P04-01: 同時発生の更新規約

This commit is contained in:
Agent Control Runner
2026-10-18 15:41:18 +09:00
parent acab529c8d
commit eb94e1d7db
24 changed files with 4092 additions and 28 deletions
@@ -0,0 +1,405 @@
#!/usr/bin/env python3
"""S4-only native entry. --check-only never loads ownership helpers or starts Godot."""
from pathlib import Path
import argparse
import copy
import hashlib
import importlib.util
import json
import os
import shutil
import subprocess
import stat
import sys
sys.dont_write_bytecode = True
HERE = Path(__file__).resolve().parent
BUILD = Path("/Users/korizatou114/Projects/TheTree-managed-worktrees/p04-01/.runtime/P04-01/build")
PRODUCT = BUILD / "audit-support/p04-r17-full-inputs-r01/product"
CACHE_RUN = BUILD / "p04-final-product-full-r01"
TEST = "tests/s3/test_runtime_staff_assignment.gd"
QA = HERE / "p04_s4_power_probe.gd"
ENGINE = Path("/Applications/Godot.app/Contents/MacOS/Godot")
ENGINE_SHA256 = "c7cccbf8fb143e34e02fd6521e09be2c2b974f0d5db080b19071c9c570718ccf"
MANIFEST = BUILD / "audit-support/p04-r17-full-inputs-r01/MANIFEST.json"
MANIFEST_SHA = "a15f29fa12537f6d8aaf7cabea390922a9f16e3eb9c10981e5742aafc8c4c8a8"
CONTRACTS = BUILD / "audit-support/p04-r17-full-inputs-r01/fixed/6ce6b28c5985e8a4f13b78bfeb1f1e09f6216d874fb01e0656ec1633bfa01cd7/completion_marker_contracts.json"
CASES = ["S4"]
LABELS = {"S4": ["boundary", "held", "recovered"]}
SLOTS = ["S4-" + label for label in sorted(LABELS["S4"])]
MATERIALS = [MANIFEST, BUILD / "audit-support/p04-review-repair22-r01/ACTUAL_CURRENT_PUBLIC_POWER_FUNCTIONS.json"]
def template_guard(root):
if root != PRODUCT.resolve() or not HERE.is_relative_to(BUILD.resolve()):
raise ValueError("Root must stage this exact QA/wrapper/plan inside own B")
if pin(MANIFEST)["sha256"] != MANIFEST_SHA:
raise ValueError("immutable full R17 relocation manifest")
manifest = json.loads(MANIFEST.read_text())
for name, source in manifest["product_source"].items():
# Old absolute paths are lookup keys only. Never open them.
row = manifest["original_to_relocated"][source["path"]]
actual = pin(root / name)
if Path(row["relocated"]).resolve() != root / name or any(
actual[k] != source[k] or actual[k] != row[k] for k in ("bytes", "sha256")):
raise ValueError("relocated product differs: " + name)
probe = QA.read_text()
import re
if ":=" in probe or re.search(r"\bvar\s+\w+\s*=", probe) or re.search(r"\bfor\s+\w+\s+in\b", probe):
raise ValueError("explicit typed declarations/loops required")
if re.search(r"\.(?:patience_remaining|elapsed_minutes|power_available|capacity|hold_until)\s*=(?!=)", probe):
raise ValueError("forbidden direct state mutation")
for forbidden in ["evaluate_now(", "configure_operations(", "._update_shift_states(", ".record_duty_minute("]:
if forbidden in probe:
raise ValueError("forbidden bypass: " + forbidden)
