Digital Drosophila Archive
492 lines
35 KiB
Python
492 lines
35 KiB
Python
"""Read-only, process-bound finite engineering audit; never a learning gate.
|
|
|
|
Only the optional final JSON is written, exclusively. The recorded successful
|
|
parent-process exits are authenticated file evidence, not re-observed exits.
|
|
Old integrity/sealing is deliberately a separate process. No E, U or Torch is
|
|
imported here; all checkpoint loading shares updated_continuation.C.R.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import hashlib
|
|
import json
|
|
from pathlib import Path
|
|
import sys
|
|
from types import ModuleType
|
|
|
|
import numpy as np
|
|
|
|
import boundary_compare as B
|
|
import boundary_plan as PLAN
|
|
import execution_authority as A
|
|
import isolated_execution as W
|
|
import updated_continuation as D
|
|
from prepare_execution import EXP, MODEL, LAB, save
|
|
|
|
N, EDGES = 166700, 25582938
|
|
require, read, digest = A.require, A.read, A.digest
|
|
|
|
|
|
def canonical(value):
|
|
return json.dumps(value, sort_keys=True, separators=(',', ':'), ensure_ascii=False, allow_nan=False)
|
|
|
|
|
|
def same_json(left, right):
|
|
return canonical(left) == canonical(right)
|
|
|
|
|
|
def verify_pins(pins):
|
|
require(type(pins) is dict and pins, 'Nonempty input authority required')
|
|
for path, sha in pins.items():
|
|
require(A.pin(path)['sha256'] == sha, 'Pinned file changed: ' + str(path))
|
|
|
|
|
|
def tree(directory):
|
|
root = Path(directory)
|
|
require(root.is_dir(), 'Missing output tree')
|
|
result = {}
|
|
for p in sorted(root.rglob('*')):
|
|
require(not any(q.is_symlink() or (hasattr(q, 'is_junction') and q.is_junction())
|
|
for q in (p, *p.parents)), 'Linked evidence forbidden')
|
|
if p.is_file():
|
|
result[p.relative_to(root).as_posix()] = dict(sha256=digest(p), bytes=p.stat().st_size)
|
|
else:
|
|
require(p.is_dir(), 'Nonregular evidence forbidden')
|
|
require(result, 'Empty output tree')
|
|
return result
|
|
|
|
|
|
def _helpers():
|
|
raw = W.AP.read_bytes()
|
|
require(hashlib.sha256(raw).hexdigest() == W.AP_SHA, 'Frozen worker helper changed')
|
|
module = ModuleType('_conditioning_execution_audit_pure_worker_helpers')
|
|
module.__file__ = str(W.AP)
|
|
exec(compile(raw, str(W.AP), 'exec'), module.__dict__)
|
|
return module
|
|
|
|
|
|
def expected_processes(plan):
|
|
calls = {row['call_id']: row for row in plan['calls']}
|
|
require(len(calls) == len(plan['calls']), 'Duplicate call')
|
|
kinds = {name: ('brain' if row['runner'] in ('runtime_light', 'fresh_probe') else
|
|
'oracle' if row['runner'] == 'boundary_oracle' else
|
|
'unchanged' if row['runner'] == 'runtime_continuation' else 'updated')
|
|
for name, row in calls.items()}
|
|
for arm in ('D1', 'D0', 'frozen'):
|
|
kinds['AP-' + arm + '--cpu-verify'] = 'validate_cpu'
|
|
for name in ('mechanical--fresh-parent', 'performance--natural-light-fresh'):
|
|
kinds[name + '--original-E'] = 'update'
|
|
kinds[name + '--cpu-verify'] = 'validate_cpu'
|
|
kinds['evaluation-inputs'] = 'sample'
|
|
require(len(kinds) == plan['counts']['total_children'], 'Planned child inventory differs')
|
|
return kinds
|
|
|
|
|
|
def _closure(reg, reg_sha):
|
|
return {**reg['source_sha256'], **reg['input_sha256'], **reg['prepared_file_sha256'],
|
|
str(EXP / 'protocol/preregistered.json'): reg_sha}
|
|
|
|
|
|
def verify_process(name, kind, reg, reg_sha, process_path, helper):
|
|
"""Recheck actual bytes; never accept worker pass flags as a seal."""
