#!/usr/bin/env bash # Branch B complete-unit replay for experiment A847-LEAN-CAPACITY-32549b50e95c. # All Python implementation/reference source needed by this harness is embedded. # Usage (from pinned repository): # bash artifacts/lean-capacity/b/replay.sh --budget-seconds REMAINING_SECONDS # Offline tool acquisition: add --archive PATH_TO_AUTHENTICATED_LEAN_TAR_ZST. # Budget includes the reserve (default 360s). No fixed 1200-second proof cutoff. # The default run uses fresh task-local storage; external olean caches are refused. # --reconcile-only --work-dir DIR packages saved results without rerunning proofs. # Official toolchain/cache binaries are intentionally excluded from delivery. set -euo pipefail umask 077 exec python3 -I - "$@" <<'IMD_BRANCH_B_PYTHON' import argparse, pathlib, tempfile, sys parser=argparse.ArgumentParser(add_help=False) parser.add_argument('--repo',default='.') known,_=parser.parse_known_args() repo=pathlib.Path(known.repo).resolve() scratch=repo/'test/scratch' scratch.mkdir(parents=True,exist_ok=True) code=pathlib.Path(tempfile.mkdtemp(prefix='b-replay-code-',dir=scratch)) sources={'b_manifest.py': '#!/usr/bin/env python3\n"""Source-bound Branch B manifest; no third-party dependencies or source edits."""\nimport argparse, hashlib, json, pathlib, re, subprocess\nfrom functools import lru_cache\nCOMMIT = \'048bb245b60abce79f1a2d0c82336ff8508ec752\'\nTREE = \'c6111a7d32daf2906275ee1ac265bf6865ebd9a5\'\nNS = \'SpectreFinite.HexSearch.RadiusFive.\'\n\ndef strip_comments(text):\n """Blank nested Lean block/line comments while retaining offsets and strings."""\n chars = list(text); i = 0; depth = 0; string = False\n while i < len(text):\n if depth:\n if text.startswith(\'/-\', i):\n chars[i:i+2] = \' \'; depth += 1; i += 2\n elif text.startswith(\'-/\', i):\n chars[i:i+2] = \' \'; depth -= 1; i += 2\n else:\n if text[i] != \'\\n\': chars[i] = \' \'\n i += 1\n elif string:\n if text[i] == \'\\\\\': i += 2\n elif text[i] == \'"\': string = False; i += 1\n else: i += 1\n elif text.startswith(\'/-\', i):\n chars[i:i+2] = \' \'; depth = 1; i += 2\n elif text.startswith(\'--\', i):\n while i < len(text) and text[i] != \'\\n\': chars[i] = \' \'; i += 1\n elif text[i] == \'"\': string = True; i += 1\n else: i += 1\n if depth: raise ValueError(\'unterminated Lean block comment\')\n return \'\'.join(chars)\n\ndef parse_imports(text):\n """Parse Lean header imports including public/meta and import all forms.\n\n Imported module names may share a line or continue across whitespace. This\n handles the ordinary dotted ASCII names used by the pinned source and fails\n closed on unsupported header syntax rather than silently omitting imports.\n """\n clean = strip_comments(text)\n tokens = re.findall(r\'[A-Za-z_][A-Za-z_0-9\\\'.]*|\\S\', clean)\n out = []; i = 0\n if i < len(tokens) and tokens[i] == \'module\': i += 1\n if i < len(tokens) and tokens[i] == \'prelude\': i += 1\n commands = {\'public\',\'private\',\'meta\',\'import\',\'module\',\'prelude\',\'namespace\',\'section\',\'open\',\'set_option\',\'def\',\'theorem\',\'lemma\',\'inductive\',\'structure\',\'class\',\'instance\',\'abbrev\',\'opaque\',\'axiom\',\'noncomputable\',\'variable\',\'universe\',\'end\'}\n while i < len(tokens):\n j = i\n while j < len(tokens) and tokens[j] in {\'public\',\'private\',\'meta\'}: j += 1\n if j >= len(tokens) or tokens[j] != \'import\': break\n j += 1\n if j < len(tokens) and tokens[j] == \'all\': j += 1\n found = []\n while j < len(tokens) and tokens[j] not in commands and re.fullmatch(r\'[A-Za-z_][A-Za-z_0-9\\\']*(?:\\.[A-Za-z_][A-Za-z_0-9\\\']*)*\', tokens[j]):\n found.append(tokens[j]); j += 1\n if not found: raise ValueError(\'empty or unsupported import syntax\')\n out.extend(found); i = j\n return list(dict.fromkeys(out))\n\nclass Source:\n """Pinned Git blob reader. Every source byte returned is compared to Git."""\n def __init__(self, repo):\n self.repo = pathlib.Path(repo).resolve()\n got = subprocess.check_output([\'git\',\'rev-parse\',COMMIT+\'^{tree}\'],cwd=self.repo,text=True).strip()\n if got != TREE: raise ValueError(\'pinned tree mismatch: \'+got)\n listing = subprocess.check_output([\'git\',\'ls-tree\',\'-rz\',COMMIT],cwd=self.repo)\n self.entries = {}\n for ent in listing.split(b\'\\0\'):\n if not ent: continue\n meta, path = ent.split(b\'\\t\',1); mode, kind, oid = meta.decode().split()\n self.entries[path.decode()] = (mode,kind,oid)\n self.modules = {p[4:-5].replace(\'/\',\'.\'): p for p, e in self.entries.items() if p.startswith(\'src/\') and p.endswith(\'.lean\') and e[1] == \'blob\'}\n self.records = {}; self.texts = {}; self.edges = {}; self.external = set()\n self.cat = subprocess.Popen([\'git\',\'cat-file\',\'--batch\'],cwd=self.repo,stdin=subprocess.PIPE,stdout=subprocess.PIPE)\n def read(self, path):\n if path in self.texts:\n # Revalidate every consumption, including a cached source read.\n if (self.repo/path).read_bytes() != self.texts[path].encode(\'utf-8\'):\n raise ValueError(\'working bytes changed after Git comparison: \'+path)\n return self.texts[path]\n mode,kind,oid = self.entries[path]\n if kind != \'blob\' or mode not in {\'100644\',\'100755\'}: raise ValueError(\'nonregular source \'+path)\n data = (self.repo/path).read_bytes()\n self.cat.stdin.write((oid+\'\\n\').encode()); self.cat.stdin.flush()\n header = self.cat.stdout.readline().decode().split()\n if len(header) != 3 or header[0] != oid or header[1] != \'blob\': raise ValueError(\'cat-file mismatch\')\n expected = self.cat.stdout.read(int(header[2])); terminator = self.cat.stdout.read(1)\n if terminator != b\'\\n\' or data != expected: raise ValueError(\'working bytes differ from Git blob: \'+path)\n self.records[path] = {\'path\':path,\'git_blob\':oid,\'bytes\':len(data),\'sha256\':hashlib.sha256(data).hexdigest(),\'byte_compare_to_git_blob\':\'PASS\'}\n self.texts[path] = data.decode(\'utf-8\'); return self.texts[path]\n def imports(self, module):\n if module not in self.edges:\n self.edges[module] = parse_imports(self.read(self.modules[module]))\n return self.edges[module]\n def closure(self, module):\n """Return local modules in dependency-first order; external names recorded.\n\n External core imports are allowed only from Init, Lean, Std or Lake.\n No absent package import is silently treated as satisfied.\n """\n result = []; done = set(); active = set()\n def visit(m):\n if m in done: return\n if m not in self.modules:\n if m.split(\'.\')[0] not in {\'Init\',\'Lean\',\'Std\',\'Lake\'}: raise ValueError(\'missing non-toolchain import \'+m)\n self.external.add(m); return\n if m in active: raise ValueError(\'cyclic import \'+m)\n active.add(m)\n for d in self.imports(m): visit(d)\n active.remove(m); done.add(m); result.append(m)\n visit(module); return result\n def close(self):\n self.cat.stdin.close(); self.cat.stdout.close(); self.cat.wait()\n\nTHEOREM_RE = re.compile(r\'(?m)^theorem\\s+([A-Za-z_][A-Za-z_0-9\\\']*)\\b\')\nTOPLEVEL_RE = re.compile(r\'(?m)^(?:theorem|lemma|def|abbrev|opaque|axiom|structure|inductive|class|instance|end|#print|#check|#eval)\\b\')\n\ndef compact(text): return re.sub(r\'\\s+\', \'\', text)\n\ndef declarations(src, path):\n text = src.read(path); clean = strip_comments(text)\n module = path[4:-5].replace(\'/\',\'.\')\n found = []\n for hit in THEOREM_RE.finditer(clean):\n candidate = hit.group(1)\n if candidate not in {\'root2Node0Step4_checked\',\'root7Node110Step1_checked\'} and not (re.match(r\'root([0145678])Node0Step1Chunk\\1_[0-5](?:_|$)|root0Node0Step2Chunk[5-8]_[0-5](?:_|$)|root0Node0Step3Chunk(?:5_5|[6-8]_[0-5])(?:_|$)\', candidate) and re.search(r\'(?:_checked|_rows_exact)$\',candidate)):\n continue\n tail = clean[hit.end():]\n typed = re.match(r\'\\s*:\\s*(.*?)\\s*:=\', tail, re.S)\n if not typed: continue # parameterized declarations are dependencies, not required unit roots\n end_match = TOPLEVEL_RE.search(clean, hit.end())\n end = end_match.start() if end_match else len(clean)\n prefix = clean[:hit.start()]\n scopes = []; opens = []\n for line in prefix.splitlines():\n line = line.strip()\n ns = re.fullmatch(r\'namespace\\s+([A-Za-z_][A-Za-z_0-9\\\'.]*)\',line)\n sec = re.fullmatch(r\'(?:public\\s+)?section(?:\\s+\\w+)?\',line)\n if ns: scopes.append((\'namespace\',ns.group(1)))\n elif sec: scopes.append((\'section\',\'\'))\n elif re.fullmatch(r\'end(?:\\s+[A-Za-z_][A-Za-z_0-9\\\'.]*)?\',line):\n if not scopes: raise ValueError(\'unmatched end \'+path)\n scopes.pop()\n elif line.startswith(\'open \'): opens.append(line)\n namespace = \'.\'.join(n for kind,n in scopes if kind == \'namespace\')\n name = hit.group(1); full = (namespace+\'.\' if namespace else \'\')+name\n type_start = hit.end()+typed.start(1); type_end = hit.end()+typed.end(1)\n found.append({\'name\':full,\'short_name\':name,\'module\':module,\'path\':path,\n \'line\':clean.count(\'\\n\',0,hit.start())+1,\'namespace\':namespace,\'opens\':list(dict.fromkeys(opens)),\n \'published_type\':text[type_start:type_end].strip(),\n \'source_fragment\':text[hit.start():end].rstrip(),\n \'body\':clean[hit.end()+typed.end():end].strip(),\n \'git_blob\':src.records[path][\'git_blob\'], \'source_sha256\':src.records[path][\'sha256\']})\n return found\n\ndef make_manifest(repo):\n src = Source(repo)\n try:\n return _build_manifest(src)\n finally:\n src.close()\n\ndef _build_manifest(src):\n for pin in [\'lean-toolchain\',\'lakefile.lean\',\'lake-manifest.json\']:\n src.read(pin)\n index = {}\n for path in sorted(src.entries):\n base = path.rsplit(\'/\',1)[-1]\n selected = (re.fullmatch(r\'RadiusFiveRoot[0145678]Part0(?:Segment[0-9]+)?\\.lean\',base) or\n re.fullmatch(r\'RadiusFiveRoot([0145678])Step1Chunk\\1_[0-5].*\\.lean\',base) or\n re.fullmatch(r\'RadiusFiveRoot0Step2Chunk[5-8]_[0-5].*\\.lean\',base) or\n re.fullmatch(r\'RadiusFiveRoot0Step3Chunk(?:5_5|[6-8]_[0-5]).*\\.lean\',base) or\n base in {\'RadiusThreeRoot2Part1.lean\',\'RadiusFiveRoot7Part43.lean\'})\n if path.startswith(\'src/SpectreFinite/\') and selected:\n for d in declarations(src,path):\n if d[\'name\'] in index: raise ValueError(\'duplicate declaration \'+d[\'name\'])\n index[d[\'name\']] = d\n names = [NS+f\'root{r}Node0Step1Chunk{r}_{j}_checked\' for r in [0,1,4,5,6,7,8] for j in range(6)]\n names += [NS+f\'root0Node0Step2Chunk{k}_{j}_checked\' for k in [5,6,7,8] for j in range(6)]\n names += [NS+\'root0Node0Step3Chunk5_5_checked\']\n names += [NS+f\'root0Node0Step3Chunk{k}_{j}_checked\' for k in [6,7,8] for j in range(6)]\n small = \'SpectreFinite.HexSearch.RadiusThree.root2Node0Step4_checked\'\n stress = NS+\'root7Node110Step1_checked\'\n names += [small,stress]\n if len(names) != 87 or len(set(names)) != 87: raise ValueError(\'invalid backlog\')\n units = {}; roots = {}; support_counts = {\'slices\':0,\'row_bindings\':0,\'intermediates\':0}\n def get(name):\n if name not in index: raise ValueError(\'missing actual declaration \'+name)\n return index[name]\n def root(name,role):\n d = dict(get(name)); d.pop(\'body\',None)\n d[\'role\'] = role; d[\'type\'] = d[\'published_type\']; roots[name] = d; return name\n for name in names:\n parent = get(name)\n unit = {\'id\':name,\'kind\':\'replacement\' if name in [small,stress] else \'complete_chunk\',\n \'module\':parent[\'module\'],\'path\':parent[\'path\'],\'line\':parent[\'line\'],\n \'published_type\':parent[\'published_type\'],\'roots\':[root(name,\'parent\')],\n \'branch\':\'B\' if name == stress or re.match(re.escape(NS)+r\'root[14567]Node0Step1Chunk\',name) else \'A\'}\n if unit[\'kind\'] == \'complete_chunk\':\n composer = parent\n alias = re.fullmatch(r\'by\\s+exact\\s+(\\w+_projected_slices_pilot_checked)\\s*\',parent[\'body\'])\n if alias:\n inter = NS+alias.group(1); composer = get(inter)\n unit[\'roots\'].append(root(inter,\'intermediate\')); support_counts[\'intermediates\'] += 1\n if compact(composer[\'published_type\']) != compact(parent[\'published_type\']): raise ValueError(\'alias type mismatch \'+name)\n ptype = re.fullmatch(r\'checkNarrowing\\s+⟨\\s*(\\w+)\\s*,\\s*(\\w+)\\s*⟩\\s+(\\w+)\\s+(\\w+)\\s*=\\s*true\',parent[\'published_type\'])\n if not ptype: raise ValueError(\'unsupported parent type \'+name)\n scope, parent_rows, d0,d1 = ptype.groups()\n body = composer[\'body\']\n rowmatch = re.search(r\'\\brw\\s*\\[\\s*(\\w+_rows_exact)\\s*\\]\',body)\n flatten = re.search(r\'\\bexact\\s+checkNarrowing_flatten\\s+(\\w+)\\s*\\[(.*?)\\]\\s+(\\w+)\\s+(\\w+)\\s*\\(by\',body,re.S)\n simp = re.search(r\'\\bsimp only\\s*\\[(.*?)\\]\',body,re.S)\n if not (rowmatch and flatten and simp): raise ValueError(\'missing flatten binding \'+name)\n fscope, rows_str, fd0, fd1 = flatten.groups()\n rows = [s.strip() for s in rows_str.split(\',\')]\n slices = re.findall(r\'\\b\\w+_(?:projected_)?slice\\d+_checked\\b\',simp.group(1))\n slice_numbers = [int(re.search(r\'slice(\\d+)_checked$\',s).group(1)) for s in slices]\n if (fscope,fd0,fd1) != (scope,d0,d1): raise ValueError(\'scope/domain mismatch \'+name)\n if not rows or len(rows) != len(slices) or slice_numbers != list(range(len(slices))): raise ValueError(\'slice row order mismatch \'+name)\n row_name = NS+rowmatch.group(1); binding = get(row_name)\n expected_binding = parent_rows+\' = [\'+\', \'.join(rows)+\'].flatten\'\n if compact(binding[\'published_type\']) != compact(expected_binding): raise ValueError(\'row binding type mismatch \'+name)\n unit[\'roots\'].append(root(row_name,\'row_binding\')); support_counts[\'row_bindings\'] += 1\n for row_expr,slice_name in zip(rows,slices):\n full_slice = NS+slice_name; sliced = get(full_slice)\n expected_slice = f\'checkNarrowing ⟨{scope}, {row_expr}⟩ {d0} {d1} = true\'\n if compact(sliced[\'published_type\']) != compact(expected_slice): raise ValueError(\'slice scope/row/domain mismatch \'+full_slice)\n unit[\'roots\'].append(root(full_slice,\'slice\')); support_counts[\'slices\'] += 1\n unit[\'composition\'] = {\'composer\':composer[\'name\'],\'scope\':scope,\'parent_rows\':parent_rows,\n \'domains\':[d0,d1],\'ordered_rows\':rows,\'ordered_slices\':[NS+s for s in slices],\n \'row_binding\':row_name,\'validation\':\'PASS\',\'validation_kind\':\'source structure; proof results recorded separately\'}\n closure = src.closure(parent[\'module\'])\n for rn in unit[\'roots\']:\n if roots[rn][\'module\'] not in closure: raise ValueError(\'support outside parent closure \'+rn)\n unit[\'closure\'] = closure\n unit[\'closure_module_count\'] = len(closure)\n unit[\'closure_source_bytes\'] = sum(src.records[src.modules[m]][\'bytes\'] for m in closure)\n units[name] = unit\n if support_counts != {\'slices\':381,\'row_bindings\':85,\'intermediates\':2} or len(roots) != 555:\n raise ValueError(\'backlog support totals differ: \'+repr(support_counts)+\', \'+str(len(roots)))\n forced = [NS+f\'root8Node0Step1Chunk8_{j}_checked\' for j in [2,0,1,3,4,5]] + [small,stress]\n for i,name in enumerate(forced[:6]):\n expected_module = \'SpectreFinite.RadiusFiveRoot8Part0Segment\'+(\'03\' if i < 3 else \'04\')\n if units[name][\'module\'] != expected_module: raise ValueError(\'forced Root8 module mismatch \'+name)\n scheduled = set(); global_queue = []; order_evidence = []\n remaining = set(names)\n def key(n):\n u = units[n]; added = set(u[\'closure\'])-scheduled\n return (len(added),sum(src.records[src.modules[m]][\'bytes\'] for m in added),u[\'path\'],u[\'line\'],n)\n for name in forced:\n k = key(name); global_queue.append(name); order_evidence.append({\'id\':name,\'forced\':True,\'selection_key\':list(k)})\n scheduled.update(units[name][\'closure\']); remaining.remove(name)\n while remaining:\n name = min(remaining,key=key); k = key(name)\n global_queue.append(name); order_evidence.append({\'id\':name,\'forced\':False,\'selection_key\':list(k)})\n scheduled.update(units[name][\'closure\']); remaining.remove(name)\n branch_queue = [n for n in global_queue if units[n][\'branch\'] == \'B\']\n if len(branch_queue) != 31 or branch_queue[0] != stress: raise ValueError(\'branch ownership/order invalid\')\n if branch_queue[1:7] != [NS+f\'root7Node0Step1Chunk7_{j}_checked\' for j in range(6)]: raise ValueError(\'warm Root7 order invalid\')\n branch_roots = set(r for n in branch_queue for r in units[n][\'roots\'])\n closure_modules = set(m for n in branch_queue for m in units[n][\'closure\'])\n closure_paths = set(src.modules[m] for m in closure_modules)\n manifest = {\'schema\':\'imd-lean-capacity/manifest/v1\',\'branch\':\'B\',\n \'source\':{\'commit\':COMMIT,\'tree\':TREE,\'authentication\':\'Every inspected working file compared directly with bytes from pinned Git blob via git cat-file --batch.\'},\n \'global_backlog\':{\'units\':87,\'chunks\':85,\'replacements\':2,**support_counts,\'unique_unit_support_roots\':555},\n \'queue_rule\':\'Construct entire canonical schedule against union of earlier SCHEDULED closures, then retain Branch B ownership. Failed entries still remain scheduled.\',\n \'global_queue\':global_queue,\'global_selection_evidence\':order_evidence,\'queue\':branch_queue,\n \'units\':{n:units[n] for n in branch_queue},\'roots\':{n:roots[n] for n in sorted(branch_roots)},\n \'branch_totals\':{\'units\':len(branch_queue),\'chunks\':30,\'replacements\':1,\'roots\':len(branch_roots),\n \'slices\':sum(roots[n][\'role\']==\'slice\' for n in branch_roots),\n \'row_bindings\':sum(roots[n][\'role\']==\'row_binding\' for n in branch_roots),\'local_modules\':len(closure_modules),\n \'source_bytes\':sum(src.records[p][\'bytes\'] for p in closure_paths)},\n \'modules\':{m:{**src.records[src.modules[m]],\'imports\':src.imports(m)} for m in sorted(closure_modules)},\n \'source_inspection_records\':{p:src.records[p] for p in sorted(src.records)},\n \'external_toolchain_imports\':sorted(src.external),\n \'parser_notes\':[\'Nested block and line comments blanked with source offsets retained.\',\n \'Imports include public/meta modifiers and import all.\',\n \'Root types extracted from actual published declarations; unsupported parameterized roots reject.\',\n \'Chunk flatten scope, exact row binding, slice order and domain pair checked before scheduling.\',\n \'Source structural validation does not constitute proof verification.\']}\n return manifest\n\ndef main():\n ap = argparse.ArgumentParser(); ap.add_argument(\'--repo\',default=\'.\'); ap.add_argument(\'--output\',required=True)\n args = ap.parse_args(); result = make_manifest(args.repo)\n pathlib.Path(args.output).write_text(json.dumps(result,indent=2,sort_keys=True)+\'\\n\')\n print(json.dumps(result[\'branch_totals\'],sort_keys=True))\n\nif __name__ == \'__main__\': main()\n', 'runner.py': '#!/usr/bin/env python3\nimport sys, pathlib, json, hashlib, subprocess, time, os, concurrent.futures, re, signal, datetime, threading, argparse\nfrom b_manifest import Source, strip_comments\nFLAGS=[\'-j1\',\'-DElab.async=false\']; ALLOWED={\'propext\',\'Quot.sound\',\'Classical.choice\'}\nARCHIVE_SHA=\'b67d0e0ba959fc74e186f1b44aebca32d6ecb6a28f8e9a029fc4e9f73398a049\'\nEXPECTED_BINARIES={\'lean\':\'bf8d54e4714cc4b03d3f6bb34c83b7202b87e49c8bfcbff6895c085bb90ceb38\',\'lake\':\'8ba83c98f76562d03b8dbc33f1057151ba6cbb121679dde76b2260ccc90495e1\',\'leanexport\':\'c5bc1a10a21e22cbb3671d65987cdef2076833b14182d823ccb2153adf2fa954\',\'leanchecker\':\'9e36e955a251b1313c8eb5b7fa101282d51df109d34d8bb7c1cfdf51985aba29\',\'nanoda_bin\':\'8241c5e6baa29490aa118d382f97961b208ae730fdb96545c2abed74c9ece5a8\',\'con-ron\':\'4e5616d94374cae37324dad2594f6230c2bb2297240249fc78ff508f3bc5acef\'}\ndef sha(p):\n h=hashlib.sha256()\n with pathlib.Path(p).open(\'rb\') as f:\n for block in iter(lambda:f.read(1024*1024),b\'\'): h.update(block)\n return h.hexdigest()\ndef save(p,obj):\n p=pathlib.Path(p); tmp=p.with_name(p.name+\'.tmp\'); tmp.write_text(json.dumps(obj,indent=2)+\'\\n\'); tmp.replace(p)\nrecord_lock=threading.Lock()\ndef configure(repo,base,deadline,resume=False):\n global REPO,BASE,EVID,WORK,TC,BUILD,ENV,records,cache,source,binhashes,DEADLINE\n REPO=pathlib.Path(repo).resolve(); BASE=pathlib.Path(base).resolve(); EVID=BASE/\'evidence\'; WORK=BASE/\'work\'\n TC=WORK/\'lean-4.35.0-rc2-linux\'; BUILD=WORK/\'build\'; DEADLINE=deadline\n for p in [BUILD,EVID/\'logs\',EVID/\'audits\']: p.mkdir(parents=True,exist_ok=True)\n ENV={\'PATH\':str(TC/\'bin\')+\':/usr/bin:/bin\',\'LANG\':\'C.UTF-8\',\'LEAN_PATH\':str(BUILD)}\n records=json.loads((EVID/\'processes.json\').read_text()) if resume and (EVID/\'processes.json\').exists() else []\n cache=json.loads((EVID/\'cache.json\').read_text()) if resume and (EVID/\'cache.json\').exists() else {}\n source=Source(REPO)\n for p in [\'lean-toolchain\',\'lakefile.lean\',\'lake-manifest.json\']: source.read(p)\n if source.read(\'lean-toolchain\').strip()!=\'leanprover/lean4:v4.35.0-rc2\': raise ValueError(\'toolchain pin mismatch\')\n if [p[\'rev\'] for p in json.loads(source.read(\'lake-manifest.json\'))[\'packages\'] if p[\'name\']==\'mathlib\']!=[\'065356127b1dc0016f66b7283ce0ce2c4055aa55\']: raise ValueError(\'mathlib pin mismatch\')\n if sha(WORK/\'lean.tar.zst\')!=ARCHIVE_SHA: raise ValueError(\'toolchain archive hash mismatch\')\n binhashes={p:sha(TC/\'bin\'/p) for p in EXPECTED_BINARIES if (TC/\'bin\'/p).is_file()}\n if \'lean\' not in binhashes or any(EXPECTED_BINARIES[p]!=h for p,h in binhashes.items()): raise ValueError(\'binary differs from authenticated release\')\n version=subprocess.check_output([str(TC/\'bin/lean\'),\'--version\'],text=True).strip()\n if \'version 4.35.0-rc2,\' not in version or \'commit 11acb17ec6b07a8f9e9173e6845197929540936b\' not in version: raise ValueError(\'Lean version/commit mismatch\')\n save(EVID/\'toolchain.json\',{\'version\':version,\'archive_sha256\':ARCHIVE_SHA,\'binary_sha256\':binhashes,\'flags\':FLAGS,\'authentication\':\'Official GitHub HTTPS release asset digest and fresh authenticated archive extraction; no LEAN_HOME override.\'})\ndef run(cmd, log, timeout=None, stdout=None):\n t=time.monotonic(); wall=time.time(); budget=DEADLINE-t\n timeout=max(0,min(budget,timeout or budget)); timedout=False; rc=None; reason=None\n cmd=[str(x) for x in cmd]\n log=pathlib.Path(log)\n with log.open(\'wb\') as f:\n out=f if stdout is None else open(stdout,\'wb\')\n if timeout<1: timedout=True; reason=\'safe remaining budget exhausted before launch\'\n else:\n try:\n p=subprocess.Popen(cmd,env=ENV,cwd=REPO,stdout=out,stderr=f,start_new_session=True)\n try: rc=p.wait(timeout=timeout)\n except subprocess.TimeoutExpired:\n timedout=True; os.killpg(p.pid,signal.SIGTERM)\n try: rc=p.wait(timeout=5)\n except subprocess.TimeoutExpired: os.killpg(p.pid,signal.SIGKILL); rc=p.wait()\n except OSError as err: reason=str(err); f.write(str(err).encode())\n if stdout is not None: out.close()\n status=\'INCONCLUSIVE\' if timedout or (rc is not None and rc<0) or rc==137 else (\'PASS\' if rc==0 else \'FAIL\')\n if rc is None and not timedout: status=\'BLOCKED\'\n diagnostic=log.read_text(errors=\'replace\')\n if status==\'FAIL\' and re.search(r\'error while loading shared libraries|cannot open shared object|unknown module prefix|object file .* does not exist|failed to open|No such file|failed to load|invalid.*config|[Uu]nknown constant\',diagnostic): status=\'BLOCKED\'\n rec={\'command\':cmd,\'cwd\':\'.\',\'env\':dict(ENV),\'exit\':rc,\'signal\':-rc if rc is not None and rc<0 else None,\'timed_out\':timedout,\'timeout_seconds\':timeout,\'wall_seconds\':time.monotonic()-t,\'started_utc\':datetime.datetime.fromtimestamp(wall,datetime.timezone.utc).isoformat(),\'status\':status,\'log\':str(log.relative_to(EVID)),\'log_sha256\':sha(log)}\n if reason: rec[\'reason\']=reason\n with record_lock: records.append(rec); save(EVID/\'processes.json\',records)\n return rec\n\ndef validate_sources(modules):\n banned=r\'\\b(sorry|sorryAx|admit|native_decide|axiom|unsafe|run_cmd|run_elab|elab|macro|initialize|builtin_initialize|implemented_by|extern|ofReduceBool|ofReduceNat)\\b|debug\\.skipKernelTC|trustLevel|decide\\s*\\+\\s*native\'\n for m in modules:\n clean=strip_comments(source.read(source.modules[m]))\n # Strings are data; source scanner is conservative about kernel-bypass syntax.\n clean=re.sub(r\'"(?:\\\\.|[^"\\\\])*"\',\'""\',clean)\n found=re.search(banned,clean)\n if found: raise ValueError(\'source bypass candidate \'+m+\': \'+found.group())\n save(EVID/\'source-records.json\',list(source.records.values()))\n previous=json.loads((EVID/\'source-policy.json\').read_text()) if (EVID/\'source-policy.json\').exists() else {\'modules\':[]}\n save(EVID/\'source-policy.json\',{\'status\':\'PASS\',\'kind\':\'source screening, not proof verification\',\'modules\':sorted(set(previous[\'modules\'])|set(modules)),\'rejected_active_pattern\':banned,\'matches\':[],\'scope\':\'Only project closure source; authenticated toolchain core is trusted. Comments and strings excluded. Compile flags fixed; no trust or plugin overrides.\'})\n\ndef outputs(m):\n base=BUILD/m.replace(\'.\',\'/\')\n return {str(p.relative_to(BUILD)):sha(p) for p in base.parent.glob(base.name+\'.*\') if p.is_file()}\n\ndef cache_valid(m,done):\n c=cache.get(m,{})\n if not isinstance(c,dict) or not isinstance(c.get(\'outputs\'),dict) or not isinstance(c.get(\'process\'),dict): return False\n base=BUILD/m.replace(\'.\',\'/\')\n expected_command=[str(TC/\'bin/lean\'),\'-R\',str(REPO/\'src\'),\'-o\',str(base)+\'.olean\',\'-i\',str(base)+\'.ilean\',*FLAGS,str(REPO/source.modules[m])]\n local_imports={d for d in source.imports(m) if d in source.modules}\n expected_imports={d:cache[d][\'outputs\'] for d in source.imports(m) if d in done}\n required=m.replace(\'.\',\'/\')+\'.olean\'\n process=c.get(\'process\',{})\n stem=m.replace(\'.\',\'/\')\n allowed_outputs={stem+s for s in [\'.olean\',\'.ilean\',\'.olean.private\',\'.olean.server\',\'.ir\',\'.ir.sig\']}\n return bool(c and required in c.get(\'outputs\',{}) and set(c[\'outputs\'])<=allowed_outputs and process.get(\'log\')==\'logs/compile.\'+m+\'.log\' and process.get(\'status\')==\'PASS\' and process.get(\'exit\')==0 and process.get(\'module\')==m and process.get(\'command\')==expected_command and (EVID/process[\'log\']).is_file() and sha(EVID/process[\'log\'])==process.get(\'log_sha256\') and local_imports<=done and c.get(\'source_sha256\')==sha(REPO/source.modules[m])==source.records[source.modules[m]][\'sha256\'] and c.get(\'lean_sha256\')==binhashes[\'lean\'] and c.get(\'flags\')==FLAGS and c.get(\'toolchain_archive_sha256\')==ARCHIVE_SHA and c.get(\'imports\')==expected_imports and all((BUILD/p).is_file() and sha(BUILD/p)==h for p,h in c[\'outputs\'].items()))\n\ndef compile_one(m):\n p=REPO/source.modules[m]; expected=source.records[source.modules[m]][\'sha256\']\n if sha(p)!=expected: raise ValueError(\'source changed before compile \'+m)\n base=BUILD/m.replace(\'.\',\'/\'); base.parent.mkdir(parents=True,exist_ok=True)\n cmd=[str(TC/\'bin/lean\'),\'-R\',str(REPO/\'src\'),\'-o\',str(base)+\'.olean\',\'-i\',str(base)+\'.ilean\',*FLAGS,str(p)]\n rec=run(cmd,EVID/\'logs\'/(\'compile.\'+m+\'.log\'))\n if sha(p)!=expected: raise ValueError(\'source changed during compile \'+m)\n text=(EVID/rec[\'log\']).read_text(errors=\'replace\')\n if rec[\'status\']==\'PASS\' and re.search(r\'\\bdeclaration uses .sorry.|(^|\\n).*error:\',text): rec[\'status\']=\'FAIL\';rec[\'reason\']=\'Lean diagnostics\'\n rec[\'module\']=m\n if rec[\'status\']==\'PASS\':\n rec[\'outputs\']=outputs(m)\n if m.replace(\'.\',\'/\')+\'.olean\' not in rec[\'outputs\']: rec[\'status\']=\'FAIL\';rec[\'reason\']=\'missing output\'\n return m,rec\n\ndef compile_closure(target):\n started=time.monotonic()\n closure=source.closure(target); validate_sources(closure)\n todo=set(closure); done=set(); failed={}; running={}\n for m in closure:\n if cache_valid(m,done): done.add(m)\n reused=sorted(done)\n print(\'CLOSURE\',target,len(closure),\'cached\',len(done),flush=True)\n with concurrent.futures.ThreadPoolExecutor(max_workers=2) as pool:\n while todo-done-set(failed):\n for m in closure:\n if len(running)>=2: break\n if m in done or m in failed or m in running: continue\n deps=set(source.imports(m))&todo\n if deps&set(failed): failed[m]={\'status\':\'BLOCKED\',\'reason\':\'failed dependency\',\'dependencies\':sorted(deps&set(failed))}; continue\n if deps<=done and time.monotonic()=DEADLINE else \'BLOCKED\')\n result={\'status\':status,\'target\':target,\'closure\':closure,\'failed\':failed,\'completed_modules\':len(done),\'cache_reused\':reused,\'newly_built\':sorted(done-set(reused)),\'wall_seconds\':time.monotonic()-started}\n save(EVID/(\'compile-\'+target+\'.json\'),result)\n with record_lock: save(EVID/\'processes.json\',records)\n return result\n\ndef audit(roots,label):\n lines=[\'import \'+m for m in sorted({r[\'module\'] for r in roots})]+[\'import Lean\',\'set_option autoImplicit false\',\'set_option maxRecDepth 100000\',\'set_option maxHeartbeats 10000000\',\'namespace SpectreFinite.HexSearch.RadiusFive\',\'open SpectreFinite.FiniteTable\',\'open HigherFastChecking\']\n for i,r in enumerate(roots):\n lines += [f\'theorem imd_expected_{i} : {r["type"]} := {r["name"]}\',f\'#print axioms {r["name"]}\']\n lines+=[\'open Lean Elab Command in\',\'run_cmd do\',\' let env ← getEnv\',\' let allowed : List Name := [``propext, ``Quot.sound, ``Classical.choice]\']\n for i,r in enumerate(roots):\n lines += [f\' let n := ``{r["name"]}\', \' let some ci := env.find? n | throwError "IMD missing root"\', \' unless ci matches .thmInfo _ do throwError "IMD root is not theorem"\',f\' let some ei := env.find? ``imd_expected_{i} | throwError "IMD missing expected"\',\' unless ci.type == ei.type do throwError "IMD exact type differs"\',\' let axs ← liftCoreM (Lean.collectAxioms n)\',\' unless axs.all (fun a => allowed.contains a) do throwError "IMD disallowed axiom {axs}"\',\' logInfo ("IMD_ROOT " ++ (Json.mkObj [("name", toJson n.toString), ("type", toJson "PASS"), ("axioms", toJson (axs.map Name.toString)), ("theorem", toJson true)]).compress)\']\n lines+=[\'end SpectreFinite.HexSearch.RadiusFive\']\n path=EVID/\'audits\'/(label+\'.lean\'); path.write_text(\'\\n\'.join(lines)+\'\\n\')\n rec=run([str(TC/\'bin/lean\'),*FLAGS,str(path)],EVID/\'logs\'/(\'audit.\'+label+\'.log\'))\n found=[]\n for line in (EVID/rec[\'log\']).read_text().splitlines():\n if line.startswith(\'IMD_ROOT \'):\n try:\n obj=json.loads(line[len(\'IMD_ROOT \'):])\n if not isinstance(obj,dict) or set(obj)!={\'name\',\'type\',\'axioms\',\'theorem\'} or not isinstance(obj[\'name\'],str) or not isinstance(obj[\'axioms\'],list) or not all(isinstance(a,str) for a in obj[\'axioms\']): raise ValueError(\'invalid evidence shape\')\n found.append(obj)\n except (ValueError,TypeError):\n if rec[\'status\']==\'PASS\': rec[\'status\']=\'FAIL\'\n rec[\'reason\']=\'malformed per-root evidence\'\n if rec[\'status\']==\'PASS\':\n if [r[\'name\'] for r in found]!=[r[\'name\'] for r in roots] or any(set(r[\'axioms\'])-ALLOWED or r[\'type\']!=\'PASS\' or r[\'theorem\'] is not True for r in found): rec[\'status\']=\'FAIL\';rec[\'reason\']=\'missing/duplicate/invalid per-root evidence\'\n rec[\'roots\']=found; rec[\'audit_source_sha256\']=sha(path); save(EVID/(\'audit-\'+label+\'.json\'),rec)\n with record_lock: save(EVID/\'processes.json\',records)\n return rec\n\ndef controls(stress_root):\n controls=[]\n false_path=EVID/\'audits\'/\'control-false-type.lean\'\n false_path.write_text(\'import \'+stress_root[\'module\']+\'\\nset_option autoImplicit false\\nnamespace SpectreFinite.HexSearch.RadiusFive\\nopen SpectreFinite.FiniteTable\\nopen HigherFastChecking\\nexample : \'+stress_root[\'type\'].removesuffix(\'true\')+\'false := \'+stress_root[\'name\']+\'\\nend SpectreFinite.HexSearch.RadiusFive\\n\')\n rec=run([str(TC/\'bin/lean\'),*FLAGS,str(false_path)],EVID/\'logs\'/\'control-false-type.log\')\n rec[\'control\']=\'false expected type\'; rec[\'source_sha256\']=sha(false_path)\n rec[\'expected_rejection_observed\']=rec[\'exit\'] not in (0,None) and bool(re.search(r\'[Tt]ype mismatch\', (EVID/rec[\'log\']).read_text()))\n controls.append(rec)\n ax_path=EVID/\'audits\'/\'control-disallowed-axiom.lean\'\n ax_path.write_text(\'\'\'import Lean\nset_option autoImplicit false\naxiom IMDControlDisallowedAxiom : True\ntheorem IMDControlUsesDisallowedAxiom : True := IMDControlDisallowedAxiom\nopen Lean Elab Command in\nrun_cmd do\n let axs ← liftCoreM (Lean.collectAxioms ``IMDControlUsesDisallowedAxiom)\n logInfo ("IMD_CONTROL_AXIOMS " ++ (toJson (axs.map Name.toString)).compress)\n let allowed : List Name := [``propext, ``Quot.sound, ``Classical.choice]\n unless axs.all (fun a => allowed.contains a) do throwError "IMD disallowed axiom {axs}"\n\'\'\')\n rec=run([str(TC/\'bin/lean\'),*FLAGS,str(ax_path)],EVID/\'logs\'/\'control-disallowed-axiom.log\')\n rec[\'control\']=\'disallowed axiom\'; rec[\'source_sha256\']=sha(ax_path)\n log=(EVID/rec[\'log\']).read_text()\n rec[\'expected_rejection_observed\']=rec[\'exit\'] not in (0,None) and \'IMD disallowed axiom\' in log and \'IMD_CONTROL_AXIOMS ["IMDControlDisallowedAxiom"]\' in log\n controls.append(rec); save(EVID/\'controls.json\',controls)\n with record_lock: save(EVID/\'processes.json\',records)\n return controls\n', 'batch.py': '#!/usr/bin/env python3\n"""Branch B ordered small-cohort execution; evidence reconciliation never reruns proofs."""\nimport json, pathlib, time, math, sys\nimport runner as R\nSTAGES=[\'compile\',\'type\',\'axioms\',\'export\',\'lean_replay\',\'nanoda\',\'con_ron\']\n\ndef initialize(manifest):\n return {n:{\'id\':n,\'module\':manifest[\'units\'][n][\'module\'],\'published_type\':manifest[\'roots\'][n][\'type\'],\n \'roots\':manifest[\'units\'][n][\'roots\'],\'stages\':{s:\'NOT_RUN\' for s in STAGES},\'evidence\':{}} for n in manifest[\'queue\']}\n\ndef checkpoint(state):\n state[\'tier_totals\']={s:sum(u[\'stages\'][s]==\'PASS\' for u in state[\'units\'].values()) for s in STAGES}\n state[\'remaining_ids\']=[n for n in state[\'queue\'] if any(state[\'units\'][n][\'stages\'][s]!=\'PASS\' for s in [\'compile\',\'type\',\'axioms\'])]\n state[\'remaining_ids_by_tier\']={s:[n for n in state[\'queue\'] if state[\'units\'][n][\'stages\'][s]!=\'PASS\'] for s in STAGES}\n R.save(R.EVID/\'branch-state.json\',state)\n\ndef complete_audit(state,ids,compile_result,audit_result,label):\n for n in ids:\n u=state[\'units\'][n]; u[\'stages\'][\'compile\']=compile_result[\'status\']\n u[\'evidence\'][\'compile\']=\'compile-\'+u[\'module\']+\'.json\'\n for phase in [\'type\',\'axioms\']:\n u[\'stages\'][phase]=audit_result[\'status\'] if audit_result else \'BLOCKED\'\n if audit_result: u[\'evidence\'][phase]=\'audit-\'+label+\'.json\'\n if audit_result:\n actual={r[\'name\']:r for r in audit_result[\'roots\']}\n u[\'root_results\']={r:actual[r] for r in u[\'roots\'] if r in actual}\n if not audit_result or audit_result[\'status\']!=\'PASS\':\n for s in STAGES[3:]: u[\'stages\'][s]=\'BLOCKED\'\n checkpoint(state)\n\ndef cohorts(manifest,queue):\n out=[]\n for n in queue:\n if out and len(out[-1])<3 and manifest[\'units\'][out[-1][0]][\'module\']==manifest[\'units\'][n][\'module\']: out[-1].append(n)\n else: out.append([n])\n return out\n\ndef execute(manifest, first=None, checker=None):\n state={\'schema\':\'imd-lean-capacity/v1\',\'experiment\':\'A847-LEAN-CAPACITY-32549b50e95c\',\'branch\':\'B\',\n \'source\':manifest[\'source\'],\'queue\':manifest[\'queue\'],\'units\':initialize(manifest),\'cohorts\':[],\n \'stop_reason\':\'running\',\'controls\':[],\'scope\':\'31 assigned complete units; supporting roots never counted as extra units.\'}\n checkpoint(state); queue=list(manifest[\'queue\']); completed_first=False\n if first:\n n=queue.pop(0)\n if first[\'id\']!=n: raise ValueError(\'first-unit receipt violates canonical queue\')\n complete_audit(state,[n],first[\'compile\'],first.get(\'audit\'),\'stress\')\n if first.get(\'audit\',{}).get(\'status\')==\'PASS\':\n expected=manifest[\'roots\'][n][\'type\']\n if \'\'.join(expected.split())!=\'checkReplacementtable36root7Node110Domains0root7Node110Domains1=true\': raise ValueError(\'initial audit expected type does not match regenerated source\')\n completed_first=True\n state[\'controls\']=R.controls(manifest[\'roots\'][n]); checkpoint(state)\n if checker: checker(state,manifest,[n],\'stress\',len(cohorts(manifest,queue))+1)\n groups=cohorts(manifest,queue)\n for index,ids in enumerate(groups):\n if R.DEADLINE-time.monotonic()<30:\n state[\'stop_reason\']=\'insufficient safe assigned budget; packaging reserve retained\'; break\n label=\'cohort-\'+str(index+1).zfill(2)\n m=manifest[\'units\'][ids[0]][\'module\']; cr=R.compile_closure(m); ar=None\n if cr[\'status\']==\'PASS\':\n names=list(dict.fromkeys(r for n in ids for r in manifest[\'units\'][n][\'roots\']))\n ar=R.audit([manifest[\'roots\'][r] for r in names],label)\n complete_audit(state,ids,cr,ar,label)\n state[\'cohorts\'].append({\'label\':label,\'units\':ids,\'module\':m,\'audit_roots\':list(dict.fromkeys(r for n in ids for r in manifest[\'units\'][n][\'roots\']))})\n if ar and ar[\'status\']==\'PASS\':\n if not completed_first:\n completed_first=True; state[\'controls\']=R.controls(manifest[\'roots\'][ids[0]]); checkpoint(state)\n if checker: checker(state,manifest,ids,label,len(groups)-index)\n print(\'COHORT\',label,len(ids),\'compile\',cr[\'status\'],\'audit\',ar[\'status\'] if ar else \'BLOCKED\',flush=True)\n checkpoint(state)\n else: state[\'stop_reason\']=\'assigned canonical queue exhausted\'\n checkpoint(state); return state\n', 'checkers.py': '#!/usr/bin/env python3\n"""Small source-bound cohort exports/replays. Never runs comparator or builds tools."""\nimport gzip, hashlib, json, pathlib, re, shutil, time\nimport runner as R\nfrom batch import checkpoint\n\nSTAGES={\'lean_replay\':\'leanchecker\',\'nanoda\':\'nanoda_bin\',\'con_ron\':\'con-ron\'}\nREFERENCE_COMMIT=\'d4e41c1d5b0d114c4859e6e5831dc6d3ad1d0d44\'\nMAX_GZIP_BYTES=48*1024*1024 # Reserve artifact space for source, audit and logs.\n\ndef references():\n ref=R.EVID/\'reference\'; ref.mkdir(exist_ok=True)\n src=R.TC/\'src/lean/lake/Lake/CLI/Check.lean\'\n data=src.read_bytes(); copy=ref/\'Lake.CLI.Check.lean\'\n if copy.exists() and copy.read_bytes()!=data: raise ValueError(\'bundled Check source changed\')\n copy.write_bytes(data)\n clean=R.strip_comments(data.decode())\n match=re.search(r\'^def primitiveTargets[^\\n]*\\n(.*?)^def \',clean,re.M|re.S)\n literal=re.fullmatch(r\'\\s*return\\s*#\\[([^\\[\\]]*)\\]\\s*\',match.group(1)) if match else None\n if not literal: raise ValueError(\'unrecognized primitiveTargets source shape\')\n names=[]\n for item in literal.group(1).split(\',\'):\n item=item.strip()\n if not item: continue\n m=re.fullmatch(r\'``([A-Za-z_][A-Za-z0-9_\\\'.]*)\',item)\n if not m: raise ValueError(\'unrecognized primitiveTargets item\')\n names.append(m.group(1))\n if not names or len(names)!=len(set(names)): raise ValueError(\'invalid primitiveTargets\')\n entries=[]\n for name in [\'verify_submission.py\',\'comparator-declaration-closure.md\']:\n path=ref/name\n if path.is_file():\n remote=(\'scripts/\' if name.endswith(\'.py\') else \'docs/\')+name\n entries.append({\'path\':\'reference/\'+name,\'sha256\':R.sha(path),\'url\':\'https://raw.githubusercontent.com/PalomarRegistry/PalomarSubmission/\'+REFERENCE_COMMIT+\'/\'+remote,\'authentication\':\'HTTPS pinned commit source, consulted as reference data only\'})\n R.save(ref/\'index.json\',{\'palomar_commit\':REFERENCE_COMMIT,\'files\':entries,\'matching_check_source\':{\'path\':\'reference/Lake.CLI.Check.lean\',\'sha256\':R.sha(copy),\'authentication\':\'source from authenticated official toolchain archive \'+R.ARCHIVE_SHA},\'primitive_targets\':names})\n validate_nanoda_template(clean,copy)\n return names\n\ndef validate_nanoda_template(clean,source):\n match=re.search(r\'configHandle\\.putStr\\s*<\\|\\s*Lean\\.Json\\.compress\\s*<\\|\\s*Lean\\.Json\\.mkObj\\s*\\[(.*?)\\]\\s*configHandle\\.flush\',clean,re.S)\n if not match: raise ValueError(\'matching source NanoDa config literal not found\')\n fields={};bindings={}\n for line in match.group(1).splitlines():\n line=line.strip()\n if not line: continue\n field=re.fullmatch(r\'\\("([a-z_]+)",\\s*(.*?)\\),?\',line)\n if not field or field.group(1) in fields: raise ValueError(\'unrecognized/duplicate NanoDa config field\')\n key,expression=field.groups()\n if expression in [\'true\',\'false\']: value=expression==\'true\'\n elif re.fullmatch(r\'[0-9]+\',expression): value=int(expression)\n elif key==\'export_file_path\' and expression==\'solutionPath.toString\': value=\'\';bindings[key]=expression\n elif key==\'permitted_axioms\' and expression==\'.arr <| legalAxioms.map (.str ∘ Lean.Name.toString)\': value=[\'propext\',\'Quot.sound\',\'Classical.choice\'];bindings[key]=expression\n else: raise ValueError(\'unsupported NanoDa config expression \'+expression)\n fields[key]=value\n generated=nanoda_config(pathlib.Path(\'\'))\n if generated!