# Constants and public bodies are read from the actual selected source, not a memo.
mana = (root / "scripts/mana/mana_network_service.gd").read_text()
for key in ("EVALUATION_INTERVAL_MINUTES", "MINIMUM_OFF_HOLD_MINUTES"):
if not re.search(r"const " + key + r" := 10\b", mana):
raise ValueError("source timing changed: " + key)
def module(name, path):
spec = importlib.util.spec_from_file_location(name, path)
value = importlib.util.module_from_spec(spec)
spec.loader.exec_module(value)
return value
def pin(path):
path = Path(path)
if path.is_symlink() or not path.is_file():
raise ValueError("missing exact input: " + str(path))
data = path.read_bytes()
return dict(path=str(path), bytes=len(data), sha256=hashlib.sha256(data).hexdigest())
def engine_pin(path, expected=None):
path = Path(path)
if path != ENGINE or any(p.is_symlink() for p in (path, *path.parents)):
raise ValueError("exact installed engine required; no symlink or relocated input")
if path.resolve(strict=True) != ENGINE:
raise ValueError("installed engine resolved path changed")
before = path.stat()
if not stat.S_ISREG(before.st_mode):
raise ValueError("installed engine must be regular")
digest = hashlib.sha256(path.read_bytes()).hexdigest()
after = path.stat()
fields = ("st_dev", "st_ino", "st_size", "st_mtime_ns", "st_ctime_ns", "st_mode")
if any(getattr(before, k) != getattr(after, k) for k in fields):
raise ValueError("engine changed while hashing")
if any(p.is_symlink() for p in (path, *path.parents)) or path.resolve(strict=True) != ENGINE:
raise ValueError("engine path changed while hashing")
value = dict(path=str(path), resolved_path=str(path.resolve(strict=True)),
bytes=after.st_size, mtime_ns=after.st_mtime_ns, mode=after.st_mode,
device=after.st_dev, inode=after.st_ino, ctime_ns=after.st_ctime_ns, sha256=digest)
if digest != ENGINE_SHA256:
raise ValueError("engine differs from installed engine constant")
if expected is not None and value != expected:
raise ValueError("engine identity changed")
return value
def main():
parser = argparse.ArgumentParser(description=__doc__)
parser.add_argument("--project-root", type=Path, default=PRODUCT)
parser.add_argument("--output", type=Path, default=BUILD / "p04-s4-native-r28")
parser.add_argument("--plan", type=Path, default=BUILD / "p04-s4-plan-r28.json")
parser.add_argument("--cache-run", type=Path, default=None,
help="optional passed registered cache; default is fresh, without cache access")
parser.add_argument("--godot", type=Path, default=ENGINE)
parser.add_argument("--check-only", action="store_true")
args = parser.parse_args()
engine_descriptor = engine_pin(args.godot)
if args.cache_run is not None and args.cache_run.resolve() != CACHE_RUN.resolve():
raise ValueError("only registered own-B full-run cache")
root = args.project_root.resolve()
out = args.output.resolve()
if not out.is_relative_to(BUILD.resolve()) or not args.plan.resolve().is_relative_to(BUILD.resolve()):
raise ValueError("plan/output must stay in task build")
if out.exists() or out.is_symlink():
raise ValueError("fresh output required")
if args.check_only and (args.plan.exists() or args.plan.is_symlink()):
raise ValueError("fresh plan required")
r = module("s4_standard_runner", root / "tools/run_all_tests.py")
# Preserve the reviewed source_refs -> exactly one QA override order.
source_before = r.source_refs(root)
refs = dict(source_before)
refs[TEST] = pin(QA)
template_guard(root)
expected = {n: dict(bytes=p["bytes"], sha256=p["sha256"]) for n, p in refs.items()}
fixed = [pin(p) for p in MATERIALS + [
QA, Path(__file__), HERE / "S4_ROOT_RUN.md",
root / "tests/transport/test_runtime_transport.gd",
root / "tests/staff/test_rescue_elevator.gd",
CONTRACTS,
]]
selected = dict(root_before=source_before, map={n: p["sha256"] for n, p in refs.items()}, timeout=1200)
cache_note = None
cache_receipts = []
if args.cache_run is not None:
# Reject failed caches before reading their inputs or cache contents.
r.require(r.read(args.cache_run / "runner-ended.json")["passed"] is True,
"failed cache is ineligible")
for leaf in (["runner-ended.json", "runner-input.json"] if args.cache_run is not None else []):
path = args.cache_run / leaf
try:
cache_receipts.append(pin(path))
except OSError as caught:
cache_note = dict(path=str(path), error=type(caught).__name__ + ": " + str(caught),
required_before_native=True)
break
plan = dict(protocol="p04-s4-preparation-v1", project_root=str(root), output=str(out), engine_path=str(args.godot.resolve()),
source_before=source_before, selected_source_map=selected["map"],
QA_overrides=[TEST], fixed_input_pins=fixed,
cache_run=str(args.cache_run) if args.cache_run is not None else None,
import_mode="cache" if args.cache_run is not None else "fresh",
engine_sha256=ENGINE_SHA256, engine=engine_descriptor,
cache_receipts=cache_receipts, cache_access=cache_note,
phases=["import", "parse", "writer", "reader"],
native_engine_launches=0, whole_goal_accepted=False, unit_accepted=False)