|
|
paths = {key: EXP / f'{sub}/{name}{suffix}' for key, sub, suffix in (
|
|
('job', 'jobs', '.json'), ('worker', 'receipts', '.worker.json'),
|
|
('process', 'receipts', '.process.json'), ('stdout', 'logs', '.stdout.log'),
|
|
('stderr', 'logs', '.stderr.log'))}
|
|
require(Path(process_path) == paths['process'], 'Wrong fixed process record path')
|
|
job, receipt, process = (read(paths[k]) for k in ('job', 'worker', 'process'))
|
|
ap = kind in ('brain', 'update')
|
|
script = W.AP if ap else MODEL / 'isolated_execution.py'
|
|
worker_sha = W.AP_SHA if ap else reg['source_sha256'][str(script)]
|
|
schema = 'phase4ap-isolated-worker-job-v1' if ap else W.SCHEMA
|
|
require(job['schema'] == schema and job['job_id'] == name and job['kind'] == kind and
|
|
job['registration_sha256'] == reg_sha and job['worker_sha256'] == worker_sha,
|
|
'Actual job identity differs')
|
|
require(process['schema'] == 'conditioning-execution-process-v1' and process['complete'] is True and
|
|
process['exit_code'] == 0 and type(process['exit_code']) is int and process['timed_out'] is False and
|
|
process['name'] == name and process['kind'] == kind and process['registration_sha256'] == reg_sha,
|
|
'Missing successful recorded process exit')
|
|
job_sha = digest(paths['job'])
|
|
require(process['job_sha256'] == job_sha and process['worker_receipt_sha256'] == digest(paths['worker']) and
|
|
all(process[k + '_sha256'] == digest(paths[k]) for k in ('stdout', 'stderr')), 'Process file chain changed')
|
|
argv = process['argv']
|
|
require(type(argv) is list and len(argv) == (8 if ap else 7) and type(argv[0]) is str and bool(argv[0]),
|
|
'Recorded process command is incomplete')
|
|
require(argv[1:] == ['-B', str(script), *([kind] if ap else []), '--job', str(paths['job']),
|
|
'--job-sha256', job_sha], 'Recorded command differs from pinned worker/job')
|
|
expected_schema = 'phase4ap-isolated-worker-receipt-v1' if ap else 'conditioning-isolated-execution-receipt-v1'
|
|
require(receipt['schema'] == expected_schema and receipt['complete'] is True and
|
|
all(receipt[k] == job[k] for k in ('job_id', 'kind', 'registration_sha256', 'worker_sha256')) and
|
|
receipt['job_sha256'] == job_sha and receipt['process_exit_independently_observed'] is False,
|
|
'Worker receipt identity/scope differs')
|
|
closure = _closure(reg, reg_sha)
|
|
require(all(job['input_sha256'].get(p) == s for p, s in closure.items()), 'Registered input closure omitted')
|
|
inputs = dict(closure)
|
|
if kind == 'brain':
|
|
roles = ('runtime_light', 'runtime_continuation')
|
|
case = Path(job['case_dir'])
|
|
extra = [case / 'spec.json', case / 'requests.npz', Path(job['overlay_file']), Path(job['overlay_manifest'])]
|
|
inputs.update({str(p): digest(p) for p in extra})
|
|
else:
|
|
authority = Path(job['authority_file'])
|
|
require(digest(authority) == job['authority_sha256'], 'Worker authority changed')
|
|
inputs[str(authority)] = job['authority_sha256']
|
|
value = read(authority)
|
|
if kind == 'sample':
|
|
require(authority == EXP / 'protocol/preregistered.json' and job['authority_sha256'] == reg_sha,
|
|
'Sampler is not bound to actual registration')
|
|
else:
|
|
inputs.update(A.files_from_authority(value))
|
|
if kind == 'validate_cpu':
|
|
update = Path(job['update_dir'])
|
|
require({p.name for p in update.iterdir()} == set(D.UPDATE_FILES), 'Update must contain exact four files')
|
|
inputs.update({str(p): digest(p) for p in update.iterdir()})
|
|
require(job['chain_sha256'] == digest(update / 'chain-receipt.json'), 'CPU chain pin differs')
|
|
if kind == 'oracle':
|
|
case = Path(job['oracle_case'])
|
|
for filename, key in (('spec.json', 'oracle_spec_sha256'), ('requests.npz', 'oracle_requests_sha256')):
|
|
require(digest(case / filename) == job[key], 'Live oracle case pin differs')
|
|
inputs[str(case / filename)] = job[key]
|
|
roles = ('conditioning_epoch',) if kind == 'update' else ()