=fields: raise ValueError(\'NanoDa template disagrees with matching active source\')\n R.save(R.EVID/\'reference/nanoda-template-validation.json\',{\'status\':\'PASS\',\'kind\':\'source-template comparison only; not proof verification\',\'source\':\'reference/Lake.CLI.Check.lean\',\'source_sha256\':R.sha(source),\'extracted_fields\':fields,\'dynamic_bindings\':bindings,\'generated_fields\':generated,\'strict_axiom_note\':\'unpermitted_axiom_hard_error:false never waives the strict per-root axiom audit.\'})\n\ndef bound_run(cmd,log,timeout,stdout=None):\n # leanexport discovers sysroot by executing lean; bind that lookup to the same bundle.\n previous=R.ENV\n R.ENV={**previous,\'PATH\':str(R.TC/\'bin\')+\':/usr/bin:/bin\',\'LEAN_ABORT_ON_PANIC\':\'1\'}\n try:\n result=R.run(cmd,log,timeout=timeout,stdout=stdout)\n text=pathlib.Path(log).read_text(errors=\'replace\')\n if result[\'status\']==\'FAIL\' and (re.search(r\'Level not found|back-reference mismatch|Declined:\',text) or pathlib.Path(cmd[0]).name==\'con-ron\' and result[\'exit\'] in [2,3]):\n result[\'original_status\']=result[\'status\'];result[\'status\']=\'BLOCKED\';result[\'reason\']=\'checker declined input or failed to load prerequisites; not a mathematical disproof\'\n result[\'env\'].update({\'PATH\':R.ENV[\'PATH\'],\'LEAN_ABORT_ON_PANIC\':\'1\'})\n result[\'child_lean_sha256\']=R.binhashes.get(\'lean\')\n R.save(R.EVID/\'processes.json\',R.records)\n return result\n finally: R.ENV=previous\n\ndef export_structure(path,roots):\n """Streaming structural prerequisite only; this is not a proof checker."""\n names={0:\'\'}; declared=set(); used=set(); axioms=[]; kind={}; count=0; meta=False\n with path.open(\'rb\') as stream:\n for raw in stream:\n count+=1; item=json.loads(raw)\n if not isinstance(item,dict): raise ValueError(\'non-object export line\')\n if \'meta\' in item: meta=True\n if \'in\' in item:\n idx=item[\'in\']; value=item.get(\'str\',item.get(\'num\'))\n if not isinstance(value,dict) or value[\'pre\'] not in names: raise ValueError(\'invalid name reference\')\n suffix=str(value.get(\'str\',value.get(\'i\')))\n names[idx]=(names[value[\'pre\']]+\'.\' if names[value[\'pre\']] else \'\')+suffix\n if \'const\' in item: used.add(names[item[\'const\'][\'name\']])\n for tag in [\'axiom\',\'def\',\'thm\',\'opaque\',\'quot\']:\n if tag in item:\n value=item[tag]; name=names[value[\'name\']]\n if name in declared: raise ValueError(\'duplicate declaration \'+name)\n declared.add(name); kind[name]=tag\n if value.get(\'isUnsafe\') or value.get(\'safety\')==\'unsafe\': raise ValueError(\'unsafe exported declaration \'+name)\n if tag==\'axiom\': axioms.append(name)\n if \'inductive\' in item:\n for group in [\'types\',\'ctors\',\'recs\']:\n for value in item[\'inductive\'][group]:\n name=names[value[\'name\']]\n if name in declared: raise ValueError(\'duplicate declaration \'+name)\n declared.add(name); kind[name]=group\n if value.get(\'isUnsafe\'): raise ValueError(\'unsafe exported declaration \'+name)\n missing=sorted(set(roots)-declared); dependencies=sorted(used-declared)\n bad_axioms=sorted(set(axioms)-R.ALLOWED)\n if not meta or missing or dependencies or bad_axioms: raise ValueError(\'incomplete/disallowed export: \'+json.dumps({\'metadata\':meta,\'missing_roots\':missing,\'missing_dependencies\':dependencies,\'disallowed_axioms\':bad_axioms}))\n return {\'status\':\'PASS\',\'meaning\':\'structural coverage only; not proof validation\',\'lines\':count,\'declaration_count\':len(declared),\'axioms\':sorted(axioms),\'root_kinds\':{n:kind[n] for n in roots},\'missing_dependencies\':dependencies}\n\ndef retain_export(raw,label,ids,roots):\n folder=R.EVID/\'exports\'; folder.mkdir(exist_ok=True); index=folder/\'index.json\'\n entries=json.loads(index.read_text()) if index.exists() else []\n digest=R.sha(raw); prior=next((e for e in entries if e[\'raw_sha256\']==digest and e.get(\'delivered\')),None)\n record={\'label\':label,\'units\':ids,\'roots\':roots,\'raw_sha256\':digest,\'raw_bytes\':raw.stat().st_size}\n if prior:\n record.update({k:prior[k] for k in [\'gzip_path\',\'gzip_sha256\',\'gzip_bytes\']});record[\'deduplicated_with\']=prior[\'label\'];record[\'delivered\']=True\n else:\n output=folder/(label+\'.ndjson.gz\'); t=time.monotonic()\n with raw.open(\'rb\') as source, output.open(\'wb\') as target:\n with gzip.GzipFile(filename=\'\',mode=\'wb\',fileobj=target,compresslevel=6,mtime=0) as archive:\n shutil.copyfileobj(source,archive,1024*1024)\n size=output.stat().st_size\n existing=sum(p.stat().st_size for p in folder.glob(\'*.gz\') if p!=output)\n record.update({\'gzip_path\':str(output.relative_to(R.EVID)),\'gzip_sha256\':R.sha(output),\'gzip_bytes\':size,\'compression_wall_seconds\':time.monotonic()-t,\'delivered\':existing+size<=MAX_GZIP_BYTES})\n if not record[\'delivered\']:\n output.unlink();record[\'delivery_reason\']=\'earliest complete exports retained; aggregate compressed export allowance exhausted\'\n entries.append(record);R.save(index,entries);return record\n\ndef stage_record(state,ids,label,stage,record):\n filename=label+\'-\'+stage+\'.json\'; R.save(R.EVID/filename,record)\n for name in ids:\n state[\'units\'][name][\'stages\'][stage]=record[\'status\']\n state[\'units\'][name][\'evidence\'][stage]=filename\n checkpoint(state)\n\ndef incomplete_control(state,stage,source_raw,roots,timeout):\n """Remove a genuine axiom declaration but preserve its name/expressions."""\n folder=R.EVID/\'controls\';folder.mkdir(exist_ok=True)\n marker=folder/(\'incomplete-\'+stage+\'.json\')\n if marker.exists(): return\n raw=folder/(\'incomplete-export-\'+stage+\'.ndjson\'); removed=None\n # Small self-contained incomplete fragment: actual source metadata + one actual\n # constant expression referring to an omitted declaration. No fabricated proof.\n with source_raw.open(\'rb\') as source, raw.open(\'wb\') as target:\n for line in source:\n obj=json.loads(line)\n if \'meta\' in obj or \'in\' in obj: target.write(line)\n if \'const\' in obj:\n target.write(line); removed={\'constant_name_index\':obj[\'const\'][\'name\'],\'omitted\':\'all declaration records; original actual constant expression retained\'}; break\n if not removed: R.save(marker,{\'status\':\'BLOCKED\',\'reason\':\'could not form incomplete dependency fixture\'});return\n tool=STAGES[stage]; config=None\n if stage==\'nanoda\':\n config=folder/\'incomplete-nanoda.config.json\';R.save(config,nanoda_config(raw));cmd=[R.TC/\'bin\'/tool,config]\n elif stage==\'lean_replay\': cmd=[R.TC/\'bin\'/tool,\'--silent\',\'--from-export\',raw]\n else: cmd=[R.TC/\'bin\'/tool,\'--jobs=2\',raw]\n process=bound_run(cmd,R.EVID/\'logs\'/(\'control-incomplete-\'+stage+\'.log\'),timeout)\n rec={\'control\':\'incomplete export / omitted dependency\',\'status\':process[\'status\'],\'process\':process,\'binary_sha256\':R.binhashes[tool],\'source_export_sha256\':R.sha(source_raw),\'fixture\':str(raw.relative_to(R.EVID)),\'fixture_sha256\':R.sha(raw),\'omission\':removed,\'expected_nonacceptance_observed\':process[\'exit\'] not in (0,None) and not process[\'timed_out\'],\'interpretation\':\'Actual incomplete-input outcome only; a loader error is not a mathematical disproof.\'}\n if config: rec.update({\'config\':str(config.relative_to(R.EVID)),\'config_sha256\':R.sha(config)})\n R.save(marker,rec);state.setdefault(\'checker_controls\',[]).append(str(marker.relative_to(R.EVID)));checkpoint(state)\n\ndef nanoda_config(path):\n return {\'use_stdin\':False,\'export_file_path\':str(path),\'permitted_axioms\':[\'propext\',\'Quot.sound\',\'Classical.choice\'],\'unpermitted_axiom_hard_error\':False,\'num_threads\':4,\'nat_extension\':True,\'string_extension\':True}\n\ndef check_cohort(state,manifest,ids,label,remaining_cohorts):\n """Try each available tier once, preserving dynamic shares for later cohorts."""\n if not re.fullmatch(r\'[A-Za-z0-9_-]+\',label): raise ValueError(\'invalid cohort label\')\n unitroots=list(dict.fromkeys(r for n in ids for r in manifest[\'units\'][n][\'roots\']))\n for n in ids:\n if any(state[\'units\'][n][\'stages\'][s]!=\'PASS\' for s in [\'compile\',\'type\',\'axioms\']): raise ValueError(\'checker requires complete exact-type/strict-axiom evidence\')\n modules=list(dict.fromkeys(manifest[\'units\'][n][\'module\'] for n in ids))\n if len(modules)!=1: raise ValueError(\'cohort must share one compiled parent module\')\n start=time.monotonic(); available=max(0,R.DEADLINE-start-30)\n # First small cohort gets each tier; an interrupted checker cannot consume all later work.\n cohort_budget=available/max(1,remaining_cohorts)\n finish=min(R.DEADLINE-30,start+cohort_budget)\n try: primitives=references()\n except Exception as error:\n for stage in [\'export\',*STAGES]: stage_record(state,ids,label,stage,{\'status\':\'BLOCKED\',\'roots\':unitroots,\'reason\':\'reference parsing: \'+str(error)})\n return\n roots=list(dict.fromkeys([\'Quot\',\'Quot.mk\',\'Quot.lift\',\'Quot.ind\',*unitroots,\'propext\',\'Quot.sound\',\'Classical.choice\',*primitives]))\n raw=R.WORK/(label+\'.ndjson\');binary=R.TC/\'bin/leanexport\'\n if not binary.is_file() or \'leanexport\' not in R.binhashes:\n rec={\'status\':\'BLOCKED\',\'roots\':roots,\'reason\':\'authenticated bundled leanexport unavailable\'}\n elif finish-time.monotonic()<4:\n rec={\'status\':\'NOT_RUN\',\'roots\':roots,\'reason\':\'insufficient safe cohort budget\'}\n else:\n cmd=[binary,modules[0],\'--\',*roots]\n process=bound_run(cmd,R.EVID/\'logs\'/(\'export.\'+label+\'.log\'),max(1,(finish-time.monotonic())*0.4),stdout=raw)\n rec={\'status\':process[\'status\'],\'roots\':roots,\'unit_roots\':unitroots,\'units\':ids,\'process\':process,\'binary_sha256\':R.binhashes[\'leanexport\'],\'module\':modules[0],\'flags\':R.FLAGS,\'note\':\'Export/structural status is not proof verification.\'}\n if raw.is_file():rec.update({\'raw_export_sha256\':R.sha(raw),\'raw_export_bytes\':raw.stat().st_size})\n if rec[\'status\']==\'PASS\':\n try:\n rec[\'structure\']=export_structure(raw,roots)\n if any(rec[\'structure\'][\'root_kinds\'][r]!=\'thm\' for r in unitroots): raise ValueError(\'unit root export is not theorem\')\n rec[\'delivery\']=retain_export(raw,label,ids,roots)\n except Exception as error:rec[\'status\']=\'FAIL\';rec[\'reason\']=\'export structural/retention validation: \'+str(error)\n stage_record(state,ids,label,\'export\',rec)\n for index,(stage,tool) in enumerate(STAGES.items()):\n detail={\'roots\':roots,\'unit_roots\':unitroots,\'units\':ids,\'binary_sha256\':R.binhashes.get(tool),\'raw_export_sha256\':rec.get(\'raw_export_sha256\'),\'strict_axiom_policy\':[\'propext\',\'Quot.sound\',\'Classical.choice\'],\'exact_type_and_axiom_prerequisite\':\'PASS for every unit/support root\'}\n if rec[\'status\']!=\'PASS\': detail.update({\'status\':\'BLOCKED\',\'reason\':\'complete validated export unavailable\'})\n elif not (R.TC/\'bin\'/tool).is_file() or tool not in R.binhashes:detail.update({\'status\':\'BLOCKED\',\'reason\':\'authenticated bundled checker unavailable\'})\n elif finish-time.monotonic()<3:detail.update({\'status\':\'NOT_RUN\',\'reason\':\'cohort budget retained for later scheduled units\'})\n else:\n if stage==\'nanoda\':\n config=R.EVID/\'exports\'/(label+\'-nanoda.json\');R.save(config,nanoda_config(raw))\n cmd=[R.TC/\'bin\'/tool,config];detail.update({\'config\':str(config.relative_to(R.EVID)),\'config_sha256\':R.sha(config),\'strict_axiom_note\':\'unpermitted_axiom_hard_error:false does not waive source-bound strict per-root axiom audit\'})\n elif stage==\'lean_replay\':cmd=[R.TC/\'bin\'/tool,\'--silent\',\'--from-export\',raw]\n else:cmd=[R.TC/\'bin\'/tool,\'--jobs=2\',raw]\n share=max(1,(finish-time.monotonic())/(len(STAGES)-index))\n process=bound_run(cmd,R.EVID/\'logs\'/(stage+\'.\'+label+\'.log\'),max(1,share-2))\n detail.update({\'status\':process[\'status\'],\'process\':process,\'validation_kind\':\'same-kernel Lean replay\' if stage==\'lean_replay\' else \'independent checker replay\'})\n # Controls are tiny, isolated, and never counted as proof units.\n if R.DEADLINE-time.monotonic()>10:\n incomplete_control(state,stage,raw,roots,min(10,max(1,share*0.05)))\n stage_record(state,ids,label,stage,detail)\n if raw.exists(): raw.unlink() # Complete compressed bytes remain in delivered evidence.\n', 'package.py': '#!/usr/bin/env python3\n"""Reconcile existing Branch B evidence and package it; never execute proofs/checkers."""\nimport argparse, copy, datetime, gzip, hashlib, importlib.util, io, json, os\nimport pathlib, re, shutil, tarfile, tempfile\n\nSTAGES = [\'compile\',\'type\',\'axioms\',\'export\',\'lean_replay\',\'nanoda\',\'con_ron\']\nSTATUSES = {\'PASS\',\'FAIL\',\'INCONCLUSIVE\',\'BLOCKED\',\'NOT_RUN\'}\nALLOWED = {\'propext\',\'Quot.sound\',\'Classical.choice\'}\nARCHIVE_LIMIT = 60 * 1024 * 1024\nEXPORT_BUDGET = 55 * 1024 * 1024\nFILE_LIMIT = 64 * 1024 * 1024\nUPLOAD_LIMIT = 128 * 1024 * 1024\nFLAGS = [\'-j1\',\'-DElab.async=false\']\n\n\ndef sha(path):\n h=hashlib.sha256()\n with pathlib.Path(path).open(\'rb\') as f:\n for block in iter(lambda:f.read(1024*1024),b\'\'): h.update(block)\n return h.hexdigest()\n\n\ndef encoded(obj): return (json.dumps(obj,indent=2,sort_keys=True)+\'\\n\').encode()\n\ndef load(path,default=None):\n p=pathlib.Path(path)\n if not p.exists(): return copy.deepcopy(default)\n return json.loads(p.read_text())\n\n\ndef relative_file(base,name):\n if not isinstance(name,str) or not name: raise ValueError(\'missing evidence path\')\n path=pathlib.Path(name)\n if path.is_absolute():\n resolved=path.resolve()\n else: resolved=(base/path).resolve()\n if not resolved.is_relative_to(base.resolve()): raise ValueError(\'evidence path outside evidence directory\')\n if not resolved.is_file() or resolved.is_symlink(): raise ValueError(\'missing/nonregular evidence file: \'+name)\n return resolved\n\n\ndef verify_process(record,evid):\n """Check a recorded successful process against its raw log; never launch it."""\n if not isinstance(record,dict): return False,\'missing process record\'\n if record.get(\'status\')!=\'PASS\' or record.get(\'exit\')!=0: return False,\'process did not record PASS with exit zero\'\n if record.get(\'timed_out\') or record.get(\'signal\'): return False,\'process interrupted\'\n if not isinstance(record.get(\'command\'),list) or not record[\'command\']: return False,\'missing actual command\'\n if not isinstance(record.get(\'wall_seconds\'),(int,float)) or record[\'wall_seconds\']<0: return False,\'missing wall timing\'\n try: path=relative_file(evid,record.get(\'log\'))\n except ValueError as e: return False,str(e)\n if sha(path)!=record.get(\'log_sha256\'): return False,\'raw log hash mismatch\'\n return True,None\n\n\ndef verify_audit(record,evid,roots,manifest):\n ok,why=verify_process(record,evid)\n if not ok: return False,why,{}\n cmd=record[\'command\']\n if pathlib.Path(cmd[0]).name!=\'lean\' or any(flag not in cmd for flag in FLAGS): return False,\'audit command flags/tool mismatch\',{}\n try:\n audit=pathlib.Path(cmd[-1])\n if not audit.is_absolute(): audit=evid/audit\n if not audit.is_file() or not audit.resolve().is_relative_to(evid.resolve()):\n label=pathlib.Path(record[\'log\']).name.removeprefix(\'audit.\').removesuffix(\'.log\')\n audit=evid/\'audits\'/(label+\'.lean\')\n source=audit.read_text()\n except OSError: return False,\'missing audit source\',{}\n if sha(audit)!=record.get(\'audit_source_sha256\'): return False,\'audit source hash mismatch\',{}\n normalized=re.sub(r\'\\s+\',\'\',source)\n if \'set_optionautoImplicitfalse\' not in normalized or \'ci.type==ei.type\' not in normalized or \'Lean.collectAxiomsn\' not in normalized:\n return False,\'missing strict audit source checks\',{}\n actual=[]\n for line in relative_file(evid,record[\'log\']).read_text().splitlines():\n if line.startswith(\'IMD_ROOT \'):\n try: obj=json.loads(line[len(\'IMD_ROOT \'):])\n except ValueError: return False,\'malformed raw root marker\',{}\n if not isinstance(obj,dict) or set(obj)!={\'name\',\'type\',\'axioms\',\'theorem\'}: return False,\'invalid raw root marker\',{}\n actual.append(obj)\n if actual!=record.get(\'roots\'): return False,\'audit JSON roots differ from raw markers\',{}\n names=[r.get(\'name\') for r in actual]\n if len(set(names))!=len(names): return False,\'duplicate raw root evidence\',{}\n found={r[\'name\']:r for r in actual}\n for root in roots:\n r=found.get(root)\n if not r or r.get(\'type\')!=\'PASS\' or r.get(\'theorem\') is not True or not isinstance(r.get(\'axioms\'),list) or any(a not in ALLOWED for a in r[\'axioms\']):\n return False,\'missing/invalid exact-type or strict axiom evidence for \'+root,{}\n expected=re.sub(r\'\\s+\',\'\',manifest[\'roots\'][root][\'type\'])\n if not re.search(r\'theoremimd_expected_\\d+:\'+re.escape(expected)+\':=\'+re.escape(root)+r\'(?:#|theorem|open)\',normalized):\n return False,\'published expected type missing from audit source for \'+root,{}\n return True,None,{root:found[root] for root in roots}\n\n\ndef verify_cache(module,cache,manifest,toolchain,evid,memo):\n if module in memo: return memo[module]\n c=cache.get(module)\n if not c: memo[module]=(False,\'missing locally built cache provenance\'); return memo[module]\n meta=manifest[\'modules\'].get(module)\n if not meta: memo[module]=(False,\'module absent from source-bound manifest\'); return memo[module]\n ok,why=verify_process(c.get(\'process\'),evid)\n process=c.get(\'process\',{});command=process.get(\'command\',[])\n stem=module.replace(\'.\',\'/\')\n if ok and (process.get(\'module\')!=module or len(command)!=10 or pathlib.Path(command[0]).name!=\'lean\' or command[1]!=\'-R\' or command[3]!=\'-o\' or command[5]!=\'-i\' or command[7:9]!=FLAGS or not command[4].endswith(\'/\'+stem+\'.olean\') or not command[6].endswith(\'/\'+stem+\'.ilean\') or not command[9].endswith(\'/\'+meta[\'path\'])):\n ok,why=False,\'compile command/module/source/flags mismatch\'\n expected_lean=toolchain.get(\'binary_sha256\',{}).get(\'lean\')\n expected_archive=toolchain.get(\'archive_sha256\')\n if ok and (not expected_lean or c.get(\'source_sha256\')!=meta[\'sha256\'] or c.get(\'lean_sha256\')!=expected_lean or c.get(\'toolchain_archive_sha256\')!=expected_archive or c.get(\'flags\')!=FLAGS): ok,why=False,\'source/toolchain/flags cache binding mismatch\'\n outputs=c.get(\'outputs\',{})\n if ok and (module.replace(\'.\',\'/\')+\'.olean\' not in outputs or not all(re.fullmatch(\'[0-9a-f]{64}\',h or \'\') for h in outputs.values())): ok,why=False,\'missing output hash provenance\'\n imports={d for d in meta[\'imports\'] if d in manifest[\'modules\']}\n if ok and set(c.get(\'imports\',{}))!=imports: ok,why=False,\'dependency cache provenance mismatch\'\n if ok:\n memo[module]=(False,\'cyclic cache provenance\')\n for dep in imports:\n passed,reason=verify_cache(dep,cache,manifest,toolchain,evid,memo)\n if not passed or c[\'imports\'][dep]!=cache[dep][\'outputs\']:\n ok,why=False,\'dependency provenance: \'+dep+\': \'+str(reason);break\n memo[module]=(ok,why);return memo[module]\n\n\ndef get_record(evid,value):\n if isinstance(value,dict): return value\n if isinstance(value,str): return load(relative_file(evid,value))\n return None\n\n\ndef export_records(evid):\n index=load(evid/\'exports/index.json\',[])\n if isinstance(index,dict): index=index.get(\'exports\',index.get(\'records\',[]))\n if not isinstance(index,list): raise ValueError(\'export index must be a list or object with exports\')\n return index\n\n\ndef inspect_exports(evid,records):\n """Validate complete gzip payloads, deduplicate by raw bytes; retain queue order."""\n byhash={};results=[]\n for position,raw in enumerate(records):\n r=copy.deepcopy(raw);r[\'index_position\']=position;r[\'delivery_status\']=\'MISSING\';r[\'delivered\']=False\n try:\n name=r.get(\'gzip_path\') or r.get(\'compressed_path\') or r.get(\'path\')\n path=relative_file(evid,name)\n if path.stat().st_size>=FILE_LIMIT: raise ValueError(\'compressed export exceeds per-file transport limit\')\n gz_sha=sha(path)\n if r.get(\'gzip_sha256\') and r[\'gzip_sha256\']!=gz_sha: raise ValueError(\'gzip hash mismatch\')\n h=hashlib.sha256();length=0\n with gzip.open(path,\'rb\') as f:\n for block in iter(lambda:f.read(1024*1024),b\'\'):h.update(block);length+=len(block)\n digest=h.hexdigest()\n if not r.get(\'raw_sha256\') or r[\'raw_sha256\']!=digest: raise ValueError(\'raw export hash missing or mismatch\')\n if r.get(\'raw_bytes\') is not None and r[\'raw_bytes\']!=length: raise ValueError(\'raw export size mismatch\')\n r.update(raw_bytes=length,gzip_sha256=gz_sha,gzip_bytes=path.stat().st_size,delivery_status=\'AVAILABLE\',archive_member=\'exports/\'+digest+\'.export.gz\')\n if digest not in byhash: byhash[digest]={\'path\':path,\'record\':r,\'raw_sha256\':digest}\n else:r[\'deduplicated_with_index\']=byhash[digest][\'record\'][\'index_position\']\n except (OSError,ValueError,EOFError) as e:r[\'delivery_reason\']=str(e)\n results.append(r)\n selected=[];total=0\n for entry in byhash.values():\n if total+entry[\'record\'][\'gzip_bytes\']<=EXPORT_BUDGET:\n selected.append(entry);total+=entry[\'record\'][\'gzip_bytes\']\n else:entry[\'record\'][\'delivery_reason\']=\'compressed export budget exhausted; earlier deliverable exports retained\'\n return results,selected\n\n\ndef reconcile(state,manifest,toolchain,evid,cache,exports=None):\n if state.get(\'branch\',\'B\')!=\'B\' or state.get(\'queue\',manifest[\'queue\'])!=manifest[\'queue\']: raise ValueError(\'checkpoint branch/queue differs from canonical manifest\')\n if set(state.get(\'units\',{}))-set(manifest[\'queue\']): raise ValueError(\'checkpoint contains unowned unit\')\n units={};issues=[];memo={}\n for n in manifest[\'queue\']:\n recorded=copy.deepcopy(state.get(\'units\',{}).get(n,{}));mu=manifest[\'units\'][n]\n reported=recorded.get(\'stages\',{s:\'NOT_RUN\' for s in STAGES})\n if any(reported.get(s,\'NOT_RUN\') not in STATUSES for s in STAGES): raise ValueError(\'unknown stage status \'+n)\n if recorded and (recorded.get(\'roots\')!=mu[\'roots\'] or recorded.get(\'module\')!=mu[\'module\']): raise ValueError(\'checkpoint root/module mismatch \'+n)\n u={**recorded,\'id\':n,\'module\':mu[\'module\'],\'published_type\':mu[\'published_type\'],\'roots\':mu[\'roots\'],\n \'reported_stages\':{s:reported.get(s,\'NOT_RUN\') for s in STAGES},\'stages\':{s:reported.get(s,\'NOT_RUN\') for s in STAGES},\'reconciliation\':[]}\n evidence=recorded.get(\'evidence\',{})\n def block(stage,reason):\n if u[\'stages\'][stage]==\'PASS\':u[\'stages\'][stage]=\'BLOCKED\';u[\'reconciliation\'].append({\'stage\':stage,\'reason\':reason})\n if u[\'stages\'][\'compile\']==\'PASS\':\n try:\n rec=get_record(evid,evidence.get(\'compile\'))\n ok=rec and rec.get(\'status\')==\'PASS\' and rec.get(\'target\')==mu[\'module\'] and rec.get(\'closure\')==mu[\'closure\']\n if not ok:block(\'compile\',\'missing/mismatched successful closure record\')\n else:\n for mod in mu[\'closure\']:\n good,why=verify_cache(mod,cache,manifest,toolchain,evid,memo)\n if not good:block(\'compile\',mod+\': \'+why);break\n except (ValueError,OSError) as e:block(\'compile\',str(e))\n if u[\'stages\'][\'type\']==\'PASS\' or u[\'stages\'][\'axioms\']==\'PASS\':\n try:\n t=get_record(evid,evidence.get(\'type\'));a=get_record(evid,evidence.get(\'axioms\'))\n if t!=a:ok,why,rr=False,\'type and axiom stage records disagree\',{}\n else:ok,why,rr=verify_audit(t,evid,mu[\'roots\'],manifest)\n except (ValueError,OSError,TypeError) as e:ok,why,rr=False,str(e),{}\n if not ok:block(\'type\',why);block(\'axioms\',why)\n else:u[\'root_results\']=rr\n strict=all(u[\'stages\'][s]==\'PASS\' for s in [\'compile\',\'type\',\'axioms\'])\n for stage in STAGES[3:]:\n if u[\'stages\'][stage]!=\'PASS\':continue\n if not strict:block(stage,\'complete unit compile/type/axiom prerequisites not PASS\');continue\n try:\n record=get_record(evid,evidence.get(stage));u.setdefault(\'stage_records\',{})[stage]=record\n process=record.get(\'process\',record) if record else None\n good,why=verify_process(process,evid)\n if not good:block(stage,why)\n elif record.get(\'status\')!=\'PASS\':block(stage,\'stage record does not report PASS\')\n elif not set(mu[\'roots\'])<=set(record.get(\'roots\',[])):block(stage,\'stage root set does not cover complete unit\')\n else:\n binary={\'export\':\'leanexport\',\'lean_replay\':\'leanchecker\',\'nanoda\':\'nanoda_bin\',\'con_ron\':\'con-ron\'}[stage]\n expected_hash=toolchain.get(\'binary_sha256\',{}).get(binary)\n command=process[\'command\']\n actual_hash=record.get(\'binary_sha256\') or process.get(\'binary_sha256\')\n if actual_hash is None and pathlib.Path(command[0]).is_file():actual_hash=sha(command[0])\n if pathlib.Path(command[0]).name!=binary or not expected_hash or actual_hash!=expected_hash:\n block(stage,\'actual checker/export binary hash/command not bound to authenticated toolchain\')\n else:record[\'binary_sha256\']=actual_hash\n digest=record.get(\'raw_export_sha256\') or record.get(\'raw_sha256\')\n matching=[e for e in (exports or []) if e.get(\'raw_sha256\')==digest and set(mu[\'roots\'])<=set(e.get(\'roots\',[]))]\n if not digest or not matching:block(stage,\'stage export hash/root set missing from export index\')\n if stage!=\'export\' and u[\'stages\'][\'export\']!=\'PASS\':block(stage,\'successful complete export prerequisite missing\')\n if stage==\'nanoda\':\n config_name=record.get(\'config\') or record.get(\'config_path\')\n try:config=relative_file(evid,config_name)\n except ValueError as err:block(stage,str(err))\n else:\n if sha(config)!=record.get(\'config_sha256\'):block(stage,\'NanoDa config hash mismatch\')\n except (ValueError,OSError,TypeError) as e:block(stage,str(e))\n if u[\'reconciliation\']:issues.append({\'id\':n,\'issues\':u[\'reconciliation\']})\n units[n]=u\n return units,issues\n\n\ndef checker_controls(state,evid):\n """Expose actual isolated controls, preserving raw outcomes and loader semantics."""\n result=[]\n for reference in state.get(\'checker_controls\',[]):\n item={\'reference\':reference if isinstance(reference,str) else None,\'mathematical_verdict\':None}\n try:\n record=get_record(evid,reference)\n if not isinstance(record,dict):raise ValueError(\'missing checker control record\')\n item.update(record=copy.deepcopy(record),recorded_status=record.get(\'status\',\'NOT_RUN\'),status=record.get(\'status\',\'NOT_RUN\'))\n if isinstance(reference,str):item[\'record_sha256\']=sha(relative_file(evid,reference))\n process=record.get(\'process\',{})\n logfile=relative_file(evid,process.get(\'log\'))\n item[\'raw_log_verified\']=sha(logfile)==process.get(\'log_sha256\')\n diagnostic=logfile.read_text(errors=\'replace\')\n loader=bool(re.search(r\'level not found|undefined level index|back[- ]reference mismatch|unknown constant|missing declaration|declaration .*not found|failed to (?:load|open)|invalid.*config|parse error|parsing error\',diagnostic,re.I))\n item[\'loader_failure\']=loader\n if loader:\n item[\'status\']=\'BLOCKED\'\n item[\'classification\']=\'incomplete-input loader/dependency rejection; no mathematical disproof\'\n else:item[\'classification\']=\'isolated control outcome only; not a branch proof-unit result\'\n item[\'actual_exit\']=process.get(\'exit\')\n item[\'expected_nonacceptance_observed\']=record.get(\'expected_nonacceptance_observed\')\n item[\'nonacceptance_evidence_valid\']=bool(item[\'raw_log_verified\'] and process.get(\'exit\') not in (None,0) and not process.get(\'timed_out\'))\n if record.get(\'fixture\'):\n fixture=relative_file(evid,record[\'fixture\'])\n item[\'fixture_bytes_verified\']=sha(fixture)==record.get(\'fixture_sha256\')\n if record.get(\'config\'):\n original=record[\'config\'];delivered=original;relocation=None\n try:verified=sha(relative_file(evid,original))==record.get(\'config_sha256\')\n except ValueError:verified=False\n if not verified:\n for path in sorted((evid/\'controls\').glob(\'*config-restoration.json\')):\n restoration=load(path,{})\n if restoration.get(\'record\')!=reference or restoration.get(\'original_record_sha256\')!=item.get(\'record_sha256\'):continue\n candidate=relative_file(evid,restoration.get(\'restored_config\'))\n if sha(candidate)==record.get(\'config_sha256\')==restoration.get(\'config_sha256\'):\n delivered=restoration[\'restored_config\'];verified=True\n relocation={\'reference\':str(path.relative_to(evid)),\'metadata\':restoration};break\n item[\'configuration\']={\'original_command_path\':original,\'delivered_path\':delivered,\'sha256\':record.get(\'config_sha256\'),\'bytes_verified\':verified}\n if relocation:item[\'configuration\'][\'relocation\']=relocation\n if not item[\'raw_log_verified\'] or item.get(\'fixture_bytes_verified\') is False or item.get(\'configuration\',{}).get(\'bytes_verified\') is False:\n item[\'status\']=\'BLOCKED\';item[\'evidence_issue\']=\'raw control evidence hash mismatch or missing configuration bytes\'\n except (ValueError,OSError,TypeError) as error:\n item.update(status=\'BLOCKED\',evidence_issue=str(error))\n result.append(item)\n return result\n\n\ndef evidence_files(base,evid,repo=None):\n """Select ordinary textual evidence only; never scan/archive work binaries."""\n allowed={\'.json\',\'.log\',\'.txt\',\'.md\',\'.lean\',\'.py\',\'.sh\',\'.yaml\',\'.yml\',\'.toml\',\'.cfg\',\'.config\'}\n result={};omitted=[]\n for p in sorted(evid.rglob(\'*\')):\n if not p.is_file() or p.is_symlink() or \'__pycache__\' in p.parts:continue\n rel=p.relative_to(evid)\n if rel.parts[0]==\'exports\':\n if p.suffix not in {\'.json\',\'.log\',\'.txt\',\'.lean\',\'.cfg\',\'.config\'}:continue\n elif p.suffix in {\'.export\',\'.ndjson\'} and (\'control\' in p.name or \'controls\' in rel.parts):pass\n elif p.suffix not in allowed:continue\n if p.stat().st_size>=FILE_LIMIT:omitted.append({\'path\':\'evidence/\'+rel.as_posix(),\'reason\':\'individual transport limit\'});continue\n result[\'evidence/\'+rel.as_posix()]=p\n for p in sorted(base.iterdir()):\n if p.is_file() and not p.is_symlink() and p.suffix in {\'.py\',\'.sh\',\'.md\',\'.log\'}:\n result[\'scripts/\'+p.name]=p\n generator=base/\'b_manifest.py\'\n if not generator.is_file():generator=base.parent/\'b_manifest.py\'\n if generator.is_file():result[\'scripts/b_manifest.py\']=generator\n if repo is not None:\n supplied_sha=\'b222cca4765faeebd619a23efd48b0bc2cc2520e37333a88e5d02cd89155341f\'\n candidates=[evid/\'reference/input-replay.sh\',evid/\'reference/replay-input.sh\',repo/\'artifacts/lean-proof-unit/replay.sh\',repo/\'.imd/reads/artifacts/replay\']\n matched=next((p for p in candidates if p.is_file() and sha(p)==supplied_sha),None)\n if matched is not None:result[\'reference/input-replay.sh\']=matched\n else:omitted.append({\'path\':\'reference/input-replay.sh\',\'reason\':\'supplied replay missing or differs from declared SHA256\'})\n return result,omitted\n\n\ndef update_portability(core,export_results,selected):\n selected_hashes={r[\'raw_sha256\'] for r in selected}\n for r in export_results:\n r[\'delivered\']=r.get(\'raw_sha256\') in selected_hashes and r.get(\'delivery_status\')==\'AVAILABLE\'\n if r[\'delivered\']:r[\'delivery_status\']=\'DELIVERED\'\n elif r.get(\'delivery_status\')==\'AVAILABLE\':r[\'delivery_status\']=\'OMITTED\';r.setdefault(\'delivery_reason\',\'archive space exhausted; earliest deliverable exports retained\')\n for n,u in core[\'units\'].items():\n needed=set(u[\'roots\']);matching=[r for r in export_results if (n in r.get(\'units\',[]) or needed<=set(r.get(\'roots\',[]))) and needed<=set(r.get(\'roots\',[]))]\n delivered=[r for r in matching if r[\'delivered\']]\n u[\'portable_export\']={\'delivered\':bool(delivered),\'raw_sha256s\':sorted({r[\'raw_sha256\'] for r in delivered}),\'archive_members\':sorted({r[\'archive_member\'] for r in delivered})}\n delivered_hashes={r[\'raw_sha256\'] for r in delivered}\n u[\'portable_stage_payloads\']={}\n for stage in STAGES[3:]:\n rec=u.get(\'stage_records\',{}).get(stage) or {}\n digest=rec.get(\'raw_export_sha256\') or rec.get(\'raw_sha256\')\n u[\'portable_stage_payloads\'][stage]=bool(digest and digest in delivered_hashes)\n if not delivered:u[\'portable_export\'][\'reason\']=\'No delivered complete export with this unit root set.\'\n core[\'exports\']=export_results\n core[\'tier_totals\']={s:sum(u[\'stages\'][s]==\'PASS\' and all(u[\'stages\'][p]==\'PASS\' for p in [\'compile\',\'type\',\'axioms\']) for u in core[\'units\'].values()) for s in STAGES}\n core[\'reported_stage_totals\']={s:sum(u[\'reported_stages\'][s]==\'PASS\' for u in core[\'units\'].values()) for s in STAGES}\n core[\'portable_tier_totals\']={s:sum(u[\'stages\'][s]==\'PASS\' and all(u[\'stages\'][p]==\'PASS\' for p in [\'compile\',\'type\',\'axioms\']) and (s in STAGES[:3] or u[\'portable_stage_payloads\'][s]) for u in core[\'units\'].values()) for s in STAGES}\n core[\'remaining_ids\']=[n for n in core[\'queue\'] if not all(core[\'units\'][n][\'stages\'][s]==\'PASS\' for s in STAGES[:3])]\n core[\'remaining_ids_by_tier\']={s:[n for n in core[\'queue\'] if not (core[\'units\'][n][\'stages\'][s]==\'PASS\' and all(core[\'units\'][n][\'stages\'][p]==\'PASS\' for p in STAGES[:3]))] for s in STAGES}\n core[\'portable_remaining_ids_by_tier\']={s:[n for n in core[\'queue\'] if n in core[\'remaining_ids_by_tier\'][s] or (s in STAGES[3:] and not core[\'units\'][n][\'portable_stage_payloads\'][s])] for s in STAGES}\n\n\ndef report(core):\n tiers=core[\'tier_totals\'];portable=core[\'portable_tier_totals\'];verified=tiers[\'axioms\']\n lines=[f"Branch B completed {verified}/31 distinct assigned units with compile, exact published type and strict transitive-axiom evidence.",\n \'\', \'Only `propext`, `Quot.sound`, and `Classical.choice` are permitted. Supporting slices and row bindings are included in each complete unit and are never extra units.\',\n \'\', \'| Tier | Complete units | Portable evidence |\',\'|---|---:|---:|\']\n for stage in STAGES:lines.append(f\'| {stage} | {tiers[stage]} | {portable[stage]} |\')\n lines+=[\'\', \'Lean replay uses the same kernel. Export/structural acceptance alone is not proof validation. Counts are distinct units within each tier; they must not be summed across tiers.\',\n \'\', \'Stop reason: \'+str(core[\'stop_reason\'])+\'.\',\n \'\', \'The source-bound manifest identifies all 31 units, 181 required roots, published types, dependency closures, canonical scheduling costs, and Git-blob byte comparisons. Reconciliation reads existing evidence and does not rerun proofs. Source/parser/component tests are separate from mathematical verification.\',\n \'\', f"Delivered {len({r[\'raw_sha256\'] for r in core[\'exports\'] if r.get(\'delivered\')})} deduplicated complete export payloads. Missing payloads are excluded from portable checker totals; no export is truncated.",\n \'\', \'Raw logs, commands, exits, wall times, controls, audit source, checker configurations, toolchain authentication, source-bound cache provenance, and scripts are in `evidence.tar.gz`. Toolchain and compiled cache binaries are excluded.\',\n \'\', \'Exact remaining unit IDs for each tier and all reported/reconciled statuses are in `receipt.json`.\']\n if core.get(\'checker_controls\'):\n observed=sum(c.get(\'expected_nonacceptance_observed\') is True and c.get(\'nonacceptance_evidence_valid\') for c in core[\'checker_controls\'])\n loaders=sum(c.get(\'loader_failure\') is True for c in core[\'checker_controls\'])\n lines+=[\'\',f"Isolated incomplete-export controls: {observed}/{len(core[\'checker_controls\'])} recorded nonacceptance outcomes, including {loaders} loader/dependency refusals. These are input-control observations, not mathematical disproofs or additional verified units."]\n if core[\'reconciliation_issues\']:lines+=[\'\',f"Evidence reconciliation downgraded unsupported PASS claims for {len(core[\'reconciliation_issues\'])} units; the recorded stage results are retained."]\n if core.get(\'source_regeneration\',{}).get(\'status\')!=\'PASS\':lines+=[\'\',\'Source regeneration was blocked: \'+core[\'source_regeneration\'].get(\'reason\',\'unspecified\')+\'.\']\n if core.get(\'omitted_evidence\'):lines+=[\'\',\'Some evidence exceeded transport limits; receipt.json records every omitted path.\']\n return \'\\n\'.join(lines)+\'\\n\'\n\n\ndef archive_write(path,files,generated):\n with path.open(\'wb\') as raw:\n with gzip.GzipFile(filename=\'\',fileobj=raw,mode=\'wb\',mtime=0,compresslevel=6) as gz:\n with tarfile.open(fileobj=gz,mode=\'w|\',format=tarfile.PAX_FORMAT) as tar:\n for name in sorted(set(files)|set(generated)):\n if name in generated:data=generated[name];size=len(data);f=io.BytesIO(data)\n else:size=files[name].stat().st_size;f=files[name].open(\'rb\')\n info=tarfile.TarInfo(name);info.size=size;info.mode=0o644;info.mtime=0;info.uid=info.gid=0;info.uname=info.gname=\'\'\n with f:tar.addfile(info,f)\n\n\ndef package(base,out,manifest_path,repo):\n """Public entry point expected by replay_main.py. Produces the three outputs."""\n base=pathlib.Path(base).resolve();out=pathlib.Path(out).resolve();repo=pathlib.Path(repo).resolve();evid=base/\'evidence\'\n manifest_path=pathlib.Path(manifest_path).resolve()\n manifest=load(manifest_path)\n regeneration={\'status\':\'BLOCKED\'}\n try:\n module_path=base/\'b_manifest.py\'\n if not module_path.is_file():module_path=base.parent/\'b_manifest.py\'\n if not module_path.is_file():module_path=pathlib.Path(__file__).with_name(\'b_manifest.py\')\n spec=importlib.util.spec_from_file_location(\'package_manifest_generator\',module_path);mod=importlib.util.module_from_spec(spec);spec.loader.exec_module(mod)\n regenerated=mod.make_manifest(repo)\n if manifest is not None and regenerated!=manifest:raise ValueError(\'regenerated manifest differs from saved source-bound manifest\')\n manifest=regenerated;regeneration={\'status\':\'PASS\',\'proof_execution\':False,\'manifest_sha256\':hashlib.sha256(encoded(manifest)).hexdigest()}\n except (OSError,ValueError,ImportError) as err:\n regeneration={\'status\':\'BLOCKED\',\'proof_execution\':False,\'reason\':str(err)}\n if manifest is None:raise ValueError(\'cannot package without a source-bound manifest\') from err\n state=load(evid/\'branch-state.json\',{})\n toolchain=load(evid/\'toolchain.json\',{\'status\':\'BLOCKED\',\'reason\':\'toolchain acquisition/authentication not completed\'})\n processes=load(evid/\'processes.json\',[]);cache=load(evid/\'cache.json\',{})\n raw_exports=export_records(evid)\n units,issues=reconcile(state,manifest,toolchain,evid,cache,raw_exports)\n if regeneration[\'status\']!=\'PASS\':\n for n,u in units.items():\n for stage in STAGES:\n if u[\'stages\'][stage]==\'PASS\':u[\'stages\'][stage]=\'BLOCKED\';u[\'reconciliation\'].append({\'stage\':stage,\'reason\':\'source manifest regeneration blocked\'})\n issues=[{\'id\':n,\'issues\':u[\'reconciliation\']} for n,u in units.items() if u[\'reconciliation\']]\n exps,selected=inspect_exports(evid,raw_exports)\n files,omitted=evidence_files(base,evid,repo)\n controls=state.get(\'controls\') or load(evid/\'controls.json\',[])\n core={\'schema\':\'imd-lean-capacity/v1\',\'experiment\':\'A847-LEAN-CAPACITY-32549b50e95c\',\'branch\':\'B\',\n \'source\':manifest[\'source\'],\'toolchain\':toolchain,\'source_regeneration\':regeneration,\'queue\':manifest[\'queue\'],\n \'units\':units,\'root_manifest\':manifest[\'roots\'],\'controls\':controls,\'checker_controls\':checker_controls(state,evid),\'processes\':processes,\n \'cache_provenance\':{\'archive_member\':\'evidence/cache.json\',\'local_modules\':len(cache),\'binaries_delivered\':False,\n \'binding\':\'Pinned Git source bytes, authenticated toolchain binary/archive hashes, fixed flags, imported-output hashes, output hashes, successful process/raw log.\'},\n \'stop_reason\':state.get(\'stop_reason\',\'no completed checkpoint; prerequisites unavailable\'),\n \'cohorts\':state.get(\'cohorts\',[]),\'reconciliation_issues\':issues,\'omitted_evidence\':omitted,\n \'stage_status_definitions\':{\'PASS\':\'Successful recorded process and all required unit-root type/axiom evidence; complete-unit counts require compile/type/axioms.\',\n \'FAIL\':\'Recorded actual rejection; not a loader failure.\',\'INCONCLUSIVE\':\'Interrupted or budget-exhausted execution.\',\n \'BLOCKED\':\'Missing prerequisite/evidence, including loader failure.\',\'NOT_RUN\':\'No attempt recorded.\'},\n \'counting\':\'Distinct complete assigned units per tier, never sums across tiers or supporting roots.