# Check-only only reads source/materials and writes the plan in task build.
# Reads engine identity; never launches Godot or inspects players/processes.
if args.check_only:
args.plan.parent.mkdir(parents=True, exist_ok=True)
r.write(args.plan, plan)
print(json.dumps(dict(check_only=True, engines=0, source_files=len(source_before),
QA_overrides=[TEST], fixed_pins=len(fixed), plan=str(args.plan),
plan_sha256=r.sha(args.plan), cache_access=cache_note), ensure_ascii=False))
return 0
r.require(root == PRODUCT.resolve() and len(source_before) == 1338, "Root native requires product 1338; worker plan is not native evidence")
r.require(args.plan.is_file() and r.read(args.plan) == plan, "run exact check-only plan first")
engine_observations = []
engine_identity = dict(before=engine_descriptor, during=[], after=None)
def repin(label):
try:
value = engine_pin(args.godot, engine_descriptor)
engine_observations.append(dict(stage=label, descriptor=value))
if label == "after-cleanup":
engine_identity["after"] = value
else:
engine_identity["during"].append(value)
except BaseException as caught:
engine_observations.append(dict(stage=label, error=str(caught)))
raise
def fixed_guard():
repin("cleanup-fixed-guard")
template_guard(root)
for value in fixed + cache_receipts:
r.require(pin(value["path"]) == value, "fixed input changed: " + value["path"])
fixed_guard()
old = args.cache_run
if old is not None:
# Native cache admission remains Root-only and fails closed.
r.require(cache_note is None, "Root must read exact cache receipts: " + str(cache_note))
r.require(r.read(old / "runner-ended.json")["passed"], "ended cache run must have passed")
cache_input = r.read(old / "runner-input.json")
r.require(cache_input["engine_sha256"] == ENGINE_SHA256, "cache engine identity")
old_map = cache_input["selected_source_map"]
current_map = {n: p["sha256"] for n, p in source_before.items()}
r.require({k: v for k, v in old_map.items() if k != "tools/check_p04_order_evidence.py"} == current_map and len(old_map) == 1339, "immutable full cache: all 1338 product inputs equal; checker is not parsed/executed by product suites")
protected = r.default_player(root)
outer = module("s4_owned_outer", r.SUPPORT / "owned_outer.py")
r.require(not outer.native.helper["live_engines"](), "another Godot owns CPU")
engine = ENGINE
repin("native-admission")
r.require(shutil.disk_usage(out.parent).free >= 1024**3 + engine.stat().st_size + 136*1024**2,
"reviewed native disk admission")
r.require(not out.exists(), "fresh output required; preserve previous attempts")
out.mkdir()
stage = out / "stage"
stage.mkdir()
(out / "starters").mkdir()
(out / "bootstrap").mkdir()
phases = []
previous = {}
error = None
guards = []
cleanup = []
cleanup_errors = []
cache_before = None
formal_before = None
formal_after = None
original_phase = outer.run_phase
def run_phase(argv, folder, timeout, env, **kwargs):
env = dict(env)
if folder.name in ["writer", "reader"]:
env.update(THE_TREE_S4_EVIDENCE=str(out / "raw"), THE_TREE_S4_MODE=folder.name)
return original_phase(argv, folder, timeout, env, **kwargs)
outer.run_phase = run_phase
try:
r.write(out / "runner-started.json", dict(started=r.now(), owner_runner_pid=os.getpid(),
plan=pin(args.plan), engines_launched=0))
r.write(out / "source_before.json", source_before)
r.write(out / "selected-source-map.json", refs)
