Files
digital-drosophila/tools/acceleration-publication/verify_delivery.py
T

69 lines
4.1 KiB
Python

"""Actual fresh-store remote retrieval; no scientific execution or retries."""
import argparse
from datetime import datetime, timezone
import json
from pathlib import Path
import subprocess
import time
import archive_results as archives
REMOTE = 'ssh://git@192.168.10.31:2222/qishizhe/digital-drosophila.git'
BRANCH = 'codex/v100-conditioning-acceleration'
def cmd(args, output=False):
result = subprocess.run(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
archives.require(result.returncode == 0, 'Git/LFS command failed; no automatic retry; diagnostic output not published')
return result.stdout.decode().strip() if output else result.returncode
def run(expected, receipt):
root = Path.cwd()
archives.require(root == Path('/home/qishizhe/digital-drosophila-acceleration-verify-20261001')
and (root / '.git').is_dir(), 'New independent verification clone required')
archives.require(cmd(['git', 'rev-parse', 'HEAD'], True) == expected, 'Unexpected checkout commit')
archives.require(cmd(['git', 'remote', 'get-url', 'origin'], True) == REMOTE, 'Unexpected remote')
remote_ref = cmd(['git', 'ls-remote', 'origin', 'refs/heads/' + BRANCH], True)
archives.require(remote_ref.split()[0] == expected, 'Remote branch does not identify data commit')
archives.require(not cmd(['git', 'status', '--porcelain'], True), 'Unclean initial checkout')
objects = root / '.git/lfs/objects'
before = list(p for p in objects.rglob('*') if p.is_file()) if objects.exists() else []
archives.require(not before, 'Fresh LFS object store must contain no prior object')
archives.require(not receipt.exists() and receipt.parent.is_dir()
and receipt.parent == Path('/home/qishizhe/digital-drosophila-acceleration-publication-20261001/registry/acceleration-20261001'),
'Exclusive publication receipt required')
start = time.perf_counter()
pull = cmd(['git', 'lfs', 'pull', '--include=artifacts/acceleration-20261001/**', '--exclude=', 'origin'])
fsck = cmd(['git', 'lfs', 'fsck', '--dry-run'])
report = archives.verify(root)
catalog = json.loads((root / archives.REGISTRY / 'publication-catalog.json').read_text())
source_count = 0
for group, info in catalog['groups'].items():
directory = archives.GROUPS[group][2]
for name, expected_sha in info['source_files'].items():
archives.require(archives.sha(root / 'models/male-cns-lif' / directory / name) == expected_sha,
'Published source differs from sealed version')
source_count += 1
stored = [p for p in objects.rglob('*') if p.is_file()]
archives.require(len(stored) == 2 and not cmd(['git', 'status', '--porcelain'], True), 'Incomplete LFS store or changed checkout')
archives.require(cmd(['git', 'rev-parse', 'HEAD'], True) == expected, 'Checkout changed during verification')
report.update(schema='acceleration-fresh-remote-delivery-v1', verified_utc=datetime.now(timezone.utc).isoformat(),
remote=REMOTE, branch=BRANCH, data_commit=expected, fresh_download_proven=True,
initial_LFS_objects=0, downloaded_LFS_objects=len(stored), downloaded_bytes=sum(p.stat().st_size for p in stored),
pull_exit_code=pull, fsck_exit_code=fsck, sealed_source_files_checked=source_count,
wall_seconds=time.perf_counter()-start, scientific_experiments_run=0, training_resumed=False,
complete_training_restore=False, historical_scientific_gate_reexecuted=False,
transport='Previously audited LAN-pinned HTTPS adapter, verified TLS and SSH short-lived authorization',
scope='Remote Git commit, two actual LFS downloads, complete public archive contents and 22 sealed code files; not all external scientific dependencies')
archives.save(receipt, report)
print(json.dumps(report, indent=2))
if __name__ == '__main__':
parser = argparse.ArgumentParser()
parser.add_argument('--expected-commit', required=True)
parser.add_argument('--receipt', type=Path, required=True)
args = parser.parse_args()
run(args.expected_commit, args.receipt)