\',\n \'limits\':{\'archive_bytes_max\':ARCHIVE_LIMIT,\'file_bytes_max_exclusive\':FILE_LIMIT,\'upload_bytes_max\':UPLOAD_LIMIT},\n \'reconciliation\':{\'proofs_rerun\':False,\'checkers_rerun\':False,\'generated_utc\':datetime.datetime.now(datetime.timezone.utc).isoformat()}}\n replay=out/\'replay.sh\'\n if not replay.is_file():raise ValueError(\'replay.sh must be assembled before packaging to bind its delivered hash\')\n out.mkdir(parents=True,exist_ok=True)\n with tempfile.TemporaryDirectory(prefix=\'package-\',dir=base) as tmpdir:\n tmp=pathlib.Path(tmpdir);archive=tmp/\'evidence.tar.gz\'\n while True:\n update_portability(core,exps,selected)\n report_text=report(core);generated={\'manifest.json\':encoded(manifest),\'receipt.core.json\':encoded(core),\'report.md\':report_text.encode()}\n chosen=dict(files)\n for entry in selected:chosen[\'exports/\'+entry[\'raw_sha256\']+\'.export.gz\']=entry[\'path\']\n inventory={n:{\'sha256\':sha(p),\'bytes\':p.stat().st_size} for n,p in chosen.items()}\n inventory.update({n:{\'sha256\':hashlib.sha256(data).hexdigest(),\'bytes\':len(data)} for n,data in generated.items()})\n generated[\'files.json\']=encoded({\'schema\':\'imd-lean-capacity/archive-files/v1\',\'self_omitted\':True,\'files\':inventory})\n archive_write(archive,chosen,generated)\n if archive.stat().st_size<=ARCHIVE_LIMIT:break\n if not selected:raise ValueError(\'mandatory textual evidence alone exceeds 60MiB; refusing truncation\')\n selected.pop() # Always retain earliest complete payloads.\n for r in exps:\n if r.get(\'delivery_status\')==\'DELIVERED\':r[\'delivery_status\']=\'AVAILABLE\'\n (tmp/\'report.md\').write_text(report_text)\n outer=copy.deepcopy(core)\n outer[\'artifacts\']={\'evidence\':{\'path\':\'evidence.tar.gz\',\'sha256\':sha(archive),\'bytes\':archive.stat().st_size},\n \'report\':{\'path\':\'report.md\',\'sha256\':sha(tmp/\'report.md\'),\'bytes\':(tmp/\'report.md\').stat().st_size},\n \'replay\':{\'path\':\'replay.sh\',\'sha256\':sha(replay),\'bytes\':replay.stat().st_size}}\n outer[\'archive_receipt\']=\'receipt.core.json excludes outer artifact hashes to avoid circular hashing.\'\n (tmp/\'receipt.json\').write_bytes(encoded(outer))\n all_paths=[tmp/\'receipt.json\',tmp/\'report.md\',archive,replay]\n if any(p.stat().st_size>=FILE_LIMIT for p in all_paths) or sum(p.stat().st_size for p in all_paths)>UPLOAD_LIMIT:raise ValueError(\'declared output transport limit exceeded\')\n # All validation completed before replacing any delivered output.\n for name in [\'receipt.json\',\'report.md\',\'evidence.tar.gz\']:os.replace(tmp/name,out/name)\n return outer\n\n\ndef main():\n p=argparse.ArgumentParser(description=__doc__);p.add_argument(\'--base\',required=True);p.add_argument(\'--out\',required=True);p.add_argument(\'--manifest\',required=True);p.add_argument(\'--repo\',default=\'.\')\n a=p.parse_args();r=package(a.base,a.out,a.manifest,a.repo)\n print(json.dumps({\'branch\':\'B\',\'tier_totals\':r[\'tier_totals\'],\'portable_tier_totals\':r[\'portable_tier_totals\'],\'archive_bytes\':r[\'artifacts\'][\'evidence\'][\'bytes\']},sort_keys=True))\n\nif __name__==\'__main__\':main()\n', 'replay_main.py': '#!/usr/bin/env python3\n"""Task-local replay entry; --budget-seconds is the assigned allowance remaining."""\nimport argparse, datetime, hashlib, json, pathlib, shutil, subprocess, sys, time, urllib.request, os, signal\nimport runner as R\nfrom b_manifest import make_manifest\nimport batch\nURL=\'https://github.com/leanprover/lean4/releases/download/v4.35.0-rc2/lean-4.35.0-rc2-linux.tar.zst\'\nAPI=\'https://api.github.com/repos/leanprover/lean4/releases/tags/v4.35.0-rc2\'\nRUN_CONTEXT={}\n\ndef download(url,path,deadline):\n request=urllib.request.Request(url,headers={\'User-Agent\':\'imd-lean-capacity-branch-b\'})\n with urllib.request.urlopen(request,timeout=max(1,min(60,deadline-time.monotonic()))) as src, pathlib.Path(path).open(\'wb\') as dst:\n while True:\n if time.monotonic()>=deadline: raise TimeoutError(\'safe assigned budget exhausted during acquisition\')\n block=src.read(1024*1024)\n if not block: break\n dst.write(block)\n\ndef _main():\n ap=argparse.ArgumentParser(description=__doc__)\n ap.add_argument(\'--repo\',default=\'.\')\n ap.add_argument(\'--budget-seconds\',type=int,required=True,help=\'actual assigned time remaining, including reserve; no fixed 1200-second cap\')\n ap.add_argument(\'--reserve-seconds\',type=int,default=360,help=\'time retained for packaging and normal submission\')\n ap.add_argument(\'--archive\',help=\'already available authenticated official .tar.zst; enables offline acquisition\')\n ap.add_argument(\'--work-dir\',help=\'fresh directory inside repository test/scratch/\')\n ap.add_argument(\'--reconcile-only\',action=\'store_true\',help=\'package existing evidence without executing proofs; requires --work-dir\')\n args=ap.parse_args()\n if args.reserve_seconds<120 or args.budget_seconds<=args.reserve_seconds+30: ap.error(\'budget must exceed reserve + 30 seconds, reserve at least 120 seconds\')\n started=time.monotonic(); deadline=started+args.budget_seconds-args.reserve_seconds\n repo=pathlib.Path(args.repo).resolve(); scratch=repo/\'test/scratch\'\n base=pathlib.Path(args.work_dir).resolve() if args.work_dir else scratch/(\'lean-capacity-b-\'+datetime.datetime.now(datetime.timezone.utc).strftime(\'%Y%m%dT%H%M%S\'))\n if not base.is_relative_to(scratch) or base==scratch: ap.error(\'--work-dir must be below repository test/scratch\')\n out=repo/\'artifacts/lean-capacity/b\'\n if args.reconcile_only:\n if not args.work_dir: ap.error(\'--reconcile-only requires --work-dir\')\n import package\n package.package(base,out,base/\'evidence/manifest.json\',repo)\n return 0\n if base.exists() and any(base.iterdir()): ap.error(\'fresh replay refuses nonempty work directory or external caches\')\n (base/\'evidence\').mkdir(parents=True); (base/\'work\').mkdir()\n manifest=make_manifest(repo); R.save(base/\'evidence/manifest.json\',manifest)\n RUN_CONTEXT.update(repo=repo,base=base,out=out,manifest=manifest)\n # The standalone shell launcher embeds these ordinary source files. Keep a\n # reviewable copy in the evidence tree; no installed package is required.\n for code in pathlib.Path(__file__).parent.glob(\'*.py\'):\n if code.parent!=base: shutil.copyfile(code,base/code.name)\n refs=pathlib.Path(__file__).parent/\'reference\'\n if refs.is_dir(): shutil.copytree(refs,base/\'evidence/reference\',dirs_exist_ok=True)\n budget={\'assigned_remaining_seconds\':args.budget_seconds,\'reserve_seconds\':args.reserve_seconds,\'started_utc\':datetime.datetime.now(datetime.timezone.utc).isoformat(),\'clock\':\'monotonic\',\'fixed_1200_second_cutoff\':False}\n R.save(base/\'evidence/budget.json\',budget)\n archive=base/\'work/lean.tar.zst\'\n if args.archive:\n supplied=pathlib.Path(args.archive).resolve()\n if R.sha(supplied)!=R.ARCHIVE_SHA: raise ValueError(\'supplied archive does not match authenticated official asset\')\n shutil.copyfile(supplied,archive)\n else:\n download(API,base/\'evidence/lean-release.json\',deadline)\n meta=json.loads((base/\'evidence/lean-release.json\').read_text())\n assets=[a for a in meta[\'assets\'] if a[\'name\']==\'lean-4.35.0-rc2-linux.tar.zst\']\n if len(assets)!=1 or assets[0][\'digest\']!=\'sha256:\'+R.ARCHIVE_SHA or assets[0][\'browser_download_url\']!=URL: raise ValueError(\'official release asset metadata mismatch\')\n download(URL,archive,deadline)\n if R.sha(archive)!=R.ARCHIVE_SHA: raise ValueError(\'official archive SHA256 mismatch\')\n command=[\'tar\',\'--zstd\',\'-xf\',str(archive),\'-C\',str(base/\'work\')]\n t=time.monotonic()\n with (base/\'evidence/toolchain-extract.log\').open(\'wb\') as log:\n process=subprocess.Popen(command,stdout=log,stderr=subprocess.STDOUT,start_new_session=True)\n try: code=process.wait(timeout=max(1,deadline-time.monotonic()))\n except subprocess.TimeoutExpired:\n os.killpg(process.pid,signal.SIGKILL);process.wait()\n raise TimeoutError(\'safe assigned budget exhausted during toolchain extraction\')\n R.save(base/\'evidence/toolchain-extract.json\',{\'command\':command,\'exit\':code,\'wall_seconds\':time.monotonic()-t,\'log\':\'toolchain-extract.log\',\'log_sha256\':R.sha(base/\'evidence/toolchain-extract.log\')})\n if code: raise RuntimeError(\'official toolchain extraction failed with exit \'+str(code))\n R.configure(repo,base,deadline)\n # No optional checker preparation occurs until batch.execute has saved a\n # complete assigned unit\'s compile/exact-type/transitive-axiom result.\n import checkers\n state=batch.execute(manifest,checker=checkers.check_cohort)\n R.source.close()\n import package\n package.package(base,out,base/\'evidence/manifest.json\',repo)\n return 0 if not state[\'remaining_ids\'] else 2\n\ndef main():\n try: return _main()\n except Exception as error:\n print(type(error).__name__+\': \'+str(error),file=sys.stderr)\n if RUN_CONTEXT:\n base=RUN_CONTEXT[\'base\']; manifest=RUN_CONTEXT[\'manifest\']; p=base/\'evidence/branch-state.json\'\n if p.exists(): state=json.loads(p.read_text())\n else: state={\'schema\':\'imd-lean-capacity/v1\',\'branch\':\'B\',\'source\':manifest[\'source\'],\'queue\':manifest[\'queue\'],\'units\':batch.initialize(manifest),\'controls\':[],\'cohorts\':[]}\n state[\'stop_reason\']=\'runtime/prerequisite failure: \'+type(error).__name__+\': \'+str(error)\n for u in state[\'units\'].values():\n for stage,status in list(u[\'stages\'].items()):\n if status==\'NOT_RUN\': u[\'stages\'][stage]=\'BLOCKED\'\n R.save(p,state)\n import package\n package.package(base,RUN_CONTEXT[\'out\'],base/\'evidence/manifest.json\',RUN_CONTEXT[\'repo\'])\n return 3\n\nif __name__==\'__main__\': sys.exit(main())\n'} references={'verify_submission.py': '#!/usr/bin/env python3\n"""Prepare and mechanically verify one Palomar submission."""\n\nfrom __future__ import annotations\n\nimport argparse\nimport datetime as dt\nimport hashlib\nimport json\nimport math\nimport os\nimport pathlib\nimport re\nimport secrets\nimport shutil\nimport socket\nimport stat\nimport subprocess\nimport sys\nimport tempfile\nimport threading\nimport time\nimport tomllib\nfrom collections.abc import Callable\nfrom dataclasses import dataclass\nfrom pathlib import Path\nfrom typing import Any\nfrom urllib.error import HTTPError, URLError\nfrom urllib.parse import quote, urlparse\nfrom urllib.request import Request, urlopen\n\nROOT = Path(__file__).resolve().parent.parent\nif __package__ in {None, ""}:\n sys.path.insert(0, str(ROOT))\n\nfrom scripts import ( # noqa: E402\n seccomp_filter,\n submission_contract,\n)\nfrom scripts.orcid_validation import validate_records as validate_orcid_records # noqa: E402\nfrom scripts.source_requirements import inspect_lean_sources, lean_source_files # noqa: E402\nfrom scripts.verification_errors import ( # noqa: E402\n FormalizationValidationError,\n VerificationError,\n)\nfrom scripts.verification_profile import ( # noqa: E402\n PROFILE_PATH,\n VerificationProfileError,\n check_host,\n effective_memory_bytes,\n load_profile,\n profile_digest,\n)\n\nMAX_SOURCE_BYTES = 500 * 1024 * 1024\nGIT_NO_AUTO_MAINTENANCE = ("-c", "gc.auto=0", "-c", "maintenance.auto=false")\nMAX_LICENSE_BYTES = 1024 * 1024\nMAX_CHALLENGE_BYTES = 100 * 1024\nMAX_CHALLENGE_LINES = 1000\nMAX_CONFIGURATION_BYTES = 1024 * 1024\nMAX_CORRECTION_BASELINE_BYTES = 2 * 1024 * 1024\nSTANDARD_AXIOMS = {"propext", "Quot.sound", "Classical.choice"}\n# The checkers `lake comparator` runs besides Lean\'s own kernel: the name the\n# protected configuration registers each under, and the binary the selected\n# toolchain bundles for it. They are the binaries `--paranoid` would run;\n# Palomar makes no kernel version choice of its own.\nPROTECTED_KERNELS = (("nanoda", "nanoda_bin"), ("con-ron", "con-ron"))\n# #157/#158 measured the 734 MB li2 export at about 10.7 GiB for the\n# comparator phase with 2 workers, versus 17.6 GiB with 4. Two leaves\n# headroom on the 16 GB standard runner; total runtime was about\n# 25 minutes at either count. Use the same count across runner profiles.\n# Revisit this limit when runner memory capacity or con-ron\'s memory/\n# parallelism implementation changes. Compare peak memory and runtime\n# on representative large exports before changing it.\nCON_RON_JOBS = 2\n# The toolchain binaries a verification runs, each digested into the record.\nTOOLCHAIN_TOOLS = ("lake", "lean", "leanexport", "leanchecker", "nanoda_bin", "con-ron")\nBWRAP_SOURCE_TAG_RE = re.compile(r"^v[0-9]+\\.[0-9]+\\.[0-9]+$")\n# `lake comparator` exits 2 when it could not run at all and 1 both when it has\n# found against the submission and when a step of its own failed. What it\n# prints tells the two apart (Lake/Check/Compare.lean, Axioms.lean and\n# CLI/Check.lean at v4.35.0-rc2). No candidate code runs in the judge phase,\n# but the transcript quotes declaration names the submitter chose, so every\n# marker is anchored to the start of its line and the names are kept free of\n# control characters: a name cannot begin a line of its own.\nCOMPARATOR_VERDICT_RE = re.compile(\n r"^error: (?:"\n r"Const not found in challenge|Const not found in solution|Constant not found in solution"\n r"|Const does not match between challenge and target"\n r"|Challenge and solution constant kind don\'t match"\n r"|Challenge and solution theorem statement do not match"\n r"|Challenge constant is not a definition|Solution constant is not a definition"\n r"|Solution constant is not a theorem|Illegal axiom detected)",\n re.MULTILINE,\n)\n# `runExternalKernel` says "rejected" for every nonzero kernel exit, a crash\n# included, so a kernel\'s word alone is not a verdict. Lean\'s own kernel runs\n# last and is the arbiter: its rejection is the submission\'s; an independent\n# kernel failing while Lean\'s accepts is Palomar\'s to look at.\nCOMPARATOR_KERNEL_REJECTED_RE = re.compile(r"^(?P[^\\n]+) kernel rejected the solution$", re.MULTILINE)\nCOMPARATOR_LEAN_KERNEL = "Lean default"\nCOMPARATOR_INFRASTRUCTURE_RE = re.compile(\n r"^(?:bwrap: |Error while interacting with |error: Error while interacting with )", re.MULTILINE\n)\nCOMPARATOR_REQUIRED_KEYS = {\n "challenge_module",\n "solution_module",\n "theorem_names",\n "permitted_axioms",\n}\nCOMPARATOR_ALLOWED_KEYS = COMPARATOR_REQUIRED_KEYS | {\n "definition_names",\n "enable_nanoda",\n}\nCOMPILED_ARTIFACT_SUFFIXES = {\n ".a",\n ".bc",\n ".dll",\n ".dylib",\n ".ilean",\n ".ir",\n ".o",\n ".obj",\n ".olean",\n ".so",\n ".trace",\n}\n# The module system\'s sidecars are double-suffixed, so `Path.suffix` reports\n# `.private`/`.server` and the table above cannot match them on its own.\nCOMPILED_ARTIFACT_NAME_SUFFIXES = (".olean.private", ".olean.server")\nMAX_STAGED_LAKE_METADATA_FILES = 512\nMAX_STAGED_LAKE_METADATA_BYTES = 8 * 1024**3\nSTAGED_LAKE_CONTROL_NAMES = {\n "lake-manifest.json",\n "lakefile.ilean",\n "lakefile.lean",\n "lakefile.olean",\n "lakefile.toml",\n "lean-toolchain",\n}\nSTAGED_LAKE_CONTROL_DIRECTORIES = {"build", "config", "packages"}\n# A Lean toolchain, as a comparable version. Release candidates sort before the\n# release they lead to, so v4.31.0-rc2 < v4.31.0, and anything that does not\n# parse is refused rather than guessed at.\nTOOLCHAIN_RE = re.compile(\n r"^leanprover/lean4:v(?P[0-9]+)\\.(?P[0-9]+)\\.(?P[0-9]+)"\n r"(?:-rc(?P[0-9]+))?$"\n)\nVERSION_RE = re.compile(\n r"^v(?P[0-9]+)\\.(?P[0-9]+)\\.(?P[0-9]+)"\n r"(?:-rc(?P[0-9]+))?$"\n)\n\n\ndef parse_lean_version(value: str, pattern: re.Pattern[str]) -> tuple[int, int, int, int, int]:\n match = pattern.fullmatch(value.strip())\n if not match:\n raise VerificationError(\n f"unsupported Lean toolchain: {value!r}", code="toolchain.invalid"\n )\n rc = match.group("rc")\n # The fourth element orders a release candidate before its release.\n return (\n int(match.group("major")),\n int(match.group("minor")),\n int(match.group("patch")),\n 0 if rc else 1,\n int(rc) if rc else 0,\n )\n\n\ndef toolchain_release_tag(toolchain: str) -> str:\n """The tag in Palomar\'s tooling repositories that matches this toolchain.\n\n The version is derived rather than looked up in a table that has to be\n edited for every release and is stale the moment it is not. Tool-specific\n policy may subsequently fall back from a missing stable patch tag to the\n release line\'s patch-zero tag.\n """\n match = TOOLCHAIN_RE.fullmatch(toolchain.strip())\n if not match:\n raise VerificationError(f"unsupported Lean toolchain: {toolchain!r}")\n return "v" + toolchain.strip().split(":v", 1)[1]\n\n\ndef supported_toolchain(toolchain: str) -> str:\n """Refuse a toolchain below the floor Palomar\'s tooling supports."""\n settings = json.loads((ROOT / "toolchains.json").read_text(encoding="utf-8"))\n if not isinstance(settings, dict) or set(settings) != {"schema_version", "minimum"}:\n raise VerificationError(\n "toolchains.json must contain exactly schema_version and minimum",\n code="palomar.toolchain_policy_invalid",\n owner="palomar",\n next_action="Do not change the repository; Palomar must repair its toolchain policy.",\n )\n if type(settings["schema_version"]) is not int or settings["schema_version"] != 2:\n raise VerificationError(\n "toolchains.json does not use schema version 2",\n code="palomar.toolchain_policy_invalid",\n owner="palomar",\n next_action="Do not change the repository; Palomar must repair its toolchain policy.",\n )\n minimum = settings.get("minimum")\n if not isinstance(minimum, str) or not VERSION_RE.fullmatch(minimum):\n raise VerificationError(\n "toolchains.json does not record a valid minimum",\n code="palomar.toolchain_policy_invalid",\n owner="palomar",\n next_action="Do not change the repository; Palomar must repair its toolchain policy.",\n )\n if parse_lean_version(toolchain, TOOLCHAIN_RE) < parse_lean_version(minimum, VERSION_RE):\n raise VerificationError(\n f"Lean toolchain {toolchain} is older than the minimum Palomar supports ({minimum})",\n code="toolchain.unsupported",\n )\n return toolchain_release_tag(toolchain)\n\n\ndef resolve_release_commit(repository: str, tag: str) -> str:\n """The commit a tooling release points at.\n\n The tag is resolved once and the commit it named is recorded in the\n mechanical report, so a record always says exactly which revision of\n Palomar\'s own tooling checked it, whatever the tag says afterwards.\n """\n proc = subprocess.run(\n ["git", "ls-remote", f"https://github.com/{repository}", f"refs/tags/{tag}^{{}}",\n f"refs/tags/{tag}"],\n check=False,\n capture_output=True,\n text=True,\n timeout=120,\n )\n if proc.returncode != 0:\n raise VerificationError(\n f"could not read {repository} releases",\n code="provider.release_lookup_failed",\n owner="provider",\n next_action="Do not change the repository. Retry the same commit later.",\n retryable=True,\n )\n commits = {}\n for line in proc.stdout.splitlines():\n parts = line.split()\n if len(parts) == 2 and submission_contract.SHA_RE.fullmatch(parts[0]):\n commits[parts[1]] = parts[0]\n # An annotated tag resolves through its peeled ref; prefer that.\n commit = commits.get(f"refs/tags/{tag}^{{}}") or commits.get(f"refs/tags/{tag}")\n if not commit:\n raise VerificationError(\n f"{repository} has published no {tag} release",\n code="palomar.toolchain_release_missing",\n owner="palomar",\n next_action=(\n "Do not change the repository. Palomar must add support for this Lean release."\n ),\n )\n return commit\n\n\ndef toolchain_commit(toolchain: str) -> str:\n """The lean4 commit the submitted toolchain\'s release tag names.\n\n Every tool that judges the submission (`lake comparator`, `leanexport`,\n `leanchecker` and the bundled kernels) ships in that release, so this one\n commit is the provenance of all of them; the record carries it together\n with the digests of the installed binaries.\n """\n return resolve_release_commit("leanprover/lean4", supported_toolchain(toolchain))\n\n\nLICENSE_FILE_RE = re.compile(\n r"^(?:licen[cs]e|copying|unlicense|ofl)(?:\\.(?:md|markdown|txt))?$",\n re.IGNORECASE,\n)\nMODULE_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_\']*(?:\\.[A-Za-z_][A-Za-z0-9_\']*)*$")\nOFFICIAL_REF_RE = re.compile(r"^refs/heads/[A-Za-z0-9._/-]+$")\nSANDBOX_ENVIRONMENT = (\n "PATH",\n "HOME",\n "TMPDIR",\n "LANG",\n "LC_ALL",\n "LEAN_PATH",\n "LEAN_SRC_PATH",\n "LEAN_ABORT_ON_PANIC",\n "GIT_CONFIG_GLOBAL",\n "GIT_CONFIG_NOSYSTEM",\n "GIT_TERMINAL_PROMPT",\n "MATHLIB_CACHE_DIR",\n "MATHLIB_CACHE_GET_URL",\n "LAKE_PKG_URL_MAP",\n "COMPARATOR_BWRAP",\n "PALOMAR_PROTECTED_CHALLENGE_MODULE",\n)\n\n\nclass LicenseValidationError(VerificationError):\n """The submitted repository does not satisfy the licence policy."""\n\n def __init__(self, message: str) -> None:\n super().__init__(\n message,\n code="license.mismatch",\n field="project.license",\n repairable=True,\n next_action=(\n "Make project.license agree with the repository license file, commit the "\n "change, and make a new submission."\n ),\n )\n\n\nclass LicenseDetectorError(VerificationError):\n """The trusted SPDX detector failed rather than rejecting submitted terms."""\n\n def __init__(self, message: str) -> None:\n super().__init__(\n message,\n code="palomar.license_detector_failed",\n owner="palomar",\n next_action=(\n "Do not change the repository. Retry the same commit later; report the "\n "workflow URL if the problem recurs."\n ),\n retryable=True,\n )\n\n\nclass ResourceExhausted(VerificationError):\n """The available worker could not complete a verification phase."""\n\n def __init__(self, message: str) -> None:\n super().__init__(\n message,\n code="provider.resource_exhausted",\n owner="provider",\n next_action=(\n "Inspect the reported resource limit and build usage. If the workload repeatedly "\n "exceeds the worker\'s capacity, reduce its resource use or arrange sufficient "\n "capacity before retrying. Retry an unchanged commit only after addressing "\n "the reported condition. Normal submission cooldowns still apply."\n ),\n retryable=True,\n )\n\n\nDIAGNOSTICS_SCHEMA_VERSION = 1\nMAX_DIAGNOSTICS = 50\nPALOMAR_OWNED_STAGES = frozenset(\n {\n "setup",\n "confinement-initial",\n "confinement-final",\n "trusted-cache",\n "trusted-roots",\n "comparator-preflight",\n "challenge-export",\n "resource-exhausted",\n }\n)\n\n\ndef report_diagnostic(\n report: dict[str, Any],\n error: BaseException,\n *,\n stage: str | None = None,\n owner: str | None = None,\n) -> None:\n """Append bounded public diagnostics without changing successful reports."""\n current_stage = stage or str(report.get("stage") or "unknown")\n if isinstance(error, FormalizationValidationError):\n for issue in error.issues:\n report_diagnostic(report, issue, stage=current_stage)\n return\n if isinstance(error, VerificationError):\n diagnostic = error.diagnostic(current_stage)\n reclassified_to_palomar = False\n if owner is not None:\n diagnostic["owner"] = owner\n reclassified_to_palomar = owner == "palomar" and error.owner == "submitter"\n elif error.owner == "submitter" and current_stage in PALOMAR_OWNED_STAGES:\n diagnostic["owner"] = "palomar"\n reclassified_to_palomar = True\n if reclassified_to_palomar:\n diagnostic["retryable"] = True\n diagnostic["repairable"] = False\n diagnostic["next_action"] = (\n "Do not change the repository. Retry the same commit later; report the "\n "workflow URL if the problem recurs."\n )\n else:\n diagnostic = VerificationError(\n "Palomar could not complete this check.",\n code="palomar.internal_error",\n owner="palomar",\n next_action=(\n "Do not change the repository. Retry the same commit later; report the "\n "workflow URL if the problem recurs."\n ),\n retryable=True,\n ).diagnostic(current_stage)\n diagnostic["explanation"] = f"{type(error).__name__}: {str(error)[:1_500]}"\n diagnostics = report.setdefault("diagnostics", [])\n if not isinstance(diagnostics, list) or len(diagnostics) >= MAX_DIAGNOSTICS:\n return\n key = (diagnostic["code"], diagnostic["summary"], diagnostic.get("field"))\n if any(\n isinstance(item, dict)\n and (item.get("code"), item.get("summary"), item.get("field")) == key\n for item in diagnostics\n ):\n return\n report["diagnostics_schema_version"] = DIAGNOSTICS_SCHEMA_VERSION\n report["formalization_profile_version"] = submission_contract.FORMALIZATION_PROFILE_VERSION\n diagnostics.append(diagnostic)\n\n\nMAX_CAPTURE_BYTES = 8 * 1024 * 1024\nEXECUTION_BUDGET_SECONDS = 12 * 60 * 60\nVERIFICATION_PROFILE = load_profile()\nVERIFICATION_LIMITS = VERIFICATION_PROFILE["limits"]\n_EXECUTION_DEADLINE: float | None = None\n_MONOTONIC = time.monotonic\n_WALL_TIME = time.time\n_RESOURCE_PHASE: str | None = None\n_RESOURCE_METRICS_PATH: Path | None = None\n_RESOURCE_DISK_PATH: Path | None = None\n\n\ndef permissive_resource_properties() -> tuple[str, ...]:\n # Imported helpers also run inside the renderer\'s confined sanitizer, where\n # /proc is deliberately hidden. Only the outer supervisor needs host capacity.\n memory = effective_memory_bytes()\n return (\n f"MemoryHigh={memory * VERIFICATION_LIMITS[\'memory_high_percent\'] // 100}",\n f"MemoryMax={memory * VERIFICATION_LIMITS[\'memory_max_percent\'] // 100}",\n f"TasksMax={VERIFICATION_LIMITS[\'tasks_max\']}",\n f"LimitNOFILE={VERIFICATION_LIMITS[\'open_files_max\']}",\n f"LimitFSIZE={VERIFICATION_LIMITS[\'file_size_max_bytes\']}",\n )\n\n\ndef install_execution_deadline(\n started_at_epoch: str | float | None = None,\n budget_seconds: int = EXECUTION_BUDGET_SECONDS,\n) -> float | None:\n """Arm the shared deadline, including trusted CI setup time when supplied."""\n global _EXECUTION_DEADLINE\n\n previous = _EXECUTION_DEADLINE\n if budget_seconds < 60:\n raise VerificationError("verification execution budget must be at least one minute")\n elapsed = 0.0\n if started_at_epoch is not None:\n try:\n started_at = float(started_at_epoch)\n except (TypeError, ValueError) as error:\n raise VerificationError("invalid verification job start time") from error\n if not math.isfinite(started_at) or started_at <= 0:\n raise VerificationError("invalid verification job start time")\n elapsed = max(0.0, _WALL_TIME() - started_at)\n remaining = max(0.0, budget_seconds - elapsed)\n _EXECUTION_DEADLINE = _MONOTONIC() + remaining\n return previous\n\n\ndef _deadline_timeout(requested: int, command: list[str]) -> int:\n """Cap one phase by the verifier-wide wall-clock deadline when active."""\n if _EXECUTION_DEADLINE is None:\n return requested\n remaining = int(_EXECUTION_DEADLINE - _MONOTONIC())\n if remaining < 1:\n raise subprocess.TimeoutExpired(command, EXECUTION_BUDGET_SECONDS)\n return min(requested, remaining)\n\n\ndef _bounded_stream_reader(stream: Any, destination: bytearray) -> None:\n omitted = 0\n try:\n while True:\n chunk = stream.read(64 * 1024)\n if not chunk:\n break\n destination.extend(chunk)\n if len(destination) > MAX_CAPTURE_BYTES:\n excess = len(destination) - MAX_CAPTURE_BYTES\n del destination[:excess]\n omitted += excess\n finally:\n stream.close()\n if omitted:\n marker = f"\\n".encode()\n destination[:0] = marker\n\n\ndef now() -> str:\n return dt.datetime.now(dt.UTC).replace(microsecond=0).isoformat().replace("+00:00", "Z")\n\n\ndef resource_metrics(path: Path) -> list[dict[str, Any]]:\n if not path.is_file() or path.is_symlink() or path.stat().st_size > 1024 * 1024:\n return []\n records: list[dict[str, Any]] = []\n for line in path.read_text(encoding="utf-8").splitlines()[:1000]:\n try:\n value = json.loads(line)\n except json.JSONDecodeError:\n continue\n if isinstance(value, dict):\n records.append(value)\n return records\n\n\ndef run(\n command: list[str],\n *,\n cwd: Path | None = None,\n env: dict[str, str] | None = None,\n input_text: str | None = None,\n timeout: int = 600,\n check: bool = True,\n) -> subprocess.CompletedProcess[str]:\n timeout = _deadline_timeout(timeout, command)\n proc = subprocess.Popen(\n command,\n cwd=cwd,\n env=env,\n stdin=subprocess.PIPE if input_text is not None else subprocess.DEVNULL,\n stdout=subprocess.PIPE,\n stderr=subprocess.PIPE,\n )\n assert proc.stdout is not None and proc.stderr is not None\n stdout_bytes = bytearray()\n stderr_bytes = bytearray()\n readers = [\n threading.Thread(target=_bounded_stream_reader, args=(proc.stdout, stdout_bytes), daemon=True),\n threading.Thread(target=_bounded_stream_reader, args=(proc.stderr, stderr_bytes), daemon=True),\n ]\n for reader in readers:\n reader.start()\n if input_text is not None:\n assert proc.stdin is not None\n proc.stdin.write(input_text.encode("utf-8"))\n proc.stdin.close()\n try:\n returncode = proc.wait(timeout=timeout)\n except subprocess.TimeoutExpired:\n proc.kill()\n proc.wait()\n for reader in readers:\n # Descendants (including a service owned by systemd) may still\n # hold these pipes. Return control so the caller can stop them.\n reader.join(timeout=1)\n stdout = bytes(stdout_bytes).decode("utf-8", errors="replace")\n stderr = bytes(stderr_bytes).decode("utf-8", errors="replace")\n raise subprocess.TimeoutExpired(command, timeout, output=stdout, stderr=stderr) from None\n for reader in readers:\n reader.join()\n stdout = stdout_bytes.decode("utf-8", errors="replace")\n stderr = stderr_bytes.decode("utf-8", errors="replace")\n completed = subprocess.CompletedProcess(command, returncode, stdout, stderr)\n if check and completed.returncode:\n streams = []\n if completed.stdout.strip():\n streams.append(f"stdout:\\n{completed.stdout.strip()}")\n if completed.stderr.strip():\n streams.append(f"stderr:\\n{completed.stderr.strip()}")\n detail = "\\n".join(streams)[-8000:]\n raise VerificationError(\n f"{\' \'.join(command[:3])} failed ({completed.returncode}): {detail}"\n )\n return completed\n\n\ndef normalized_repository_path(value: str, field: str) -> pathlib.PurePosixPath:\n """Validate one user-supplied repository-relative POSIX path."""\n raw = value.strip()\n segments = raw.split("/")\n if (\n not raw\n or raw.startswith("/")\n or "\\\\" in raw\n or "?" in raw\n or "#" in raw\n or any(not segment or segment in {".", ".."} for segment in segments)\n or any(segment.lower() in {".git", ".lake"} for segment in segments)\n or ":" in segments[0]\n or any(ord(character) < 32 or ord(character) == 127 for character in raw)\n ):\n raise VerificationError(f"{field} must be a safe repository-relative POSIX path")\n return pathlib.PurePosixPath(*segments)\n\n\ndef joined_repository_path(\n project_path: pathlib.PurePosixPath | None, filename: str\n) -> pathlib.PurePosixPath:\n return (project_path / filename) if project_path is not None else pathlib.PurePosixPath(filename)\n\n\ndef resolve_repository_path(\n checkout: Path,\n relative: pathlib.PurePosixPath,\n field: str,\n *,\n kind: str,\n) -> Path:\n """Resolve a validated repository path without following submitted symlinks."""\n candidate = checkout\n for segment in relative.parts:\n candidate /= segment\n if candidate.is_symlink():\n raise VerificationError(f"{field} contains a symlinked path component")\n resolved = candidate.resolve()\n try:\n resolved.relative_to(checkout.resolve())\n except ValueError as error:\n raise VerificationError(f"{field} escapes the pinned repository checkout") from error\n if kind == "file" and not resolved.is_file():\n raise VerificationError(f"{field} is not a regular file: {relative.as_posix()}")\n if kind == "directory" and not resolved.is_dir():\n raise VerificationError(f"{field} is not a directory: {relative.as_posix()}")\n return resolved\n\n\ndef repository_relative_path(checkout: Path, path: Path) -> str:\n try:\n return path.resolve().relative_to(checkout.resolve()).as_posix()\n except ValueError as error:\n raise VerificationError("resolved project file escapes the pinned repository checkout") from error\n\n\ndef project_tree_url(repository_url: str, commit: str, project_path: str | None) -> str:\n base = f"{repository_url}/tree/{commit}"\n if not project_path:\n return base\n encoded = "/".join(quote(segment, safe="") for segment in project_path.split("/"))\n return f"{base}/{encoded}"\n\n\ndef module_source_suffix(module: str) -> pathlib.PurePosixPath:\n if not isinstance(module, str) or not MODULE_RE.fullmatch(module):\n raise VerificationError(f"unsafe dotted Lean module name: {module!r}")\n return pathlib.PurePosixPath(*module.split(".")).with_suffix(".lean")\n\n\ndef sha256(path: Path) -> str:\n digest = hashlib.sha256()\n with path.open("rb") as handle:\n for chunk in iter(lambda: handle.read(1024 * 1024), b""):\n digest.update(chunk)\n return digest.hexdigest()\n\n\ndef verification_profile_evidence() -> dict[str, Any]:\n """Record the published policy; the capacity check adds observed host limits."""\n return {\n "id": VERIFICATION_PROFILE["id"],\n "sha256": (sha256(PROFILE_PATH) if VERIFICATION_PROFILE["id"] == "palomar-standard-v1"\n else profile_digest(VERIFICATION_PROFILE)),\n "runner": dict(VERIFICATION_PROFILE["runner"]),\n "limits": dict(VERIFICATION_LIMITS),\n "trusted_tools": dict(VERIFICATION_PROFILE["trusted_tools"]),\n }\n\n\ndef correction_source_evidence(\n correction: dict[str, Any],\n *,\n checkout: Path,\n repository: str,\n commit: str,\n open_url: Callable[..., Any] = urlopen,\n) -> dict[str, dict[str, str]]:\n """Bind correction review paths to the exact registered baseline bytes."""\n baseline_binding = correction["baseline"]\n baseline_path = baseline_binding["path"]\n encoded_path = "/".join(quote(part, safe="") for part in baseline_path.split("/"))\n request = Request(\n f"https://data.palomar-registry.org/{encoded_path}",\n headers={"User-Agent": "PalomarSubmission/correction-validation"},\n )\n try:\n with open_url(request, timeout=30) as response:\n raw = response.read(MAX_CORRECTION_BASELINE_BYTES + 1)\n except (HTTPError, URLError, OSError) as error:\n raise VerificationError(\n "Registry correction baseline could not be read from the published Registry"\n ) from error\n if len(raw) > MAX_CORRECTION_BASELINE_BYTES:\n raise VerificationError("Registry correction baseline exceeds the 2 MiB bound")\n if hashlib.sha256(raw).hexdigest() != baseline_binding["sha256"]:\n raise VerificationError("Registry correction baseline bytes do not match their digest")\n try:\n baseline = json.loads(raw)\n except (UnicodeDecodeError, json.JSONDecodeError) as error:\n raise VerificationError("Registry correction baseline is not valid JSON") from error\n based_on = correction["based_on"]\n if (\n not isinstance(baseline, dict)\n or baseline.get("id") != based_on["id"]\n or baseline.get("version") != based_on["version"]\n or baseline.get("source", {}).get("repository") != repository\n or baseline.get("source", {}).get("commit") != commit\n ):\n raise VerificationError(\n "Registry correction baseline does not match the registered version and source"\n )\n formalization = baseline.get("formalization")\n verification = baseline.get("verification")\n if not isinstance(formalization, dict) or not isinstance(verification, dict):\n raise VerificationError("Registry correction baseline lacks source evidence")\n\n evidence: dict[str, dict[str, str]] = {}\n for name in ("challenge", "solution"):\n relative = formalization.get(f"{name}_path")\n expected_sha256 = verification.get(f"{name}_sha256")\n if (\n not isinstance(relative, str)\n or not isinstance(expected_sha256, str)\n or not re.fullmatch(r"[0-9a-f]{64}", expected_sha256)\n ):\n raise VerificationError(\n f"Registry correction baseline lacks valid {name} source evidence"\n )\n normalized = normalized_repository_path(relative, f"Baseline {name} path")\n source_path = resolve_repository_path(\n checkout, normalized, f"Baseline {name} path", kind="file"\n )\n if sha256(source_path) != expected_sha256:\n raise VerificationError(\n f"Registry correction source no longer matches the registered {name} digest"\n )\n evidence[name] = {"path": relative, "sha256": expected_sha256}\n return evidence\n\n\ndef repository_license_file(source: Path) -> Path:\n candidates = sorted(\n (path for path in source.iterdir() if LICENSE_FILE_RE.fullmatch(path.name)),\n key=lambda path: (path.name.casefold(), path.name),\n )\n if not candidates:\n raise LicenseValidationError(\n "repository root has no conventional licence file "\n "(LICENSE, LICENCE, COPYING, UNLICENSE, or OFL)"\n )\n if len(candidates) != 1:\n names = ", ".join(path.name for path in candidates)\n raise LicenseValidationError(\n f"repository root must contain exactly one conventional licence file; found: {names}"\n )\n path = candidates[0]\n if path.is_symlink() or not path.is_file():\n raise LicenseValidationError(f"repository licence path is not a regular root file: {path.name}")\n if path.stat().st_size > MAX_LICENSE_BYTES:\n raise LicenseValidationError("repository licence file exceeds the 1 MiB hard cap")\n try:\n contents = path.read_text(encoding="utf-8")\n except UnicodeDecodeError as error:\n raise LicenseValidationError("repository licence file must be UTF-8 text") from error\n if not contents.strip():\n raise LicenseValidationError("repository licence file must not be empty")\n return path\n\n\ndef detect_spdx_identifier(path: Path, bundle: Path) -> str:\n if not bundle.is_file():\n raise LicenseDetectorError(f"trusted Bundler executable is unavailable: {bundle}")\n environment = os.environ.copy()\n environment["BUNDLE_GEMFILE"] = str(ROOT / "Gemfile")\n try:\n completed = run(\n [\n str(bundle),\n "exec",\n "ruby",\n str(ROOT / "scripts" / "detect_license.rb"),\n str(path),\n ],\n cwd=ROOT,\n env=environment,\n timeout=30,\n check=False,\n )\n except (OSError, subprocess.TimeoutExpired) as error:\n raise LicenseDetectorError("trusted SPDX licence detector could not run") from error\n if completed.returncode != 0:\n detail = completed.stderr.strip()[-2_000:]\n suffix = f": {detail}" if detail else ""\n raise LicenseDetectorError(\n f"trusted SPDX licence detector failed with exit {completed.returncode}{suffix}"\n )\n try:\n result = json.loads(completed.stdout)\n except json.JSONDecodeError as error:\n raise LicenseDetectorError("trusted SPDX licence detector returned malformed JSON") from error\n if not isinstance(result, dict):\n raise LicenseDetectorError("trusted SPDX licence detector returned a non-object result")\n licenses = result.get("licenses")\n matched_files = result.get("matched_files")\n if not isinstance(licenses, list) or not isinstance(matched_files, list):\n raise LicenseDetectorError("trusted SPDX licence detector omitted required result fields")\n identifiers = [\n item.get("spdx_id")\n for item in licenses\n if isinstance(item, dict) and isinstance(item.get("spdx_id"), str)\n ]\n matches = [\n item.get("matched_license")\n for item in matched_files\n if isinstance(item, dict) and isinstance(item.get("matched_license"), str)\n ]\n if len(identifiers) != 1 or len(matches) != 1:\n raise LicenseValidationError(\n "repository licence file does not have one unambiguous standard SPDX match"\n )\n identifier = identifiers[0]\n if identifier in {"NONE", "NOASSERTION"} or matches[0] != identifier:\n raise LicenseValidationError(\n "repository licence file does not have one unambiguous standard SPDX match"\n )\n return identifier\n\n\ndef write_json(path: Path, value: Any) -> None:\n path.parent.mkdir(parents=True, exist_ok=True)\n temporary: Path | None = None\n try:\n with tempfile.NamedTemporaryFile(\n mode="w",\n encoding="utf-8",\n dir=path.parent,\n prefix=f".{path.name}.",\n delete=False,\n ) as handle:\n temporary = Path(handle.name)\n handle.write(json.dumps(value, indent=2, sort_keys=True) + "\\n")\n handle.flush()\n os.fsync(handle.fileno())\n os.replace(temporary, path)\n temporary = None\n finally:\n if temporary is not None:\n temporary.unlink(missing_ok=True)\n\n\ndef workflow_output(**values: str) -> None:\n path = os.environ.get("GITHUB_OUTPUT")\n if not path:\n return\n with open(path, "a", encoding="utf-8") as handle:\n for key, value in values.items():\n if "\\n" in value:\n raise VerificationError(f"newline in workflow output {key}")\n handle.write(f"{key}={value}\\n")\n\n\ndef clone_commit(url: str, commit: str, destination: Path) -> None:\n destination.mkdir(parents=True)\n git_env = os.environ.copy()\n git_env.update(\n {\n "GIT_CONFIG_GLOBAL": "/dev/null",\n "GIT_CONFIG_NOSYSTEM": "1",\n "GIT_TERMINAL_PROMPT": "0",\n "GIT_LFS_SKIP_SMUDGE": "1",\n }\n )\n git = [\n "git",\n "-c",\n "core.hooksPath=/dev/null",\n "-c",\n "protocol.file.allow=never",\n *GIT_NO_AUTO_MAINTENANCE,\n "-C",\n str(destination),\n ]\n run(["git", "-c", "core.hooksPath=/dev/null", "init", "-q", str(destination)], env=git_env)\n run([*git, "remote", "add", "origin", url], env=git_env)\n run(\n [\n *git,\n "fetch",\n "--depth=1",\n "--no-tags",\n "origin",\n commit,\n ],\n env=git_env,\n timeout=600,\n )\n run([*git, "checkout", "-q", "--detach", "FETCH_HEAD"], env=git_env)\n resolved = run([*git, "rev-parse", "HEAD"], env=git_env).stdout.strip()\n if resolved != commit:\n raise VerificationError(f"fetched {resolved}, expected {commit}")\n run([*git, "remote", "set-url", "--push", "origin", "no_push"], env=git_env)\n\n\ndef validate_preservable_git_checkout(\n checkout: Path,\n label: str,\n *,\n allow_inert_submodules: bool = False,\n) -> None:\n """Reject Git shapes whose contents a GitHub fork would not preserve.\n\n A native fork preserves a submodule\'s gitlink but not the referenced\n repository. Submitted and substantive sources therefore may not use them.\n Dependency checkouts are different: Palomar never initializes their\n submodules, so an inert historical gitlink is part of the preserved Git\n tree but not part of the source consumed by the build.