US_requests=0, inputs_sha256=digest(case), complete_response_metrics_or_retention_gate=False)) for name in ('D1--idle--1s', 'D1--idle--9s'): call = next(c for c in reg['plan']['calls'] if c['call_id'] == name) auth = read(verified[name]['job']['authority_file']); parent = _parent(reg, complete, call['parent']) req = _npz(auth['case']['requests']['path']) checks[name + '.actual_duration'] = records[name]['steps'] == call['steps'] checks[name + '.parent_clock'] = auth['parent'] == dict(directory=parent['directory'], checkpoint_manifest_sha256=parent['checkpoint_sha256']) and auth['global_tick_offset'] == call['global_tick_offset'] checks[name + '.empty_input'] = len(req['tick']) == len(req['neuron_idx']) == 0 checks[name + '.fixed_delta'] = auth['overlay_after']['file']['sha256'] == delta['overlay_file'] and auth['overlay_after']['manifest']['sha256'] == delta['overlay_manifest'] checks['no_probe_feeds_other_segment'] = all('--probe--' not in str(c.get('parent')) for c in reg['plan']['calls']) checks['ten_seconds_actually_advanced'] = records['D1--idle--1s']['steps'] + records['D1--idle--9s']['steps'] == 100000 and records['D1--idle--9s']['summary']['global_next_tick'] == 101200 perf = verified['performance--evaluation-A-light-fresh']['job'] checks['normal_probe_performance_actual_A_bytes'] = digest(Path(perf['case_dir']) / 'requests.npz') == digest(sampler['output'] / 'A-requests.npz') checks['normal_probe_performance_zero_overlay'] = perf['overlay_file'] == reg['initial_overlay']['overlay_file'] and perf['overlay_manifest'] == reg['initial_overlay']['overlay_manifest'] return dict(pass_all=all(checks.values()), checks=checks, failed_checks=[k for k, v in checks.items() if not v], probes=probe_rows, biological_retention_demonstrated=False, learning_pass_claimed=False, light_per_tick_identity_claimed=False, one_and_nine_second_same_state_lineage_verified=all(checks.values())) def audit(reg_sha, *, save_report=True): require(sys.dont_write_bytecode and 'torch' not in sys.modules and 'conditioning_epoch' not in sys.modules, 'Run a fresh pure CPU Python -B audit process') regfile = EXP / 'protocol/preregistered.json' require(digest(regfile) == reg_sha, 'External registration SHA changed') reg = read(regfile); PLAN.validate_plan(reg['plan']) require(reg['schema'] == 'conditioning-execution-registration-v1' and reg['engineering_only'] is True and reg['scientific_acquisition_authorized'] is False, 'Not an engineering-only authority') pins = _closure(reg, reg_sha); verify_pins(pins) complete_path = EXP / 'audit/execution-complete.json'; complete_sha = digest(complete_path); complete = read(complete_path) calls = reg['plan']['calls']; expected = expected_processes(reg['plan']) require(complete['complete'] is True and complete['registration_sha256'] == reg_sha and complete['completed_calls'] == [c['call_id'] for c in calls] and set(complete['processes']) == set(expected) and complete['scientific_learning_pass_claimed'] is complete['candidate_generated'] is False, 'Execution inventory incomplete or scientifically overclaimed') helper = _helpers(); verified = {name: verify_process(name, kind, reg, reg_sha, complete['processes'][name], helper) for name, kind in expected.items()} records = {}; imports = {}; checks = {}; updates = {}; comparisons = {}; pending = {}; used_pins = dict(pins) for item in verified.values(): for path, sha in {**item['input_pins'], **item['evidence_sha256']}.items(): require(path not in used_pins or used_pins[path] == sha, 'Conflicting actual process authority') used_pins[path] = sha try: for arm, descriptor in reg['plan']['imported_parents'].items(): parent = _parent(reg, complete, descriptor['role']) require(str(Path(parent['directory']) / 'checkpoint-manifest.json') == descriptor['checkpoint_manifest'] and parent['checkpoint_sha256'] == descriptor['sha256'], 'Imported authority differs') D.C.load_checkpoint(parent['directory'], descriptor['sha256']) imports[arm] = B.load_record(parent['directory'], kind='parent') updates['AP-' + arm] = _update_check(parent, verified, 'AP-' + arm + '--cpu-verify') for call in calls: name = call['call_id']; run = verified[name]; directory = run['output']; receipt = run['receipt'] case = EXP / 'cases' / call['case_group'] expected_spec = read(reg['case_templates'][call['case_group']]) if call['parent'] is not None: p = _parent(reg, complete, call['parent']) expected_spec.update(parent_checkpoint_manifest_sha256=p['checkpoint_sha256'], global_tick_offset=call['global_tick_offset']) require(same_json(read(case / 'spec.json'), expected_spec), 'Executed case drifted from registered template') if run['kind'] in ('brain', 'unchanged'): require(Path(run['job']['case_dir']) == case, 'Wrong registered runtime case') elif run['kind'] == 'oracle': require(Path(run['job']['oracle_case']) == case, 'Wrong registered oracle case') else: auth = read(run['job']['authority_file']) require(auth['case'] == dict(spec=A.pin(case / 'spec.json'), requests=A.pin(case / 'requests.npz')) and auth['boundary_id'] == name and auth['registration_sha256'] == reg_sha and auth['diagnostic_mode'] == call['diagnostic_mode'] and auth['input_policy'] == call['input_policy'] and auth['transition'] == call['transition'] and auth['parent'] == dict(directory=p['directory'], checkpoint_manifest_sha256=p['checkpoint_sha256']), 'Boundary authority differs from actual registered call') if call['runner'] == 'boundary_oracle': manifest = read(directory / 'oracle-manifest.json') actual = {k: v['sha256'] for k, v in tree(directory).items() if k != 'oracle-manifest.json'} require(manifest == dict(schema='conditioning-live-oracle-files-v1', complete=True, files_sha256=actual), 'Live oracle exact manifest differs') kind = 'oracle' else: checkpoint_sha = receipt['result']['checkpoint_manifest_sha256'] D.load_checkpoint(directory, checkpoint_sha) kind = 'updated' if call['runner'] == 'updated_continuation' else 'parent' record = B.load_record(directory, kind=kind); records[name] = record; B._complete(record) require(record['steps'] == call['steps'] and record['global_tick_offset'] == call['global_tick_offset'] and record['summary']['nodes'] == N and record['summary']['edges'] == EDGES and record['summary']['diagnostic_mode'] == call['diagnostic_mode'], 'Actual graph/clock/mode differs from registered call') if call['runner'] == 'updated_continuation': declared = _parent(reg, complete, name) require(declared['directory'] == str(directory) and declared['checkpoint_sha256'] == checkpoint_sha, 'Saved parent registry differs from actual checkpoint') helper._verify_precision(receipt['environment'], record['summary']['apl_component']['environment']) cycle = read(EXP / 'receipts' / (name + '.cycle.json')) used_pins[str(EXP / 'receipts' / (name + '.cycle.json'))] = digest(EXP / 'receipts' / (name + '.cycle.json')) require(cycle['complete'] is True and same_json(cycle['call'], call) and cycle['source_registration_sha256'] == reg_sha, 'Complete-cycle descriptor mismatch') for relative, evidence in cycle['output_inventory'].items(): path = EXP / relative require(path.is_relative_to(EXP) and '..' not in Path(relative).parts and evidence == dict(sha256=digest(path), bytes=path.stat().st_size), 'Cycle immutable output changed') for name in ('mechanical--fresh-parent', 'performance--natural-light-fresh'): parent = _parent(reg, complete, name) require(parent['directory'] == str(verified[name]['output']) and parent['checkpoint_sha256'] == records[name]['manifest_sha256'], 'New E source parent identity differs') updates[name] = _update_check(parent, verified, name + '--cpu-verify') worker = verified[name + '--original-E'] require(worker['output'] == Path(parent['update_dir']) and worker['receipt']['result']['chain_receipt_sha256'] == digest(worker['output'] / 'chain-receipt.json'), 'Original E actual process output differs') for arm in ('D1', 'mechanical'): oracle = records[arm + '--live-oracle'] parent = imports['D1'] if arm == 'D1' else records['mechanical--fresh-parent'] descriptor = _parent(reg, complete, reg['plan']['imported_parents']['D1']['role'] if arm == 'D1' else 'mechanical--fresh-parent') original_authority = Path(verified[arm + '--updated--reference']['job']['authority_file']) auth = read(original_authority) for mode in ('reference', 'light'): name = arm + '--updated--' + mode; authority = Path(verified[name]['job']['authority_file']) comparisons[arm + '-live-vs-' + mode] = B.compare_boundary(oracle, records[name], parent=parent, expected_before_sha256=auth['expected_effective_weight_before_sha256'], expected_after_sha256=auth['expected_effective_weight_after_sha256'], paired_authorities=(original_authority.read_bytes(), authority.read_bytes())) pending[arm] = _pending(parent, records[arm + '--updated--reference'], descriptor) for arm in ('D0', 'frozen'): for mode in ('reference', 'light'): comparisons[arm + '-old-C-vs-' + mode] = _pair(records[arm + '--old-C--reference'], records[arm + '--updated--' + mode]) performance = 'performance--natural-light-fresh' comparisons['performance-natural-vs-AP'] = _pair(imports['D1'], records[performance]) old = reg['parent_records'][reg['plan']['imported_parents']['D1']['role']] new = complete['parents'][performance] old_delta, new_delta = (_npz(x['after_overlay']['overlay_file']) for x in (old, new)) checks['natural_fullcycle_after_delta_exact'] = set(old_delta) == set(new_delta) and all(B.bit_equal(v, new_delta[k]) for k, v in old_delta.items()) checks['natural_fullcycle_U_receipt_exact'] = same_json(read(Path(old['update_dir']) / 'update-receipt.json'), read(Path(new['update_dir']) / 'update-receipt.json')) lineage = _lineage(reg, complete, verified, records) checks.update({name: result['numerical_exact'] for name, result in comparisons.items()}) checks['D1_conditional_queue_exact'] = pending['D1']['conditional_ref_request_queue_exact'] and pending['D1']['reference_queue_and_ref_coverage_complete'] checks['mechanical_conditional_queue_exact'] = pending['mechanical']['conditional_ref_request_queue_exact'] and pending['mechanical']['reference_queue_and_ref_coverage_complete'] checks['actual_idle_and_probe_lineage'] = lineage['pass_all'] exact, coverage, status = outcome(checks, pending) require(len(records) == 23 and sum(r['steps'] for r in records.values()) == 125200, 'Actual full-call/tick inventory differs') verify_pins(used_pins) for name, item in verified.items(): require(tree(item['output']) == item['output_inventory'], 'Audited outputs changed') require(digest(complete_path) == complete_sha, 'Execution receipt changed') result = dict(schema='conditioning-execution-numerical-audit-v1', complete=True, status=status, pass_all=exact and coverage, numerical_exact=exact, registration_sha256=reg_sha, execution_complete_sha256=digest(complete_path), checks=checks, failed_checks=[k for k, v in checks.items() if not v], comparisons=comparisons, updates=updates, pending_edge_audits=pending, idle_probe_lineage=lineage, actual_new_brain_calls=len(records), actual_new_brain_ticks=sum(r['steps'] for r in records.values()), actual_processes=len(verified), actual_CPU_processes=sum(r['kind'] in ('update', 'validate_cpu') for r in verified.values()), actual_GPU_sampler_processes=sum(r['kind'] == 'sample' for r in verified.values()), all_actual_runs_finite=True, process_evidence={name: dict(kind=v['kind'], process_sha256=digest(v['paths']['process']), worker_sha256=digest(v['paths']['worker']), job_sha256=digest(v['paths']['job']), output_files=len(v['output_inventory']), recorded_exit_code=0) for name, v in verified.items()}, observed_scope='Sparse events, complete final state/queues; full reference-only histories; authenticated recorded process evidence', light_intermediate_states_observed=False, AP_D1_changed_edge_coverage_is_not_required=True, historical_integrity_after_checked_here=False, sealed_here=False, brain_executed_here=False, U_recomputed_here=False, learning_pass_claimed=False, full_retention_experiment=False, candidate_generated=False) if save_report: save(EXP / 'audit/numerical-comparison.json', result) return result finally: for record in [*records.values(), *imports.values()]: B.close_record(record) if __name__ == '__main__': parser = argparse.ArgumentParser(description=__doc__) parser.add_argument('--registration-sha256', required=True) args = parser.parse_args() result = audit(args.registration_sha256) print(json.dumps({k: result[k] for k in ('complete', 'status', 'pass_all', 'actual_new_brain_calls', 'actual_processes')}), flush=True)