|
|
require(job['input_sha256'] == inputs, 'Actual job has missing/undeclared input authority')
|
|
pins = {**inputs, str(paths['job']): job_sha, str(script): worker_sha}
|
|
if ap:
|
|
expected_sources = {n: dict(path=str(LAB / (n + '.py')), sha256=helper.SOURCE_PINS[n]) for n in roles}
|
|
require(job['sources'] == expected_sources and receipt['source_files'] == expected_sources, 'Frozen process source differs')
|
|
pins.update({v['path']: v['sha256'] for v in expected_sources.values()})
|
|
else:
|
|
require(set(job['source_sha256']) == W.SOURCES[kind], 'New worker source inventory differs')
|
|
for filename, sha in job['source_sha256'].items():
|
|
require(reg['source_sha256'][str(MODEL / filename)] == sha, 'New source not registered')
|
|
pins[str(MODEL / filename)] = sha
|
|
pins[str(W.AP)] = W.AP_SHA
|
|
require(receipt['verified_input_sha256' if ap else 'input_sha256'] == pins, 'Worker did not check the complete actual closure')
|
|
verify_pins(pins)
|
|
if kind == 'unchanged':
|
|
W.bind_unchanged_authority(helper, job, dict(authority=Path(job['authority_file']),
|
|
checkpoint=Path(job['checkpoint_dir']), case=Path(job['case_dir']),
|
|
overlay_file=Path(job['overlay_file']), overlay_manifest=Path(job['overlay_manifest'])),
|
|
{Path(p): sha for p, sha in pins.items()})
|
|
expected_output = EXP / ('updates' if kind == 'update' else 'runs') / name.removesuffix('--original-E')
|
|
require(Path(job['output_dir']) == expected_output and receipt['output_dir'] == str(expected_output) and
|
|
job['receipt_file'] == str(paths['worker']), 'Output or receipt escaped fixed inventory')
|
|
outputs = tree(expected_output)
|
|
hashes = {k: v['sha256'] for k, v in outputs.items()}
|
|
require(hashes == receipt['output_files_sha256'] and process['output_bytes'] == sum(v['bytes'] for v in outputs.values()) and
|
|
process['output_inventory_sha256'] == hashlib.sha256(json.dumps(hashes, sort_keys=True).encode()).hexdigest(),
|
|
'Full output inventory changed')
|
|
attempt = Path(str(paths['worker']) + '.attempt.json')
|
|
require(digest(attempt) == receipt['attempt_sha256'], 'Attempt record changed')
|
|
av = read(attempt)
|
|
require(av['complete'] is False and av['job_sha256'] == job_sha and av['no_automatic_retry'] is True,
|
|
'Attempt record does not bind actual invocation')
|
|
require(receipt.get('scientific_learning_pass_claimed', receipt.get('scientific_gate_pass_claimed')) is False,
|
|
'Worker claims a scientific gate')
|
|
for key in ('child_wall_seconds', 'end_to_end_seconds', 'validation_wall_seconds'):
|
|
require(type(process[key]) in (float, int) and np.isfinite(process[key]) and process[key] >= 0, 'Invalid recorded timing')
|
|
evidence = {str(p): digest(p) for p in (*paths.values(), attempt)}
|
|
return dict(name=name, kind=kind, paths=paths, job=job, receipt=receipt, process=process,
|
|
output=expected_output, output_inventory=outputs, evidence_sha256=evidence, input_pins=pins)
|
|
|
|
|
|
def _npz(path):
|
|
with np.load(path, allow_pickle=False) as archive:
|
|
return {name: archive[name].copy() for name in archive.files}
|
|
|
|
|
|
def _pair(left, right):
|
|
B._complete(left); B._complete(right)
|
|
checks, observed = B.C._pair_checks(left, right)
|
|
exact = all(checks.values())
|
|
return dict(numerical_exact=exact, pass_all=exact, checks=checks,
|
|
failed_checks=[k for k, v in checks.items() if not v], observed=observed,
|
|
light_intermediate_states_observed=False, learning_pass_claimed=False)
|
|
|
|
|
|
def _parent(reg, complete, role):
|
|
record = complete['parents'][role]
|
|
if role in reg['parent_records']:
|
|
original = reg['parent_records'][role]
|
|
require(all(same_json(record[k], v) for k, v in original.items()), 'Imported parent declaration changed')
|
|
return record
|
|
|
|
|
|
def _update_check(parent, verified, cpu_name):
|
|
"""Bind actual CPU recomputation process to original E four-file evidence."""