\n\n Git LFS entries always preserve only pointers into storage owned by the\n original repository, so they remain disallowed in every checkout.\n """\n git = [\n "git",\n "-c",\n "core.hooksPath=/dev/null",\n "-C",\n str(checkout),\n ]\n if not allow_inert_submodules:\n index = run([*git, "ls-files", "--stage", "-z"]).stdout\n for record in index.split("\\0"):\n if record and record.split(None, 1)[0] == "160000":\n path = record.split("\\t", 1)[-1]\n raise VerificationError(\n f"{label} contains Git submodule {path!r}; submodules are not preservable"\n )\n\n tracked = run([*git, "ls-files", "-z"]).stdout\n if not tracked:\n return\n attributes = run(\n [*git, "check-attr", "--cached", "-z", "filter", "--stdin"],\n input_text=tracked,\n ).stdout.split("\\0")\n for position in range(0, len(attributes) - 2, 3):\n path, attribute, value = attributes[position : position + 3]\n if attribute == "filter" and value == "lfs":\n raise VerificationError(\n f"{label} tracks {path!r} with Git LFS; LFS objects are not preservable"\n )\n\n\ndef tree_size(root: Path) -> int:\n total = 0\n for directory, subdirectories, filenames in os.walk(root, followlinks=False):\n # Prune before descending: a Git operation can remove a loose-object\n # directory while a recursive glob is walking the checkout\'s .git.\n subdirectories[:] = [\n name\n for name in subdirectories\n if name != ".git" and not (Path(directory) / name).is_symlink()\n ]\n for name in filenames:\n if name == ".git":\n continue\n path = Path(directory) / name\n if path.is_symlink() or not path.is_file():\n continue\n total += path.stat().st_size\n if total > MAX_SOURCE_BYTES:\n return total\n return total\n\n\ndef validate_preservable_remote_source(\n work: Path, source: dict[str, str], label: str, *, check_lean_sources: bool = False\n) -> dict[str, Any] | None:\n """Fetch and inspect a recorded source that is not part of the proof build."""\n with tempfile.TemporaryDirectory(prefix="palomar-preservation-", dir=work) as directory:\n checkout = Path(directory) / "source"\n clone_commit(source["repository_url"], source["commit"], checkout)\n validate_preservable_git_checkout(checkout, label)\n if tree_size(checkout) > MAX_SOURCE_BYTES:\n raise VerificationError(f"{label} exceeds the 500 MiB cap")\n if check_lean_sources:\n evidence, issues = inspect_lean_sources(checkout)\n if issues:\n remote_issues = [VerificationError(\n f"{label}: {source[\'repository_url\']} at {source[\'commit\']}: {issue}",\n code=issue.code,\n detail=f"File in the separately pinned substantive source: {issue.path}",\n next_action=("Correct the substantive source, commit it, update the wrapper\'s "\n "substantive source pin, and submit the new wrapper commit."),\n ) for issue in issues]\n raise FormalizationValidationError(remote_issues)\n return evidence\n return None\n\n\ndef strip_lean_comments(text: str) -> str:\n """Replace nested Lean comments with whitespace while preserving line boundaries."""\n result: list[str] = []\n index = 0\n block_depth = 0\n in_string = False\n escaped = False\n while index < len(text):\n pair = text[index : index + 2]\n character = text[index]\n if block_depth:\n if pair == "/-":\n block_depth += 1\n result.extend(" ")\n index += 2\n elif pair == "-/":\n block_depth -= 1\n result.extend(" ")\n index += 2\n else:\n result.append("\\n" if character == "\\n" else " ")\n index += 1\n continue\n if not in_string and pair == "--":\n end = text.find("\\n", index)\n if end == -1:\n result.extend(" " * (len(text) - index))\n break\n result.extend(" " * (end - index))\n result.append("\\n")\n index = end + 1\n continue\n if not in_string and pair == "/-":\n block_depth = 1\n result.extend(" ")\n index += 2\n continue\n result.append(character)\n if in_string:\n if escaped:\n escaped = False\n elif character == "\\\\":\n escaped = True\n elif character == \'"\':\n in_string = False\n elif character == \'"\':\n in_string = True\n index += 1\n if block_depth:\n raise VerificationError("unterminated Lean block comment")\n return "".join(result)\n\n\ndef unique_comparator_object(pairs: list[tuple[str, Any]]) -> dict[str, Any]:\n """Build one JSON object without accepting last-key-wins ambiguity."""\n result: dict[str, Any] = {}\n duplicates: set[str] = set()\n for key, value in pairs:\n if key in result:\n duplicates.add(key)\n result[key] = value\n if duplicates:\n raise VerificationError(\n f"Comparator configuration has duplicate keys: {\', \'.join(sorted(duplicates))}",\n code="comparator.duplicate_key",\n )\n return result\n\n\ndef valid_export_target_name(name: object) -> bool:\n """Accept the canonical name literals that leanexport can decode as targets.\n\n Escaped components and punctuation are rejected here so a target cannot be\n interpreted as an exporter option or panic during argument decoding.\n """\n if not isinstance(name, str) or not name:\n return False\n\n def letterlike(character: str) -> bool:\n # Lean Init/Meta/Defs.lean isLetterLike, shared by the supported floor\n # toolchain and v4.35.0-rc2. Python\'s Unicode isalpha is much broader.\n codepoint = ord(character)\n return (\n (0x3B1 <= codepoint <= 0x3C9 and codepoint != 0x3BB)\n or (0x391 <= codepoint <= 0x3A9 and codepoint not in {0x3A0, 0x3A3})\n or 0x3CA <= codepoint <= 0x3FB\n or 0x1F00 <= codepoint <= 0x1FFE\n or 0x2100 <= codepoint <= 0x214F\n or 0x1D49C <= codepoint <= 0x1D59F\n or (0xC0 <= codepoint <= 0xFF and codepoint not in {0xD7, 0xF7})\n or 0x100 <= codepoint <= 0x17F\n )\n\n def ascii_letter(character: str) -> bool:\n return "a" <= character <= "z" or "A" <= character <= "Z"\n\n def identifier_rest(character: str) -> bool:\n codepoint = ord(character)\n return (\n ascii_letter(character)\n or "0" <= character <= "9"\n or character in "_\'!?"\n or letterlike(character)\n or 0x2080 <= codepoint <= 0x2089\n or 0x2090 <= codepoint <= 0x209C\n or 0x1D62 <= codepoint <= 0x1D6A\n or codepoint == 0x2C7C\n )\n\n for component in name.split("."):\n if not component:\n return False\n if component.isascii() and component.isdecimal():\n if len(component) > 1 and component.startswith("0"):\n return False\n continue\n if not (ascii_letter(component[0]) or component[0] == "_" or letterlike(component[0])):\n return False\n if not all(identifier_rest(character) for character in component[1:]):\n return False\n return True\n\n\ndef load_comparator_config(path: Path) -> dict[str, Any]:\n if path.is_symlink() or not path.is_file():\n raise VerificationError("Comparator configuration is not a regular file")\n if path.stat().st_size > MAX_CONFIGURATION_BYTES:\n raise VerificationError(\n "Comparator configuration exceeds the 1 MiB hard cap",\n code="comparator.too_large",\n )\n try:\n config = json.loads(\n path.read_text(encoding="utf-8"), object_pairs_hook=unique_comparator_object\n )\n except (UnicodeDecodeError, json.JSONDecodeError) as error:\n raise VerificationError(\n "Comparator configuration must contain valid UTF-8 JSON"\n ) from error\n if not isinstance(config, dict):\n raise VerificationError("Comparator configuration must contain one JSON object")\n missing = COMPARATOR_REQUIRED_KEYS - config.keys()\n if missing:\n raise VerificationError(\n f"comparator.json missing: {\', \'.join(sorted(missing))}",\n code="comparator.missing_key",\n )\n # Comparator exposes this switch for other callers, but it is not an\n # authoring requirement here. Palomar always enables the independent\n # replay in its own protected copy below, regardless of what a repository\n # says or whether it carries the compatibility field at all.\n unknown = config.keys() - COMPARATOR_ALLOWED_KEYS\n if unknown:\n raise VerificationError(\n f"comparator.json has unknown keys: {\', \'.join(sorted(unknown))}",\n code="comparator.unknown_key",\n )\n module_source_suffix(config["challenge_module"])\n module_source_suffix(config["solution_module"])\n if config["challenge_module"] == config["solution_module"]:\n raise VerificationError("Comparator Challenge and Solution modules must be distinct")\n theorem_names = config["theorem_names"]\n definition_names = config.get("definition_names", [])\n if not isinstance(theorem_names, list) or not theorem_names:\n raise VerificationError("comparator theorem_names must be a nonempty array")\n if not isinstance(definition_names, list) or not all(\n isinstance(item, str) and item for item in theorem_names + definition_names\n ):\n raise VerificationError("comparator declaration names must be nonempty strings")\n if any(re.search(r"[\\x00-\\x1f\\x7f]", item) for item in theorem_names + definition_names):\n raise VerificationError("comparator declaration names must not contain control characters")\n if not all(valid_export_target_name(item) for item in theorem_names + definition_names):\n raise VerificationError(\n "comparator declaration names must use canonical Lean identifier components",\n code="comparator.invalid_declaration_name",\n )\n axioms = config["permitted_axioms"]\n if not isinstance(axioms, list) or not set(axioms) <= STANDARD_AXIOMS:\n raise VerificationError(\n "comparator permitted_axioms exceed Palomar\'s standard allowlist",\n code="comparator.invalid_axioms",\n )\n return config\n\n\ndef protected_challenge_module(config: dict[str, Any]) -> str:\n """Give the canonical statement an unpredictable per-run top-level namespace."""\n del config\n return f"PalomarCanonical{secrets.token_hex(12)}.Challenge"\n\n\ndef protected_comparator_config(\n source: Path, destination: Path, *, kernels: dict[str, list[str]]\n) -> Path:\n """Write Palomar\'s trusted config: the canonical Challenge alias and its kernels.\n\n The submitted file supplies the modules, declarations and axioms. Palomar\n replaces the Challenge module name with the per-run alias, drops the\n submitter\'s `enable_nanoda` (a switch whose value never mattered here) and\n registers the two bundled external kernels itself.\n """\n config = load_comparator_config(source)\n challenge_module = protected_challenge_module(config)\n protected = {\n "challenge_module": challenge_module,\n "solution_module": config["solution_module"],\n "theorem_names": list(config["theorem_names"]),\n "definition_names": list(config.get("definition_names", [])),\n "permitted_axioms": list(config["permitted_axioms"]),\n "external_kernels": {name: list(argv) for name, argv in kernels.items()},\n }\n write_json(destination, protected)\n # Validate the bytes `lake comparator` will actually consume, not only the\n # object serialized above.\n validate_protected_comparator_config(destination, kernels=kernels)\n written = json.loads(destination.read_text(encoding="utf-8"))\n if written["challenge_module"] != challenge_module:\n raise VerificationError("protected Comparator configuration lost its Challenge alias")\n return destination.resolve(strict=True)\n\n\ndef validate_protected_comparator_config(path: Path, *, kernels: dict[str, list[str]]) -> dict[str, Any]:\n """Require exactly the shape `protected_comparator_config` writes.\n\n The submitter\'s loader rejects `external_kernels`, which is right for a\n submitted file and wrong for Palomar\'s own, so the protected copy has its\n own check: the six keys, the alias namespace, and the kernel commands as\n absolute paths under the selected toolchain.\n """\n if path.is_symlink() or not path.is_file():\n raise VerificationError("protected Comparator configuration is not a regular file")\n config = json.loads(path.read_text(encoding="utf-8"), object_pairs_hook=unique_comparator_object)\n expected_keys = {\n "challenge_module", "solution_module", "theorem_names", "definition_names",\n "permitted_axioms", "external_kernels",\n }\n if not isinstance(config, dict) or set(config) != expected_keys:\n raise VerificationError("protected Comparator configuration has the wrong keys")\n if not re.fullmatch(r"PalomarCanonical[0-9a-f]{24}\\.Challenge", str(config["challenge_module"])):\n raise VerificationError("protected Comparator configuration lost its Challenge alias")\n module_source_suffix(config["solution_module"])\n names = [*config["theorem_names"], *config["definition_names"]]\n if not config["theorem_names"] or not all(valid_export_target_name(item) for item in names):\n raise VerificationError("protected Comparator configuration names invalid declarations")\n if not set(config["permitted_axioms"]) <= STANDARD_AXIOMS:\n raise VerificationError("protected Comparator configuration permits a non-standard axiom")\n if config["external_kernels"] != {name: list(argv) for name, argv in kernels.items()}:\n raise VerificationError("protected Comparator configuration names the wrong kernels")\n for name, argv in config["external_kernels"].items():\n if not re.fullmatch(r"[a-z][a-z0-9-]{0,31}", name):\n raise VerificationError(f"protected Comparator kernel name is invalid: {name}")\n if not argv or not all(isinstance(item, str) and item for item in argv):\n raise VerificationError(f"protected Comparator kernel {name} has an invalid command")\n if not Path(argv[0]).is_absolute():\n raise VerificationError(f"protected Comparator kernel {name} is not an absolute path")\n return config\n\n\ndef prepare(args: argparse.Namespace) -> int:\n global _EXECUTION_DEADLINE\n\n output = Path(args.output).resolve()\n work = Path(args.work_dir).resolve()\n previous_deadline = _EXECUTION_DEADLINE\n report: dict[str, Any] = {\n "schema_version": 1,\n "status": "error",\n "stage": "intake",\n "phase": "preparation",\n "verification_profile": verification_profile_evidence(),\n "checked_at": now(),\n "errors": [],\n "warnings": [],\n }\n try:\n install_execution_deadline(os.environ.get("PALOMAR_JOB_STARTED_AT"))\n event = json.loads(Path(args.event).read_text(encoding="utf-8"))\n values, submission_id = submission_contract.submission_request(event)\n mode = str(event.get("inputs", {}).get("mode") or "full")\n if mode not in {"preflight", "full", "correction"}:\n raise VerificationError("Submission mode is unsupported")\n correction = submission_contract.registry_correction(\n values.get("registry_correction", "").strip()\n )\n repository, url = submission_contract.normalize_repository(\n values.get("repository_url", "")\n )\n commit = values.get("commit_sha", "").strip().lower()\n if not submission_contract.SHA_RE.fullmatch(commit):\n raise VerificationError("Commit SHA must be 40 lowercase hexadecimal characters")\n existing_id = values.get("existing_id", "").strip().upper()\n if existing_id and not submission_contract.PALOMAR_ID_RE.fullmatch(existing_id):\n raise VerificationError(\n "Existing Palomar ID must have the form PALOMAR-2026-07-29-000123"\n )\n raw_relationship = values.get("authorization_relationship", "").strip()\n if raw_relationship:\n authorization_relationship = submission_contract.AUTHORIZATION_RELATIONSHIPS.get(\n raw_relationship\n )\n if authorization_relationship is None:\n raise VerificationError(\n "Relationship to the substantive formalization is not recognized"\n )\n else:\n raise VerificationError(\n "Relationship to the substantive formalization must be declared"\n )\n if (correction is not None) != (authorization_relationship == "palomar-maintainer"):\n raise VerificationError(\n "Registry correction data and Palomar-maintainer authorization must appear together"\n )\n if correction is not None and (\n mode != "correction" or existing_id != correction["based_on"]["id"]\n ):\n raise VerificationError("Registry correction mode or target is inconsistent")\n if correction is None and mode == "correction":\n raise VerificationError("Correction mode carried no registry correction")\n if correction is not None:\n report["schema_version"] = 2\n server_url = os.environ.get("GITHUB_SERVER_URL", "https://github.com")\n workflow_repository = os.environ.get(\n "GITHUB_REPOSITORY", "PalomarRegistry/PalomarSubmission"\n )\n workflow_run_id = os.environ.get("GITHUB_RUN_ID", "")\n if not workflow_run_id.isdigit() or int(workflow_run_id) < 1:\n raise VerificationError("Correction validation has no trusted workflow run id")\n report["workflow_url"] = (\n f"{server_url}/{workflow_repository}/actions/runs/{workflow_run_id}"\n )\n authorization: dict[str, str] = {\n "relationship": authorization_relationship,\n }\n authorization_evidence = values.get("authorization_evidence", "").strip()\n if len(authorization_evidence) > 4_000:\n raise VerificationError("Authorization evidence exceeds 4,000 characters")\n if authorization_evidence:\n authorization["evidence"] = authorization_evidence\n\n raw_project_path = values.get("project_path", "").strip()\n project_relative = (\n normalized_repository_path(raw_project_path, "Project path")\n if raw_project_path\n else None\n )\n project_path_value = project_relative.as_posix() if project_relative is not None else None\n\n report.update(\n {\n "submission": {\n "submission_id": submission_id,\n "authorization": authorization,\n "requested_paths": {\n "project_path": raw_project_path,\n "comparator_config_path": values.get(\n "comparator_config_path", ""\n ).strip(),\n "formalization_metadata_path": values.get(\n "formalization_metadata_path", ""\n ).strip(),\n },\n **({"registry_correction": correction} if correction is not None else {}),\n },\n "source": {\n "repository": repository,\n "repository_url": url,\n "commit": commit,\n "tree_url": project_tree_url(url, commit, project_path_value),\n },\n "existing_id": existing_id or None,\n }\n )\n source = work / "source"\n clone_commit(url, commit, source)\n validate_preservable_git_checkout(source, "submitted source")\n size = tree_size(source)\n if size > MAX_SOURCE_BYTES:\n raise VerificationError("checked-out source exceeds the 500 MiB cap")\n report["source"]["bytes"] = size\n\n project = (\n resolve_repository_path(source, project_relative, "Project path", kind="directory")\n if project_relative is not None\n else source.resolve()\n )\n if project_path_value is not None:\n report["source"]["project_path"] = project_path_value\n\n lakefiles = [\n path\n for name in ("lakefile.toml", "lakefile.lean")\n if (path := project / name).exists() or path.is_symlink()\n ]\n if len(lakefiles) != 1:\n raise VerificationError(\n "project directory must contain exactly one of lakefile.toml or lakefile.lean"\n )\n lakefile = lakefiles[0]\n if lakefile.is_symlink() or not lakefile.is_file():\n raise VerificationError("selected Lakefile is not a regular file")\n if lakefile.stat().st_size > MAX_CONFIGURATION_BYTES:\n raise VerificationError("Lakefile exceeds the 1 MiB hard cap")\n if lakefile.name == "lakefile.toml":\n tomllib.loads(lakefile.read_text(encoding="utf-8"))\n\n raw_metadata_path = values.get("formalization_metadata_path", "").strip()\n metadata_relative = (\n normalized_repository_path(raw_metadata_path, "Formalization metadata path")\n if raw_metadata_path\n else joined_repository_path(project_relative, "formalization.yaml")\n )\n if metadata_relative.name != "formalization.yaml":\n raise VerificationError("Formalization metadata path must name formalization.yaml")\n metadata_path = resolve_repository_path(\n source, metadata_relative, "Formalization metadata path", kind="file"\n )\n preflight_issues: list[tuple[str, BaseException]] = []\n\n def add_issue(stage: str, error: BaseException) -> None:\n if isinstance(error, FormalizationValidationError):\n preflight_issues.extend(\n ("source-requirements" if issue.code.startswith("source.") else stage, issue)\n for issue in error.issues\n )\n else:\n preflight_issues.append((stage, error))\n\n if correction is None:\n report["source_requirements"], source_issues = inspect_lean_sources(source)\n preflight_issues.extend(("source-requirements", issue) for issue in source_issues)\n\n formalization: dict[str, Any] | None = None\n provenance: dict[str, Any] | None = None\n try:\n formalization = submission_contract.load_formalization_metadata(\n metadata_path,\n allow_legacy_orcid_names=correction is not None,\n )\n provenance = submission_contract.normalized_provenance(\n formalization,\n allow_legacy_orcid_names=correction is not None,\n )\n substantive = provenance.get("substantive_formalization")\n if isinstance(substantive, dict):\n substantive_sources = validate_preservable_remote_source(\n work,\n substantive,\n "substantive formalization source",\n check_lean_sources=correction is None,\n )\n if substantive_sources is not None:\n report["source_requirements"]["substantive_formalization"] = substantive_sources\n except Exception as error: # independent preflight group\n if (\n isinstance(error, FormalizationValidationError)\n and any(issue.repairable for issue in error.issues)\n and error.repair_draft is not None\n ):\n report["formalization_repair_draft"] = error.repair_draft\n add_issue("formalization", error)\n\n orcid_validation: dict[str, Any] | None = None\n if formalization is not None and provenance is not None:\n try:\n declared_orcids = set(\n submission_contract.declared_orcids(\n formalization,\n provenance,\n allow_legacy_orcid_names=correction is not None,\n )\n )\n if correction is not None:\n correction_metadata = correction["metadata"]\n groups = [\n correction_metadata["authors"],\n correction_metadata["provenance"]["responsible_maintainers"],\n *(\n source.get("authors", [])\n for source in correction_metadata["provenance"]["mathematical_sources"]\n if isinstance(source, dict)\n ),\n ]\n declared_orcids.update(\n person["orcid"]\n for people in groups\n for person in people\n if isinstance(person, dict) and isinstance(person.get("orcid"), str)\n )\n orcid_validation = validate_orcid_records(sorted(declared_orcids))\n except Exception as error: # independent external-registry group\n add_issue("orcid", error)\n\n license_record: dict[str, Any] | None = None\n try:\n license_path = repository_license_file(source)\n detected_license = detect_spdx_identifier(\n license_path, Path(args.licensee).resolve()\n )\n declared_license = (\n formalization["project"]["license"].strip()\n if formalization is not None\n else None\n )\n license_record = {\n "path": license_path.name,\n "sha256": sha256(license_path),\n "declared_identifier": declared_license,\n "detected_identifier": detected_license,\n }\n if declared_license is not None and declared_license != detected_license:\n raise LicenseValidationError(\n "formalization.yaml field project.license "\n f"declares {declared_license!r}, but {license_path.name} matches "\n f"{detected_license!r}"\n )\n except Exception as error: # independent preflight group\n add_issue("license", error)\n\n toolchain_path: Path | None = None\n toolchain: str | None = None\n lean4_commit: str | None = None\n try:\n project_toolchain = project / "lean-toolchain"\n root_toolchain = source / "lean-toolchain"\n toolchain_path = project_toolchain if project_toolchain.exists() else root_toolchain\n if toolchain_path.is_symlink() or not toolchain_path.is_file():\n raise VerificationError(\n "lean-toolchain must be a regular file in the project or repository root",\n code="toolchain.missing",\n path="lean-toolchain",\n next_action=(\n "Add a regular lean-toolchain file to the project or repository root, "\n "commit it, and make a new submission."\n ),\n )\n toolchain = toolchain_path.read_text(encoding="utf-8").strip()\n lean4_commit = toolchain_commit(toolchain)\n except Exception as error: # independent preflight group\n add_issue("toolchain", error)\n\n config_relative: Path | None = None\n config_path: Path | None = None\n config: dict[str, Any] | None = None\n manifest_path = project / "lake-manifest.json"\n try:\n raw_config_path = values.get("comparator_config_path", "").strip()\n if not raw_config_path:\n raise VerificationError(\n "Comparator configuration path must be supplied explicitly for this submission",\n code="comparator.path_missing",\n next_action=(\n "Enter the repository-relative comparator.json path and submit again."\n ),\n )\n config_relative = normalized_repository_path(\n raw_config_path, "Comparator configuration path"\n )\n if config_relative.suffix.lower() != ".json":\n raise VerificationError(\n "Comparator configuration path must name a .json file",\n code="comparator.path_invalid",\n )\n config_path = resolve_repository_path(\n source, config_relative, "Comparator configuration path", kind="file"\n )\n try:\n config_path.relative_to(project)\n except ValueError as error:\n raise VerificationError(\n "Comparator configuration path must be inside the selected project",\n code="comparator.path_outside_project",\n ) from error\n config = load_comparator_config(config_path)\n if manifest_path.is_symlink():\n raise VerificationError("project lake-manifest.json must not be a symlink")\n if lakefile.name == "lakefile.lean" and not manifest_path.is_file():\n raise VerificationError(\n "lakefile.lean projects require a committed lake-manifest.json"\n )\n except Exception as error: # independent preflight group\n add_issue("comparator-config", error)\n\n if preflight_issues:\n report["stage"] = "preflight"\n for issue_stage, issue in preflight_issues:\n report["errors"].append(str(issue))\n report_diagnostic(report, issue, stage=issue_stage)\n owners = {\n item.get("owner")\n for item in report.get("diagnostics", [])\n if isinstance(item, dict)\n }\n report["status"] = "error" if owners - {"submitter"} else "fail"\n if license_record is not None:\n report["license"] = license_record\n write_json(output, report)\n workflow_output(ready="false", lean_toolchain="")\n return 0\n\n assert formalization is not None and provenance is not None\n assert orcid_validation is not None\n assert license_record is not None\n assert toolchain_path is not None and toolchain is not None and lean4_commit is not None\n assert config_relative is not None and config_path is not None and config is not None\n correction_evidence = (\n correction_source_evidence(\n correction,\n checkout=source,\n repository=repository,\n commit=commit,\n )\n if correction is not None\n else None\n )\n report["license"] = license_record\n lakefile_relative = repository_relative_path(source, lakefile)\n toolchain_relative = repository_relative_path(source, toolchain_path)\n report.update(\n {\n "lean_toolchain": toolchain,\n "lean_toolchain_path": toolchain_relative,\n "toolchain_commit": lean4_commit,\n "challenge": {\n "module": config["challenge_module"],\n **(correction_evidence["challenge"] if correction_evidence else {}),\n },\n "solution": {\n "module": config["solution_module"],\n **(correction_evidence["solution"] if correction_evidence else {}),\n },\n "formalization": {\n "path": metadata_relative.as_posix(),\n "sha256": sha256(metadata_path),\n "project_name": formalization["project"]["name"].strip(),\n "source_count": len(provenance["mathematical_sources"]),\n "automation_method_count": len(formalization["automation"]["methods"]),\n "review_status": formalization["review"]["status"].strip(),\n },\n "classification": {\n "arxiv": [\n {\n "code": code,\n "name": submission_contract.ARXIV_CATEGORY_NAMES[code],\n }\n for code in formalization["classification"]["arxiv"]\n ],\n "msc2020": [\n {\n "code": code,\n "name": submission_contract.MSC2020_NAMES[code],\n }\n for code in formalization["classification"].get("msc2020", [])\n ],\n },\n "provenance": provenance,\n "orcid_validation": orcid_validation,\n "lakefile": {\n "path": lakefile_relative,\n "sha256": sha256(lakefile),\n "format": "lean" if lakefile.name == "lakefile.lean" else "toml",\n },\n "comparator": {\n "path": config_relative.as_posix(),\n "sha256": sha256(config_path),\n "challenge_module": config["challenge_module"],\n "solution_module": config["solution_module"],\n "theorem_names": config["theorem_names"],\n "definition_names": config.get("definition_names", []),\n "permitted_axioms": config["permitted_axioms"],\n },\n }\n )\n if manifest_path.is_file():\n report["lake_manifest"] = {\n "path": repository_relative_path(source, manifest_path),\n "sha256": sha256(manifest_path),\n }\n write_json(work / "metadata.json", report)\n report["status"] = "pass" if correction is not None else "pending"\n report["stage"] = "correction-validation" if correction is not None else "prepared"\n if correction is not None:\n report["phase"] = "complete"\n write_json(output, report)\n workflow_output(\n ready="false" if correction is not None else "true",\n lean_toolchain=toolchain,\n )\n except LicenseValidationError as error:\n report["status"] = "fail"\n report["stage"] = "license"\n report["errors"].append(str(error))\n report_diagnostic(report, error, stage="license")\n write_json(output, report)\n workflow_output(ready="false", lean_toolchain="")\n except FormalizationValidationError as error:\n report["status"] = "fail"\n report["stage"] = "formalization"\n report["errors"].extend(str(issue) for issue in error.issues)\n report_diagnostic(report, error, stage="formalization")\n write_json(output, report)\n workflow_output(ready="false", lean_toolchain="")\n except Exception as error: # noqa: BLE001 -- all intake failures become a bounded report\n report["errors"].append(str(error))\n report["status"] = "fail" if isinstance(error, VerificationError) else "error"\n report_diagnostic(report, error)\n write_json(output, report)\n workflow_output(ready="false", lean_toolchain="")\n finally:\n _EXECUTION_DEADLINE = previous_deadline\n return 0\n\n\ndef github_repository(url: str) -> str | None:\n parsed = urlparse(url)\n if parsed.hostname and parsed.hostname.lower() != "github.com":\n return None\n if parsed.scheme in {"http", "https", "git"}:\n path = parsed.path\n elif url.startswith("git@github.com:"):\n path = url.split(":", 1)[1]\n else:\n return None\n path = path.strip("/")\n path = path.removesuffix(".git")\n parts = path.split("/")\n if len(parts) != 2 or not all(parts):\n return None\n return f"{parts[0]}/{parts[1]}"\n\n\ndef manifest_packages(source: Path) -> list[dict[str, str]]:\n path = source / "lake-manifest.json"\n if not path.is_file():\n return []\n data = json.loads(path.read_text(encoding="utf-8"))\n packages = []\n # Escaped and bare spellings of one name share a Lake checkout directory.\n seen_names: set[str] = set()\n for package in data.get("packages", []):\n manifest_name = package.get("name")\n name = submission_contract.lake_package_name(manifest_name)\n if name is None:\n raise VerificationError(f"unsafe package name in Lake manifest: {manifest_name!r}")\n if name in seen_names:\n raise VerificationError(f"duplicate package name in Lake manifest: {name!r}")\n seen_names.add(name)\n package_type = package.get("type")\n url = package.get("url")\n if package_type == "git":\n repository = github_repository(url) if isinstance(url, str) else None\n if repository is None:\n raise VerificationError(\n f"Git package {str(package.get(\'name\') or \'\')!r} must be hosted on GitHub"\n )\n revision = str(package.get("rev") or package.get("inputRev") or "")\n if not submission_contract.SHA_RE.fullmatch(revision):\n raise VerificationError(\n f"Git package {str(package.get(\'name\') or \'\')!r} is not pinned to a full commit"\n )\n elif package_type == "path":\n directory = str(package.get("dir") or "")\n repository = f"path:{directory}"\n url = repository\n revision = "source-tree"\n else:\n repository = f"{package_type or \'unknown\'}:{package.get(\'name\') or \'\'}"\n url = repository\n revision = str(package.get("rev") or package.get("inputRev") or "unknown")\n packages.append(\n {\n "name": name,\n "manifest_name": manifest_name,\n "repository": repository,\n "url": url,\n "revision": revision,\n }\n )\n return packages\n\n\ndef contained_path_dependency(\n project: Path, raw_value: str, checkout: Path, name: str\n) -> Path:\n """Resolve a Lake path dependency without following submitted symlinks."""\n relative = pathlib.PurePosixPath(raw_value)\n if (\n not raw_value\n or raw_value != relative.as_posix()\n or relative.is_absolute()\n or "\\\\" in raw_value\n or any(ord(character) < 32 or ord(character) == 127 for character in raw_value)\n ):\n raise VerificationError(f"path package {name!r} has an unsafe directory")\n boundary = checkout.resolve()\n candidate = project.resolve()\n for segment in relative.parts:\n candidate /= segment\n if candidate.is_symlink():\n raise VerificationError(f"path package {name!r} contains a symlinked component")\n try:\n candidate.resolve().relative_to(boundary)\n except ValueError as error:\n raise VerificationError(\n f"path package {name!r} escapes the repository checkout"\n ) from error\n resolved = candidate.resolve()\n if any(part == ".lake" for part in resolved.relative_to(boundary).parts):\n raise VerificationError(f"path package {name!r} may not live under .lake")\n if resolved == project.resolve() or not resolved.is_dir():\n raise VerificationError(f"path package {name!r} is not a distinct regular directory")\n return resolved\n\n\ndef ensure_lake_manifest(project: Path, checkout: Path) -> bool:\n """Create a trusted manifest for a simple TOML path-dependency workspace.\n\n Nested Comparator workspaces often depend on the repository\'s main project\n by path but omit their own generated manifest. Reuse only already-pinned,\n committed manifests from contained path targets; never run submitted Lake\n configuration or resolve a moving Git reference to manufacture the lock.\n Returns true when a manifest was generated.\n """\n manifest = project / "lake-manifest.json"\n if manifest.is_symlink():\n raise VerificationError("project lake-manifest.json must not be a symlink")\n if manifest.is_file():\n data = json.loads(manifest.read_text(encoding="utf-8"))\n if not isinstance(data, dict) or not isinstance(data.get("packages", []), list):\n raise VerificationError("lake-manifest.json must contain one manifest object")\n return False\n if manifest.exists():\n raise VerificationError("project lake-manifest.json must be a regular file")\n\n # Only a declarative lakefile.toml can be read without running it, so it is\n # the only shape whose dependencies can be established without a manifest.\n lakefile = project / "lakefile.toml"\n if lakefile.is_symlink() or not lakefile.is_file():\n raise VerificationError(\n "a project with no committed lake-manifest.json must configure Lake with "\n "a regular lakefile.toml"\n )\n try:\n configuration = tomllib.loads(lakefile.read_text(encoding="utf-8"))\n except (OSError, UnicodeDecodeError, tomllib.TOMLDecodeError) as error:\n raise VerificationError(f"invalid lakefile.toml: {error}") from error\n requirements = configuration.get("require", [])\n if not isinstance(requirements, list):\n raise VerificationError("lakefile.toml require entries must be an array")\n\n boundary = checkout.resolve()\n packages: list[dict[str, Any]] = []\n seen_names: set[str] = set()\n packages_directories: set[Path] = set()\n\n def add(package: dict[str, Any], *, inherited: bool) -> None:\n name = submission_contract.lake_package_name(package.get("name"))\n if name is None:\n raise VerificationError(f"invalid Lake package name: {package.get(\'name\')!r}")\n if name in seen_names:\n raise VerificationError(f"duplicate Lake package name: {name!r}")\n seen_names.add(name)\n candidate = dict(package)\n candidate["inherited"] = inherited\n packages.append(candidate)\n\n for requirement in requirements:\n if not isinstance(requirement, dict):\n raise VerificationError("lakefile.toml require entries must be objects")\n manifest_name = requirement.get("name")\n name = submission_contract.lake_package_name(manifest_name)\n raw_path = requirement.get("path")\n if name is None:\n raise VerificationError(f"invalid direct Lake package name: {manifest_name!r}")\n if not isinstance(raw_path, str):\n raise VerificationError(\n "a TOML project without lake-manifest.json may use only contained path "\n "dependencies whose targets have committed manifests"\n )\n target = contained_path_dependency(project, raw_path, boundary, name)\n target_lakefiles = [\n target / filename\n for filename in ("lakefile.toml", "lakefile.lean")\n if (target / filename).exists() or (target / filename).is_symlink()\n ]\n if len(target_lakefiles) != 1 or target_lakefiles[0].is_symlink():\n raise VerificationError(f"path package {name!r} has no unique regular Lakefile")\n target_manifest = target / "lake-manifest.json"\n if target_manifest.is_symlink() or not target_manifest.is_file():\n raise VerificationError(\n f"path package {name!r} must have a committed lake-manifest.json"\n )\n try:\n target_data = json.loads(target_manifest.read_text(encoding="utf-8"))\n except (OSError, UnicodeDecodeError, json.JSONDecodeError) as error:\n raise VerificationError(f"path package {name!r} has an invalid manifest: {error}") from error\n target_packages = target_data.get("packages") if isinstance(target_data, dict) else None\n if not isinstance(target_packages, list):\n raise VerificationError(f"path package {name!r} has an invalid manifest")\n target_packages_dir = manifest_packages_directory(target, checkout=boundary)\n packages_directories.add(target_packages_dir)\n add(\n {\n "type": "path",\n "scope": "",\n "name": (\n manifest_name if manifest_name.startswith("\\u00ab")\n else submission_contract.lake_manifest_name(name)\n ),\n "manifestFile": "lake-manifest.json",\n "dir": raw_path,\n "configFile": target_lakefiles[0].name,\n },\n inherited=False,\n )\n for package in target_packages:\n if not isinstance(package, dict) or package.get("type") == "path":\n raise VerificationError(\n f"path package {name!r} manifest has an unsupported nested path dependency"\n )\n add(package, inherited=True)\n\n if len(packages_directories) > 1:\n raise VerificationError(\n "path dependencies use different packages directories; commit this project\'s manifest"\n )\n packages_dir = next(iter(packages_directories), project / ".lake" / "packages")\n packages_dir_value = Path(os.path.relpath(packages_dir, project)).as_posix()\n generated = {\n "version": "1.2.0",\n "packagesDir": packages_dir_value,\n "packages": packages,\n "name": str(configuration.get("name") or project.name),\n "lakeDir": ".lake",\n "fixedToolchain": False,\n }\n write_json(manifest, generated)\n return True\n\n\ndef manifest_packages_directory(source: Path, *, checkout: Path) -> Path:\n """Resolve Lake\'s packages directory within the verifier-owned checkout."""\n manifest = source / "lake-manifest.json"\n directory = ".lake/packages"\n if manifest.is_file() and not manifest.is_symlink():\n data = json.loads(manifest.read_text(encoding="utf-8"))\n if not isinstance(data, dict):\n raise VerificationError("lake-manifest.json must contain one JSON object")\n directory = str(data.get("packagesDir") or directory)\n raw = Path(directory)\n if raw.is_absolute() or "\\\\" in directory or any(\n ord(character) < 32 or ord(character) == 127 for character in directory\n ):\n raise VerificationError("Lake manifest packagesDir must be a safe relative path")\n resolved = (source / raw).resolve()\n boundary = checkout.resolve()\n try:\n resolved.relative_to(boundary)\n except ValueError as error:\n raise VerificationError("Lake manifest packagesDir escapes the repository checkout") from error\n if resolved.name != "packages" or resolved.parent.name != ".lake":\n raise VerificationError("Lake manifest packagesDir must name a contained .lake/packages directory")\n return resolved\n\n\ndef recorded_project_dependencies(\n source: Path, checkout: Path, packages: list[dict[str, str]]\n) -> list[dict[str, str]]:\n records: list[dict[str, str]] = []\n for package in packages:\n if package["url"].startswith("path:"):\n target = package_checkout(source, package, checkout=checkout)\n relative = target.relative_to(checkout.resolve()).as_posix()\n records.append({"name": package["name"], "path": relative or "."})\n else:\n records.append(\n {\n "name": package["name"],\n "repository": package["repository"],\n "url": package["url"],\n "revision": package["revision"],\n }\n )\n return records\n\n\n\ndef allowed_roots() -> tuple[list[dict[str, Any]], dict[str, dict[str, Any]]]:\n """Load canonical allowlisted roots and a case-insensitive alias index."""