# Private source stage first, then literal reviewed bootstrap.
for name, value in refs.items():
target = stage / name
target.parent.mkdir(parents=True, exist_ok=True)
r.copy_source(Path(value["path"]), target)
r.require(r.inventory(stage, stage=True) == expected, "whole private source")
for name, value in r.read(r.SUPPORT / "bootstrap-scripts.json").items():
data = value["text"].encode()
r.require(hashlib.sha256(data).hexdigest() == value["sha256"], "bootstrap pin")
(out / "bootstrap" / name).write_bytes(data)
if old is not None:
cache = old / "stage/.godot"
cache_before = r.inventory(cache)
r.require(bool(cache_before), "nonempty ended cache")
for name in cache_before:
src = cache / name
dst = stage / ".godot" / name
dst.parent.mkdir(parents=True, exist_ok=True)
subprocess.run(["/bin/cp", "-c", str(src), str(dst)], check=True)
r.require((src.stat().st_dev, src.stat().st_ino) != (dst.stat().st_dev, dst.stat().st_ino),
"cache clone is a separate inode")
r.require(r.inventory(stage / ".godot") == cache_before, "whole cache clone hashes")
r.write(out / "cache-reuse.json", dict(ended_run=str(old), receipts=cache_receipts,
whole_cache=cache_before, independent_inode=True,
ordinary_import_required=True, ordinary_parse_required=True))
paths = ["res://" + n for n in sorted(refs) if n.endswith(".gd")]
r.require(len(paths) == 316, "complete 316-script parse roster")
r.write(out / "parse-paths.json", paths)
markers = module("s4_markers", root / "tools/strict_test_markers.py")
contracts = markers.load_contracts(CONTRACTS)
contracts[TEST] = dict(test=TEST, template="S4 power: <checks> checks, <failures> failures", required=True)
policy = r.read(r.SUPPORT / "suite-policy.json")
r.require(TEST not in policy["suite_policies"], "no normal suite watchdog/policy override")
r.write(out / "contracts.json", contracts)
r.write(out / "runner-input.json", dict(plan, owner_runner_pid=os.getpid(),
wrapper_sha256=r.sha(__file__), QA=pin(QA), engine=engine_descriptor,
engine_identity_before=engine_descriptor, engine_identity_initial=copy.deepcopy(engine_identity),
runner_sha256=r.sha(root / "tools/run_all_tests.py"),
default_player_before=protected, fixed_input_pins=fixed,
functional_watchdog_seconds=1200, source_adoption=False))
diagnostics = module("s4_diagnostics", r.SUPPORT / "diagnostic_gate.py")
owners = module("s4_owners", r.SUPPORT / "ordinary_proof_gate.py")
audio = module("s4_audio", r.SUPPORT / "audio_evidence_gate.py")
public = (stage / "project.godot").read_bytes()
for phase, test in [("import", None), ("parse", None), ("writer", TEST), ("reader", TEST)]:
if phase == "reader":
writer = r.read(out / "raw/writer.json")
formal_before = {n: r.inventory(Path(p)) for n, p in writer["slots"].items()}
r.require(sorted(formal_before) == SLOTS, "exact three formal points for isolated power case")
if phase == "import" and old is None:
r.require(not (stage / ".godot").exists() and not (stage / ".godot").is_symlink(),
"fresh private .godot absent at actual import")
repin("before-" + phase)
r.write(out / ("engine-identity-before-" + phase + ".json"),
dict(engine_observations[-1], observation_index=len(engine_observations)-1))
row = r.execute_phase(str(engine), stage, out, phase, test, selected, expected,
previous, policy, contracts, paths, public, protected, root,
outer, markers, diagnostics, owners, audio)
phases.append(row)
# execute_phase writer/reader share out/<test>.log via write_text.
# Keep binary per-phase copies under these existing unique names.
# The shared runner log is not write-once; see S4_ROOT_RUN.md.
if test and row.get("log"):
(out / (phase + "-combined-raw.log")).write_bytes((out / row["log"]).read_bytes())
row["strict_runner_log_path"] = row["log"]
row["log"] = phase + "-combined-raw.log"
r.write(out / (phase + "-actual-phase.json"), row)
print(json.dumps(dict(phase=phase, passed=row["passed"], error=row.get("validation_error"))), flush=True)
r.require(row["passed"], "first strict phase failure: " + phase)
if phase in ["writer", "reader"]:
receipt = r.read(out / ("raw/" + phase + ".json"))
r.require(receipt["checks"] > 0 and receipt["failures"] == 0,
"S4 actual outcome receipt")
r.require(sorted(receipt["branches"]) == CASES,
"exact one independent Writer/Reader case")
r.require(sorted(receipt["slots"]) == SLOTS, "all formal point slots")
r.require(receipt["pid"] == row["actual_pid"], "actual native PID/receipt")
repin("after-collection")
writer = r.read(out / "raw/writer.json")
reader = r.read(out / "raw/reader.json")
r.require(writer["pid"] != reader["pid"] and writer["profile"] != reader["profile"], "distinct formal processes")
formal_after = {n: r.inventory(Path(p)) for n, p in writer["slots"].items()}
r.require(formal_before == formal_after, "Reader leaves Writer packages unchanged")
except BaseException as caught:
error = type(caught).__name__ + ": " + str(caught)
finally:
try:
cleanup, cleanup_errors = outer.finish_captured(outer.OWNED)
except BaseException as caught:
cleanup_errors.append(str(caught))
try:
r.write(out / "outer-owned-finally.json", dict(cleanup=cleanup, errors=cleanup_errors))
except BaseException as caught:
guards.append("finally receipt: " + type(caught).__name__ + ": " + str(caught))