|
|
cpu = verified[cpu_name]
|
|
require(cpu['kind'] == 'validate_cpu', 'Missing independent CPU update verification process')
|
|
directory = Path(parent['update_dir']); hashes = {n: digest(directory / n) for n in D.UPDATE_FILES}
|
|
require(set(p.name for p in directory.iterdir()) == set(D.UPDATE_FILES), 'Unexpected update inventory')
|
|
require(parent['after_overlay'] == dict(overlay_file=str(directory / 'delta-after.npz'),
|
|
overlay_manifest=str(directory / 'overlay-manifest.json')), 'After snapshot paths leave actual E update')
|
|
authority = parent['epoch_authority']; epoch = read(authority['path'])
|
|
require(A.pin(authority['path']) == authority and cpu['job']['authority_file'] == authority['path'] and
|
|
cpu['job']['authority_sha256'] == authority['sha256'] and Path(cpu['job']['update_dir']) == directory and
|
|
cpu['job']['chain_sha256'] == hashes['chain-receipt.json'], 'CPU verification points to another update')
|
|
chain, update = (read(directory / name) for name in ('chain-receipt.json', 'update-receipt.json'))
|
|
report = read(cpu['output'] / 'validation.json')
|
|
require(same_json(report, cpu['receipt']['result']) and report['schema'] == 'conditioning-update-cpu-validation-v1' and
|
|
report['complete'] is True and report['epoch_authority_sha256'] == authority['sha256'] and
|
|
report['parent_checkpoint_manifest_sha256'] == parent['checkpoint_sha256'] and
|
|
report['update_files_sha256'] == hashes and report['frozen_U_verify_receipt_recomputed'] is True and
|
|
report['actual_sealed_events_used'] is True and report['full_candidate_mapping_verified'] is True and
|
|
report['brain_executed'] is False and report['learning_pass_claimed'] is False and
|
|
report['frozen_U_source_sha256'] == D.SOURCE_PINS['conditioning_update_source'] and
|
|
report['validator_source'] == A.pin(MODEL / 'validate_update_cpu.py'), 'CPU recomputation receipt mismatch')
|
|
require(chain.get('schema') == 'phase4an-epoch-postprocess-chain-v1' and chain['complete'] is True and
|
|
all(chain[k] is False for k in ('weights_installed', 'brain_executed', 'learning_pass_claimed', 'candidate_generated')) and
|
|
chain['authority_sha256'] == authority['sha256'] and chain['source_neural_checkpoint_dir'] == parent['directory'] and
|
|
chain['source_neural_checkpoint_manifest_sha256'] == parent['checkpoint_sha256'] and
|
|
chain['output_files_sha256'] == {k: v for k, v in hashes.items() if k != 'chain-receipt.json'} and
|
|
chain['update_receipt_payload_sha256'] == report['update_receipt_payload_sha256'] == update['payload_sha256'],
|
|
'Original E chain no longer binds the same update')
|
|
before = _npz(parent['before_overlay']['overlay_file']); after = _npz(parent['after_overlay']['overlay_file'])
|
|
require(set(before) == set(after) == {'edge_id', 'plastic_delta_mv'} and
|
|
B.bit_equal(before['edge_id'], after['edge_id']), 'Overlay identity changed')
|
|
require(report['before_overlay_sha256'] == digest(parent['before_overlay']['overlay_file']) and
|
|
report['before_manifest_sha256'] == digest(parent['before_overlay']['overlay_manifest']) and
|
|
report['after_overlay_sha256'] == hashes['delta-after.npz'] and
|
|
report['after_manifest_sha256'] == hashes['overlay-manifest.json'] and
|
|
report['before_delta_raw_sha256'] == B._raw(before['plastic_delta_mv']) and
|
|
report['after_delta_raw_sha256'] == B._raw(after['plastic_delta_mv']), 'Actual delta differs from CPU verification')
|
|
require(update['payload_sha256'] == hashlib.sha256(canonical({k: v for k, v in update.items() if k != 'payload_sha256'}).encode()).hexdigest(),
|
|
'Update receipt payload changed')
|
|
require(epoch['checkpoint_dir'] == parent['directory'] and epoch['checkpoint_manifest_sha256'] == parent['checkpoint_sha256'],
|
|
'Update is not from actual neural parent')
|
|
return dict(pass_all=True, CPU_process=cpu_name, update_files_sha256=hashes,
|
|
before_delta_raw_sha256=report['before_delta_raw_sha256'], after_delta_raw_sha256=report['after_delta_raw_sha256'],
|
|
U_receipt_payload_sha256=update['payload_sha256'], U_recomputed_in_this_audit=False,
|
|
U_recomputation_from_authenticated_separate_CPU_process=True)
|
|
|
|
|
|
def outcome(checks, pending):
|
|
"""Numerical failure and missing nonvacuous coverage are not equivalent."""