\n config = json.loads((ROOT / "allowed-challenge-repositories.json").read_text(encoding="utf-8"))\n roots = config.get("roots")\n if not isinstance(roots, list):\n raise VerificationError("allowlisted roots configuration is malformed")\n aliases: dict[str, dict[str, Any]] = {}\n for root in roots:\n if not isinstance(root, dict):\n raise VerificationError("allowlisted root entry is malformed")\n repository = root.get("repository")\n official_ref = root.get("official_ref")\n accepted_revisions = root.get("accepted_revisions", [])\n include_semver_release_tags = root.get("include_semver_release_tags", False)\n trust_level = root.get("trust_level")\n repository_aliases = root.get("repository_aliases", [])\n if (\n not isinstance(repository, str)\n or github_repository(f"https://github.com/{repository}") != repository\n or not isinstance(official_ref, str)\n or not OFFICIAL_REF_RE.fullmatch(official_ref)\n or not isinstance(accepted_revisions, list)\n or not all(\n isinstance(revision, str)\n and submission_contract.SHA_RE.fullmatch(revision)\n for revision in accepted_revisions\n )\n or len(set(accepted_revisions)) != len(accepted_revisions)\n or type(include_semver_release_tags) is not bool\n or trust_level not in {"high", "qualified"}\n or root.get("include_pinned_manifest_closure") is not True\n or not isinstance(repository_aliases, list)\n or not all(isinstance(alias, str) for alias in repository_aliases)\n ):\n raise VerificationError(f"invalid allowlisted root configuration: {repository!r}")\n for alias in [repository, *repository_aliases]:\n if github_repository(f"https://github.com/{alias}") != alias:\n raise VerificationError(f"invalid repository alias in allowlist: {alias!r}")\n normalized = alias.lower()\n if normalized in aliases:\n raise VerificationError(f"duplicate repository alias in allowlist: {alias}")\n aliases[normalized] = root\n return roots, aliases\n\n\ndef canonical_repository(repository: str, aliases: dict[str, dict[str, Any]]) -> str:\n root = aliases.get(repository.lower())\n return str(root["repository"]) if root else repository\n\n\ndef git_environment(source: Path, base_env: dict[str, str]) -> dict[str, str]:\n return {\n "HOME": str(source / ".lake" / "config" / "git-home"),\n "PATH": base_env["PATH"],\n "GIT_CONFIG_GLOBAL": "/dev/null",\n "GIT_CONFIG_NOSYSTEM": "1",\n "GIT_TERMINAL_PROMPT": "0",\n "GIT_LFS_SKIP_SMUDGE": "1",\n }\n\n\ndef verify_official_revision(\n package_dir: Path,\n *,\n repository: str,\n revision: str,\n official_ref: str,\n accepted_revisions: list[str] | None = None,\n git_env: dict[str, str],\n include_semver_release_tags: bool = False,\n) -> None:\n """Require a package commit to occur in the canonical repository\'s official history."""\n if revision in (accepted_revisions or []):\n return\n fetched_ref = "refs/remotes/palomar-official/head"\n git = [\n "git",\n "-c",\n "core.hooksPath=/dev/null",\n "-c",\n "protocol.file.allow=never",\n *GIT_NO_AUTO_MAINTENANCE,\n "-C",\n str(package_dir),\n ]\n run([*git, "remote", "add", "palomar-official", f"https://github.com/{repository}"], env=git_env)\n run(\n [\n *git,\n "fetch",\n "--quiet",\n "--filter=tree:0",\n "--no-tags",\n "palomar-official",\n f"+{official_ref}:{fetched_ref}",\n ],\n env=git_env,\n timeout=EXECUTION_BUDGET_SECONDS,\n )\n ancestry = run(\n [*git, "merge-base", "--is-ancestor", revision, fetched_ref],\n env=git_env,\n check=False,\n )\n if ancestry.returncode == 1:\n if include_semver_release_tags:\n tags = revision_release_tags(\n git,\n revision,\n env=git_env,\n remote="palomar-official",\n )\n if any(VERSION_RE.fullmatch(tag) for tag in tags):\n return\n raise VerificationError(\n f"{repository} revision {revision} is not an ancestor of canonical {official_ref} "\n "and is not named by an accepted canonical release tag"\n )\n if ancestry.returncode:\n raise VerificationError(f"could not establish official ancestry for {repository}")\n\n\ndef package_allowlist(\n source: Path,\n packages: list[dict[str, str]],\n *,\n checkout: Path,\n base_env: dict[str, str],\n) -> dict[str, tuple[str, str]]:\n """Verify roots and their exact official manifest closures, then map trusted package names."""\n roots, aliases = allowed_roots()\n by_name: dict[str, dict[str, str]] = {}\n for package in packages:\n name = package["name"]\n if not name or name in by_name:\n raise VerificationError(f"duplicate or empty package name in Lake manifest: {name!r}")\n by_name[name] = package\n\n allowed: dict[str, tuple[str, str]] = {}\n # Mathlib wins overlap so its infrastructure remains a high-trust surface.\n roots = sorted(roots, key=lambda root: root["trust_level"] != "high")\n git_env = git_environment(source, base_env)\n for root in roots:\n display = str(root["repository"])\n level = str(root["trust_level"])\n matching = [\n package\n for package in packages\n if canonical_repository(str(package["repository"]), aliases).lower() == display.lower()\n ]\n if len(matching) > 1:\n names = ", ".join(repr(package["name"]) for package in matching)\n raise VerificationError(\n f"Lake manifest assigns multiple package names to allowlisted "\n f"repository {display}: {names}"\n )\n for root_package in matching:\n package_dir = package_checkout(source, root_package, checkout=checkout)\n verify_official_revision(\n package_dir,\n repository=display,\n revision=root_package["revision"],\n official_ref=str(root["official_ref"]),\n accepted_revisions=list(root.get("accepted_revisions", [])),\n git_env=git_env,\n include_semver_release_tags=bool(\n root.get("include_semver_release_tags", False)\n ),\n )\n nested = manifest_packages(package_dir)\n closure = {root_package["name"]}\n for expected in nested:\n name = expected["name"]\n actual = by_name.get(name)\n if actual is None:\n raise VerificationError(\n f"submitted manifest omits {display}\'s pinned dependency {name!r}"\n )\n expected_repository = canonical_repository(str(expected["repository"]), aliases)\n actual_repository = canonical_repository(str(actual["repository"]), aliases)\n if (\n actual_repository.lower() != expected_repository.lower()\n or actual["revision"] != expected["revision"]\n ):\n raise VerificationError(\n f"submitted manifest substitutes {display}\'s pinned dependency {name!r}"\n )\n closure.add(name)\n for name in closure:\n allowed.setdefault(name, (display, level))\n return allowed\n\n\ndef package_checkout(source: Path, package: dict[str, str], *, checkout: Path) -> Path:\n """Return the already-materialized checkout for one manifest package."""\n if package["url"].startswith("path:"):\n return contained_path_dependency(\n source,\n package["url"].removeprefix("path:"),\n checkout,\n package["name"],\n )\n return (\n manifest_packages_directory(source, checkout=checkout) / package["name"]\n ).resolve()\n\n\ndef shadowing_dependency(\n module: str, packages: list[dict[str, str]], *, source: Path, checkout: Path\n) -> str | None:\n """The dependency whose top-level directory would capture `module`\'s source.\n\n Lean finds a module\'s source by the first component of its name: the first\n search-path root that holds a directory or file of that name wins, and\n Lake lists dependencies before the root package. A Challenge whose\n top-level directory shares its name with a dependency\'s is therefore looked\n for inside the dependency, where it is not, when Verso renders it. The\n verifier\'s own phases never use that lookup (Lake builds and `leanexport`\n go by the library configuration), so this is checked here, where the\n submitter still has a cheap correction, instead of surfacing after review\n as a render that fails the same way every time.\n """\n root = module.split(".", 1)[0]\n for package in packages:\n directory = package_checkout(source, package, checkout=checkout)\n if (directory / root).is_dir() or (directory / f"{root}.lean").is_file():\n return package["name"]\n return None\n\n\ndef module_root_shadowed(module: str, dependency: str) -> VerificationError:\n root = module.split(".", 1)[0]\n return VerificationError(\n f"the Challenge module\'s top-level name {root!r} is also a top-level entry of the "\n f"dependency {dependency!r}, which is where Verso would look for its source",\n code="challenge.module_root_shadowed",\n field="comparator.challenge_module",\n next_action=(\n "Move the Challenge module under a top-level directory that no dependency also has "\n "at its top level, update challenge_module in comparator.json, commit the change, "\n "and make a new submission."\n ),\n )\n\n\ndef check_mathlib_toolchain(\n source: Path, packages: list[dict[str, str]], *, checkout: Path,\n project_toolchain: str, project_toolchain_path: str,\n) -> list[dict[str, str]]:\n """Compare the selected project toolchain with the authenticated Mathlib checkout."""\n _roots, aliases = allowed_roots()\n evidence = []\n for package in packages:\n if canonical_repository(package["repository"], aliases).lower() != "leanprover-community/mathlib4":\n continue\n path = package_checkout(source, package, checkout=checkout) / "lean-toolchain"\n mathlib_toolchain = path.read_text(encoding="utf-8").strip()\n evidence.append({"revision": package["revision"], "toolchain": mathlib_toolchain})\n if (parse_lean_version(project_toolchain, TOOLCHAIN_RE)\n != parse_lean_version(mathlib_toolchain, TOOLCHAIN_RE)):\n raise VerificationError(\n f"Project toolchain {project_toolchain_path} selects {project_toolchain}, but canonical "\n f"Mathlib at {package[\'revision\']} selects {mathlib_toolchain}. Align the project toolchain "\n "and pinned Mathlib revision, then regenerate lake-manifest.json.",\n code="toolchain.mathlib_mismatch", owner="submitter", retryable=False,\n next_action=("Align lean-toolchain and the resolved Mathlib revision; "\n "resubmit the updated commit."),\n )\n return evidence\n\n\ndef trusted_package_url_map(\n packages: list[dict[str, str]], authoritative_packages: list[dict[str, str]]\n) -> str:\n """Pin trusted Lake dependency remotes to the authenticated root manifest."""\n _roots, aliases = allowed_roots()\n by_name = {package["name"]: package for package in packages}\n urls: dict[str, str] = {}\n for expected in sorted(authoritative_packages, key=lambda package: package["name"]):\n name = expected["name"]\n actual = by_name.get(name)\n if actual is None:\n raise VerificationError(f"trusted package {name!r} is absent from the manifest")\n expected_url = expected["url"]\n if actual["url"].startswith("path:") or expected_url.startswith("path:"):\n raise VerificationError(f"trusted package {name!r} may not use a path dependency")\n parsed_expected = urlparse(expected_url)\n if (\n parsed_expected.scheme != "https"\n or parsed_expected.netloc.lower() != "github.com"\n or parsed_expected.username\n or parsed_expected.password\n or parsed_expected.query\n or parsed_expected.fragment\n ):\n raise VerificationError(\n f"trusted package {name!r} authenticated URL is not a credential-free "\n "HTTPS GitHub remote"\n )\n actual_repository = github_repository(actual["url"])\n expected_repository = github_repository(expected_url)\n if (\n actual_repository is None\n or expected_repository is None\n or canonical_repository(actual_repository, aliases).lower()\n != canonical_repository(expected_repository, aliases).lower()\n ):\n raise VerificationError(\n f"trusted package {name!r} URL does not match its authenticated repository"\n )\n if actual.get("revision") != expected.get("revision"):\n raise VerificationError(\n f"trusted package {name!r} revision does not match its verified manifest"\n )\n if actual["manifest_name"] != expected["manifest_name"]:\n raise VerificationError(f"trusted package {name!r} has a different manifest spelling")\n urls[expected["manifest_name"]] = expected_url\n return json.dumps(urls, sort_keys=True, separators=(",", ":"))\n\n\ndef package_lake_directories(\n source: Path, name: str, *, checkout: Path\n) -> tuple[Path, Path]:\n package = next((item for item in manifest_packages(source) if item["name"] == name), None)\n if package is None:\n raise VerificationError(f"trusted package {name!r} is absent from the manifest")\n boundary = checkout.resolve()\n package_dir = package_checkout(source, package, checkout=boundary)\n return _validated_package_lake_directories(package_dir, name, boundary)\n\n\ndef _validated_package_lake_directories(\n package_dir: Path, name: str, boundary: Path\n) -> tuple[Path, Path]:\n """Resolve one package\'s writable Lake leaves inside an explicit boundary."""\n result: list[Path] = []\n for leaf in ("build", "config"):\n candidate = package_dir / ".lake" / leaf\n try:\n relative = pathlib.PurePosixPath(candidate.relative_to(boundary).as_posix())\n except ValueError as error:\n raise VerificationError(\n f"trusted package {name!r} Lake directory escapes the repository checkout"\n ) from error\n result.append(\n resolve_repository_path(\n boundary,\n relative,\n f"trusted package {name!r} Lake {leaf} directory",\n kind="directory",\n )\n )\n return result[0], result[1]\n\n\ndef trusted_lake_directories(\n source: Path, names: Any, *, checkout: Path\n) -> list[Path]:\n result: list[Path] = []\n for name in names:\n for directory in package_lake_directories(source, name, checkout=checkout):\n if not directory.is_dir():\n raise VerificationError(f"trusted package Lake directory is missing: {directory}")\n result.append(directory)\n return sorted(set(result))\n\n\ndef reset_trusted_lake_state(\n source: Path,\n names: Any,\n *,\n packages: list[dict[str, str]],\n checkout: Path,\n) -> list[Path]:\n """Validate, then recreate each trusted package\'s writable Lake state."""\n requested = set(names)\n boundary = checkout.resolve()\n packages_directory = manifest_packages_directory(source, checkout=boundary)\n package_directories: list[Path] = []\n selected: set[str] = set()\n for package in packages:\n name = package["name"]\n if name not in requested:\n continue\n if name in selected:\n raise VerificationError(f"duplicate trusted package name: {name!r}")\n selected.add(name)\n if package["url"].startswith("path:"):\n raise VerificationError(f"trusted package {name!r} may not use a path dependency")\n if not re.fullmatch(r"[A-Za-z0-9_.-]+", name) or name in {".", ".."}:\n raise VerificationError(f"unsafe trusted package name: {name!r}")\n package_dir = (packages_directory / name).resolve()\n # Validate every target before deleting any state. A redirected or\n # malformed package therefore fails without touching another package.\n _validated_package_lake_directories(package_dir, name, boundary)\n package_directories.append(package_dir)\n missing = requested - selected\n if missing:\n name = min(missing)\n raise VerificationError(f"trusted package {name!r} is absent from the manifest")\n\n writable: list[Path] = []\n for package_dir in package_directories:\n writable.extend(remove_untrusted_lake_state(package_dir))\n return writable\n\n\ndef nested_package_links(\n source: Path,\n root_package: Path,\n *,\n checkout: Path,\n allowed_names: set[str],\n) -> Path:\n """Give a trusted root its exact flattened closure without running Lake update."""\n nested = root_package / ".lake" / "packages"\n if nested.exists() or nested.is_symlink():\n raise VerificationError(f"trusted package directory was not freshly prepared: {nested}")\n nested.mkdir()\n by_name = {package["name"]: package for package in manifest_packages(source)}\n for expected in manifest_packages(root_package):\n name = expected["name"]\n if name not in allowed_names:\n raise VerificationError(\n f"trusted root dependency {name!r} is outside its verified manifest closure"\n )\n actual = by_name.get(name)\n if actual is None:\n raise VerificationError(f"trusted root dependency {name!r} is not materialized")\n if (\n actual["repository"].lower() != expected["repository"].lower()\n or actual["revision"] != expected["revision"]\n ):\n raise VerificationError(\n f"trusted root dependency {name!r} does not match its pinned manifest"\n )\n target = package_checkout(source, actual, checkout=checkout)\n if not target.is_dir() or target.is_symlink():\n raise VerificationError(f"trusted root dependency is not a real checkout: {target}")\n (nested / name).symlink_to(target, target_is_directory=True)\n return nested.resolve()\n\n\ndef build_allowlisted_roots(\n source: Path,\n *,\n checkout: Path,\n packages: list[dict[str, str]],\n allowlist: dict[str, tuple[str, str]],\n base_env: dict[str, str],\n lake: Path,\n readable_paths: list[Path],\n executable_paths: list[Path],\n tools: dict[Path, str],\n) -> None:\n """Build non-Mathlib trusted roots from freshly reset Lake state."""\n roots, aliases = allowed_roots()\n by_name = {package["name"]: package for package in packages}\n for root in sorted(roots, key=lambda item: item["trust_level"] != "high"):\n repository = str(root["repository"])\n if repository.lower() == "leanprover-community/mathlib4":\n # Mathlib and its official closure come from its explicitly trusted cache.\n continue\n root_package = next(\n (\n package\n for package in packages\n if canonical_repository(package["repository"], aliases).lower() == repository.lower()\n ),\n None,\n )\n if root_package is None:\n continue\n root_dir = package_checkout(source, root_package, checkout=checkout)\n closure = {\n root_package["name"],\n *(dependency["name"] for dependency in manifest_packages(root_dir)),\n }\n if not closure <= allowlist.keys() or not closure <= by_name.keys():\n raise VerificationError(f"trusted root {repository} has an incomplete closure")\n owned_names = {\n name for name, (owner, _level) in allowlist.items() if owner == repository\n }\n if root_package["name"] not in owned_names:\n raise VerificationError(f"trusted root {repository} has no unique package role")\n trusted_directories = reset_trusted_lake_state(\n source,\n owned_names,\n packages=packages,\n checkout=checkout,\n )\n nested = nested_package_links(\n source, root_dir, checkout=checkout, allowed_names=closure\n )\n build_env = base_env.copy()\n build_env["LAKE_PKG_URL_MAP"] = trusted_package_url_map(\n packages, manifest_packages(root_dir)\n )\n home = root_dir / ".lake" / "config" / "home"\n temporary = root_dir / ".lake" / "config" / "tmp"\n home.mkdir(exist_ok=True)\n temporary.mkdir(exist_ok=True)\n build_env.update(\n {"HOME": str(home.resolve()), "TMPDIR": str(temporary.resolve()), "LEAN_ABORT_ON_PANIC": "1"}\n )\n writable = validate_writable_directories(checkout, trusted_directories)\n try:\n sandboxed_run(\n [str(lake), "build"],\n cwd=root_dir,\n environment=build_env,\n writable_directories=writable,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n timeout=EXECUTION_BUDGET_SECONDS,\n )\n finally:\n if nested.is_dir():\n shutil.rmtree(nested)\n\n\n\ndef source_package(path: Path, source: Path, *, checkout: Path) -> str | None:\n packages = manifest_packages_directory(source, checkout=checkout)\n try:\n relative = path.resolve().relative_to(packages)\n except ValueError:\n return None\n return relative.parts[0] if relative.parts else None\n\n\ndef remove_untrusted_lake_state(package_dir: Path) -> tuple[Path, Path]:\n """Discard submitted Lake state and create the only two writable subdirectories."""\n dot_lake = package_dir / ".lake"\n if dot_lake.is_symlink() or (dot_lake.exists() and not dot_lake.is_dir()):\n dot_lake.unlink()\n elif dot_lake.is_dir():\n shutil.rmtree(dot_lake)\n build = dot_lake / "build"\n config = dot_lake / "config"\n build.mkdir(parents=True)\n config.mkdir()\n return build.resolve(), config.resolve()\n\n\ndef reject_committed_build_artifacts(package_dir: Path) -> None:\n """Reject prebuilt Lean/native output outside the fresh ``.lake`` tree."""\n root = package_dir.resolve()\n for current, directories, filenames in os.walk(root, followlinks=False):\n directories[:] = [name for name in directories if name not in {".git", ".lake"}]\n for filename in filenames:\n path = Path(current) / filename\n lowered = path.name.lower()\n if path.suffix.lower() in COMPILED_ARTIFACT_SUFFIXES or lowered.endswith(\n COMPILED_ARTIFACT_NAME_SUFFIXES\n ):\n raise VerificationError(\n "committed build artifact is not permitted outside fresh .lake state: "\n f"{path}"\n )\n\n\ndef purge_untrusted_lake_state(checkout: Path) -> None:\n """Remove every submitted ``.lake`` tree before the checkout becomes readable."""\n root = checkout.resolve()\n candidates = sorted(\n (path for path in root.rglob(".lake") if ".git" not in path.relative_to(root).parts),\n key=lambda path: len(path.parts),\n reverse=True,\n )\n for path in candidates:\n if path.is_symlink() or (path.exists() and not path.is_dir()):\n path.unlink()\n elif path.is_dir():\n shutil.rmtree(path)\n\n\ndef validate_writable_directories(\n checkout: Path, directories: list[Path]\n) -> list[Path]:\n """Validate sandbox writes against the verifier-owned checkout boundary."""\n root = checkout.resolve()\n result: list[Path] = []\n for directory in directories:\n if directory.is_symlink() or not directory.is_dir():\n raise VerificationError(f"sandbox writable path is not a real directory: {directory}")\n resolved = directory.resolve()\n try:\n resolved.relative_to(root)\n except ValueError as error:\n raise VerificationError(f"sandbox writable path escapes the source tree: {directory}") from error\n if resolved not in result:\n result.append(resolved)\n return result\n\n\ndef require_protected_paths(protected_paths: list[Path], writable_directories: list[Path]) -> None:\n for protected in protected_paths:\n resolved = protected.resolve()\n for writable in writable_directories:\n try:\n resolved.relative_to(writable)\n except ValueError:\n continue\n raise VerificationError(f"protected verifier path is sandbox-writable: {protected}")\n\n\ndef path_is_within(path: Path, directories: list[Path]) -> bool:\n for directory in directories:\n try:\n path.resolve().relative_to(directory.resolve())\n except ValueError:\n continue\n return True\n return False\n\n\ndef system_readable_paths() -> list[Path]:\n """Return the narrow host configuration needed by ordinary HTTPS clients."""\n candidates = (\n Path("/etc/ssl/certs"),\n Path("/etc/pki"),\n Path("/etc/resolv.conf"),\n Path("/etc/hosts"),\n Path("/etc/nsswitch.conf"),\n Path("/etc/gai.conf"),\n Path("/etc/host.conf"),\n Path("/etc/ld.so.cache"),\n Path("/etc/ld.so.conf"),\n Path("/etc/ld.so.conf.d"),\n Path("/etc/alternatives"),\n )\n result: set[Path] = set()\n for path in candidates:\n if path.exists():\n result.add(path.absolute())\n result.add(path.resolve())\n return sorted(result)\n\n\ndef tool_snapshot(paths: list[Path]) -> dict[Path, str]:\n snapshot: dict[Path, str] = {}\n for path in paths:\n resolved = path.resolve(strict=True)\n if not resolved.is_file():\n raise VerificationError(f"missing verifier tool: {resolved}")\n snapshot[resolved] = sha256(resolved)\n return snapshot\n\n\ndef verify_tool_snapshot(snapshot: dict[Path, str]) -> None:\n for path, expected in snapshot.items():\n try:\n actual = sha256(path)\n except OSError as error:\n raise VerificationError(f"verifier tool disappeared during execution: {path}") from error\n if actual != expected:\n raise VerificationError(f"verifier tool changed during execution: {path}")\n\n\n# --- cgroup supervisor -----------------------------------------------------------------\n#\n# Three things confine a phase: isolation (bubblewrap, `bwrap_command`), cgroup\n# resource limits with a deadline (a small babysitter that owns a delegated\n# cgroup, `scripts/supervise_cgroup.py`, driven by `supervisor_command`), and\n# trustworthy evidence of how the phase ended (its status file, read by\n# `supervisor_outcome`). The systemd transient unit that used to supply all\n# three is gone; the classification vocabulary and the telemetry field names\n# it established are kept so the mechanical report does not change shape.\n\n_SUPERVISOR_BOOTSTRAP: list[str] | None = None\n_BWRAP: Path | None = (\n Path(os.environ["PALOMAR_BWRAP"]).resolve() if os.environ.get("PALOMAR_BWRAP") else None\n)\n\n\ndef configure_bwrap(path: Path) -> Path:\n """Select the bubblewrap binary every confined phase of this process uses."""\n global _BWRAP\n resolved = path.resolve(strict=True)\n if not resolved.is_file() or not os.access(resolved, os.X_OK):\n raise VerificationError(f"bubblewrap is not an executable file: {resolved}")\n _BWRAP = resolved\n return resolved\nSUPERVISOR_PARENT_MARGIN_SECONDS = 15\nSUPERVISOR_DEFAULT_GRACE_SECONDS = 30\n# Descriptors the babysitter hands the sandbox: bwrap reports on the first\n# (`--json-status-fd`) and reads its seccomp filter from the second.\nSANDBOX_STATUS_FD = 3\nSECCOMP_FD = 4\n\n\n@dataclass(frozen=True)\nclass SupervisorLimits:\n """systemd resource properties translated into what the babysitter writes."""\n\n cgroup: dict[str, str]\n rlimits: dict[str, int]\n deadline: int | None\n grace: int | None\n\n\ndef _systemd_size(value: str, name: str) -> str:\n if value == "infinity":\n return "max"\n match = re.fullmatch(r"(\\d+)([KMGT]?)", value)\n if not match:\n raise VerificationError(f"unsupported {name} value: {value!r}")\n return str(int(match.group(1)) * 1024 ** "_KMGT".index(match.group(2) or "_"))\n\n\ndef _systemd_seconds(value: str, name: str) -> int:\n match = re.fullmatch(r"(\\d+)(s|min|h)?", value)\n if not match:\n raise VerificationError(f"unsupported {name} value: {value!r}")\n return int(match.group(1)) * {None: 1, "s": 1, "min": 60, "h": 3600}[match.group(2)]\n\n\ndef translate_resource_properties(properties: tuple[str, ...] | list[str]) -> SupervisorLimits:\n """Map the `Key=Value` vocabulary the phases already speak onto cgroup files.\n\n Only the properties Palomar actually uses are accepted. `LimitAS` in\n particular is refused: an address-space rlimit would turn con-ron\'s\n per-worker reservations into candidate failures; `memory.max` is the ceiling.\n """\n cgroup: dict[str, str] = {"memory.oom.group": "1"}\n rlimits: dict[str, int] = {}\n deadline = grace = None\n for item in properties:\n key, separator, value = item.partition("=")\n value = value.strip()\n if not separator or not value or any(c in value for c in "\\0\\n\\r"):\n raise VerificationError(f"invalid resource property: {item!r}")\n if key == "MemoryMax":\n cgroup["memory.max"] = _systemd_size(value, key)\n elif key == "MemoryHigh":\n cgroup["memory.high"] = _systemd_size(value, key)\n elif key == "MemorySwapMax":\n cgroup["memory.swap.max"] = _systemd_size(value, key)\n elif key == "TasksMax":\n cgroup["pids.max"] = _systemd_size(value, key) if value == "infinity" else str(int(value))\n elif key in {"LimitNOFILE", "LimitFSIZE"}:\n if not value.isdigit():\n raise VerificationError(f"unsupported {key} value: {value!r}")\n rlimits[key.removeprefix("Limit")] = int(value)\n elif key == "RuntimeMaxSec":\n deadline = _systemd_seconds(value, key)\n elif key == "TimeoutStopSec":\n grace = _systemd_seconds(value, key)\n elif key == "CPUQuota":\n if not re.fullmatch(r"\\d+%", value):\n raise VerificationError(f"unsupported CPUQuota value: {value!r}")\n cgroup["cpu.max"] = f"{int(value[:-1]) * 1000} 100000"\n else:\n raise VerificationError(f"unsupported resource property for the cgroup supervisor: {key}")\n return SupervisorLimits(cgroup=cgroup, rlimits=rlimits, deadline=deadline, grace=grace)\n\n\ndef _supervisor_unavailable(message: str) -> VerificationError:\n return VerificationError(\n message,\n code="provider.resource_telemetry_missing",\n owner="provider",\n next_action=(\n "Palomar could not determine how the worker stopped. Report the workflow URL "\n "if this persists; retry only after the reported condition is addressed. "\n "Normal submission cooldowns still apply."\n ),\n retryable=True,\n )\n\n\ndef supervisor_bootstrap(cwd: Path) -> list[str]:\n """Choose, once per verifier process, how a delegated cgroup is obtained.\n\n On a systemd host the user manager hands out a `Delegate=yes` scope; on a\n runner without systemd a root helper drains the container root, enables the\n controllers and enters a fresh run cgroup before dropping privileges. Either\n way the babysitter then starts inside a cgroup this user owns (`--parent\n self`). The choice is proven by running the whole chain once on `true` and\n reading the status it leaves behind, so a runner that cannot delegate fails\n closed before any candidate code runs.\n """\n global _SUPERVISOR_BOOTSTRAP\n if _SUPERVISOR_BOOTSTRAP is not None:\n return list(_SUPERVISOR_BOOTSTRAP)\n python = str(Path(sys.executable).resolve())\n babysitter = str((ROOT / "scripts" / "supervise_cgroup.py").resolve())\n delegate = str((ROOT / "scripts" / "cgroup_delegate.py").resolve())\n try:\n pid1 = Path("/proc/1/comm").read_text(encoding="utf-8").strip()\n except OSError:\n pid1 = ""\n candidates: list[list[str]] = []\n runner = shutil.which("systemd-run")\n sudo = shutil.which("sudo")\n if pid1 == "systemd" and runner:\n candidates.append([runner, "--user", "--scope", "--quiet", "--property=Delegate=yes", "--"])\n elif pid1 != "systemd" and sudo:\n candidates.append(\n [sudo, "-n", python, delegate, f"--uid={os.getuid()}", f"--gid={os.getgid()}", "--"]\n )\n true = shutil.which("true")\n if not true:\n raise VerificationError("true is required to probe the cgroup supervisor")\n failures: list[str] = []\n for candidate in candidates:\n with tempfile.TemporaryDirectory(prefix="palomar-supervisor-probe-") as directory:\n status = Path(directory) / "status.json"\n # The launcher is trusted and runs with the verifier\'s own\n # environment (systemd-run needs the user bus variables); the\n # payload receives only what the babysitter\'s --setenv names.\n probe = run(\n [*candidate, python, babysitter, "--parent", "self", "--collect", "--deadline", "20",\n "--grace", "1", "--cwd", str(cwd), "--status", str(status), "--", true],\n cwd=cwd, env=os.environ.copy(), timeout=60, check=False,\n )\n try:\n report = json.loads(status.read_text(encoding="utf-8"))\n except (OSError, ValueError):\n report = {}\n if probe.returncode == 0 and report.get("state") == "finished" and report.get("placement_ok"):\n _SUPERVISOR_BOOTSTRAP = candidate\n return list(candidate)\n failures.append(f"{candidate[0]}: exit {probe.returncode}: {probe.stderr.strip()[-300:]}")\n raise VerificationError(\n "no cgroup delegation bootstrap works on this runner: "\n + ("; ".join(failures) if failures else f"PID 1 is {pid1 or \'unknown\'} and no bootstrap applies")\n )\n\n\ndef supervisor_command(\n command: list[str],\n *,\n cwd: Path,\n environment: dict[str, str],\n timeout: int = 600,\n resource_properties: tuple[str, ...] = (),\n unit_name: str,\n status_path: Path,\n liveness_path: Path,\n sandbox_status_fd: int | None = None,\n pass_files: dict[int, Path] | None = None,\n stdout_path: Path | None = None,\n) -> list[str]:\n """Wrap one phase in the babysitter, itself started inside a delegated cgroup.\n\n `stdout_path` is opened by the babysitter, outside the sandbox, and handed\n to the workload as its standard output: that is how an export of any size\n lands in a verifier-owned file the sandbox cannot otherwise reach.\n """\n if not re.fullmatch(r"palomar-[a-f0-9]{24}", unit_name):\n raise VerificationError("invalid verifier-owned phase cgroup name")\n limits = translate_resource_properties(resource_properties)\n python = str(Path(sys.executable).resolve())\n babysitter = str((ROOT / "scripts" / "supervise_cgroup.py").resolve())\n result = [\n *supervisor_bootstrap(cwd),\n python, babysitter,\n "--parent", "self",\n "--name", unit_name,\n "--deadline", str(max(1, limits.deadline if limits.deadline is not None else timeout)),\n "--grace", str(max(\n 1, limits.grace if limits.grace is not None else SUPERVISOR_DEFAULT_GRACE_SECONDS,\n )),\n "--cwd", str(cwd),\n "--status", str(status_path),\n "--liveness", str(liveness_path),\n ]\n if sandbox_status_fd is not None:\n result.extend(["--sandbox-status-fd", str(sandbox_status_fd)])\n if stdout_path is not None:\n result.extend(["--stdout", str(stdout_path)])\n for descriptor, path in sorted((pass_files or {}).items()):\n result.extend(["--pass-file", f"{descriptor}={path}"])\n for key, value in limits.cgroup.items():\n result.extend(["--limit", f"{key}={value}"])\n for key, value in limits.rlimits.items():\n result.extend(["--rlimit", f"{key}={value}"])\n for name in SANDBOX_ENVIRONMENT:\n value = environment.get(name)\n if value is not None:\n if any(character in value for character in ("\\0", "\\n", "\\r")):\n raise VerificationError(f"invalid control character in sandbox environment {name}")\n result.extend(["--setenv", f"{name}={value}"])\n return [*result, "--", *command]\n\n\ndef _cgroup_from_status(report: dict[str, Any]) -> Path | None:\n raw = str(report.get("cgroup") or "")\n path = Path(raw)\n if not raw.startswith("/sys/fs/cgroup/") or ".." in path.parts:\n return None\n return path\n\n\ndef _cleanup_phase_cgroup(cgroup: Path) -> None:\n """KillMode=control-group for the verifier\'s own cleanup: kill, then remove what is ours."""\n try:\n (cgroup / "cgroup.kill").write_text("1", encoding="ascii")\n except OSError:\n pass\n deadline = time.monotonic() + 10\n while time.monotonic() < deadline:\n try:\n if "populated 0" in (cgroup / "cgroup.events").read_text(encoding="utf-8"):\n break\n except OSError:\n break\n time.sleep(0.05)\n for path in (cgroup / "leaf", cgroup, cgroup.parent / "supervisor"):\n try:\n path.rmdir()\n except OSError:\n pass\n if cgroup.parent.name.startswith("run-") and cgroup.parent.parent.name == "palomar":\n try:\n cgroup.parent.rmdir()\n except OSError:\n pass # the root helper\'s sweep removes it once empty\n\n\ndef supervisor_outcome(\n status_path: Path,\n *,\n supervisor_timeout: bool = False,\n) -> dict[str, Any]:\n """Read the babysitter\'s evidence, then tear down whatever it left behind.\n\n A missing or unfinished status is an infrastructure diagnostic, never an\n inferred success, except when the verifier\'s own deadline fired first: then\n the phase is reported with `Result` unset and the caller\'s `TimeoutExpired`\n stands, exactly as `append_resource_outcome(supervisor_timeout=True)` records.\n """\n try:\n report = json.loads(status_path.read_text(encoding="utf-8"))\n if not isinstance(report, dict):\n raise ValueError("status is not an object")\n except (OSError, ValueError) as error:\n if supervisor_timeout:\n report = {}\n else:\n raise _supervisor_unavailable(f"cgroup supervisor left no status: {error}") from error\n cgroup = _cgroup_from_status(report)\n try:\n events = {"oom": 0, "oom_kill": 0}\n for name in events:\n raw = report.get("memory_events", {}).get(name)\n if isinstance(raw, int):\n events[name] = raw\n if cgroup is not None and cgroup.is_dir():\n # The babysitter may have been killed before its final read.\n try:\n for line in (cgroup / "memory.events").read_text(encoding="utf-8").splitlines():\n name, _, raw = line.partition(" ")\n if name in events and raw.strip().isdigit():\n events[name] = max(events[name], int(raw))\n except OSError:\n pass\n finished = report.get("state") == "finished"\n if not finished and not supervisor_timeout:\n raise _supervisor_unavailable("cgroup supervisor did not finish the confined phase")\n if finished and not report.get("placement_ok"):\n raise _supervisor_unavailable(\n f"confined phase never joined its cgroup: {report.get(\'placement_error\')}"\n )\n if finished and report.get("launch_error"):\n raise _supervisor_unavailable(\n f"confined phase launcher failed to start: {report.get(\'launch_error\')}"\n )\n if finished and report.get("sandbox_started") is False:\n # bwrap never reported a child: its own setup failed. Whatever exit\n # status resulted is the sandbox\'s, not the candidate\'s.\n raise _supervisor_unavailable("sandbox failed to start for the confined phase")\n if finished and report.get("populated_after_kill"):\n raise _supervisor_unavailable(\n "confined phase left processes the supervisor could not remove"\n )\n exit_status = report.get("exit_status")\n term_signal = report.get("term_signal")\n oom_group = report.get("memory_events", {}).get("oom_group_kill")\n if not finished:\n result = None\n elif events["oom_kill"] > 0 or (isinstance(oom_group, int) and oom_group > 0):\n result = "oom-kill"\n elif report.get("deadline_fired"):\n result = "timeout"\n elif exit_status == 0:\n result = "success"\n elif exit_status is not None:\n result = "exit-code"\n else:\n result = "signal"\n cpu_stat = report.get("cpu_stat", {})\n usage_usec = cpu_stat.get("usage_usec") if isinstance(cpu_stat, dict) else None\n # `ExecMainCode`/`ActiveState` keep systemd\'s encodings for existing\n # readers: CLD_EXITED=1, CLD_KILLED=2; a finished unit that did not\n # succeed reads `failed`.\n outcome: dict[str, Any] = {\n "Result": result,\n "ActiveState": ("inactive" if result == "success" else "failed") if finished else "active",\n "ExecMainCode": ("1" if exit_status is not None else "2") if finished else "",\n "ExecMainStatus": str(exit_status if exit_status is not None else term_signal or ""),\n "ControlGroup": "/" + str(cgroup.relative_to("/sys/fs/cgroup")) if cgroup else "",\n "MemoryPeak": str(report.get("memory_peak") or ""),\n "CPUUsageNSec": str(usage_usec * 1000) if isinstance(usage_usec, int) else "",\n "memory_events": events,\n "supervisor": "cgroup",\n "deadline_fired": bool(report.get("deadline_fired")),\n "liveness_lost": bool(report.get("liveness_lost")),\n "cpu_max_applied": bool(report.get("limits_applied", {}).get("cpu.max", False)),\n "pids_events": report.get("pids_events", {}),\n "rlimits_applied": report.get("rlimits_applied", {}),\n "sandbox_started": report.get("sandbox_started"),\n }\n return outcome\n finally:\n if cgroup is not None:\n _cleanup_phase_cgroup(cgroup)\n\n\ndef bwrap_command(\n command: list[str],\n *,\n bwrap: Path,\n writable_directories: list[Path],\n writable_files: tuple[Path, ...] | list[Path] = (),\n readable_paths: list[Path] | None = None,\n executable_paths: list[Path],\n environment: dict[str, str],\n readable_directories: tuple[Path, ...] | list[Path] = (),\n unrestricted_network: bool = False,\n nested_sandbox: bool = False,\n sandbox_status_fd: int | None = None,\n seccomp_fd: int | None = None,\n) -> list[str]:\n """Build the outer, submission-wide bubblewrap policy.\n\n Allowlist form: the root is an empty tmpfs and only what a phase names is\n bound into it, read-only unless it is one of the phase\'s writable trees. The\n root is then remounted read-only so nothing can add to it, every namespace is\n unshared, and the environment is reset to the sandbox variables alone (the\n `env -i` keeps the launcher\'s environment out of `/proc/1/environ`).\n `nested_sandbox` is for the one phase that runs `lake comparator`, whose own\n bwrap needs user namespaces and the mount points it overlays.\n """\n env = shutil.which("env")\n if not env:\n raise VerificationError("env is required to launch the confined phase")\n result = [env, "-i", str(bwrap), "--tmpfs", "/", "--dev", "/dev", "--proc", "/proc", "--tmpfs", "/tmp"]\n if nested_sandbox:\n # Check.lean `buildSandboxArgs` overlays tmpfs on these (and on /run and\n # /var in the kernel phases); the mount points must exist in our root.\n for point in ("/home", "/root", "/run/user", "/var"):\n result.extend(["--dir", point])\n # Merged-usr hosts keep /bin, /sbin, /lib and /lib64 as symlinks into /usr;\n # the allowlisted root needs the same symlinks for #! lines and the loader.\n # They come first so that a later bind of, say, /bin/touch lands under the\n # symlink\'s target instead of turning /bin into a directory of its own.\n for name, target in _merged_usr_symlinks():\n result.extend(["--symlink", target, name])\n # Debian\'s alternatives farm is where /usr/bin/cc, awk, which and friends\n # point; without it those are dangling symlinks. Landlock never restricted\n # symlink traversal, so the old policy never had to name it. It holds only\n # symlinks into the system directories bound below.\n alternatives = Path("/etc/alternatives")\n system = {alternatives} if alternatives.is_dir() else set()\n for path in sorted({*(readable_paths or []), *readable_directories, *executable_paths, *system}):\n result.extend(["--ro-bind", str(path), str(path)])\n for directory in sorted(set(writable_directories)):\n result.extend(["--bind", str(directory), str(directory)])\n for path in sorted(set(writable_files)):\n result.extend(["--bind", str(path), str(path)])\n result.extend(["--remount-ro", "/"])\n for name in SANDBOX_ENVIRONMENT:\n value = environment.get(name)\n if value is not None:\n if any(character in value for character in ("\\0", "\\n", "\\r")):\n raise VerificationError(f"invalid control character in sandbox environment {name}")\n result.extend(["--setenv", name, value])\n result.extend([\n "--unshare-user", "--unshare-ipc", "--unshare-pid", "--unshare-uts", "--unshare-cgroup",\n ])\n if not unrestricted_network:\n result.append("--unshare-net")\n if not nested_sandbox:\n result.append("--disable-userns")\n result.extend(["--die-with-parent", "--new-session", "--cap-drop", "ALL"])\n if sandbox_status_fd is not None:\n result.extend(["--json-status-fd", str(sandbox_status_fd)])\n if seccomp_fd is not None:\n result.extend(["--seccomp", str(seccomp_fd)])\n return [*result, "--", *command]\n\n\ndef _merged_usr_symlinks() -> list[tuple[str, str]]:\n """The host\'s top-level merged-usr symlinks, as (name, target) pairs."""\n result = []\n for name in ("/bin", "/sbin", "/lib", "/lib64"):\n top = Path(name)\n if top.is_symlink():\n result.append((name, os.readlink(top)))\n return result\n\n\ndef append_resource_outcome(\n path: Path, phase: str, outcome: dict[str, Any], *, supervisor_timeout: bool = False,\n) -> None:\n def numeric(name: str) -> int:\n value = str(outcome.get(name) or "")\n return int(value) if value.isdigit() else 0\n\n record = {\n "phase": f"{phase}:cgroup",\n # A still-running unit starts with Result=success. That snapshot is\n # not a successful termination when the parent has reached its deadline.