# Explicit re-pin after cleanup is independent of other fixed-input guards.
try:
repin("after-cleanup")
except BaseException as caught:
guards.append(type(caught).__name__ + ": " + str(caught))
# Fixed guard always follows ownership cleanup, even if setup or an engine failed.
try:
fixed_guard()
after = r.source_refs(root)
r.write(out / "source_after.json", after)
r.require(after == source_before, "whole product source unchanged")
r.require(r.default_player(root) == protected, "default player unchanged")
if (stage / "project.godot").exists():
r.require(r.inventory(stage, stage=True) == dict(expected, **previous), "whole private source unchanged")
if cache_before is not None:
r.require(r.inventory(old / "stage/.godot") == cache_before, "original cache unchanged")
if formal_before is not None:
writer = r.read(out / "raw/writer.json")
formal_after = {n: r.inventory(Path(p)) for n, p in writer["slots"].items()}
r.require(formal_before == formal_after, "Writer formal packages unchanged after Reader, including failure")
except BaseException as caught:
guards.append(type(caught).__name__ + ": " + str(caught))
pids = [p.pid for p in outer.OWNED]
passed = (error is None and not guards and not cleanup_errors and len(phases) == 4
and all(p["passed"] for p in phases) and len(pids) == len(set(pids)) == 4
and all(p["engine_ended"] for p in cleanup))
execution = dict(passed=passed, error=error, guard_errors=guards, phases=phases,
actual_captured_PIDs=pids, cleanup=cleanup, cleanup_errors=cleanup_errors,
formal_before=formal_before, formal_after=formal_after,
whole_goal_accepted=False, unit_accepted=False)
# IO1 has already copied all four members into a separate Reader profile.
# Mirror those exact complete directories to own B for read-only R verification.
# Original profile paths are provenance after this step, never verifier inputs.
try:
if passed:
relocated = {}
for role in ("writer", "reader"):
receipt = r.read(out / ("raw/" + role + ".json"))
relocated[role] = {}
for slot, original in receipt["slots"].items():
target = out / "formal" / role / slot
target.mkdir(parents=True)
members = r.inventory(Path(original))
r.require(set(members) == {"journal.log", "manifest.json", "thumbnail.png", "world.bin"}, "all formal members")
for member in members:
shutil.copyfile(Path(original) / member, target / member)
r.require(r.inventory(target) == members == formal_before[slot], "whole formal mirror")
relocated[role][slot] = dict(provenance=original, relative=str(target.relative_to(out)), members=members)
r.write(out / "formal-relocation.json", relocated)
r.write(out / "raw-inventory.json", r.inventory(out / "raw"))
r.write(out / "PID-set.json", dict(owner_runner_pid=os.getpid(), engine_PIDs=pids))
except BaseException as caught:
guards.append("output collection: " + type(caught).__name__ + ": " + str(caught))
passed = False
execution["passed"] = False
try:
repin("after-output-collection")
except BaseException as caught:
guards.append(str(caught))
passed = False
execution["passed"] = False
try:
r.write(out / "engine-identity.json",
dict(observations=engine_observations, identity=engine_identity))
except BaseException as caught:
guards.append("engine identity receipt: " + type(caught).__name__ + ": " + str(caught))
passed = False
execution["passed"] = False
execution["engine_observations"] = engine_observations
execution["engine_identity"] = engine_identity
r.write(out / "execution.json", execution)
r.write(out / "runner-ended.json", dict(execution, ended=r.now()))
print(json.dumps(dict(passed=passed, error=error, guard_errors=guards, output=str(out))))
return 0 if passed else 1
if __name__ == "__main__":
try:
raise SystemExit(main())
except Exception as caught:
print(type(caught).__name__ + ": " + str(caught), file=sys.stderr)
raise SystemExit(2)