|
|
require(type(checks) is dict and bool(checks) and all(type(v) is bool for v in checks.values()),
|
|
'Explicit nonempty numerical/lineage checks required')
|
|
require(set(pending) == {'D1', 'mechanical'}, 'Both predetermined pending-edge audits required')
|
|
exact = all(checks.values())
|
|
coverage = pending['mechanical']['accepted_changed_edge_witness_verified'] is True
|
|
status = 'FAIL-NUMERICAL-OR-LINEAGE' if not exact else ('PASS-EXACT-UPDATED-BOUNDARY-ENGINEERING-NOT-LEARNING'
|
|
if coverage else 'INCOMPLETE-CHANGED-EDGE-COVERAGE')
|
|
return exact, coverage, status
|
|
|
|
|
|
def _pending(parent, child, parent_descriptor):
|
|
epoch = read(parent_descriptor['epoch_authority']['path']); spec = read(epoch['files']['spec']['path'])
|
|
graph = Path(spec['graph_dir']); apl_dir = Path(spec['apl_bundle_dir']); arrays = {}
|
|
try:
|
|
for name in ('ptr', 'src', 'dst', 'edge_id', 'weights'):
|
|
arrays[name] = np.load(graph / (name + '.npy'), mmap_mode='r', allow_pickle=False)
|
|
apl = np.load(apl_dir / 'apl_globals.npy', allow_pickle=False)
|
|
before = _npz(parent_descriptor['before_overlay']['overlay_file'])
|
|
after = _npz(parent_descriptor['after_overlay']['overlay_file'])
|
|
require(B.bit_equal(before['edge_id'], after['edge_id']), 'Changed witness candidate mask differs')
|
|
paths = [graph / (n + '.npy') for n in arrays] + [apl_dir / 'apl_globals.npy',
|
|
Path(parent_descriptor['before_overlay']['overlay_file']), Path(parent_descriptor['after_overlay']['overlay_file'])]
|
|
return B.audit_changed_pending(parent, child, ptr=arrays['ptr'], src=arrays['src'], dst=arrays['dst'],
|
|
edge_id=arrays['edge_id'], base_weights=arrays['weights'], apl_mask=np.isin(arrays['src'], apl),
|
|
candidate_edge_id=before['edge_id'], delta_before=before['plastic_delta_mv'],
|
|
delta_after=after['plastic_delta_mv'], input_pins={str(p): digest(p) for p in paths})
|
|
finally:
|
|
for value in arrays.values():
|
|
value._mmap.close()
|
|
|
|
|
|
def _lineage(reg, complete, verified, records):
|
|
"""Actual advancing idle chain plus non-feedback probes, not memory success."""
|
|
checks = {}; probe_rows = []
|
|
base = reg['parent_records'][reg['plan']['imported_parents']['D1']['role']]
|
|
delta = {k: digest(v) for k, v in base['after_overlay'].items()}
|
|
sampler = verified['evaluation-inputs']; sr = read(sampler['output'] / 'sampler-receipt.json')
|
|
require(same_json(sr, sampler['receipt']['result']) and sr['complete'] is True and sr['registration_sha256'] == sampler['job']['registration_sha256'] and
|
|
sr['uniform_batch_calls'] == 2 and sr['US_added'] is False and sr['brain_executed'] is False,
|
|
'Sampler receipt changed or wrong scope')
|
|
for cue in ('A', 'B'):
|
|
sample = sampler['output'] / (cue + '-requests.npz')
|
|
rows = [r for r in sr['rows'] if r['cue'] == cue]
|
|
require(len(rows) == 1 and rows[0]['saved_requests_sha256'] == digest(sample), 'Sampler cue binding differs')
|
|
req = _npz(sample); rates = _npz(EXP / f'inputs/static/{cue}-rates.npz')
|
|
require(set(req) == {'tick', 'neuron_idx'} and req['tick'].dtype == req['neuron_idx'].dtype == np.int32 and
|
|
req['tick'].shape == req['neuron_idx'].shape and np.all((req['tick'] >= 0) & (req['tick'] < 1000)) and
|
|
np.isin(req['neuron_idx'], rates['targets']).all(), 'Probe contains non-CS or out-of-window input')
|
|
require(rows[0]['stream']['seed'] == reg['plan']['evaluation_streams'][cue]['seed'] and
|
|
rows[0]['stream']['semantic_key'] == reg['plan']['evaluation_streams'][cue]['key'] and
|
|
rows[0]['stream']['split'] == 'evaluation', 'Probe seed semantic binding differs')
|
|
for label in ('t0', 't1', 't10'):
|
|
name = f'D1--probe--{label}--{cue}'; call = next(c for c in reg['plan']['calls'] if c['call_id'] == name)
|
|
job = verified[name]['job']; auth = read(job['authority_file'])
|
|
case = Path(auth['case']['requests']['path'])
|
|
parent = _parent(reg, complete, call['parent'])
|
|
checks[name + '.input_bytes'] = digest(case) == digest(sample)
|
|
checks[name + '.parent_clock'] = auth['parent'] == dict(directory=parent['directory'], checkpoint_manifest_sha256=parent['checkpoint_sha256']) and auth['global_tick_offset'] == call['global_tick_offset']
|
|
checks[name + '.fixed_delta'] = auth['overlay_after']['file']['sha256'] == delta['overlay_file'] and auth['overlay_after']['manifest']['sha256'] == delta['overlay_manifest']
|
|