\n "systemd_result": None if supervisor_timeout else outcome.get("Result"),\n "supervisor_timeout": supervisor_timeout,\n "systemd_active_state": outcome.get("ActiveState"),\n "exec_main_code": outcome.get("ExecMainCode"),\n "exec_main_status": outcome.get("ExecMainStatus"),\n "memory_peak_bytes": numeric("MemoryPeak"),\n "cpu_usage_nanoseconds": numeric("CPUUsageNSec"),\n "memory_events": outcome.get("memory_events", {"oom": 0, "oom_kill": 0}),\n # The `systemd_*` names above are historical; the values come from the\n # cgroup supervisor, whose own evidence is recorded alongside.\n "supervisor": "cgroup",\n "deadline_fired": bool(outcome.get("deadline_fired", False)),\n "cpu_max_applied": bool(outcome.get("cpu_max_applied", False)),\n "pids_events_max": int((outcome.get("pids_events") or {}).get("max", 0) or 0),\n "rlimits_applied": dict(outcome.get("rlimits_applied") or {}),\n }\n if supervisor_timeout:\n record["systemd_result_before_cleanup"] = outcome.get("Result")\n descriptor = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o600)\n with os.fdopen(descriptor, "a", encoding="utf-8") as handle:\n handle.write(json.dumps(record, sort_keys=True, separators=(",", ":")) + "\\n")\n\n\ndef sandboxed_run(\n command: list[str],\n *,\n cwd: Path,\n environment: dict[str, str],\n writable_directories: list[Path],\n writable_files: tuple[Path, ...] | list[Path] = (),\n readable_paths: list[Path] | None = None,\n executable_paths: list[Path],\n tools: dict[Path, str],\n timeout: int = 600,\n check: bool = True,\n unrestricted_network: bool = False,\n resource_properties: tuple[str, ...] = (),\n nested_sandbox: bool = False,\n stdout_path: Path | None = None,\n) -> subprocess.CompletedProcess[str]:\n timeout = _deadline_timeout(timeout, command)\n verify_tool_snapshot(tools)\n if _BWRAP is None:\n raise VerificationError("bubblewrap is required for fail-closed confinement")\n confined = bwrap_command(\n command,\n bwrap=_BWRAP,\n writable_directories=writable_directories,\n writable_files=writable_files,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n environment=environment,\n readable_directories=[cwd],\n unrestricted_network=unrestricted_network,\n nested_sandbox=nested_sandbox,\n sandbox_status_fd=SANDBOX_STATUS_FD,\n seccomp_fd=SECCOMP_FD,\n )\n phase = _RESOURCE_PHASE or Path(command[0]).name[:80] or "phase"\n unit_name = f"palomar-{secrets.token_hex(12)}"\n if _RESOURCE_METRICS_PATH is not None:\n metrics_wrapper = (ROOT / "scripts" / "measure_resources.py").resolve()\n python = Path(sys.executable).resolve()\n if not metrics_wrapper.is_file():\n raise VerificationError("trusted resource measurement wrapper is missing")\n # The observer runs inside the phase cgroup, so its usage figures are\n # the workload\'s. If it dies, the babysitter\'s status still classifies.\n confined = [\n str(python),\n str(metrics_wrapper),\n "--output",\n str(_RESOURCE_METRICS_PATH),\n "--phase",\n phase,\n "--disk-path",\n str(_RESOURCE_DISK_PATH or cwd),\n "--cgroup-accounting",\n "--pass-fd", str(SANDBOX_STATUS_FD), "--pass-fd", str(SECCOMP_FD),\n "--",\n *confined,\n ]\n properties = tuple(dict.fromkeys((*permissive_resource_properties(), *resource_properties)))\n return _cgroup_supervised_run(\n command, confined, cwd=cwd, environment=environment, timeout=timeout, check=check,\n resource_properties=properties, unit_name=unit_name, phase=phase, tools=tools,\n unrestricted_network=unrestricted_network, stdout_path=stdout_path,\n )\n\n\ndef _classify_confined_result(\n command: list[str],\n proc: subprocess.CompletedProcess[str],\n outcome: dict[str, Any],\n *,\n check: bool,\n) -> subprocess.CompletedProcess[str]:\n # Payload output is attacker-controlled and must never manufacture an\n # infrastructure outcome merely by printing an OOM or timeout phrase.\n # Numeric exit statuses are payload-controlled too. Only the babysitter\'s\n # telemetry (or the parent\'s TimeoutExpired) establishes resource exhaustion.\n memory_events = outcome.get("memory_events", {})\n resource_results = {"oom-kill", "resources", "timeout", "watchdog"}\n if (\n outcome.get("Result") in resource_results\n or int(memory_events.get("oom_kill", 0)) > 0\n ):\n raise ResourceExhausted(\n f"worker resource ceiling reached while running {Path(command[0]).name} "\n f"(exit {proc.returncode}, result {outcome.get(\'Result\')})"\n )\n if check and proc.returncode:\n detail = "\\n".join(\n f"{name}:\\n{value.strip()[-3500:]}"\n for name, value in (("stdout", proc.stdout), ("stderr", proc.stderr))\n if value.strip()\n )\n raise VerificationError(\n f"{\' \'.join(command[:3])} failed ({proc.returncode}): {detail}"\n )\n return proc\n\n\ndef _cgroup_supervised_run(\n command: list[str],\n confined: list[str],\n *,\n cwd: Path,\n environment: dict[str, str],\n timeout: int,\n check: bool,\n resource_properties: tuple[str, ...],\n unit_name: str,\n phase: str,\n tools: dict[Path, str],\n unrestricted_network: bool = False,\n stdout_path: Path | None = None,\n) -> subprocess.CompletedProcess[str]:\n # The status file, liveness FIFO and seccomp filter live in a verifier-owned\n # directory the payload cannot see: bwrap gives it a private /tmp and binds\n # nothing here.\n with tempfile.TemporaryDirectory(prefix="palomar-supervisor-") as directory:\n status_path = Path(directory) / "status.json"\n liveness_path = Path(directory) / "liveness"\n os.mkfifo(liveness_path, 0o600)\n filter_path = Path(directory) / "seccomp.bpf"\n filter_path.write_bytes(seccomp_filter.build(deny_unix_sockets=True))\n limits = translate_resource_properties(resource_properties)\n deadline = limits.deadline if limits.deadline is not None else timeout\n grace = limits.grace if limits.grace is not None else SUPERVISOR_DEFAULT_GRACE_SECONDS\n confined_command = supervisor_command(\n confined,\n cwd=cwd,\n environment=environment,\n timeout=timeout,\n resource_properties=resource_properties,\n unit_name=unit_name,\n status_path=status_path,\n liveness_path=liveness_path,\n sandbox_status_fd=SANDBOX_STATUS_FD,\n pass_files={SECCOMP_FD: filter_path},\n stdout_path=stdout_path,\n )\n # O_RDWR never blocks on a FIFO; holding it keeps a writer present until\n # this process exits, which is precisely what the babysitter watches for.\n liveness = os.open(liveness_path, os.O_RDWR | os.O_CLOEXEC)\n try:\n try:\n # The babysitter owns the deadline and the grace; the parent\n # only steps in once both have been given their full time.\n proc = run(\n confined_command, cwd=cwd, env=os.environ.copy(),\n timeout=deadline + grace + SUPERVISOR_PARENT_MARGIN_SECONDS, check=False,\n )\n except subprocess.TimeoutExpired:\n # The babysitter itself overran its deadline plus grace; the\n # verifier tears the cgroup down from the started-record and\n # records that its own deadline fired first.\n try:\n outcome = supervisor_outcome(status_path, supervisor_timeout=True)\n if _RESOURCE_METRICS_PATH is not None:\n append_resource_outcome(\n _RESOURCE_METRICS_PATH, phase, outcome, supervisor_timeout=True,\n )\n except VerificationError:\n pass # The parent\'s observed wall-clock expiry is already sufficient.\n raise\n finally:\n os.close(liveness)\n # Every phase is classified from the status file, success included: a\n # zero exit with an OOM event or a fired deadline is not a success.\n outcome = supervisor_outcome(status_path)\n if _RESOURCE_METRICS_PATH is not None:\n append_resource_outcome(_RESOURCE_METRICS_PATH, phase, outcome)\n verify_tool_snapshot(tools)\n return _classify_confined_result(command, proc, outcome, check=check)\n\n\n@dataclass(frozen=True)\nclass _ConfinementProbeResult:\n """Observed positive and negative controls from one filesystem policy."""\n\n allowed: subprocess.CompletedProcess[str]\n allowed_created: bool\n denied: subprocess.CompletedProcess[str] | None\n denied_created: bool\n\n\ndef _run_filesystem_confinement_probe(\n denied_probe: Path,\n *,\n existing_probe_error: str,\n touch: Path,\n cwd: Path,\n environment: dict[str, str],\n writable_directories: list[Path],\n readable_paths: list[Path],\n executable_paths: list[Path],\n tools: dict[Path, str],\n after_allowed: Callable[[], None] | None = None,\n) -> _ConfinementProbeResult:\n """Run one writable positive control and one write-denial control.\n\n A failed positive control returns without attempting the negative control,\n preserving the security decision order. Every path this function proves\n absent before use is removed in ``finally``, including when the sandbox\n runner itself raises.\n """\n\n require_protected_paths([denied_probe], writable_directories)\n if denied_probe.exists():\n raise VerificationError(f"{existing_probe_error}: {denied_probe}")\n allowed_probe = writable_directories[0] / ".palomar-write-probe"\n if allowed_probe.exists():\n raise VerificationError(\n f"filesystem confinement probe path already exists: {allowed_probe}"\n )\n\n try:\n allowed = sandboxed_run(\n [str(touch), str(allowed_probe)],\n cwd=cwd,\n environment=environment,\n writable_directories=writable_directories,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n check=False,\n )\n allowed_created = allowed_probe.is_file()\n allowed_probe.unlink(missing_ok=True)\n if allowed.returncode or not allowed_created:\n return _ConfinementProbeResult(allowed, allowed_created, None, False)\n\n if after_allowed is not None:\n after_allowed()\n\n denied = sandboxed_run(\n [str(touch), str(denied_probe)],\n cwd=cwd,\n environment=environment,\n writable_directories=writable_directories,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n check=False,\n )\n return _ConfinementProbeResult(\n allowed,\n allowed_created,\n denied,\n denied_probe.exists(),\n )\n finally:\n allowed_probe.unlink(missing_ok=True)\n denied_probe.unlink(missing_ok=True)\n\n\ndef verify_sandbox_confinement(\n write_probe: Path,\n read_probe: Path,\n *,\n positive_read: Path,\n python: Path,\n touch: Path,\n cwd: Path,\n environment: dict[str, str],\n writable_directories: list[Path],\n protected_write_directories: list[Path] | None = None,\n readable_paths: list[Path],\n executable_paths: list[Path],\n tools: dict[Path, str],\n) -> None:\n """Prove the composed outer boundary before untrusted code runs.\n\n Positive controls: a write inside the first writable directory and a read\n of ``positive_read``. Negative controls: a write outside the writable set,\n a write into each ``protected_write_directories`` entry, a read outside the\n read allowlist, a read of a live sibling process\'s ``/proc`` environment,\n an outbound TCP connection to a listener the trusted parent has just\n accepted on, and the namespace controls: the sandbox\'s PID 1 carries no\n environment, a nested user namespace is refused, the user namespace differs\n from the host\'s, and canaries the parent has just written under the host\n home directory, ``/tmp`` and ``/dev/shm`` are invisible.\n\n The probes run under the same policy as the work they stand for, so that\n what they demonstrate is a property of the policy actually used. Every\n parameter is required rather than defaulted, so that a later caller cannot\n quietly probe a configuration nobody runs under. Callers must run this in\n the same network phase as the work that follows.\n """\n\n def detail(proc: subprocess.CompletedProcess[str]) -> str:\n message = (proc.stderr or proc.stdout).strip().replace("\\n", " ")\n return f" (exit {proc.returncode}: {message[:500]})" if message else ""\n\n require_protected_paths([write_probe, read_probe], writable_directories)\n if path_is_within(read_probe, [*readable_paths, *executable_paths]):\n raise VerificationError("read-denial probe is inside the sandbox read allowlist")\n for probe in (write_probe, read_probe):\n if probe.exists():\n raise VerificationError(f"confinement probe path already exists: {probe}")\n\n read_probe.write_text("palomar confidential read sentinel\\n", encoding="utf-8")\n\n def verify_namespace_confinement() -> None:\n token = secrets.token_hex(8)\n canaries = [\n Path.home() / f".palomar-host-canary-{token}",\n Path("/tmp") / f"palomar-host-canary-{token}",\n ]\n if Path("/dev/shm").is_dir():\n canaries.append(Path("/dev/shm") / f"palomar-host-canary-{token}")\n created: list[Path] = []\n try:\n for canary in canaries:\n # Exclusive creation: a pre-existing path, symlink included,\n # is somebody else\'s and is never removed by this probe.\n try:\n with open(canary, "x", encoding="utf-8") as handle:\n handle.write("palomar host canary\\n")\n except FileExistsError as error:\n raise VerificationError(f"host canary path already exists: {canary}") from error\n created.append(canary)\n host_userns = os.readlink("/proc/self/ns/user")\n # Beyond the namespaces, the seccomp filter\'s controls: no tracing\n # of the parent (the standalone comparator shares the sandbox with\n # the candidate build it runs), no AF_UNIX sockets, no setuid\n # files, no personality changes.\n namespace_script = (\n "import ctypes, errno, os, socket, sys\\n"\n "failures = []\\n"\n "if open(\'/proc/1/environ\', \'rb\').read(): failures.append(\'pid 1 carries an environment\')\\n"\n "libc = ctypes.CDLL(None, use_errno=True)\\n"\n "if libc.unshare(0x10000000) == 0: failures.append(\'nested user namespace permitted\')\\n"\n "if os.readlink(\'/proc/self/ns/user\') == sys.argv[1]:\\n"\n " failures.append(\'host user namespace\')\\n"\n "for raw in sys.argv[2:]:\\n"\n " if os.path.lexists(raw): failures.append(\'host canary visible: \' + raw)\\n"\n "if libc.ptrace(16, os.getppid(), 0, 0) != -1 or ctypes.get_errno() != errno.EPERM:\\n"\n " failures.append(\'ptrace of the parent permitted\')\\n"\n "try:\\n"\n " socket.socket(socket.AF_UNIX).close(); failures.append(\'AF_UNIX socket permitted\')\\n"\n "except PermissionError: pass\\n"\n "if libc.personality(0x0040000) != -1: failures.append(\'personality change permitted\')\\n"\n "probe = os.path.join(os.environ.get(\'TMPDIR\', \'/tmp\'), \'palomar-setuid-probe\')\\n"\n "open(probe, \'w\').close()\\n"\n "try:\\n"\n " os.chmod(probe, 0o4755); failures.append(\'setuid file creation permitted\')\\n"\n "except PermissionError: pass\\n"\n "os.unlink(probe)\\n"\n "print(\'; \'.join(failures))\\n"\n "sys.exit(1 if failures else 0)\\n"\n )\n namespaces = sandboxed_run(\n [str(python), "-c", namespace_script, host_userns, *(str(c) for c in canaries)],\n cwd=cwd,\n environment=environment,\n writable_directories=writable_directories,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n check=False,\n )\n finally:\n for canary in created:\n canary.unlink(missing_ok=True)\n if namespaces.returncode:\n raise VerificationError("outer sandbox namespace controls failed" + detail(namespaces))\n\n result: _ConfinementProbeResult | None = None\n try:\n result = _run_filesystem_confinement_probe(\n write_probe,\n existing_probe_error="confinement probe path already exists",\n touch=touch,\n cwd=cwd,\n environment=environment,\n writable_directories=writable_directories,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n after_allowed=verify_namespace_confinement,\n )\n finally:\n if result is None:\n read_probe.unlink(missing_ok=True)\n if result.allowed.returncode or not result.allowed_created:\n read_probe.unlink(missing_ok=True)\n raise VerificationError(\n "outer sandbox did not permit its writable directory" + detail(result.allowed)\n )\n\n if result.denied is None:\n read_probe.unlink(missing_ok=True)\n raise VerificationError("outer sandbox confinement probe omitted its negative control")\n if result.denied_created or result.denied.returncode == 0:\n read_probe.unlink(missing_ok=True)\n raise VerificationError(\n "outer sandbox write policy was not enforced" + detail(result.denied)\n )\n\n protected = protected_write_directories or []\n require_protected_paths(protected, writable_directories)\n if protected:\n marker = ".palomar-frozen-write-probe"\n for directory in protected:\n if not directory.is_dir() or (directory / marker).exists():\n raise VerificationError(f"invalid frozen write probe directory: {directory}")\n frozen_script = (\n "from pathlib import Path; import sys; escaped=False; "\n "\\nfor raw in sys.argv[1:]:"\n f"\\n p=Path(raw)/\'{marker}\'"\n "\\n try: p.write_text(\'escape\')"\n "\\n except OSError: pass"\n "\\n else: escaped=True"\n "\\nsys.exit(1 if escaped else 0)"\n )\n frozen = sandboxed_run(\n [str(python), "-c", frozen_script, *(str(path) for path in protected)],\n cwd=cwd,\n environment=environment,\n writable_directories=writable_directories,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n check=False,\n )\n frozen_escape = any((directory / marker).exists() for directory in protected)\n for directory in protected:\n (directory / marker).unlink(missing_ok=True)\n if frozen.returncode or frozen_escape:\n read_probe.unlink(missing_ok=True)\n raise VerificationError("outer sandbox wrote a frozen trusted build" + detail(frozen))\n\n read_script = "from pathlib import Path; import sys; Path(sys.argv[1]).read_bytes()"\n allowed_read = sandboxed_run(\n [str(python), "-c", read_script, str(positive_read)],\n cwd=cwd,\n environment=environment,\n writable_directories=writable_directories,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n check=False,\n )\n if allowed_read.returncode:\n read_probe.unlink(missing_ok=True)\n raise VerificationError("outer sandbox denied its readable source" + detail(allowed_read))\n\n denied_read = sandboxed_run(\n [str(python), "-c", read_script, str(read_probe)],\n cwd=cwd,\n environment=environment,\n writable_directories=writable_directories,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n check=False,\n )\n read_probe.unlink(missing_ok=True)\n if denied_read.returncode == 0:\n raise VerificationError("outer sandbox read policy was not enforced")\n\n token = secrets.token_hex(32)\n holder_env = os.environ.copy()\n holder_env["PALOMAR_PROCESS_SENTINEL"] = token\n holder = subprocess.Popen(\n [str(python), "-c", "import time; time.sleep(120)"],\n env=holder_env,\n stdin=subprocess.DEVNULL,\n stdout=subprocess.DEVNULL,\n stderr=subprocess.DEVNULL,\n )\n try:\n # Popen returns before the child necessarily completes exec; until then\n # /proc can still expose the pre-exec environment. Wait briefly for the\n # sentinel so a scheduler race does not masquerade as failed isolation.\n positive_deadline = time.monotonic() + 2\n while True:\n unconfined = Path(f"/proc/{holder.pid}/environ").read_bytes()\n if token.encode() in unconfined and holder.poll() is None:\n break\n if holder.poll() is not None or time.monotonic() >= positive_deadline:\n raise VerificationError("process-environment probe lacks a live positive control")\n time.sleep(0.01)\n proc_read = sandboxed_run(\n [str(python), "-c", read_script, f"/proc/{holder.pid}/environ"],\n cwd=cwd,\n environment=environment,\n writable_directories=writable_directories,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n check=False,\n )\n finally:\n holder.terminate()\n try:\n holder.wait(timeout=5)\n except subprocess.TimeoutExpired:\n holder.kill()\n holder.wait()\n if proc_read.returncode == 0:\n raise VerificationError("outer sandbox exposed another process environment")\n\n listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n listener.bind(("127.0.0.1", 0))\n listener.listen(1)\n port = listener.getsockname()[1]\n network_script = (\n "import socket,sys; "\n "s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); s.settimeout(2); "\n "sys.exit(0 if s.connect_ex((\'127.0.0.1\',int(sys.argv[1]))) == 0 else 1)"\n )\n try:\n with socket.create_connection(("127.0.0.1", port), timeout=2):\n accepted, _ = listener.accept()\n accepted.close()\n network = sandboxed_run(\n [str(python), "-c", network_script, str(port)],\n cwd=cwd,\n environment=environment,\n writable_directories=writable_directories,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n check=False,\n )\n finally:\n listener.close()\n if network.returncode == 0:\n raise VerificationError("normal sandbox phase unexpectedly reached the network")\n\n\nTAG_NAME_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._+/-]*$")\n\n\ndef revision_release_tags(\n git: list[str], revision: str, *, env: dict[str, str], remote: str = "origin"\n) -> list[str]:\n """The remote\'s tag names that point at exactly this revision.\n\n Lake builds a GitHub release download URL from ``git describe --tags\n --exact-match``, so a dependency that ships prebuilt assets rather than\n building them (ProofWidgets\' widget bundle needs npm) can only be fetched\n when the tag naming its pinned revision exists in the local checkout.\n """\n listing = run(\n [*git, "ls-remote", "--tags", remote],\n env=env,\n timeout=EXECUTION_BUDGET_SECONDS,\n ).stdout\n direct: dict[str, str] = {}\n peeled: dict[str, str] = {}\n for line in listing.splitlines():\n parts = line.split()\n if len(parts) != 2 or not submission_contract.SHA_RE.fullmatch(parts[0]):\n continue\n if not parts[1].startswith("refs/tags/"):\n continue\n name = parts[1].removeprefix("refs/tags/")\n if name.endswith("^{}"):\n peeled[name.removesuffix("^{}")] = parts[0]\n else:\n direct[name] = parts[0]\n # An annotated tag names its commit through the peeled ref; a lightweight\n # tag points at the commit directly.\n return sorted(\n name\n for name, target in direct.items()\n if peeled.get(name, target) == revision\n and TAG_NAME_RE.fullmatch(name)\n and ".." not in name\n and "//" not in name\n and not name.endswith(("/", ".lock"))\n )\n\n\ndef materialize_packages(\n source: Path, *, checkout: Path, base_env: dict[str, str]\n) -> list[Path]:\n """Materialize the exact Git revisions in the submitted Lake manifest.\n\n This deliberately does not use ``lake update``: Lake runs package\n post-update hooks, which are unnecessary for fetching and expand the\n pre-verification execution surface.\n """\n boundary = checkout.resolve()\n packages = manifest_packages(source)\n path_directories: dict[str, Path] = {}\n for package in packages:\n if not package["url"].startswith("path:"):\n continue\n name = package["name"]\n raw_value = package["url"].removeprefix("path:")\n package_dir = contained_path_dependency(source, raw_value, boundary, name)\n path_directories[name] = package_dir\n\n purge_untrusted_lake_state(boundary)\n reject_committed_build_artifacts(boundary)\n packages_dir = manifest_packages_directory(source, checkout=boundary)\n packages_owner = packages_dir.parent.parent\n permitted_owners = {source.resolve(), *path_directories.values()}\n if packages_owner not in permitted_owners:\n raise VerificationError(\n "Lake manifest packagesDir must belong to the project or a contained path dependency"\n )\n writable: list[Path] = []\n for owner in sorted(permitted_owners):\n writable.extend(remove_untrusted_lake_state(owner))\n packages_dir.mkdir(exist_ok=True)\n git_env = git_environment(source, base_env)\n Path(git_env["HOME"]).mkdir(parents=True)\n for package in packages:\n name = package["name"]\n if not re.fullmatch(r"[A-Za-z0-9_.-]+", name) or name in {".", ".."}:\n raise VerificationError(f"unsafe package name in Lake manifest: {name!r}")\n repository_url = package["url"]\n if repository_url.startswith("path:"):\n continue\n revision = package["revision"]\n parsed = urlparse(repository_url)\n if (\n parsed.scheme != "https"\n or not parsed.hostname\n or parsed.username\n or parsed.password\n or parsed.query\n or parsed.fragment\n ):\n raise VerificationError(f"Git package {name!r} must use a credential-free HTTPS repository URL")\n if not submission_contract.SHA_RE.fullmatch(revision):\n raise VerificationError(f"Git package {name!r} is not pinned to a full commit")\n package_dir = packages_dir / name\n package_dir.mkdir()\n git = [\n "git",\n "-c",\n "core.hooksPath=/dev/null",\n "-c",\n "protocol.file.allow=never",\n *GIT_NO_AUTO_MAINTENANCE,\n "-C",\n str(package_dir),\n ]\n run([*git, "init", "--quiet"], env=git_env)\n run([*git, "remote", "add", "origin", repository_url], env=git_env)\n run(\n [*git, "fetch", "--quiet", "--depth=1", "origin", revision],\n env=git_env,\n timeout=EXECUTION_BUDGET_SECONDS,\n )\n # A depth-1 fetch of a bare commit brings no tags, so fetch the ones\n # naming this revision. They carry no history the pinned revision did\n # not already bring, and the revision itself stays the verified one.\n tags = revision_release_tags(git, revision, env=git_env)\n if tags:\n run(\n [\n *git,\n "fetch",\n "--quiet",\n "--depth=1",\n "origin",\n *(f"+refs/tags/{tag}:refs/tags/{tag}" for tag in tags),\n ],\n env=git_env,\n timeout=EXECUTION_BUDGET_SECONDS,\n )\n run([*git, "checkout", "--quiet", "--detach", revision], env=git_env)\n validate_preservable_git_checkout(\n package_dir,\n f"Git package {name!r}",\n allow_inert_submodules=True,\n )\n writable.extend(remove_untrusted_lake_state(package_dir))\n return validate_writable_directories(boundary, writable)\n\n\ndef reject_untrusted_package_artifacts(\n source: Path,\n packages: list[dict[str, str]],\n allowlist: dict[str, tuple[str, str]],\n *,\n checkout: Path,\n) -> None:\n """Scan candidate-controlled packages after official closure verification."""\n for package in packages:\n if package["name"] not in allowlist:\n reject_committed_build_artifacts(\n package_checkout(source, package, checkout=checkout)\n )\n\n\ndef mathlib_cache_availability(transcript: str) -> bool | None:\n """Interpret the trusted cache client\'s completion summary."""\n downloaded = [\n int(count)\n for count in re.findall(r"(?im)^[\\r ]*Downloaded:\\s*([0-9]+)\\s+file", transcript)\n ]\n if "Warning: some files were not found in the cache." in transcript:\n return False\n if downloaded:\n return any(count > 0 for count in downloaded)\n if "No files to download" in transcript:\n return True\n # Older cache clients did not expose a stable availability summary. Do not\n # claim either outcome when the trusted transcript is silent.\n return None\n\n\n@dataclass(frozen=True)\nclass StagedTrustedClosure:\n """A disposable copy of one verified package closure."""\n\n source: Path\n root_package: Path\n lake_roots: tuple[Path, ...]\n source_snapshots: tuple[TrustedSourceSnapshot, ...]\n\n\n@dataclass(frozen=True)\nclass TrustedSourceSnapshot:\n """Filesystem identity of one canonical or staged source tree."""\n\n root: Path\n entries: tuple[tuple[str, tuple[Any, ...]], ...]\n\n\n@dataclass(frozen=True)\nclass StagedLakePromotion:\n """Validated staged state ready to move into one canonical package."""\n\n name: str\n staged_build: Path\n canonical_build: Path\n metadata: tuple[tuple[Path, Path], ...]\n\n\n@dataclass(frozen=True)\nclass TrustedReplayWorkspace:\n """Verifier-authored root that configures the closure as dependencies."""\n\n source: Path\n lake_root: Path\n\n\ndef _trusted_source_snapshot(root: Path) -> TrustedSourceSnapshot:\n """Record source identity, excluding the intentionally mutable top-level .lake."""\n entries: list[tuple[str, tuple[Any, ...]]] = []\n for current, directories, filenames in os.walk(root, followlinks=False):\n current_path = Path(current)\n directories[:] = [directory for directory in directories if directory != ".lake"]\n for name in [*directories, *filenames]:\n path = current_path / name\n info = path.lstat()\n relative = path.relative_to(root).as_posix()\n if stat.S_ISLNK(info.st_mode):\n kind = "symlink"\n target: str | None = os.readlink(path)\n if name in directories:\n directories.remove(name)\n elif stat.S_ISDIR(info.st_mode):\n kind = "directory"\n target = None\n elif stat.S_ISREG(info.st_mode):\n kind = "file"\n target = None\n else:\n raise VerificationError("trusted package source contains a special file")\n entries.append(\n (\n relative,\n (\n kind,\n info.st_dev,\n info.st_ino,\n info.st_mode,\n info.st_nlink,\n info.st_size,\n info.st_mtime_ns,\n info.st_ctime_ns,\n target,\n ),\n )\n )\n return TrustedSourceSnapshot(root.resolve(), tuple(sorted(entries)))\n\n\ndef _validate_staged_source_copy(\n canonical: TrustedSourceSnapshot, staged: TrustedSourceSnapshot, name: str\n) -> None:\n """Require staging to preserve structure and hard-link every regular source file."""\n canonical_entries = dict(canonical.entries)\n staged_entries = dict(staged.entries)\n if canonical_entries.keys() != staged_entries.keys():\n raise VerificationError(f"staged trusted package source is incomplete: {name!r}")\n for relative, canonical_info in canonical_entries.items():\n staged_info = staged_entries[relative]\n canonical_kind = canonical_info[0]\n if canonical_kind != staged_info[0] or canonical_info[-1] != staged_info[-1]:\n raise VerificationError(f"staged trusted package source changed: {name!r}")\n if canonical_kind == "file" and canonical_info[1:3] != staged_info[1:3]:\n raise VerificationError(\n f"staged trusted package source file was not hard-linked: {name!r}"\n )\n\n\ndef validate_trusted_source_snapshots(\n snapshots: tuple[TrustedSourceSnapshot, ...],\n) -> None:\n """Recheck canonical and hard-linked staged sources after networked execution."""\n for snapshot in snapshots:\n if _trusted_source_snapshot(snapshot.root).entries != snapshot.entries:\n raise VerificationError(\n "trusted package source changed during the network-enabled cache phase"\n )\n\n\ndef stage_trusted_closure(\n source: Path,\n *,\n checkout: Path,\n packages: list[dict[str, str]],\n closure: set[str],\n root_name: str,\n destination: Path,\n) -> StagedTrustedClosure:\n """Copy only a verified closure into a disposable Lake workspace."""\n if destination.is_symlink() or not destination.is_dir():\n raise VerificationError("trusted-cache staging boundary is not a real directory")\n by_name = {package["name"]: package for package in packages}\n if not closure <= by_name.keys() or root_name not in closure:\n raise VerificationError("trusted-cache staging closure is incomplete")\n\n staged_packages = destination / ".lake" / "packages"\n staged_packages.mkdir(parents=True)\n manifest: list[dict[str, str]] = []\n source_snapshots: list[TrustedSourceSnapshot] = []\n for name in sorted(closure):\n package = by_name.get(name)\n if package is None:\n raise VerificationError(f"trusted package {name!r} is absent from the manifest")\n if package["url"].startswith("path:"):\n raise VerificationError(f"trusted package {name!r} may not use a path dependency")\n if not re.fullmatch(r"[A-Za-z0-9_.-]+", name) or name in {".", ".."}:\n raise VerificationError(f"unsafe trusted package name: {name!r}")\n canonical = package_checkout(source, package, checkout=checkout)\n if canonical.is_symlink() or not canonical.is_dir():\n raise VerificationError(f"trusted package checkout is not a real directory: {canonical}")\n staged = staged_packages / name\n # Staging and canonical state deliberately share a filesystem. Hard\n # links make the large verified source closure cheap to reproduce; the\n # sandbox exposes these files read-only and grants writes only below\n # each newly created staged .lake root.\n shutil.copytree(\n canonical,\n staged,\n symlinks=True,\n ignore=shutil.ignore_patterns(".lake"),\n copy_function=os.link,\n )\n canonical_snapshot = _trusted_source_snapshot(canonical)\n staged_snapshot = _trusted_source_snapshot(staged)\n _validate_staged_source_copy(canonical_snapshot, staged_snapshot, name)\n source_snapshots.extend((canonical_snapshot, staged_snapshot))\n if (staged / ".git").is_symlink() or not (staged / ".git").is_dir():\n raise VerificationError(f"staged trusted package has no real Git metadata: {name!r}")\n manifest.append(\n {\n "name": package["manifest_name"],\n "type": "git",\n "url": package["url"],\n "rev": package["revision"],\n }\n )\n\n write_json(\n destination / "lake-manifest.json",\n {"version": "1.2.0", "packagesDir": ".lake/packages", "packages": manifest},\n )\n staged_manifest = manifest_packages(destination)\n for package in staged_manifest:\n staged_lake = package_checkout(\n destination, package, checkout=destination\n ) / ".lake"\n (staged_lake / "build").mkdir(parents=True)\n (staged_lake / "config").mkdir()\n reset_trusted_lake_state(\n destination,\n closure,\n packages=staged_manifest,\n checkout=destination,\n )\n root = package_checkout(\n destination,\n next(package for package in staged_manifest if package["name"] == root_name),\n checkout=destination,\n )\n nested_package_links(destination, root, checkout=destination, allowed_names=closure)\n\n lake_roots: list[Path] = []\n boundary = destination.resolve()\n for name in sorted(closure):\n package = next(package for package in staged_manifest if package["name"] == name)\n lake_root = package_checkout(\n destination, package, checkout=destination\n ) / ".lake"\n if lake_root.is_symlink() or not lake_root.is_dir():\n raise VerificationError(f"staged trusted package Lake root is invalid: {name!r}")\n resolved = lake_root.resolve()\n try:\n resolved.relative_to(boundary)\n except ValueError as error:\n raise VerificationError(\n f"staged trusted package Lake root escapes its boundary: {name!r}"\n ) from error\n lake_roots.append(resolved)\n return StagedTrustedClosure(\n destination.resolve(), root.resolve(), tuple(lake_roots), tuple(source_snapshots)\n )\n\n\ndef _resolve_staged_symlink(path: Path, root: Path) -> Path:\n """Resolve one symlink without ever traversing outside its build root."""\n current = path.parent\n remaining = list(Path(os.readlink(path)).parts)\n traversed_links = 0\n while remaining:\n component = remaining.pop(0)\n if component in {"", "."}:\n continue\n current = current.parent if component == ".." else current / component\n try:\n current.relative_to(root)\n except ValueError as error:\n raise VerificationError("staged build symlink escapes its build root") from error\n try:\n info = current.lstat()\n except OSError as error:\n raise VerificationError("staged build symlink has a missing target") from error\n if stat.S_ISLNK(info.st_mode):\n target = Path(os.readlink(current))\n if target.is_absolute():\n raise VerificationError("staged build symlink has an absolute target")\n traversed_links += 1\n if traversed_links > 40:\n raise VerificationError("staged build symlink chain is too deep")\n remaining = [*target.parts, *remaining]\n current = current.parent\n return current\n\n\ndef _validate_staged_build_tree(build: Path, name: str) -> None:\n """Reject generated filesystem objects that could escape after promotion."""\n root = build.resolve()\n if build.is_symlink() or not build.is_dir():\n raise VerificationError(f"staged trusted package build is invalid: {name!r}")\n hardlinks: dict[tuple[int, int], tuple[int, int]] = {}\n for current, directories, filenames in os.walk(build, followlinks=False):\n current_path = Path(current)\n for entry_name in [*directories, *filenames]:\n path = current_path / entry_name\n info = path.lstat()\n mode = info.st_mode\n if stat.S_ISLNK(mode):\n target = os.readlink(path)\n if Path(target).is_absolute():\n raise VerificationError(\n f"staged trusted package build contains an absolute symlink: {name!r}"\n )\n try:\n _resolve_staged_symlink(path, root)\n except VerificationError as error:\n raise VerificationError(\n f"staged trusted package build contains an escaping symlink: {name!r}"\n ) from error\n continue\n if stat.S_ISDIR(mode):\n continue\n if not stat.S_ISREG(mode):\n raise VerificationError(\n f"staged trusted package build contains a special file: {name!r}"\n )\n key = (info.st_dev, info.st_ino)\n observed, links = hardlinks.get(key, (0, info.st_nlink))\n hardlinks[key] = (observed + 1, links)\n if any(observed != links for observed, links in hardlinks.values()):\n raise VerificationError(\n f"staged trusted package build contains an external hard link: {name!r}"\n )\n\n\ndef _staged_lake_metadata(\n staged_lake: Path, canonical_lake: Path, name: str\n) -> tuple[tuple[Path, Path], ...]:\n """Validate generic Lake archive/trace pairs outside generated directories."""\n files: dict[pathlib.PurePosixPath, Path] = {}\n directories: set[pathlib.PurePosixPath] = set()\n total_bytes = 0\n for expected in ("build", "config"):\n path = staged_lake / expected\n if path.is_symlink() or not path.is_dir():\n raise VerificationError(\n f"staged trusted package Lake {expected} is invalid: {name!r}"\n )\n\n for current, child_directories, filenames in os.walk(staged_lake, followlinks=False):\n current_path = Path(current)\n relative_current = pathlib.PurePosixPath(current_path.relative_to(staged_lake).as_posix())\n if relative_current == pathlib.PurePosixPath("."):\n child_directories[:] = [\n child for child in child_directories if child not in {"build", "config", "packages"}\n ]\n for child in child_directories:\n path = current_path / child\n if path.is_symlink() or not path.is_dir():\n raise VerificationError(\n f"staged trusted package Lake metadata contains a symlink: {name!r}"\n )\n directories.add(pathlib.PurePosixPath(path.relative_to(staged_lake).as_posix()))\n for filename in filenames:\n path = current_path / filename\n info = path.lstat()\n if not stat.S_ISREG(info.st_mode) or info.st_nlink != 1:\n raise VerificationError(\n f"staged trusted package Lake metadata is not a regular file: {name!r}"\n )\n relative = pathlib.PurePosixPath(path.relative_to(staged_lake).as_posix())\n files[relative] = path\n total_bytes += info.st_size\n if (\n len(files) > MAX_STAGED_LAKE_METADATA_FILES\n or total_bytes > MAX_STAGED_LAKE_METADATA_BYTES\n ):\n raise VerificationError(\n f"staged trusted package Lake metadata exceeds its limit: {name!r}"\n )\n\n archives = {\n relative\n for relative in files\n if not relative.name.endswith(".trace")\n and relative.with_name(relative.name + ".trace") in files\n }\n expected = {\n *archives,\n *(relative.with_name(relative.name + ".trace") for relative in archives),\n }\n if set(files) != expected:\n raise VerificationError(\n f"staged trusted package Lake metadata is not paired archive state: {name!r}"\n )\n for archive in archives:\n lowered_name = archive.name.lower()\n if (\n any(part.lower() in STAGED_LAKE_CONTROL_DIRECTORIES for part in archive.parts[:-1])\n or lowered_name in STAGED_LAKE_CONTROL_DIRECTORIES\n or lowered_name in STAGED_LAKE_CONTROL_NAMES\n or Path(lowered_name).suffix in COMPILED_ARTIFACT_SUFFIXES - {".trace"}\n or lowered_name.endswith(COMPILED_ARTIFACT_NAME_SUFFIXES)\n ):\n raise VerificationError(\n f"staged trusted package Lake metadata is control-plane state: {name!r}"\n )\n required_directories = {\n parent\n for relative in files\n for parent in relative.parents\n if parent != pathlib.PurePosixPath(".")\n }\n if directories != required_directories:\n raise VerificationError(\n f"staged trusted package Lake metadata contains an unexpected directory: {name!r}"\n )\n\n result: list[tuple[Path, Path]] = []\n for relative in sorted(files):\n destination = canonical_lake.joinpath(*relative.parts)\n if destination.exists() or destination.is_symlink():\n raise VerificationError(\n f"canonical trusted package Lake metadata already exists: {name!r}"\n )\n result.append((files[relative], destination))\n return tuple(result)\n\n\ndef validate_staged_lake_promotions(\n source: Path,\n staged_source: Path,\n *,\n checkout: Path,\n packages: list[dict[str, str]],\n closure: set[str],\n root_name: str,\n) -> tuple[StagedLakePromotion, ...]:\n """Validate every staged package before any canonical state is replaced."""