Digital Drosophila Archive
125 lines
7.6 KiB
Python
125 lines
7.6 KiB
Python
"""Exclusive finite engineering seal; never creates a learned candidate.
|
|
|
|
Run only after independent numerical/budget reports and a NEW integrity process.
|
|
Report hashes are external arguments. Historical regression evidence is preserved,
|
|
not relabeled as a newly executed five-trial numerical regression.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import hashlib
|
|
import json
|
|
from pathlib import Path
|
|
import subprocess
|
|
import sys
|
|
from types import ModuleType
|
|
|
|
import execution_authority as A
|
|
from prepare_execution import ROOT, EXP, MODEL, save, verify
|
|
|
|
HELPER = ROOT/'models/male-cns-lif/pn-recruitment-audit-v1/publication.py'
|
|
HELPER_SHA = '7a79c499098b74163e7bb16adabcbc54e7069dafa204d0b99c7f4c03d79f8016'
|
|
require, read, digest = A.require, A.read, A.digest
|
|
|
|
|
|
def helper():
|
|
raw = HELPER.read_bytes()
|
|
require(hashlib.sha256(raw).hexdigest() == HELPER_SHA, 'Frozen seal verifier changed')
|
|
module = ModuleType('_execution_seal_pure_verifier')
|
|
module.__file__ = str(HELPER)
|
|
exec(compile(raw, str(HELPER), 'exec'), module.__dict__)
|
|
return module
|
|
|
|
|
|
def seal(directory):
|
|
directory = Path(directory)
|
|
require(directory.is_absolute() and directory.is_dir(), 'Exact real seal root required')
|
|
require(not any((directory/n).exists() for n in ('manifest.json', 'checksums.sha256')), 'Never replace seal controls')
|
|
paths = sorted(directory.rglob('*'))
|
|
require(all(not p.is_symlink() and not (hasattr(p, 'is_junction') and p.is_junction()) and
|
|
'__pycache__' not in p.parts and (p.is_file() or p.is_dir()) for p in (directory, *paths)),
|
|
'Unsafe seal payload')
|
|
files = [dict(path=p.relative_to(directory).as_posix(), bytes=p.stat().st_size, sha256=digest(p))
|
|
for p in paths if p.is_file()]
|
|
require(files, 'Empty seal forbidden')
|
|
save(directory/'manifest.json', dict(root=str(directory), files=files))
|
|
with (directory/'checksums.sha256').open('x', encoding='utf-8', newline='\n') as out:
|
|
for row in files:
|
|
out.write(row['sha256']+' '+row['path']+'\n')
|
|
out.write(digest(directory/'manifest.json')+' manifest.json\n')
|
|
return helper().verify_seal(directory)
|
|
|
|
|
|
def finalize(reg_sha, numerical_sha, budget_sha, integrity_sha):
|
|
require(sys.dont_write_bytecode and 'torch' not in sys.modules, 'Fresh CPU -B process required')
|
|
require(not any((EXP/n).exists() for n in ('audit/final-status.json', 'manifest.json', 'checksums.sha256', 'audit/stopped.json')),
|
|
'Stopped, finalized or partly sealed workflow requires a separate explicit failure audit')
|
|
reg_path = EXP/'protocol/preregistered.json'
|
|
require(digest(reg_path) == reg_sha, 'External registration changed')
|
|
reg = read(reg_path)
|
|
require(reg['schema'] == 'conditioning-execution-registration-v1' and reg['engineering_only'] is True and
|
|
reg['scientific_acquisition_authorized'] is False, 'Wrong scope')
|
|
verify({**reg['source_sha256'], **reg['input_sha256'], **reg['prepared_file_sha256']})
|
|
reports = {}
|
|
for key, relative, sha in (
|
|
('numerical', 'audit/numerical-comparison.json', numerical_sha),
|
|
('budget', 'audit/budget-report.json', budget_sha),
|
|
('integrity', 'regression/integrity-after.json', integrity_sha)):
|
|
path = EXP/relative
|
|
require(A.pin(path)['sha256'] == sha, 'External '+key+' report changed')
|
|
reports[key] = read(path)
|
|
numerical, budget, integrity = (reports[n] for n in ('numerical', 'budget', 'integrity'))
|
|
require(numerical['schema'] == 'conditioning-execution-numerical-audit-v1' and numerical['complete'] is True and
|
|
numerical['registration_sha256'] == reg_sha and numerical['actual_new_brain_calls'] == 23 and
|
|