checks[name + '.no_update_US_backflow'] = call['US'] is call['plastic_update'] is call['feedback_to_idle'] is False and not records[name]['summary']['within_trial_weight_updates']
|
|
probe_rows.append(dict(call_id=name, global_tick_offset=records[name]['global_tick_offset'],
|
|
actual_CS_requests=len(req['tick']), actual_US_requests=0, inputs_sha256=digest(case),
|
|
complete_response_metrics_or_retention_gate=False))
|
|
for name in ('D1--idle--1s', 'D1--idle--9s'):
|
|
call = next(c for c in reg['plan']['calls'] if c['call_id'] == name)
|
|
auth = read(verified[name]['job']['authority_file']); parent = _parent(reg, complete, call['parent'])
|
|
req = _npz(auth['case']['requests']['path'])
|
|
checks[name + '.actual_duration'] = records[name]['steps'] == call['steps']
|
|
checks[name + '.parent_clock'] = auth['parent'] == dict(directory=parent['directory'], checkpoint_manifest_sha256=parent['checkpoint_sha256']) and auth['global_tick_offset'] == call['global_tick_offset']
|
|
checks[name + '.empty_input'] = len(req['tick']) == len(req['neuron_idx']) == 0
|
|
checks[name + '.fixed_delta'] = auth['overlay_after']['file']['sha256'] == delta['overlay_file'] and auth['overlay_after']['manifest']['sha256'] == delta['overlay_manifest']
|
|
checks['no_probe_feeds_other_segment'] = all('--probe--' not in str(c.get('parent')) for c in reg['plan']['calls'])
|
|
checks['ten_seconds_actually_advanced'] = records['D1--idle--1s']['steps'] + records['D1--idle--9s']['steps'] == 100000 and records['D1--idle--9s']['summary']['global_next_tick'] == 101200
|
|
perf = verified['performance--evaluation-A-light-fresh']['job']
|
|
checks['normal_probe_performance_actual_A_bytes'] = digest(Path(perf['case_dir']) / 'requests.npz') == digest(sampler['output'] / 'A-requests.npz')
|
|
checks['normal_probe_performance_zero_overlay'] = perf['overlay_file'] == reg['initial_overlay']['overlay_file'] and perf['overlay_manifest'] == reg['initial_overlay']['overlay_manifest']
|
|
return dict(pass_all=all(checks.values()), checks=checks, failed_checks=[k for k, v in checks.items() if not v],
|
|
probes=probe_rows, biological_retention_demonstrated=False, learning_pass_claimed=False,
|
|
light_per_tick_identity_claimed=False, one_and_nine_second_same_state_lineage_verified=all(checks.values()))
|
|
|
|
|
|
def audit(reg_sha, *, save_report=True):
|
|
require(sys.dont_write_bytecode and 'torch' not in sys.modules and 'conditioning_epoch' not in sys.modules,
|
|
'Run a fresh pure CPU Python -B audit process')
|
|
regfile = EXP / 'protocol/preregistered.json'
|
|
require(digest(regfile) == reg_sha, 'External registration SHA changed')
|
|
reg = read(regfile); PLAN.validate_plan(reg['plan'])
|
|
require(reg['schema'] == 'conditioning-execution-registration-v1' and reg['engineering_only'] is True and
|
|
reg['scientific_acquisition_authorized'] is False, 'Not an engineering-only authority')
|
|
pins = _closure(reg, reg_sha); verify_pins(pins)
|
|
complete_path = EXP / 'audit/execution-complete.json'; complete_sha = digest(complete_path); complete = read(complete_path)
|
|
calls = reg['plan']['calls']; expected = expected_processes(reg['plan'])
|
|
require(complete['complete'] is True and complete['registration_sha256'] == reg_sha and
|
|
complete['completed_calls'] == [c['call_id'] for c in calls] and set(complete['processes']) == set(expected) and
|
|
complete['scientific_learning_pass_claimed'] is complete['candidate_generated'] is False,
|
|
'Execution inventory incomplete or scientifically overclaimed')
|
|
helper = _helpers(); verified = {name: verify_process(name, kind, reg, reg_sha, complete['processes'][name], helper)
|
|
for name, kind in expected.items()}
|
|
records = {}; imports = {}; checks = {}; updates = {}; comparisons = {}; pending = {}; used_pins = dict(pins)
|
|
for item in verified.values():
|
|
for path, sha in {**item['input_pins'], **item['evidence_sha256']}.items():
|
|
require(path not in used_pins or used_pins[path] == sha, 'Conflicting actual process authority')
|
|
used_pins[path] = sha
|
|
try:
|
|
for arm, descriptor in reg['plan']['imported_parents'].items():
|
|
parent = _parent(reg, complete, descriptor['role'])
|
|
require(str(Path(parent['directory']) / 'checkpoint-manifest.json') == descriptor['checkpoint_manifest'] and
|
|
parent['checkpoint_sha256'] == descriptor['sha256'], 'Imported authority differs')
|
|
D.C.load_checkpoint(parent['directory'], descriptor['sha256'])
|
|
imports[arm] = B.load_record(parent['directory'], kind='parent')
|
|