\n canonical_by_name = {package["name"]: package for package in packages}\n staged_by_name = {package["name"]: package for package in manifest_packages(staged_source)}\n if set(staged_by_name) != closure:\n raise VerificationError("trusted-cache staged package mapping is incomplete")\n for name in sorted(closure):\n canonical = canonical_by_name.get(name)\n staged = staged_by_name[name]\n if canonical is None or (\n canonical["repository"].lower() != staged["repository"].lower()\n or canonical["revision"] != staged["revision"]\n ):\n raise VerificationError(\n f"trusted-cache staged package mapping changed: {name!r}"\n )\n\n staged_root_package = staged_by_name.get(root_name)\n if staged_root_package is None:\n raise VerificationError("trusted-cache staged root package is missing")\n staged_root = package_checkout(\n staged_source, staged_root_package, checkout=staged_source\n )\n staged_links = staged_root / ".lake" / "packages"\n if staged_links.is_symlink() or not staged_links.is_dir():\n raise VerificationError("trusted-cache staged package links are invalid")\n expected_links = {\n package["name"]: package for package in manifest_packages(staged_root)\n }\n if set(path.name for path in staged_links.iterdir()) != set(expected_links):\n raise VerificationError("trusted-cache staged package links changed")\n for name, expected in expected_links.items():\n link = staged_links / name\n actual = staged_by_name.get(name)\n if actual is None or (\n actual["repository"].lower() != expected["repository"].lower()\n or actual["revision"] != expected["revision"]\n ):\n raise VerificationError(\n f"trusted-cache staged dependency mapping changed: {name!r}"\n )\n target = package_checkout(staged_source, actual, checkout=staged_source)\n if not link.is_symlink() or link.resolve(strict=True) != target.resolve(strict=True):\n raise VerificationError(\n f"trusted-cache staged dependency link changed: {name!r}"\n )\n\n promotions: list[StagedLakePromotion] = []\n for name in sorted(closure):\n canonical_package = canonical_by_name.get(name)\n staged_package = staged_by_name.get(name)\n if canonical_package is None or staged_package is None:\n raise VerificationError(f"trusted-cache promotion package is missing: {name!r}")\n canonical_dir = package_checkout(source, canonical_package, checkout=checkout)\n staged_dir = package_checkout(staged_source, staged_package, checkout=staged_source)\n canonical_lake = canonical_dir / ".lake"\n staged_lake = staged_dir / ".lake"\n for lake, field in ((canonical_lake, "canonical"), (staged_lake, "staged")):\n if lake.is_symlink() or not lake.is_dir():\n raise VerificationError(f"{field} trusted package Lake root is invalid: {name!r}")\n canonical_entries = {path.name for path in canonical_lake.iterdir()}\n if canonical_entries != {"build", "config"}:\n raise VerificationError(\n f"canonical trusted package Lake state is not fresh: {name!r}"\n )\n canonical_build = canonical_lake / "build"\n staged_build = staged_lake / "build"\n if canonical_build.is_symlink() or not canonical_build.is_dir():\n raise VerificationError(f"canonical trusted package build is invalid: {name!r}")\n if any(canonical_build.iterdir()):\n raise VerificationError(f"canonical trusted package build is not fresh: {name!r}")\n if staged_build.stat().st_dev != canonical_build.parent.stat().st_dev:\n raise VerificationError(f"trusted-cache staging is on another filesystem: {name!r}")\n _validate_staged_build_tree(staged_build, name)\n metadata = _staged_lake_metadata(staged_lake, canonical_lake, name)\n promotions.append(\n StagedLakePromotion(name, staged_build, canonical_build, metadata)\n )\n return tuple(promotions)\n\n\ndef promote_staged_lake_state(promotions: tuple[StagedLakePromotion, ...]) -> None:\n """Move already-validated build and release state into canonical packages."""\n for promotion in promotions:\n promotion.canonical_build.rmdir()\n os.replace(promotion.staged_build, promotion.canonical_build)\n for source, destination in promotion.metadata:\n destination.parent.mkdir(parents=True, exist_ok=True)\n os.replace(source, destination)\n\n\ndef create_trusted_replay_workspace(\n source: Path,\n *,\n checkout: Path,\n packages: list[dict[str, str]],\n closure: set[str],\n root_name: str,\n destination: Path,\n) -> TrustedReplayWorkspace:\n """Create a synthetic root that configures canonical packages as dependencies."""\n if destination.exists() or destination.is_symlink():\n raise VerificationError("trusted-cache replay workspace is not fresh")\n by_name = {package["name"]: package for package in packages}\n root_package = by_name.get(root_name)\n if root_package is None or not closure <= by_name.keys():\n raise VerificationError("trusted-cache replay closure is incomplete")\n destination.mkdir()\n destination.joinpath("lakefile.toml").write_text(\n "\\n".join(\n (\n \'name = "palomarTrustedCacheReplay"\',\n \'version = "0.0.0"\',\n "",\n "[[require]]",\n f"name = {json.dumps(root_name)}",\n f"git = {json.dumps(root_package[\'url\'])}",\n f"rev = {json.dumps(root_package[\'revision\'])}",\n "",\n )\n ),\n encoding="utf-8",\n )\n root_checkout = package_checkout(source, root_package, checkout=checkout)\n config_files = [\n name for name in ("lakefile.toml", "lakefile.lean") if (root_checkout / name).is_file()\n ]\n if len(config_files) != 1:\n raise VerificationError("trusted-cache replay root has ambiguous Lake configuration")\n try:\n authoritative_manifest = json.loads(\n (root_checkout / "lake-manifest.json").read_text(encoding="utf-8")\n )\n dependency_entries = authoritative_manifest["packages"]\n except (OSError, UnicodeDecodeError, json.JSONDecodeError, KeyError, TypeError) as error:\n raise VerificationError("trusted-cache replay root manifest is invalid") from error\n if not isinstance(dependency_entries, list) or not all(\n isinstance(entry, dict) for entry in dependency_entries\n ):\n raise VerificationError("trusted-cache replay root manifest has invalid packages")\n normalized_dependencies = manifest_packages(root_checkout)\n if (\n len(normalized_dependencies) != len(dependency_entries)\n or {package["name"] for package in normalized_dependencies} != closure - {root_name}\n ):\n raise VerificationError("trusted-cache replay root manifest changed its closure")\n root_entry = {\n "url": root_package["url"],\n "type": "git",\n "subDir": None,\n "scope": "",\n "rev": root_package["revision"],\n "name": root_package["manifest_name"],\n "manifestFile": "lake-manifest.json",\n "inputRev": root_package["revision"],\n "inherited": False,\n "configFile": config_files[0],\n }\n write_json(\n destination / "lake-manifest.json",\n {\n "version": authoritative_manifest.get("version", "1.1.0"),\n "packagesDir": ".lake/packages",\n "packages": [root_entry, *dependency_entries],\n },\n )\n lake_root = destination / ".lake"\n packages_root = lake_root / "packages"\n (lake_root / "build").mkdir(parents=True)\n (lake_root / "config").mkdir()\n packages_root.mkdir()\n boundary = checkout.resolve()\n for name in sorted(closure):\n target = package_checkout(source, by_name[name], checkout=boundary)\n if target.is_symlink() or not target.is_dir():\n raise VerificationError(\n f"trusted-cache replay package is not a real checkout: {name!r}"\n )\n (packages_root / name).symlink_to(target, target_is_directory=True)\n return TrustedReplayWorkspace(destination.resolve(), lake_root.resolve())\n\n\ndef get_mathlib_cache(\n source: Path,\n *,\n checkout: Path,\n base_env: dict[str, str],\n allowlist: dict[str, tuple[str, str]],\n lake: Path,\n readable_paths: list[Path],\n executable_paths: list[Path],\n tools: dict[Path, str],\n resource_properties: tuple[str, ...] = (),\n) -> dict[str, bool | None]:\n """Run the trusted cache client and report whether it supplied the closure."""\n packages = manifest_packages(source)\n _roots, aliases = allowed_roots()\n mathlib = next(\n (\n package\n for package in packages\n if canonical_repository(str(package["repository"]), aliases).lower()\n == "leanprover-community/mathlib4"\n ),\n None,\n )\n if mathlib is None:\n return {"required": False, "available": None}\n package_dir = package_checkout(source, mathlib, checkout=checkout)\n if not (package_dir / ".git").is_dir():\n raise VerificationError("official Mathlib dependency is not a Git checkout")\n git_env = git_environment(source, base_env)\n head = run(\n [\n "git",\n "-C",\n str(package_dir),\n "-c",\n "core.fsmonitor=false",\n "-c",\n "core.hooksPath=/dev/null",\n "rev-parse",\n "HEAD",\n ],\n env=git_env,\n ).stdout.strip()\n if head != mathlib["revision"]:\n raise VerificationError("Mathlib checkout does not match lake-manifest.json")\n origin = run(["git", "-C", str(package_dir), "remote", "get-url", "origin"], env=git_env).stdout.strip()\n if (github_repository(origin) or "").lower() != "leanprover-community/mathlib4":\n raise VerificationError("Mathlib checkout has an unexpected origin")\n changes = run(\n [\n "git",\n "-C",\n str(package_dir),\n "-c",\n "core.fsmonitor=false",\n "-c",\n "core.hooksPath=/dev/null",\n "status",\n "--porcelain=v1",\n "--untracked-files=all",\n ],\n env=git_env,\n ).stdout.strip()\n if changes:\n raise VerificationError("Mathlib source was modified while configuring the workspace")\n\n # Run Mathlib as the workspace root so candidate Lake configuration never\n # executes during the network-enabled phase. Its independently verified\n # closure is copied into a disposable workspace first: the cache client can\n # use arbitrary Lake release facets there without gaining write access to\n # canonical package source or build state.\n closure = {\n mathlib["name"],\n *(dependency["name"] for dependency in manifest_packages(package_dir)),\n }\n if not closure <= allowlist.keys():\n raise VerificationError("Mathlib cache closure is outside the verified allowlist")\n # Candidate configuration ran with these directories writable. Recreate\n # every verified package\'s .lake tree before any staged output can be\n # promoted back into it.\n reset_trusted_lake_state(\n source,\n closure,\n packages=packages,\n checkout=checkout,\n )\n cache_env = base_env.copy()\n cache_env["LAKE_PKG_URL_MAP"] = trusted_package_url_map(\n packages, manifest_packages(package_dir)\n )\n\n cache_available: bool | None\n with tempfile.TemporaryDirectory(\n prefix=".palomar-trusted-cache-", dir=checkout.parent\n ) as staging_directory:\n staged = stage_trusted_closure(\n source,\n checkout=checkout,\n packages=packages,\n closure=closure,\n root_name=mathlib["name"],\n destination=Path(staging_directory),\n )\n staged_home = staged.root_package / ".lake" / "config" / "home"\n staged_temporary = staged.root_package / ".lake" / "config" / "tmp"\n staged_home.mkdir(exist_ok=True)\n staged_temporary.mkdir(exist_ok=True)\n staged_env = cache_env.copy()\n staged_env.update(\n {\n "HOME": str(staged_home.resolve()),\n "TMPDIR": str(staged_temporary.resolve()),\n "LEAN_ABORT_ON_PANIC": "1",\n }\n )\n cache_result = sandboxed_run(\n [str(lake), "exe", "cache", "get"],\n cwd=staged.root_package,\n environment=staged_env,\n writable_directories=list(staged.lake_roots),\n readable_paths=sorted({staged.source, *system_readable_paths()}),\n executable_paths=executable_paths,\n tools=tools,\n timeout=EXECUTION_BUDGET_SECONDS,\n unrestricted_network=True,\n resource_properties=resource_properties,\n )\n cache_transcript = f"{cache_result.stdout}\\n{cache_result.stderr}"\n cache_available = mathlib_cache_availability(cache_transcript)\n validate_trusted_source_snapshots(staged.source_snapshots)\n promotions = validate_staged_lake_promotions(\n source,\n staged.source,\n checkout=checkout,\n packages=packages,\n closure=closure,\n root_name=mathlib["name"],\n )\n promote_staged_lake_state(promotions)\n\n nested_packages = nested_package_links(\n source, package_dir, checkout=checkout, allowed_names=closure\n )\n replay_writable_files: list[Path] = []\n proofwidgets = next((package for package in packages if package["name"] == "proofwidgets"), None)\n if proofwidgets and proofwidgets["name"] in closure:\n # ProofWidgets\' official Lake target records this generated replay\n # marker beside the pinned lockfile. Grant only this exact file; a\n # qualified root must never write its source tree or compiled output.\n lock_hash = (\n package_checkout(source, proofwidgets, checkout=checkout)\n / "widget"\n / "package-lock.json.hash"\n )\n lock_hash.touch(exist_ok=True)\n if lock_hash.is_symlink() or not lock_hash.is_file():\n raise VerificationError("ProofWidgets replay marker is not a regular file")\n replay_writable_files.append(lock_hash.resolve())\n cache_writable = validate_writable_directories(\n checkout,\n trusted_lake_directories(source, closure, checkout=checkout),\n )\n home = package_dir / ".lake" / "config" / "home"\n temporary = package_dir / ".lake" / "config" / "tmp"\n home.mkdir(exist_ok=True)\n temporary.mkdir(exist_ok=True)\n cache_env.update(\n {\n "HOME": str(home.resolve()),\n "TMPDIR": str(temporary.resolve()),\n "LEAN_ABORT_ON_PANIC": "1",\n }\n )\n try:\n # Replay only the fully validated staged state in the canonical closure.\n # Lake records local hash metadata during replay; creating it here\n # prevents a qualified root from later needing write access to Mathlib\n # or its dependencies.\n sandboxed_run(\n [str(lake), "build"],\n cwd=package_dir,\n environment=cache_env,\n writable_directories=cache_writable,\n writable_files=replay_writable_files,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n timeout=EXECUTION_BUDGET_SECONDS,\n )\n # A root-scoped replay does not create Lake\'s dependency-scoped config\n # entries. Build a verifier-authored empty root as well so later\n # candidate configuration can consume those entries read-only instead\n # of requesting writes to frozen trusted package state.\n with tempfile.TemporaryDirectory(\n prefix=".palomar-trusted-replay-", dir=checkout.parent\n ) as replay_directory:\n replay = create_trusted_replay_workspace(\n source,\n checkout=checkout,\n packages=packages,\n closure=closure,\n root_name=mathlib["name"],\n destination=Path(replay_directory) / "workspace",\n )\n replay_home = replay.lake_root / "config" / "home"\n replay_temporary = replay.lake_root / "config" / "tmp"\n replay_home.mkdir()\n replay_temporary.mkdir()\n replay_env = cache_env.copy()\n replay_env.update(\n {"HOME": str(replay_home.resolve()), "TMPDIR": str(replay_temporary.resolve())}\n )\n sandboxed_run(\n [str(lake), "build"],\n cwd=replay.source,\n environment=replay_env,\n writable_directories=[replay.lake_root, *cache_writable],\n readable_paths=sorted(\n {replay.source, checkout.resolve(), *system_readable_paths()}\n ),\n executable_paths=executable_paths,\n tools=tools,\n timeout=EXECUTION_BUDGET_SECONDS,\n )\n return {"required": True, "available": cache_available}\n finally:\n if nested_packages.is_symlink():\n nested_packages.unlink()\n elif nested_packages.is_dir():\n shutil.rmtree(nested_packages)\n\n\ndef source_matches_checkout(path: Path, package_dir: Path) -> bool:\n try:\n relative = path.resolve().relative_to(package_dir.resolve()).as_posix()\n except ValueError:\n return False\n git = [\n "git",\n "-c",\n "core.fsmonitor=false",\n "-c",\n "core.hooksPath=/dev/null",\n "-c",\n "protocol.file.allow=never",\n "-C",\n str(package_dir),\n ]\n env = os.environ.copy()\n env.update(\n {\n "GIT_CONFIG_GLOBAL": "/dev/null",\n "GIT_CONFIG_NOSYSTEM": "1",\n "GIT_TERMINAL_PROMPT": "0",\n }\n )\n expected = run([*git, "rev-parse", f"HEAD:{relative}"], env=env, check=False)\n actual = run([*git, "hash-object", "--", str(path.resolve())], env=env, check=False)\n return (\n expected.returncode == 0\n and actual.returncode == 0\n and expected.stdout.strip() == actual.stdout.strip()\n )\n\n\n@dataclass(frozen=True)\nclass LeanHeader:\n """A Lean source header, as the compiler\'s own parser reports it."""\n\n is_module: bool\n imports: tuple[str, ...]\n\n\ndef parse_lean_header(stdout: str) -> LeanHeader:\n """Read one `lean --deps-json` report.\n\n The compiler injects `Init` into every header that does not say `prelude`,\n so those entries are dropped: this reports the modules an author wrote. A\n Challenge that imports `Init` by hand is therefore not credited with it,\n which costs nothing that a reviewer reads.\n """\n lines = [line for line in stdout.splitlines() if line.strip()]\n try:\n payload = json.loads(lines[-1])\n except (IndexError, json.JSONDecodeError) as error:\n raise VerificationError("Lean did not report a parsable header") from error\n entries = payload.get("imports") if isinstance(payload, dict) else None\n if not isinstance(entries, list) or len(entries) != 1 or not isinstance(entries[0], dict):\n raise VerificationError("Lean reported no single header")\n reported = entries[0]\n errors = reported.get("errors") or []\n if errors:\n raise VerificationError(f"Lean rejected the header: {str(errors[0])[:500]}")\n result = reported.get("result")\n if not isinstance(result, dict) or not isinstance(result.get("isModule"), bool):\n raise VerificationError("Lean did not report whether the source is a module")\n reported_imports = result.get("imports")\n if not isinstance(reported_imports, list):\n raise VerificationError("Lean did not report the header imports")\n modules: list[str] = []\n for entry in reported_imports:\n if not isinstance(entry, dict) or not isinstance(entry.get("module"), str):\n raise VerificationError("Lean reported an unreadable header import")\n module = entry["module"]\n if module != "Init":\n modules.append(module)\n return LeanHeader(is_module=result["isModule"], imports=tuple(sorted(set(modules))))\n\n\ndef lean_header(\n source: Path,\n *,\n lean_source: Path,\n lean: Path,\n environment: dict[str, str],\n writable_directories: list[Path],\n readable_paths: list[Path],\n executable_paths: list[Path],\n tools: dict[Path, str],\n) -> LeanHeader:\n """Ask Lean to read a source header.\n\n ``--deps-json`` runs the compiler\'s own parser, the one Lake uses to decide\n which artifacts a module produces and which modules it imports, so\n Palomar\'s reading cannot drift from Lean\'s. The header is parsed, never\n elaborated, so this reads the candidate\'s source without running it.\n """\n proc = sandboxed_run(\n [str(lean), "--deps-json", str(lean_source)],\n cwd=source,\n environment=environment,\n writable_directories=writable_directories,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n )\n return parse_lean_header(proc.stdout)\n\n\ndef confirm_source_modules(\n checkout: Path, *, source: Path, lean: Path, environment: dict[str, str],\n writable_directories: list[Path], readable_paths: list[Path],\n executable_paths: list[Path], tools: dict[Path, str],\n) -> None:\n """Confirm every submitted header with Lean, before candidate Lake code runs.\n\n --deps-json only parses headers, including unused sources; it never imports\n or elaborates the candidate. Batch requests bound argv size and avoid a\n separate sandbox setup per file.\n """\n # Keep the lexical precheck: Lean\'s fast parser also accepts moduleFoo.\n files = [path for path in lean_source_files(checkout) if path.name != "lakefile.lean"]\n for start in range(0, len(files), 64):\n batch = files[start:start + 64]\n proc = sandboxed_run(\n [str(lean), "--deps-json", *(str(path) for path in batch)],\n cwd=source, environment=environment, writable_directories=writable_directories,\n readable_paths=readable_paths, executable_paths=executable_paths, tools=tools,\n )\n try:\n entries = json.loads(proc.stdout.strip())["imports"]\n if not isinstance(entries, list) or len(entries) != len(batch):\n raise ValueError("header count differs from source count")\n except (ValueError, KeyError, TypeError) as error:\n raise VerificationError(\n "Lean did not return the requested source headers",\n code="palomar.source_header_unavailable", owner="palomar", retryable=True,\n ) from error\n for path, entry in zip(batch, entries, strict=True):\n relative = path.relative_to(checkout).as_posix()\n try:\n header = parse_lean_header(json.dumps({"imports": [entry]}))\n except VerificationError as error:\n raise VerificationError(\n f"{relative}: {error}", code="source.invalid_header", path=relative,\n ) from error\n if not header.is_module:\n raise VerificationError(\n f"{relative} does not use Lean\'s module system",\n code="source.module_required", path=relative, line=1,\n )\n\n\ndef lean_source_dependencies(\n source: Path,\n *,\n challenge_source: Path,\n lean: Path,\n environment: dict[str, str],\n writable_directories: list[Path],\n readable_paths: list[Path],\n executable_paths: list[Path],\n tools: dict[Path, str],\n) -> list[Path]:\n proc = sandboxed_run(\n [str(lean), "--src-deps", str(challenge_source)],\n cwd=source,\n environment=environment,\n writable_directories=writable_directories,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n )\n dependencies: set[Path] = set()\n for line in proc.stdout.splitlines():\n value = line.strip()\n if not value:\n continue\n path = Path(value)\n if not path.is_absolute():\n raise VerificationError(f"Lean reported a non-absolute source dependency: {value!r}")\n resolved = path.resolve()\n if resolved.suffix != ".lean" or not resolved.is_file():\n raise VerificationError(f"Lean reported an invalid source dependency: {value!r}")\n dependencies.add(resolved)\n return sorted(dependencies)\n\n\ndef audit_challenge_sources(\n source: Path,\n *,\n checkout: Path,\n dependency_sources: list[Path],\n lean_prefix: Path,\n allowlist: dict[str, tuple[str, str]],\n writable_directories: list[Path],\n) -> dict[str, Any]:\n packages = manifest_packages(source)\n by_name = {package["name"]: package for package in packages}\n untrusted: list[str] = []\n dependencies: dict[tuple[str, str], None] = {}\n qualified_allowlisted = False\n toolchain_prefix = lean_prefix.resolve()\n\n for resolved in dependency_sources:\n try:\n resolved.relative_to(toolchain_prefix)\n continue\n except ValueError:\n pass\n if path_is_within(resolved, writable_directories):\n untrusted.append(str(resolved))\n continue\n package_name = source_package(resolved, source, checkout=checkout)\n if package_name is None:\n # Any candidate-local helper import expands the unaudited statement\n # surface and is forbidden in v1.\n untrusted.append(str(resolved))\n continue\n package = by_name.get(package_name)\n if not package:\n untrusted.append(str(resolved))\n continue\n package_dir = package_checkout(source, package, checkout=checkout)\n if not source_matches_checkout(resolved, package_dir):\n untrusted.append(str(resolved))\n continue\n if package_name in allowlist:\n repository, level = allowlist[package_name]\n dependencies[(repository, "allowlisted")] = None\n qualified_allowlisted = qualified_allowlisted or level == "qualified"\n continue\n # A repository is not importable merely because Palomar has already\n # accepted a record from it.\n untrusted.append(str(resolved))\n\n serialized_dependencies = [\n {"repository": repository, "provenance": provenance}\n for repository, provenance in sorted(dependencies)\n ]\n return {\n "source_count": len(dependency_sources),\n "dependencies": serialized_dependencies,\n "untrusted_sources": untrusted[:100],\n "trust_level": "qualified" if qualified_allowlisted else "high",\n }\n\n\ndef lake_environment_value(\n name: str,\n *,\n source: Path,\n lake: Path,\n printenv: Path,\n environment: dict[str, str],\n writable_directories: list[Path],\n readable_paths: list[Path],\n executable_paths: list[Path],\n tools: dict[Path, str],\n allowed_roots: list[Path],\n) -> str:\n proc = sandboxed_run(\n [str(lake), "env", str(printenv), name],\n cwd=source,\n environment=environment,\n writable_directories=writable_directories,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n )\n lines = [line.strip() for line in proc.stdout.splitlines() if line.strip()]\n if not lines:\n raise VerificationError(f"Lake did not report {name}")\n value = lines[-1]\n paths = value.split(os.pathsep)\n if not paths or any(not path or not Path(path).is_absolute() for path in paths):\n raise VerificationError(f"Lake reported an invalid {name}")\n resolved = [Path(path).resolve() for path in paths]\n if any(not path_is_within(path, allowed_roots) for path in resolved):\n raise VerificationError(f"Lake reported {name} outside the materialized project")\n return os.pathsep.join(str(path) for path in resolved)\n\n\ndef resolve_module_source(\n module: str,\n *,\n project: Path,\n lean_source_path: str,\n) -> Path:\n """Resolve a configured module using Lake\'s ordered source roots."""\n suffix = module_source_suffix(module)\n for root_value in lean_source_path.split(os.pathsep):\n if not root_value:\n continue\n candidate = Path(root_value).joinpath(*suffix.parts)\n if not candidate.exists() and not candidate.is_symlink():\n continue\n if candidate.is_symlink() or not candidate.is_file():\n raise VerificationError(f"configured module {module!r} is not a regular source file")\n resolved = candidate.resolve()\n try:\n resolved.relative_to(project.resolve())\n except ValueError as error:\n raise VerificationError(\n f"configured module {module!r} resolves outside the selected project"\n ) from error\n return resolved\n raise VerificationError(f"configured module {module!r} has no source file in Lake\'s source path")\n\n\nCOMPARATOR_FAILURE_MARKERS = (\n "uncaught exception", "panic at", "not found in environment", "error:", "error]", "failed",\n "rejected the solution", "exited with",\n)\nRETRY_SAME_COMMIT = (\n "Do not change the repository. Retry the same commit later; report the "\n "workflow URL if the problem recurs."\n)\n\n\ndef comparator_failure_excerpt(log: str, *, limit: int = 10) -> str:\n """The lines of a build or judge log that say why it stopped.\n\n A submitter should not have to read a build log of several thousand lines\n to find the one line that matters, so the lines that name a failure are\n carried into the report. The whole tail is kept separately for an operator.\n """\n lines = [line.rstrip() for line in log.splitlines() if line.strip()]\n marked = [\n line for line in lines\n if any(marker in line.lower() for marker in COMPARATOR_FAILURE_MARKERS)\n ]\n chosen = (marked or lines)[-limit:]\n return "\\n".join(line[:400] for line in chosen)\n\n\ndef comparator_verdict(returncode: int, log: str) -> VerificationError | None:\n """Say what a `lake comparator` exit means, and whose problem it is.\n\n Only a run that has judged the submission and found against it, in the\n comparator\'s own words, is a rejection. A comparator that could not start\n (exit 2), whose nested sandbox or kernel failed to run, or that stopped for\n a reason it does not name has established nothing about the submission.\n """\n if returncode == 0:\n return None\n excerpt = comparator_failure_excerpt(log)\n if returncode == 2:\n return VerificationError(\n "lake comparator could not run",\n code="palomar.comparator_cannot_run",\n owner="palomar",\n detail=excerpt,\n next_action=RETRY_SAME_COMMIT,\n retryable=True,\n )\n if COMPARATOR_INFRASTRUCTURE_RE.search(log):\n return VerificationError(\n "lake comparator\'s nested sandbox or one of its kernels failed to run",\n code="palomar.comparator_sandbox_failed",\n owner="palomar",\n detail=excerpt,\n next_action=RETRY_SAME_COMMIT,\n retryable=True,\n )\n rejecting_kernels = COMPARATOR_KERNEL_REJECTED_RE.findall(log)\n if returncode == 1 and (\n COMPARATOR_VERDICT_RE.search(log) or COMPARATOR_LEAN_KERNEL in rejecting_kernels\n ):\n return VerificationError(\n "lake comparator rejected the project",\n code="comparator.rejected",\n detail=excerpt,\n next_action=(\n "Correct the Comparator failure quoted above, commit it, and make "\n "a new submission."\n ),\n )\n if rejecting_kernels:\n return VerificationError(\n "an independent kernel failed or rejected the proof that Lean\'s kernel accepted: "\n + ", ".join(sorted(set(rejecting_kernels))),\n code="palomar.kernel_disagreement",\n owner="palomar",\n detail=excerpt,\n next_action=(\n "Do not change the repository. Palomar must examine this run; report the "\n "workflow URL."\n ),\n retryable=True,\n )\n return VerificationError(\n f"lake comparator stopped without a verdict (exit {returncode})",\n code="palomar.comparator_unclassified",\n owner="palomar",\n detail=excerpt,\n next_action=RETRY_SAME_COMMIT,\n retryable=True,\n )\n\n\ndef bwrap_source_tag_from_installer() -> str:\n """The bubblewrap release `scripts/install_bwrap.sh` builds, as its tag."""\n text = (ROOT / "scripts" / "install_bwrap.sh").read_text(encoding="utf-8")\n match = re.search(r\'^BWRAP_VERSION="([0-9]+\\.[0-9]+\\.[0-9]+)"$\', text, re.MULTILINE)\n if match is None:\n raise VerificationError(\n "scripts/install_bwrap.sh does not pin a bubblewrap release",\n code="palomar.tool_policy_invalid",\n owner="palomar",\n next_action="Do not change the repository; Palomar must repair its tool policy.",\n )\n return f"v{match.group(1)}"\n\n\ndef toolchain_tools(lean_prefix: Path) -> dict[str, Path]:\n """The bundled binaries a verification runs, or a refusal naming the missing ones."""\n tools = {name: lean_prefix / "bin" / name for name in TOOLCHAIN_TOOLS}\n missing = [\n name for name, path in tools.items()\n if path.is_symlink() or not path.is_file() or not os.access(path, os.X_OK)\n ]\n if missing:\n raise VerificationError(\n f"the selected Lean toolchain does not bundle: {\', \'.join(missing)}",\n code="palomar.toolchain_incomplete",\n owner="palomar",\n next_action=(\n "Do not change the repository. Palomar must add support for this Lean release."\n ),\n )\n return {name: path.resolve(strict=True) for name, path in tools.items()}\n\n\ndef tool_digests(tools: dict[str, Path], bwrap: Path) -> dict[str, str]:\n """The sha256 of every binary that judged the submission, by name."""\n return {**{name: sha256(path) for name, path in tools.items()}, "bwrap": sha256(bwrap)}\n\n\ndef protected_kernels(tools: dict[str, Path]) -> dict[str, list[str]]:\n """The external kernels the protected configuration registers, by name."""\n kernels = {name: [str(tools[binary])] for name, binary in PROTECTED_KERNELS}\n kernels["con-ron"].append(f"--jobs={CON_RON_JOBS}")\n return kernels\n\n\ndef primitive_targets(lean_prefix: Path) -> list[str]:\n """The kernel-builtin constants `lake comparator` exports beside the declarations.\n\n `compareAt` seeds its walk with them, and an export that lacks one fails a\n valid proof, so the list is read from the selected toolchain\'s own copy of\n `Lake/CLI/Check.lean` rather than duplicated here, where it would drift. A\n toolchain whose copy does not have the expected shape is refused.\n """\n source = lean_prefix / "src" / "lean" / "lake" / "Lake" / "CLI" / "Check.lean"\n refusal = VerificationError(\n "the selected Lean toolchain\'s lake comparator has an unrecognised export target list",\n code="palomar.toolchain_unrecognised",\n owner="palomar",\n next_action="Do not change the repository. Palomar must add support for this Lean release.",\n )\n try:\n text = source.read_text(encoding="utf-8")\n except OSError as error:\n raise refusal from error\n match = re.search(\n r"^def primitiveTargets[^\\n]*\\n(?P.*?)^def ", text, re.MULTILINE | re.DOTALL\n )\n if match is None:\n raise refusal\n # Strip comments (`-- ``Nat.zero,` is a commented-out entry, not an entry),\n # then accept exactly one literal array of quoted names and nothing else:\n # a list assembled any other way would be read only in part.\n body = re.sub(r"/-.*?-/", "", match.group("body"), flags=re.DOTALL)\n body = "\\n".join(line.split("--", 1)[0] for line in body.splitlines())\n literal = re.fullmatch(r"\\s*return\\s*#\\[(?P[^\\[\\]]*)\\]\\s*", body)\n if literal is None:\n raise refusal\n names: list[str] = []\n for item in literal.group("items").split(","):\n item = item.strip()\n if not item:\n continue\n name = re.fullmatch(r"``([A-Za-z_][A-Za-z0-9_\'.]*)", item)\n if name is None:\n raise refusal\n names.append(name.group(1))\n if not names or len(set(names)) != len(names):\n raise refusal\n return names\n\n\ndef comparator_export_targets(config: dict[str, Any], primitives: list[str]) -> list[str]:\n """The declarations both exports carry, in the order `compareIt` asks for them."""\n axioms = list(config["permitted_axioms"])\n builtin = ["Quot", "Quot.mk", "Quot.lift", "Quot.ind"] if "Quot.sound" in axioms else []\n return [\n *builtin,\n *config["theorem_names"],\n *axioms,\n *primitives,\n *config.get("definition_names", []),\n ]\n\n\ndef export_module(\n module: str,\n targets: list[str],\n *,\n output: Path,\n leanexport: Path,\n cwd: Path,\n environment: dict[str, str],\n readable_paths: list[Path],\n executable_paths: list[Path],\n tools: dict[Path, str],\n timeout: int,\n) -> subprocess.CompletedProcess[str]:\n """Export one module\'s declaration closure to a verifier-owned file.\n\n The exporter writes to its standard output, which the babysitter has opened\n outside the sandbox: nothing inside can reach the file, its size is not\n capped by the log capture, and a later phase cannot swap it.\n """\n if output.exists() or output.is_symlink():\n raise VerificationError(f"export path is not fresh: {output}")\n return sandboxed_run(\n [str(leanexport), module, "--", *targets],\n cwd=cwd,\n environment=environment,\n writable_directories=[],\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n timeout=timeout,\n check=False,\n stdout_path=output,\n )\n\n\ndef export_failure(\n proc: subprocess.CompletedProcess[str], *, module: str, palomar_owned: bool,\n configured_targets: set[str],\n) -> VerificationError:\n """Say what a failed export means.\n\n A missing declaration belongs to the submitter only when the exporter\n names one of the declarations in comparator.json. Exporting a dependency\n closure can also panic on an unrelated missing constant; a generic panic\n must not be described as a missing configured declaration.\n """\n excerpt = comparator_failure_excerpt(proc.stderr)\n missing = sorted(\n name for name in configured_targets\n if f"Constant {name} not found in environment." in proc.stderr\n )\n if missing:\n missing_name = missing[0]\n return VerificationError(\n f"comparator.json names {missing_name}, which {module} does not define",\n code="comparator.declaration_missing",\n detail=excerpt,\n next_action=(\n "Name in comparator.json only declarations the Challenge and Solution "\n "modules define, commit the correction, and make a new submission."\n ),\n )\n if palomar_owned:\n return VerificationError(\n f"exporting the Challenge that Palomar compiled failed (exit {proc.returncode})",\n code="palomar.challenge_export_failed",\n owner="palomar",\n detail=excerpt,\n next_action=RETRY_SAME_COMMIT,\n retryable=True,\n )\n return VerificationError(\n f"exporting the Solution failed (exit {proc.returncode})",\n code="solution.export_failed",\n detail=excerpt,\n next_action=(\n "Correct the failure quoted above, commit it, and make a new submission."\n ),\n )\n\n\ndef ill_typed_export(source: Path, theorem: str) -> bytes:\n """A copy of an export in which `theorem`\'s proof is its own statement.\n\n The export is NDJSON: a name table, an expression table and one record per\n declaration referring into them. Replacing the theorem\'s `value` by its\n `type` keeps every record well-formed and makes the proof ill-typed, which\n is exactly what a kernel, and nothing before it, must refuse.\n """\n lines = source.read_bytes().split(b"\\n")\n records = [json.loads(line) for line in lines if line.strip()]\n name_index = next(\n (\n record["in"]\n for record in records\n if "in" in record and record.get("str", {}).get("str") == theorem\n ),\n None,\n )\n if name_index is None:\n raise VerificationError(f"export does not name {theorem}")\n for position, record in enumerate(records):\n declaration = record.get("thm")\n if isinstance(declaration, dict) and declaration.get("name") == name_index:\n declaration["value"] = declaration["type"]\n records[position] = {"thm": declaration}\n break\n else:\n raise VerificationError(f"export carries no theorem record for {theorem}")\n return b"".join(json.dumps(record, separators=(",", ":")).encode() + b"\\n" for record in records)\n\n\ndef verify_export(output: Path) -> None:\n """Require the file an export phase left behind to be one the exporter wrote."""\n if output.is_symlink() or not output.is_file():\n raise VerificationError(f"export produced no file: {output.name}")\n with output.open("rb") as handle:\n head = handle.readline(4096)\n if not head.startswith(b\'{"meta":\'):\n raise VerificationError(f"export does not start with the exporter\'s header: {output.name}")\n\n\ndef judge_exports(\n *,\n lake: Path,\n config: Path,\n challenge_export: Path,\n solution_export: Path,\n scratch: Path,\n bwrap: Path,\n lean_prefix: Path,\n environment: dict[str, str],\n tools: dict[Path, str],\n timeout: int,\n) -> subprocess.CompletedProcess[str]:\n """Run `lake comparator` over two exports under the judge-only policy.\n\n Nothing of the candidate is bound in: the two exports, the protected\n configuration, the toolchain, the system directories and a fresh scratch\n directory for the comparator\'s own temporary files. The comparator nests\n its own bubblewrap around each kernel, so this is the one phase that keeps\n user namespaces, and `COMPARATOR_BWRAP` points it at the same bubblewrap\n build the outer sandbox uses.\n """\n project = scratch / "project"\n home = scratch / "home"\n temporary = scratch / "tmp"\n for directory in (project, home, temporary):\n directory.mkdir(parents=True)\n system_executables = [\n path.resolve()\n for path in (\n Path("/usr"), Path("/bin"), Path("/lib"), Path("/lib64"),\n Path("/run/current-system/sw"), Path("/nix/store"),\n )\n if path.exists()\n ]\n # The comparator resolves `which`, `git`, `env` and the kernel paths on\n # PATH. It gets the toolchain and the bound system directories, not the\n # runner\'s PATH, so the judge sees the same search path everywhere.\n search_path = [str(lean_prefix / "bin")]\n for directory in (*(path / "bin" for path in system_executables), Path("/usr/bin"), Path("/bin")):\n if directory.is_dir() and str(directory) not in search_path:\n search_path.append(str(directory))\n env = {name: value for name, value in environment.items() if name in {"LANG", "LC_ALL"}}\n env.update(\n {\n "PATH": os.pathsep.join(search_path),\n "HOME": str(home.resolve()),\n "TMPDIR": str(temporary.resolve()),\n "LEAN_ABORT_ON_PANIC": "1",\n "COMPARATOR_BWRAP": str(bwrap),\n }\n )\n return sandboxed_run(\n [\n str(lake), "comparator", "--config", str(config),\n "--challenge-from-export", str(challenge_export),\n "--solution-from-export", str(solution_export),\n ],\n cwd=project,\n environment=env,\n writable_directories=[scratch.resolve()],\n readable_paths=sorted({\n config.resolve(), challenge_export.resolve(), solution_export.resolve(),\n *system_readable_paths(),\n }),\n executable_paths=sorted({lean_prefix, bwrap, *system_executables}),\n tools=tools,\n timeout=timeout,\n check=False,\n nested_sandbox=True,\n )\n\n\ndef comparator_preflight(\n work: Path,\n *,\n lean: Path,\n leanexport: Path,\n lake: Path,\n lean_prefix: Path,\n bwrap: Path,\n kernels: dict[str, list[str]],\n primitives: list[str],\n environment: dict[str, str],\n executable_paths: list[Path],\n tools: dict[Path, str],\n timeout: int,\n) -> None:\n """Prove the judge pipeline on this runner before any candidate code runs.\n\n Three one-line modules compiled against Init alone are exported and judged\n exactly as the submission will be: a matching pair must pass, and a pair\n whose statements differ must be found against in the comparator\'s own\n words. A failure here is Palomar\'s or the runner\'s (a kernel binary that\n will not start, a nested sandbox the runner refuses, an export target list\n the toolchain no longer expects), never the submitter\'s.\n """\n root = work / "comparator-preflight"\n if root.exists() or root.is_symlink():\n raise VerificationError(f"comparator preflight path is not fresh: {root}")\n source = root / "src"\n library = root / "lib"\n exports = root / "exports"\n home = root / "home"\n temporary = root / "tmp"\n for directory in (source, library, exports, home, temporary):\n directory.mkdir(parents=True)\n modules = {\n "PalomarPreflightChallenge": "theorem palomar_preflight : True := trivial\\n",\n "PalomarPreflightSolution": "theorem palomar_preflight : True := trivial\\n",\n "PalomarPreflightWrong": "theorem palomar_preflight : True ∧ True := ⟨trivial, trivial⟩\\n",\n }\n config = {\n "challenge_module": "PalomarPreflightChallenge",\n "solution_module": "PalomarPreflightSolution",\n "theorem_names": ["palomar_preflight"],\n "definition_names": [],\n "permitted_axioms": sorted(STANDARD_AXIOMS),\n "external_kernels": kernels,\n }\n config_path = root / "comparator.json"\n write_json(config_path, config)\n targets = comparator_export_targets(config, primitives)\n env = environment.copy()\n env.update(\n {\n "HOME": str(home.resolve()),\n "TMPDIR": str(temporary.resolve()),\n "LEAN_PATH": os.pathsep.join([str(library.resolve()), str(lean_prefix / "lib" / "lean")]),\n "LEAN_ABORT_ON_PANIC": "1",\n }\n )\n readable_paths = sorted({root.resolve(), *system_readable_paths()})\n\n def failure(message: str, detail: str = "") -> VerificationError:\n return VerificationError(\n f"comparator preflight failed: {message}",\n code="palomar.comparator_preflight_failed",\n owner="palomar",\n detail=detail[-1_500:],\n next_action=RETRY_SAME_COMMIT,\n retryable=True,\n )\n\n try:\n for module, text in modules.items():\n (source / f"{module}.lean").write_text(text, encoding="utf-8")\n sandboxed_run(\n [str(lean), "-o", str(library / f"{module}.olean"), str(source / f"{module}.lean")],\n cwd=root,\n environment=env,\n writable_directories=[library.resolve(), home.resolve(), temporary.resolve()],\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n timeout=timeout,\n )\n proc = export_module(\n module,\n targets,\n output=exports / f"{module}.export",\n leanexport=leanexport,\n cwd=root,\n environment=env,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n timeout=timeout,\n )\n if proc.returncode:\n raise failure(f"exporting {module} failed (exit {proc.returncode})", proc.stderr)\n verify_export(exports / f"{module}.export")\n except VerificationError as error:\n if error.code == "palomar.comparator_preflight_failed":\n raise\n raise failure(str(error), error.detail or "") from error\n\n # The mismatched pair is refused before any kernel runs. A copy of the\n # matching Solution export whose proof is replaced by its own statement\n # is well-formed and ill-typed: only the kernels can refuse it, and Lean\'s\n # must, in the words the verdict reader expects.