numerical['actual_processes'] == 31 and numerical['actual_new_brain_ticks'] == 125200 and
|
|
numerical['learning_pass_claimed'] is numerical['candidate_generated'] is False, 'Wrong numerical coverage/scope')
|
|
status = numerical['status']
|
|
require(status in ('PASS-EXACT-UPDATED-BOUNDARY-ENGINEERING-NOT-LEARNING',
|
|
'FAIL-NUMERICAL-OR-LINEAGE', 'INCOMPLETE-CHANGED-EDGE-COVERAGE'), 'Unknown engineering outcome')
|
|
require(numerical['pass_all'] == status.startswith('PASS-'), 'Inconsistent engineering gate')
|
|
require(budget['registration_sha256'] == reg_sha and budget['learning_pass_claimed'] is False,
|
|
'Wrong budget authority or scientific overclaim')
|
|
require(integrity['complete'] is True and integrity['AP']['pass_all'] is True and
|
|
integrity['old_experiments_reexecuted'] is integrity['old_files_modified'] is False and
|
|
integrity['five_frozen_reference_trials_rerun_here'] is integrity['scientific_learning_pass_claimed'] is False,
|
|
'Historical integrity/scope not verified')
|
|
# Recheck the actual file-bound evidence at sealing, not only old PASS flags.
|
|
import audit_execution
|
|
import budget_report
|
|
require(audit_execution.same_json(audit_execution.audit(reg_sha, save_report=False), numerical),
|
|
'Numerical evidence changed after the independent audit')
|
|
require(audit_execution.same_json(budget_report.report(reg_sha, save_report=False), budget),
|
|
'Budget evidence changed after the independent audit')
|
|
# Historical integrity has a different frozen runtime import owner; isolate it.
|
|
seal_integrity = EXP/'regression/integrity-at-seal.json'
|
|
require(not seal_integrity.exists(), 'No automatic retry of partly completed finalization')
|
|
command = [sys.executable, '-B', str(MODEL/'prepare_execution.py'), 'integrity', '--output', str(seal_integrity)]
|
|
result = subprocess.run(command, cwd=MODEL, capture_output=True, text=True, timeout=1800)
|
|
require(result.returncode == 0 and seal_integrity.is_file(),
|
|
'Independent integrity-at-seal process failed: '+result.stderr[-2000:])
|
|
require(audit_execution.same_json(read(seal_integrity), integrity), 'Frozen integrity changed before sealing')
|
|
final = dict(schema='conditioning-execution-final-v1', status=status, registration_sha256=reg_sha,
|
|
numerical_sha256=numerical_sha, budget_sha256=budget_sha, integrity_after_sha256=integrity_sha,
|
|
integrity_at_seal_sha256=digest(seal_integrity), numerical_and_budget_recomputed_at_seal=True,
|
|
actual_new_brain_calls=23, actual_new_brain_ticks=125200, actual_execution_child_processes=31,
|
|
historical_integrity_after_pass=True, historical_five_trial_regression='AM sealed evidence preserved; not rerun here',
|
|
scientific_acquisition_executed=False, scientific_acquisition_authorized=False,
|
|
candidate_generated=False, learning_pass_claimed=False,
|
|
source_code_commit=reg['source_code_commit'], entire_model_directory_sealed=False,
|
|
source_scope='All registered source bytes and committed snapshot frozen by this experiment seal',
|
|
bulk_data_git_backup_claimed=False)
|
|
save(EXP/'audit/final-status.json', final)
|
|
checked = seal(EXP)
|
|
return dict(status=status, manifest_sha256=checked['manifest_sha256'], checksums_sha256=checked['checksums_sha256'],
|
|
final_sha256=digest(EXP/'audit/final-status.json'), payload_files=checked['payload_file_count'],
|
|
payload_bytes=checked['payload_bytes'], learning_pass_claimed=False)
|
|
|
|
|
|
if __name__ == '__main__':
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
for name in ('registration', 'numerical', 'budget', 'integrity'):
|
|
parser.add_argument('--'+name+'-sha256', required=True)
|
|
args = parser.parse_args()
|
|
print(json.dumps(finalize(args.registration_sha256, args.numerical_sha256, args.budget_sha256,
|
|
args.integrity_sha256), sort_keys=True), flush=True)
|