updates['AP-' + arm] = _update_check(parent, verified, 'AP-' + arm + '--cpu-verify')
|
|
for call in calls:
|
|
name = call['call_id']; run = verified[name]; directory = run['output']; receipt = run['receipt']
|
|
case = EXP / 'cases' / call['case_group']
|
|
expected_spec = read(reg['case_templates'][call['case_group']])
|
|
if call['parent'] is not None:
|
|
p = _parent(reg, complete, call['parent'])
|
|
expected_spec.update(parent_checkpoint_manifest_sha256=p['checkpoint_sha256'],
|
|
global_tick_offset=call['global_tick_offset'])
|
|
require(same_json(read(case / 'spec.json'), expected_spec), 'Executed case drifted from registered template')
|
|
if run['kind'] in ('brain', 'unchanged'):
|
|
require(Path(run['job']['case_dir']) == case, 'Wrong registered runtime case')
|
|
elif run['kind'] == 'oracle':
|
|
require(Path(run['job']['oracle_case']) == case, 'Wrong registered oracle case')
|
|
else:
|
|
auth = read(run['job']['authority_file'])
|
|
require(auth['case'] == dict(spec=A.pin(case / 'spec.json'), requests=A.pin(case / 'requests.npz')) and
|
|
auth['boundary_id'] == name and auth['registration_sha256'] == reg_sha and
|
|
auth['diagnostic_mode'] == call['diagnostic_mode'] and auth['input_policy'] == call['input_policy'] and
|
|
auth['transition'] == call['transition'] and auth['parent'] == dict(directory=p['directory'],
|
|
checkpoint_manifest_sha256=p['checkpoint_sha256']), 'Boundary authority differs from actual registered call')
|
|
if call['runner'] == 'boundary_oracle':
|
|
manifest = read(directory / 'oracle-manifest.json')
|
|
actual = {k: v['sha256'] for k, v in tree(directory).items() if k != 'oracle-manifest.json'}
|
|
require(manifest == dict(schema='conditioning-live-oracle-files-v1', complete=True, files_sha256=actual),
|
|
'Live oracle exact manifest differs')
|
|
kind = 'oracle'
|
|
else:
|
|
checkpoint_sha = receipt['result']['checkpoint_manifest_sha256']
|
|
D.load_checkpoint(directory, checkpoint_sha)
|
|
kind = 'updated' if call['runner'] == 'updated_continuation' else 'parent'
|
|
record = B.load_record(directory, kind=kind); records[name] = record; B._complete(record)
|
|
require(record['steps'] == call['steps'] and record['global_tick_offset'] == call['global_tick_offset'] and
|
|
record['summary']['nodes'] == N and record['summary']['edges'] == EDGES and
|
|
record['summary']['diagnostic_mode'] == call['diagnostic_mode'], 'Actual graph/clock/mode differs from registered call')
|
|
if call['runner'] == 'updated_continuation':
|
|
declared = _parent(reg, complete, name)
|
|
require(declared['directory'] == str(directory) and declared['checkpoint_sha256'] == checkpoint_sha,
|
|
'Saved parent registry differs from actual checkpoint')
|
|
helper._verify_precision(receipt['environment'], record['summary']['apl_component']['environment'])
|
|
cycle = read(EXP / 'receipts' / (name + '.cycle.json'))
|
|
used_pins[str(EXP / 'receipts' / (name + '.cycle.json'))] = digest(EXP / 'receipts' / (name + '.cycle.json'))
|
|
require(cycle['complete'] is True and same_json(cycle['call'], call) and cycle['source_registration_sha256'] == reg_sha,
|
|
'Complete-cycle descriptor mismatch')
|
|
for relative, evidence in cycle['output_inventory'].items():
|
|
path = EXP / relative
|
|
require(path.is_relative_to(EXP) and '..' not in Path(relative).parts and
|
|
evidence == dict(sha256=digest(path), bytes=path.stat().st_size), 'Cycle immutable output changed')
|
|
for name in ('mechanical--fresh-parent', 'performance--natural-light-fresh'):
|
|
parent = _parent(reg, complete, name)
|
|
require(parent['directory'] == str(verified[name]['output']) and parent['checkpoint_sha256'] == records[name]['manifest_sha256'],
|
|
'New E source parent identity differs')
|
|
updates[name] = _update_check(parent, verified, name + '--cpu-verify')
|
|
worker = verified[name + '--original-E']
|
|
require(worker['output'] == Path(parent['update_dir']) and
|
|
worker['receipt']['result']['chain_receipt_sha256'] == digest(worker['output'] / 'chain-receipt.json'),
|
|
'Original E actual process output differs')
|
|
for arm in ('D1', 'mechanical'):
|
|
oracle = records[arm + '--live-oracle']
|
|
parent = imports['D1'] if arm == 'D1' else records['mechanical--fresh-parent']
|
|
descriptor = _parent(reg, complete, reg['plan']['imported_parents']['D1']['role'] if arm == 'D1' else 'mechanical--fresh-parent')
|
|
original_authority = Path(verified[arm + '--updated--reference']['job']['authority_file'])
|
|
auth = read(original_authority)
|
|
for mode in ('reference', 'light'):
|
|
name = arm + '--updated--' + mode; authority = Path(verified[name]['job']['authority_file'])
|
|
comparisons[arm + '-live-vs-' + mode] = B.compare_boundary(oracle, records[name], parent=parent,
|
|
expected_before_sha256=auth['expected_effective_weight_before_sha256'],
|
|
expected_after_sha256=auth['expected_effective_weight_after_sha256'],
|
|
paired_authorities=(original_authority.read_bytes(), authority.read_bytes()))
|
|
pending[arm] = _pending(parent, records[arm + '--updated--reference'], descriptor)
|
|
for arm in ('D0', 'frozen'):
|
|
for mode in ('reference', 'light'):
|
|
comparisons[arm + '-old-C-vs-' + mode] = _pair(records[arm + '--old-C--reference'], records[arm + '--updated--' + mode])
|
|
performance = 'performance--natural-light-fresh'
|
|
comparisons['performance-natural-vs-AP'] = _pair(imports['D1'], records[performance])
|
|
old = reg['parent_records'][reg['plan']['imported_parents']['D1']['role']]
|
|
new = complete['parents'][performance]
|
|
old_delta, new_delta = (_npz(x['after_overlay']['overlay_file']) for x in (old, new))
|
|
checks['natural_fullcycle_after_delta_exact'] = set(old_delta) == set(new_delta) and all(B.bit_equal(v, new_delta[k]) for k, v in old_delta.items())
|
|
checks['natural_fullcycle_U_receipt_exact'] = same_json(read(Path(old['update_dir']) / 'update-receipt.json'), read(Path(new['update_dir']) / 'update-receipt.json'))
|
|
lineage = _lineage(reg, complete, verified, records)
|
|
checks.update({name: result['numerical_exact'] for name, result in comparisons.items()})
|
|
checks['D1_conditional_queue_exact'] = pending['D1']['conditional_ref_request_queue_exact'] and pending['D1']['reference_queue_and_ref_coverage_complete']
|
|
checks['mechanical_conditional_queue_exact'] = pending['mechanical']['conditional_ref_request_queue_exact'] and pending['mechanical']['reference_queue_and_ref_coverage_complete']
|
|
checks['actual_idle_and_probe_lineage'] = lineage['pass_all']
|
|
exact, coverage, status = outcome(checks, pending)
|
|
require(len(records) == 23 and sum(r['steps'] for r in records.values()) == 125200, 'Actual full-call/tick inventory differs')
|
|
verify_pins(used_pins)
|
|
for name, item in verified.items():
|
|
require(tree(item['output']) == item['output_inventory'], 'Audited outputs changed')
|
|
require(digest(complete_path) == complete_sha, 'Execution receipt changed')
|
|
result = dict(schema='conditioning-execution-numerical-audit-v1', complete=True, status=status,
|
|
pass_all=exact and coverage, numerical_exact=exact, registration_sha256=reg_sha,
|
|
execution_complete_sha256=digest(complete_path), checks=checks, failed_checks=[k for k, v in checks.items() if not v],
|
|
comparisons=comparisons, updates=updates, pending_edge_audits=pending, idle_probe_lineage=lineage,
|
|
actual_new_brain_calls=len(records), actual_new_brain_ticks=sum(r['steps'] for r in records.values()),
|
|
actual_processes=len(verified), actual_CPU_processes=sum(r['kind'] in ('update', 'validate_cpu') for r in verified.values()),
|
|
actual_GPU_sampler_processes=sum(r['kind'] == 'sample' for r in verified.values()), all_actual_runs_finite=True,
|
|
process_evidence={name: dict(kind=v['kind'], process_sha256=digest(v['paths']['process']), worker_sha256=digest(v['paths']['worker']),
|
|
job_sha256=digest(v['paths']['job']), output_files=len(v['output_inventory']), recorded_exit_code=0) for name, v in verified.items()},
|
|
observed_scope='Sparse events, complete final state/queues; full reference-only histories; authenticated recorded process evidence',
|
|
light_intermediate_states_observed=False, AP_D1_changed_edge_coverage_is_not_required=True,
|
|
historical_integrity_after_checked_here=False, sealed_here=False, brain_executed_here=False,
|
|
U_recomputed_here=False, learning_pass_claimed=False, full_retention_experiment=False, candidate_generated=False)
|
|
if save_report:
|
|
save(EXP / 'audit/numerical-comparison.json', result)
|
|
return result
|
|
finally:
|
|
for record in [*records.values(), *imports.values()]:
|
|
B.close_record(record)
|
|
|
|
|
|
if __name__ == '__main__':
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument('--registration-sha256', required=True)
|
|
args = parser.parse_args()
|
|
result = audit(args.registration_sha256)
|
|
print(json.dumps({k: result[k] for k in ('complete', 'status', 'pass_all', 'actual_new_brain_calls', 'actual_processes')}), flush=True)
|