\n tampered = exports / "PalomarPreflightIllTyped.export"\n tampered.write_bytes(\n ill_typed_export(exports / "PalomarPreflightSolution.export", "palomar_preflight")\n )\n for solution, expected in (\n ("PalomarPreflightSolution", 0),\n ("PalomarPreflightWrong", 1),\n ("PalomarPreflightIllTyped", 1),\n ):\n scratch = root / f"judge-{solution}"\n proc = judge_exports(\n lake=lake,\n config=config_path,\n challenge_export=exports / "PalomarPreflightChallenge.export",\n solution_export=exports / f"{solution}.export",\n scratch=scratch,\n bwrap=bwrap,\n lean_prefix=lean_prefix,\n environment=env,\n tools=tools,\n timeout=timeout,\n )\n log = (proc.stdout + "\\n" + proc.stderr).strip()\n verdict = comparator_verdict(proc.returncode, log)\n if expected == 0 and (verdict is not None or "Your solution is okay!" not in log):\n raise failure("a matching export pair was not accepted", log)\n if expected == 1 and (verdict is None or verdict.code != "comparator.rejected"):\n raise failure(f"{solution} was not found against", log)\n if solution == "PalomarPreflightWrong" and (\n "Challenge and solution theorem statement do not match" not in log\n ):\n raise failure("a mismatched export pair was not found against by comparison", log)\n if solution == "PalomarPreflightIllTyped" and (\n COMPARATOR_LEAN_KERNEL not in COMPARATOR_KERNEL_REJECTED_RE.findall(log)\n ):\n raise failure("an ill-typed proof was not refused by Lean\'s kernel", log)\n\n\ndef protected_lean_path(\n canonical_olean: Path,\n trusted_lean_paths: list[Path],\n candidate_lean_path: str,\n *,\n protected_root: Path | None = None,\n) -> str:\n """Resolve protected statement imports before any candidate build output."""\n candidate_paths = [Path(value) for value in candidate_lean_path.split(os.pathsep) if value]\n ordered = [protected_root or canonical_olean.parent, *trusted_lean_paths, *candidate_paths]\n return os.pathsep.join(str(path) for path in dict.fromkeys(ordered))\n\n\ndef canonical_challenge_artifacts(olean: Path, *, module_system: bool) -> tuple[Path, ...]:\n """Every file the trusted Challenge compilation is expected to publish.\n\n A module-system source compiles to a public module plus private, server and\n IR sidecars, and importing it fails unless all four travel together. A\n pre-module-system source compiles to the single module. Deriving the set\n from the source rather than from whatever the sandbox happens to contain\n keeps hostile elaboration from adding a file to the protected directory.\n """\n if not module_system:\n return (olean,)\n return (\n olean,\n olean.parent / f"{olean.name}.private",\n olean.parent / f"{olean.name}.server",\n olean.parent / f"{olean.stem}.ir",\n )\n\n\ndef compile_canonical_challenge(\n work: Path,\n source: Path,\n *,\n checkout: Path,\n challenge_source: Path | None = None,\n challenge_module: str = "Challenge",\n published_module: str | None = None,\n lean: Path,\n lean_prefix: Path,\n allowlist: dict[str, tuple[str, str]],\n environment: dict[str, str],\n readable_paths: list[Path],\n executable_paths: list[Path],\n tools: dict[Path, str],\n) -> tuple[Path, list[Path], list[Path]]:\n """Compile Challenge directly against frozen trusted dependencies.\n\n Candidate Lake configuration never participates in this compilation. The\n resulting module is published under a verifier-owned alias and prepended to\n Comparator\'s LEAN_PATH so its Challenge export cannot be replaced by\n candidate build output or capture a sibling module namespace.\n """\n output_dir = work / "canonical-challenge"\n scratch = work / "canonical-challenge-scratch"\n for directory in (output_dir, scratch):\n if directory.exists() or directory.is_symlink():\n raise VerificationError(f"canonical Challenge path is not fresh: {directory}")\n scratch.mkdir()\n home = scratch / "home"\n temporary = scratch / "tmp"\n home.mkdir()\n temporary.mkdir()\n challenge_source = challenge_source or (source / "Challenge.lean")\n\n packages_by_name = {package["name"]: package for package in manifest_packages(source)}\n trusted_names = sorted(\n allowlist,\n key=lambda name: (allowlist[name][1] != "high", name.lower()),\n )\n trusted_packages = {\n name: package_checkout(source, packages_by_name[name], checkout=checkout)\n for name in trusted_names\n }\n lean_paths: list[Path] = []\n core_path = lean_prefix / "lib" / "lean"\n if core_path.is_dir():\n lean_paths.append(core_path.resolve())\n for package_dir in trusted_packages.values():\n path = package_dir / ".lake" / "build" / "lib" / "lean"\n if path.is_dir():\n lean_paths.append(path.resolve())\n lean_paths = list(dict.fromkeys(lean_paths))\n canonical_readable_paths = list(readable_paths)\n challenge_root = challenge_source.resolve()\n for _segment in module_source_suffix(challenge_module).parts:\n challenge_root = challenge_root.parent\n source_paths = [\n source.resolve(),\n challenge_root,\n *trusted_packages.values(),\n ]\n lake_source = lean_prefix / "src" / "lean" / "lake"\n if lake_source.is_dir():\n source_paths.append(lake_source.resolve())\n\n canonical_env = environment.copy()\n canonical_env.update(\n {\n "HOME": str(home.resolve()),\n "TMPDIR": str(temporary.resolve()),\n "LEAN_PATH": os.pathsep.join(str(path) for path in dict.fromkeys(lean_paths)),\n "LEAN_SRC_PATH": os.pathsep.join(str(path) for path in sorted(set(source_paths))),\n }\n )\n module_suffix = module_source_suffix(\n published_module or challenge_module\n ).with_suffix(".olean")\n compiled_olean = scratch.joinpath(*module_suffix.parts)\n compiled_olean.parent.mkdir(parents=True, exist_ok=True)\n sandboxed_run(\n [str(lean), "-o", str(compiled_olean), str(challenge_source)],\n cwd=source,\n environment=canonical_env,\n writable_directories=[scratch.resolve()],\n readable_paths=canonical_readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n timeout=EXECUTION_BUDGET_SECONDS,\n )\n if compiled_olean.is_symlink() or not compiled_olean.is_file():\n raise VerificationError("trusted Challenge compilation produced no module")\n module_system = lean_header(\n source,\n lean_source=challenge_source,\n lean=lean,\n environment=canonical_env,\n writable_directories=[scratch.resolve()],\n readable_paths=canonical_readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n ).is_module\n compiled_artifacts = canonical_challenge_artifacts(\n compiled_olean, module_system=module_system\n )\n for artifact in compiled_artifacts:\n if artifact.is_symlink() or not artifact.is_file():\n raise VerificationError(\n f"trusted Challenge compilation did not publish {artifact.name}"\n )\n # A source that Lean treats as a module but the header check does not would\n # otherwise lose its sidecars silently, and a source that is not a module\n # has no business carrying them.\n surplus = [\n artifact\n for artifact in canonical_challenge_artifacts(compiled_olean, module_system=True)\n if artifact not in compiled_artifacts and (artifact.exists() or artifact.is_symlink())\n ]\n if surplus:\n raise VerificationError(\n "trusted Challenge compilation published unexpected module artifacts: "\n + ", ".join(sorted(artifact.name for artifact in surplus))\n )\n compiled_artifacts = tuple(artifact.resolve() for artifact in compiled_artifacts)\n compiled_olean = compiled_olean.resolve()\n for artifact in compiled_artifacts:\n tools[artifact] = sha256(artifact)\n dependencies = lean_source_dependencies(\n source,\n challenge_source=challenge_source,\n lean=lean,\n environment=canonical_env,\n writable_directories=[scratch.resolve()],\n readable_paths=canonical_readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n )\n # Challenge elaboration is hostile and may write other files in `scratch`.\n # Only the single snapshotted module crosses into the protected search path,\n # which is created by the verifier after all hostile canonical-build passes.\n output_dir.mkdir()\n canonical_olean = output_dir.joinpath(*module_suffix.parts)\n canonical_olean.parent.mkdir(parents=True, exist_ok=True)\n canonical_artifacts = canonical_challenge_artifacts(\n canonical_olean, module_system=module_system\n )\n for compiled, canonical in zip(compiled_artifacts, canonical_artifacts, strict=True):\n shutil.copyfile(compiled, canonical)\n if canonical.is_symlink() or not canonical.is_file():\n raise VerificationError(f"protected Challenge artifact {canonical.name} is not a regular file")\n protected_files = {\n path.resolve()\n for path in output_dir.rglob("*")\n if path.is_file() or path.is_symlink()\n }\n if protected_files != {artifact.resolve() for artifact in canonical_artifacts}:\n raise VerificationError("protected Challenge directory contains unexpected files")\n canonical_olean = canonical_olean.resolve()\n for artifact in canonical_artifacts:\n tools[artifact.resolve()] = sha256(artifact)\n return canonical_olean, dependencies, lean_paths\n\n\ndef execute(args: argparse.Namespace) -> int:\n global _EXECUTION_DEADLINE, _RESOURCE_DISK_PATH, _RESOURCE_METRICS_PATH, _RESOURCE_PHASE\n\n output = Path(args.output).resolve()\n work = Path(args.work_dir).resolve()\n report = json.loads(output.read_text(encoding="utf-8"))\n if report.get("status") != "pending":\n return 0\n previous_deadline = _EXECUTION_DEADLINE\n previous_phase = _RESOURCE_PHASE\n previous_metrics_path = _RESOURCE_METRICS_PATH\n previous_disk_path = _RESOURCE_DISK_PATH\n checkout = work / "source"\n raw_project_path = report.get("source", {}).get("project_path")\n project_relative = (\n normalized_repository_path(raw_project_path, "Mechanical project path")\n if isinstance(raw_project_path, str) and raw_project_path\n else None\n )\n source = (\n resolve_repository_path(\n checkout, project_relative, "Mechanical project path", kind="directory"\n )\n if project_relative is not None\n else checkout.resolve()\n )\n metrics_path = work / "resource-metrics.jsonl"\n report.update(\n {\n # Schema 2: the record of what judged the submission is the Lean\n # toolchain\'s commit, the digests of the binaries it bundles, the\n # kernels the protected configuration named, and the bubblewrap\n # release, instead of four separately pinned tool commits.\n "schema_version": 2,\n "status": "error",\n "stage": "setup",\n "phase": "verification",\n "bwrap_source_tag": args.bwrap_source_tag,\n "workflow_url": args.workflow_url,\n }\n )\n tools: dict[Path, str] = {}\n\n def guarded_write() -> None:\n global _RESOURCE_PHASE\n _RESOURCE_PHASE = str(report.get("stage") or "verification")\n report["resource_usage"] = resource_metrics(metrics_path)\n if tools:\n try:\n verify_tool_snapshot(tools)\n except VerificationError as error:\n report["status"] = "error"\n message = str(error)\n if message not in report["errors"]:\n report["errors"].append(message)\n report_diagnostic(report, error, owner="palomar")\n write_json(output, report)\n\n try:\n if checkout.is_symlink() or not checkout.is_dir():\n raise VerificationError("verifier-owned source checkout is not a real directory")\n git_metadata = checkout / ".git"\n if git_metadata.is_symlink() or not git_metadata.is_dir():\n raise VerificationError(\n "verifier-owned source checkout has no real Git metadata directory"\n )\n if metrics_path.is_symlink() or (metrics_path.exists() and not metrics_path.is_file()):\n raise VerificationError("resource metrics path is not a regular file")\n metrics_path.unlink(missing_ok=True)\n _RESOURCE_METRICS_PATH = metrics_path\n _RESOURCE_DISK_PATH = checkout\n install_execution_deadline(\n os.environ.get("PALOMAR_JOB_STARTED_AT"),\n getattr(args, "execution_budget_seconds", EXECUTION_BUDGET_SECONDS),\n )\n report["stage"] = "source-requirements"\n source_evidence, source_issues = inspect_lean_sources(checkout)\n report.setdefault("source_requirements", {}).update(source_evidence)\n if source_issues:\n raise source_issues[0]\n bwrap = configure_bwrap(Path(args.bwrap))\n if not BWRAP_SOURCE_TAG_RE.fullmatch(args.bwrap_source_tag):\n raise VerificationError("bubblewrap source tag must be a release tag")\n if args.bwrap_source_tag != bwrap_source_tag_from_installer():\n raise VerificationError(\n "bubblewrap source tag does not match the release scripts/install_bwrap.sh builds",\n code="palomar.tool_policy_invalid",\n owner="palomar",\n )\n metrics_wrapper = (ROOT / "scripts" / "measure_resources.py").resolve()\n babysitter = (ROOT / "scripts" / "supervise_cgroup.py").resolve()\n delegate = (ROOT / "scripts" / "cgroup_delegate.py").resolve()\n verifier = Path(__file__).resolve()\n for tool in (bwrap, metrics_wrapper, babysitter, delegate, verifier):\n if not tool.is_file():\n raise VerificationError(f"missing verifier tool: {tool}")\n env = os.environ.copy()\n env.pop("LAKE_PKG_URL_MAP", None)\n env.update(\n {\n "GIT_CONFIG_GLOBAL": "/dev/null",\n "GIT_CONFIG_NOSYSTEM": "1",\n "GIT_TERMINAL_PROMPT": "0",\n "LEAN_ABORT_ON_PANIC": "1",\n }\n )\n lean_command = shutil.which("lean", path=env["PATH"])\n if not lean_command:\n raise VerificationError("trusted Lean executable is unavailable")\n lean_prefix = Path(\n run([lean_command, "--print-prefix"], cwd=source, env=env).stdout.strip()\n ).resolve()\n if not lean_prefix.is_dir():\n raise VerificationError("trusted Lean prefix is unavailable")\n env["PATH"] = f"{lean_prefix / \'bin\'}:{env[\'PATH\']}"\n lake_command = shutil.which("lake", path=env["PATH"])\n printenv_command = shutil.which("printenv", path=env["PATH"])\n touch_command = shutil.which("touch", path=env["PATH"])\n if not lake_command or not printenv_command or not touch_command:\n raise VerificationError("trusted Lake environment tools are unavailable")\n lake = Path(lake_command).resolve(strict=True)\n printenv = Path(printenv_command).absolute()\n lean = (lean_prefix / "bin" / "lean").resolve(strict=True)\n python = Path(sys.executable).resolve(strict=True)\n touch = Path(touch_command).absolute()\n try:\n lake.relative_to(lean_prefix)\n except ValueError as error:\n raise VerificationError("Lake executable is outside the selected Lean toolchain") from error\n bundled = toolchain_tools(lean_prefix)\n if bundled["lean"] != lean or bundled["lake"] != lake:\n raise VerificationError("the Lean and Lake on PATH are not the selected toolchain\'s")\n leanexport = bundled["leanexport"]\n kernels = protected_kernels(bundled)\n primitives = primitive_targets(lean_prefix)\n report["tool_digests"] = tool_digests(bundled, bwrap)\n report["kernels"] = [{"name": name, "argv": argv} for name, argv in kernels.items()]\n\n report["stage"] = "candidate-setup"\n guarded_write()\n if ensure_lake_manifest(source, checkout):\n report["warnings"].append(\n "Generated a trusted Lake manifest from contained path-dependency manifests"\n )\n writable_directories = materialize_packages(source, checkout=checkout, base_env=env)\n sandbox_home = source / ".lake" / "config" / "home"\n sandbox_tmp = source / ".lake" / "config" / "tmp"\n sandbox_home.mkdir()\n sandbox_tmp.mkdir()\n env["HOME"] = str(sandbox_home.resolve())\n env["TMPDIR"] = str(sandbox_tmp.resolve())\n\n python_prefix = Path(sys.executable).resolve().parent.parent\n executable_paths = [\n lean_prefix,\n python_prefix,\n metrics_wrapper,\n lake,\n lean,\n python,\n printenv,\n touch,\n ]\n for system_path in (\n Path("/usr"),\n Path("/bin"),\n Path("/lib"),\n Path("/lib64"),\n Path("/run/current-system/sw"),\n Path("/nix/store"),\n ):\n if system_path.exists():\n executable_paths.append(system_path.resolve())\n executable_paths = sorted(set(executable_paths))\n comparator_path = resolve_repository_path(\n checkout,\n normalized_repository_path(\n str(report.get("comparator", {}).get("path") or ""),\n "Mechanical Comparator configuration path",\n ),\n "Mechanical Comparator configuration path",\n kind="file",\n )\n lakefile_path = resolve_repository_path(\n checkout,\n normalized_repository_path(\n str(report.get("lakefile", {}).get("path") or ""),\n "Mechanical Lakefile path",\n ),\n "Mechanical Lakefile path",\n kind="file",\n )\n comparator_config = protected_comparator_config(\n comparator_path, work / "protected-comparator.json", kernels=kernels\n )\n protected_config = validate_protected_comparator_config(comparator_config, kernels=kernels)\n protected_challenge = protected_config["challenge_module"]\n env["PALOMAR_PROTECTED_CHALLENGE_MODULE"] = protected_challenge\n # The configuration the judge consumes travels with the report, which\n # the evidence bundle archives: the file\'s exact text, so the record\'s\n # digest is checked against the bytes and not a description of them.\n report["protected_config_sha256"] = sha256(comparator_config)\n report["protected_config"] = comparator_config.read_text(encoding="utf-8")\n report["stage"] = "setup"\n guarded_write()\n readable_paths = sorted(\n {checkout.resolve(), comparator_config, *system_readable_paths()}\n )\n require_protected_paths(\n [\n output,\n comparator_config,\n *bundled.values(),\n bwrap,\n metrics_wrapper,\n verifier,\n python,\n printenv,\n touch,\n lean_prefix,\n ],\n writable_directories,\n )\n tools = tool_snapshot(\n [\n *bundled.values(),\n comparator_config,\n bwrap,\n metrics_wrapper,\n babysitter,\n delegate,\n verifier,\n python,\n printenv,\n touch,\n ]\n )\n report["stage"] = "confinement-initial"\n guarded_write()\n # `--best-effort` is accepted only after the composed outer boundary\n # proves that its positive and negative controls work on this runner.\n # No candidate-controlled Lean or Lake code executes before this probe.\n verify_sandbox_confinement(\n work / "initial-write-denial-probe",\n work / "initial-read-denial-probe",\n positive_read=lakefile_path,\n python=python,\n touch=touch,\n cwd=source,\n environment=env,\n writable_directories=writable_directories,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n )\n report["stage"] = "source-requirements"\n guarded_write()\n confirm_source_modules(\n checkout, source=source, lean=lean, environment=env,\n writable_directories=writable_directories, readable_paths=readable_paths,\n executable_paths=executable_paths, tools=tools,\n )\n report["source_requirements"]["header_parser"] = "lean --deps-json"\n report["stage"] = "comparator-preflight"\n guarded_write()\n comparator_preflight(\n work,\n lean=lean,\n leanexport=leanexport,\n lake=lake,\n lean_prefix=lean_prefix,\n bwrap=bwrap,\n kernels=kernels,\n primitives=primitives,\n environment=env,\n executable_paths=executable_paths,\n tools=tools,\n timeout=EXECUTION_BUDGET_SECONDS,\n )\n report["stage"] = "module-resolution"\n guarded_write()\n candidate_source_path = lake_environment_value(\n "LEAN_SRC_PATH",\n source=source,\n lake=lake,\n printenv=printenv,\n environment=env,\n writable_directories=writable_directories,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n allowed_roots=[checkout, lean_prefix],\n )\n challenge_source = resolve_module_source(\n report["comparator"]["challenge_module"],\n project=source,\n lean_source_path=candidate_source_path,\n )\n solution_source = resolve_module_source(\n report["comparator"]["solution_module"],\n project=source,\n lean_source_path=candidate_source_path,\n )\n challenge_bytes = challenge_source.stat().st_size\n if challenge_bytes > MAX_CHALLENGE_BYTES:\n raise VerificationError("configured Challenge source exceeds the 100 KiB hard cap")\n challenge_text = challenge_source.read_text(encoding="utf-8")\n challenge_lines = len(challenge_text.splitlines())\n if challenge_lines > MAX_CHALLENGE_LINES:\n raise VerificationError("configured Challenge source exceeds the 1,000-line hard cap")\n if challenge_bytes > 32 * 1024 or challenge_lines > 300:\n report["warnings"].append(\n "configured Challenge source exceeds the preferred 32 KiB / 300-line review surface"\n )\n challenge_header = lean_header(\n source,\n lean_source=challenge_source,\n lean=lean,\n environment=env,\n writable_directories=writable_directories,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n )\n report["challenge"].update(\n {\n "path": repository_relative_path(checkout, challenge_source),\n "bytes": challenge_bytes,\n "lines": challenge_lines,\n "direct_imports": list(challenge_header.imports),\n "sha256": sha256(challenge_source),\n }\n )\n report["solution"].update(\n {\n "path": repository_relative_path(checkout, solution_source),\n "sha256": sha256(solution_source),\n }\n )\n report["stage"] = "dependency-provenance"\n guarded_write()\n packages = manifest_packages(source)\n shadow = shadowing_dependency(\n report["comparator"]["challenge_module"], packages, source=source, checkout=checkout\n )\n if shadow is not None:\n raise module_root_shadowed(report["comparator"]["challenge_module"], shadow)\n allowlist = package_allowlist(\n source, packages, checkout=checkout, base_env=env\n )\n report["mathlib_toolchain"] = check_mathlib_toolchain(\n source, packages, checkout=checkout,\n project_toolchain=report["lean_toolchain"],\n project_toolchain_path=report["lean_toolchain_path"],\n )\n reject_untrusted_package_artifacts(\n source, packages, allowlist, checkout=checkout\n )\n report["stage"] = "trusted-cache"\n guarded_write()\n report["mathlib_cache"] = get_mathlib_cache(\n source,\n checkout=checkout,\n base_env=env,\n allowlist=allowlist,\n lake=lake,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n )\n report["stage"] = "trusted-roots"\n guarded_write()\n build_allowlisted_roots(\n source,\n checkout=checkout,\n packages=packages,\n allowlist=allowlist,\n base_env=env,\n lake=lake,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n )\n\n trusted_names = set(allowlist)\n trusted_directories = set(\n trusted_lake_directories(source, trusted_names, checkout=checkout)\n )\n trusted_build_directories = {\n package_lake_directories(source, name, checkout=checkout)[0]\n for name in trusted_names\n }\n candidate_writable = [\n directory for directory in writable_directories if directory not in trusted_directories\n ]\n executable_paths = sorted({*executable_paths, *trusted_build_directories})\n report["stage"] = "canonical-challenge"\n guarded_write()\n canonical_olean, dependency_sources, trusted_lean_paths = compile_canonical_challenge(\n work,\n source,\n checkout=checkout,\n challenge_source=challenge_source,\n challenge_module=report["comparator"]["challenge_module"],\n published_module=protected_challenge,\n lean=lean,\n lean_prefix=lean_prefix,\n allowlist=allowlist,\n environment=env,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n )\n canonical_root = (work / "canonical-challenge").resolve()\n readable_paths = sorted({*readable_paths, canonical_root})\n # The whole protected directory, so every module-system sidecar beside\n # the Challenge olean is covered, not just the olean itself.\n require_protected_paths([canonical_root, canonical_olean], candidate_writable)\n report["stage"] = "challenge-provenance"\n guarded_write()\n audit = audit_challenge_sources(\n source,\n checkout=checkout,\n dependency_sources=dependency_sources,\n lean_prefix=lean_prefix,\n allowlist=allowlist,\n writable_directories=candidate_writable,\n )\n report["project_dependencies"] = recorded_project_dependencies(\n source, checkout, packages\n )\n report["challenge"].update(\n {\n "transitive_source_count": audit["source_count"],\n "dependencies": audit["dependencies"],\n "trust_level": audit["trust_level"],\n "untrusted_sources": audit["untrusted_sources"],\n "canonical_olean_sha256": sha256(canonical_olean),\n }\n )\n if audit["untrusted_sources"]:\n report["status"] = "fail"\n report["stage"] = "challenge-provenance"\n error = VerificationError(\n "configured Challenge transitively imports sources outside the allowlist",\n code="challenge.untrusted_imports",\n next_action=(\n "Remove the untrusted Challenge imports or move the trusted statement into "\n "the submitted project, then make a new submission."\n ),\n )\n report["errors"].append(str(error))\n report_diagnostic(report, error)\n report["checked_at"] = now()\n guarded_write()\n return 0\n\n report["stage"] = "confinement-final"\n guarded_write()\n verify_sandbox_confinement(\n work / "write-denial-probe",\n work / "read-denial-probe",\n positive_read=challenge_source,\n python=python,\n touch=touch,\n cwd=source,\n environment=env,\n writable_directories=candidate_writable,\n protected_write_directories=sorted(trusted_build_directories),\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n )\n\n report["stage"] = "candidate-configuration"\n guarded_write()\n env["LEAN_PATH"] = lake_environment_value(\n "LEAN_PATH",\n source=source,\n lake=lake,\n printenv=printenv,\n environment=env,\n writable_directories=candidate_writable,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n allowed_roots=[checkout, lean_prefix],\n )\n env["LEAN_SRC_PATH"] = lake_environment_value(\n "LEAN_SRC_PATH",\n source=source,\n lake=lake,\n printenv=printenv,\n environment=env,\n writable_directories=candidate_writable,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n allowed_roots=[checkout, lean_prefix],\n )\n env["LEAN_PATH"] = protected_lean_path(\n canonical_olean,\n trusted_lean_paths,\n env["LEAN_PATH"],\n protected_root=canonical_root,\n )\n def stop(error: VerificationError, stage: str) -> int:\n report["status"] = "error" if error.owner != "submitter" else "fail"\n report["errors"].append(str(error))\n report_diagnostic(\n report, error, stage=stage,\n owner=error.owner if error.code == "comparator.declaration_missing" else None,\n )\n report["stage"] = stage\n guarded_write()\n return 0\n\n # Both exports go to a verifier-owned directory that no candidate\n # phase can write to, and are snapshotted so the judge reads exactly\n # what the exporter wrote. The Challenge export comes from the\n # canonical module, first on the protected search path, so the\n # candidate\'s own Challenge build output never supplies the statement.\n exports = work / "exports"\n exports.mkdir()\n require_protected_paths([exports], candidate_writable)\n targets = comparator_export_targets(protected_config, primitives)\n configured_targets = set(protected_config["theorem_names"]) | set(\n protected_config.get("definition_names", [])\n )\n report["stage"] = "challenge-export"\n guarded_write()\n challenge_export = exports / "challenge.export"\n proc = export_module(\n protected_challenge,\n targets,\n output=challenge_export,\n leanexport=leanexport,\n cwd=source,\n environment=env,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n timeout=EXECUTION_BUDGET_SECONDS,\n )\n if proc.returncode:\n return stop(\n export_failure(\n proc, module="the Challenge", palomar_owned=True,\n configured_targets=configured_targets,\n ),\n "challenge-export",\n )\n verify_export(challenge_export)\n tools[challenge_export.resolve()] = sha256(challenge_export)\n\n # The candidate\'s Lake build, under the candidate policy. This is\n # where the submitted code runs.\n report["stage"] = "solution-build"\n guarded_write()\n proc = sandboxed_run(\n [str(lake), "build", report["comparator"]["solution_module"]],\n cwd=source,\n environment=env,\n writable_directories=candidate_writable,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n timeout=EXECUTION_BUDGET_SECONDS,\n check=False,\n )\n log = (proc.stdout + "\\n" + proc.stderr).strip()\n report["build_log_tail"] = log[-20000:]\n if proc.returncode:\n return stop(\n VerificationError(\n f"the Solution build failed (exit {proc.returncode})",\n code="solution.build_failed",\n detail=comparator_failure_excerpt(log),\n next_action=(\n "Correct the Lean failure quoted above, commit it, and make a new "\n "submission."\n ),\n ),\n "solution-build",\n )\n\n report["stage"] = "solution-export"\n guarded_write()\n solution_export = exports / "solution.export"\n proc = export_module(\n report["comparator"]["solution_module"],\n targets,\n output=solution_export,\n leanexport=leanexport,\n cwd=source,\n environment=env,\n readable_paths=readable_paths,\n executable_paths=executable_paths,\n tools=tools,\n timeout=EXECUTION_BUDGET_SECONDS,\n )\n if proc.returncode:\n return stop(\n export_failure(\n proc, module="the Solution", palomar_owned=False,\n configured_targets=configured_targets,\n ),\n "solution-export",\n )\n verify_export(solution_export)\n tools[solution_export.resolve()] = sha256(solution_export)\n\n report["stage"] = "comparator"\n guarded_write()\n proc = judge_exports(\n lake=lake,\n config=comparator_config,\n challenge_export=challenge_export,\n solution_export=solution_export,\n scratch=work / "judge",\n bwrap=bwrap,\n lean_prefix=lean_prefix,\n environment=env,\n tools=tools,\n timeout=EXECUTION_BUDGET_SECONDS,\n )\n log = (proc.stdout + "\\n" + proc.stderr).strip()\n report["comparator_log_tail"] = log[-20000:]\n verdict = comparator_verdict(proc.returncode, log)\n if verdict is not None:\n return stop(verdict, "comparator")\n\n report["status"] = "pass"\n report["stage"] = "complete"\n guarded_write()\n report["checked_at"] = now()\n guarded_write()\n except (subprocess.TimeoutExpired, ResourceExhausted) as error:\n report["status"] = "error"\n report["last_active_stage"] = report.get("stage")\n report["stage"] = "resource-exhausted"\n guarded_write()\n report["error_kind"] = "infrastructure/resource-exhausted"\n report["retryable"] = True\n if isinstance(error, subprocess.TimeoutExpired):\n bounded = ResourceExhausted(\n "worker wall-clock capacity was exhausted; retry on a longer-running worker"\n )\n else:\n bounded = error\n report["errors"].append(str(bounded))\n report_diagnostic(report, bounded, stage="resource-exhausted")\n guarded_write()\n except Exception as error: # noqa: BLE001 -- all verifier failures become a bounded report\n submitter_failure = (\n isinstance(error, VerificationError)\n and error.owner == "submitter"\n and str(report.get("stage") or "") not in PALOMAR_OWNED_STAGES\n )\n report["status"] = "fail" if submitter_failure else "error"\n report["errors"].append(str(error))\n report_diagnostic(report, error)\n guarded_write()\n finally:\n _EXECUTION_DEADLINE = previous_deadline\n _RESOURCE_METRICS_PATH = previous_metrics_path\n _RESOURCE_PHASE = previous_phase\n _RESOURCE_DISK_PATH = previous_disk_path\n return 0\n\n\ndef check_capacity(args: argparse.Namespace) -> int:\n """Record host evidence or a terminal provider error in the prepared report."""\n output = Path(args.output)\n report = json.loads(output.read_text(encoding="utf-8"))\n if report.get("status") != "pending":\n return 1\n try:\n observed = check_host(VERIFICATION_PROFILE, Path(args.disk_path))\n except (VerificationProfileError, OSError) as error:\n diagnostic = VerificationError(\n str(error), code="provider.host_below_profile", owner="provider", retryable=True,\n next_action=(\n "Run the preflight on a host meeting the published profile, or wait for "\n "Palomar to restore worker capacity before retrying. "\n "Normal submission cooldowns still apply."\n ),\n )\n report.update(status="error", stage="resource-exhausted", checked_at=now())\n report.setdefault("errors", []).append(str(diagnostic))\n report_diagnostic(report, diagnostic, stage="resource-exhausted")\n write_json(output, report)\n return 1\n report["verification_profile"]["observed_host"] = observed\n write_json(output, report)\n return 0\n\n\ndef parser() -> argparse.ArgumentParser:\n result = argparse.ArgumentParser()\n commands = result.add_subparsers(dest="command", required=True)\n capacity_parser = commands.add_parser("check-capacity")\n capacity_parser.add_argument("--disk-path", required=True)\n capacity_parser.add_argument("--output", required=True)\n capacity_parser.set_defaults(func=check_capacity)\n prepare_parser = commands.add_parser("prepare")\n prepare_parser.add_argument("--event", required=True)\n prepare_parser.add_argument("--work-dir", required=True)\n prepare_parser.add_argument("--output", required=True)\n prepare_parser.add_argument("--licensee", required=True)\n prepare_parser.set_defaults(func=prepare)\n execute_parser = commands.add_parser("execute")\n execute_parser.add_argument("--work-dir", required=True)\n execute_parser.add_argument("--output", required=True)\n execute_parser.add_argument("--bwrap", required=True)\n execute_parser.add_argument("--bwrap-source-tag", required=True)\n execute_parser.add_argument("--workflow-url", required=True)\n execute_parser.add_argument(\n "--execution-budget-seconds",\n type=int,\n default=EXECUTION_BUDGET_SECONDS,\n help="trusted worker wall-clock capacity (default: 12 hours)",\n )\n execute_parser.set_defaults(func=execute)\n return result\n\n\ndef main() -> int:\n args = parser().parse_args()\n return args.func(args)\n\n\nif __name__ == "__main__":\n raise SystemExit(main())\n', 'comparator-declaration-closure.md': "# Comparator declaration-closure note\n\nDate: 2026-09-23\n\nPalomar judges with the `lake comparator` that ships in the submitted Lean\ntoolchain, at or above the floor `v4.35.0-rc2`; the mechanical report records\nthe lean4 commit that toolchain's release tag names. This note describes\n`Lake/Check/Compare.lean`, `Lake/Check/Axioms.lean` and `Lake/CLI/Check.lean`\nat that floor. A later toolchain is judged by its own copy of the same code.\n\n`compareAt` first requires every configured theorem to have the same kind\n(theorem or axiom) and the same statement in the exported Challenge and\nSolution environments, and adds the constants used by each statement's type to\na worklist. Every configured definition must be a definition of the same type\nand safety on both sides; its name enters the worklist. `Compare.loop` then\nwalks the used-constant graph transitively and requires each ordinary\ndeclaration reached to be identical in both environments. The kernel's builtin\nconstants (`primitiveTargets`) seed the same walk, which is why Palomar exports\nthem alongside the declarations; that list is read from the toolchain's own\nsource rather than copied (the quotient additions `builtinTargets` makes when\n`Quot.sound` is permitted are held in Palomar), and an export that lacked one\nwould fail a valid proof.\n\nConfigured `definition_names` are deliberate holes, not ordinary dependencies.\nA named definition is compared by type and safety, the constants used by that\ntype are followed, and its body may differ. The axiom pass separately walks\nthe Solution proof and named definition bodies and rejects any axiom outside\n`permitted_axioms`; the registered external kernels and Lean's own\n`leanchecker` then replay the whole Solution export.\n\nConfigured `theorem_names` are holes in the same sense, and the walk treats\nthem so wherever it reaches them. A named theorem is compared by statement,\nand its proof is not compared even when some other declaration's value\nmentions it. A Challenge may therefore state a supporting lemma and leave its\nproof to the Solution, provided the lemma is named in `theorem_names`; a\n`sorry` on a declaration that is not named is still a mismatch. The axiom pass\nand the kernel replays of the Solution are what establish that the Solution\nproves each named statement.\n\nPalomar never lets the comparator build or export. It builds the Solution\nunder its own sandbox, exports the canonical Challenge (compiled outside the\ncandidate Lake plan and published under a per-run alias) and the built\nSolution with the toolchain's `leanexport`, and passes both files with\n`--challenge-from-export` and `--solution-from-export`. In that form the\ncomparator skips dependency resolution and building, and it does not check\nthat the exports match the project: that is Palomar's responsibility, met by\nproducing both exports itself and snapshotting them before the judge runs.\n\nConsequently, declarations used to determine a compared theorem's type do not\nall need to be listed individually in `comparator.json`: the comparator follows\nthe relevant declaration closure mechanically. The rendered page may still show\nonly the declarations named in `theorem_names` and `definition_names`. Palomar\ntherefore labels that rendering as a partial “named compared declarations”\nview and links to the full pinned `Challenge.lean`. The UI must not call the partial\nrender the complete statement without this disclosure.\n", 'replay-input.sh': '#!/usr/bin/env bash\n# Replay harness: Lean proof check of ONE helper declaration from the public\n# Palomar all-dimensions source.\n#\n# module SpectreFinite.RadiusFiveRoot8Step1Chunk8_2Slice3\n# declaration SpectreFinite.HexSearch.RadiusFive.root8Node0Step1Chunk8_2_slice3_checked\n# commit 048bb245b60abce79f1a2d0c82336ff8508ec752\n#\n# What it does:\n# 1. verifies the checkout is byte-identical to the pinned commit for src/,\n# lean-toolchain, lakefile.lean and lake-manifest.json (nothing is edited);\n# 2. obtains the project-pinned toolchain leanprover/lean4:v4.35.0-rc2\n# (official release tarball, sha256-verified) unless LEAN_HOME is given;\n# 3. computes the transitive import closure of the module (it imports only\n# project modules and Lean core `Init`, so Mathlib and the other Lake\n# packages are pinned but never loaded) and compiles every module of\n# that closure from source with the library\'s moreLeanArgs\n# (-j1 -DElab.async=false), in dependency order;\n# 4. elaborates an audit file that (a) re-states the theorem\'s exact type and\n# checks the declaration against it, (b) runs `#print axioms`, and\n# (c) collects the transitive axioms programmatically and fails unless they\n# are a subset of {propext, Classical.choice, Quot.sound};\n# 5. writes evidence.txt and receipt.json next to this script (or OUT_DIR).\n#\n# All Lean invocations (steps 3 and 4) share ONE wall-clock budget of\n# CHECK_TIMEOUT seconds (default and maximum 1200). If it expires the result\n# is INCONCLUSIVE, never PASS.\n#\n# Environment knobs (all optional):\n# REPO repository root (default: git toplevel of this script)\n# OUT_DIR where evidence/receipt go (default: directory of this script)\n# WORK_DIR scratch dir for toolchain/oleans/logs (default: mktemp -d)\n# LEAN_HOME existing toolchain dir containing bin/lean (skips download)\n# JOBS parallel module compilations (default: nproc)\n# CHECK_TIMEOUT seconds, <= 1200 (default: 1200)\n#\n# Exit status: 0 PASS, 1 FAIL, 2 INCONCLUSIVE (timeout), 3 setup/pin error.\nset -uo pipefail\n\nEXPECTED_COMMIT=048bb245b60abce79f1a2d0c82336ff8508ec752\nMODULE=SpectreFinite.RadiusFiveRoot8Step1Chunk8_2Slice3\nDECL=SpectreFinite.HexSearch.RadiusFive.root8Node0Step1Chunk8_2_slice3_checked\nTOOLCHAIN=leanprover/lean4:v4.35.0-rc2\nLEAN_VERSION=4.35.0-rc2\nLEAN_GITHASH=11acb17ec6b07a8f9e9173e6845197929540936b\nLEAN_URL=https://github.com/leanprover/lean4/releases/download/v4.35.0-rc2/lean-4.35.0-rc2-linux.tar.zst\nLEAN_SHA256=b67d0e0ba959fc74e186f1b44aebca32d6ecb6a28f8e9a029fc4e9f73398a049\nMATHLIB_REV=065356127b1dc0016f66b7283ce0ce2c4055aa55\nLEAN_ARGS=(-j1 -DElab.async=false) # lakefile.lean: lean_lib PalomarAllDimensions moreLeanArgs\nALLOWED_AXIOMS="Classical.choice propext Quot.sound"\n\nHERE=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)\nREPO=${REPO:-$(git -C "$HERE" rev-parse --show-toplevel 2>/dev/null)}\nOUT_DIR=${OUT_DIR:-$HERE}\nWORK_DIR=${WORK_DIR:-$(mktemp -d "${TMPDIR:-/tmp}/lean-proof-unit.XXXXXX")}\nJOBS=${JOBS:-$(nproc 2>/dev/null || echo 4)}\nCHECK_TIMEOUT=${CHECK_TIMEOUT:-1200}\nif ! [[ "$CHECK_TIMEOUT" =~ ^[0-9]+$ ]] || (( CHECK_TIMEOUT < 1 || CHECK_TIMEOUT > 1200 )); then\n echo "CHECK_TIMEOUT must be an integer in 1..1200" >&2; exit 3\nfi\n\nEVIDENCE="$OUT_DIR/evidence.txt"\nRECEIPT="$OUT_DIR/receipt.json"\nmkdir -p "$OUT_DIR" "$WORK_DIR"\n: > "$EVIDENCE"\nev() { printf \'%s\\n\' "$*" >> "$EVIDENCE"; }\nlog() { printf \'[replay] %s\\n\' "$*" >&2; ev "$*"; }\ndie() { log "SETUP ERROR: $*"; write_receipt "ERROR" 3 "$*"; exit 3; }\nnow() { date -u +%Y-%m-%dT%H:%M:%SZ; }\n\nRESULT=""; CHECK_EXIT=""; AXIOMS_JSON="null"; MODULE_COUNT=0; ELAPSED=""\nSRC_SHA=""; TC_SHA=""; LF_SHA=""; LM_SHA=""; HEAD_COMMIT=""; LEAN_VERSION_LINE=""\nwrite_receipt() { # status exit reason\n python3 -I - "$RECEIPT" "$1" "$2" "$3" </dev/null)\ngit cat-file -e "$EXPECTED_COMMIT^{commit}" 2>/dev/null || die "pinned commit $EXPECTED_COMMIT not present in repository"\ngit diff --quiet "$EXPECTED_COMMIT" -- src lean-toolchain lakefile.lean lake-manifest.json \\\n || die "working tree differs from pinned commit in src/ or build pins"\n[[ -z "$(git ls-files --others --exclude-standard -- src)" ]] || die "untracked files under src/"\n[[ "$(cat lean-toolchain)" == "$TOOLCHAIN" ]] || die "lean-toolchain is not $TOOLCHAIN"\npython3 -I -c \'import json,sys; m=json.load(open("lake-manifest.json")); r=[p["rev"] for p in m["packages"] if p["name"]=="mathlib"]; sys.exit(0 if r==[sys.argv[1]] else 1)\' "$MATHLIB_REV" \\\n || die "lake-manifest.json mathlib rev is not $MATHLIB_REV"\nMODFILE="src/${MODULE//.//}.lean"\n[[ -f "$MODFILE" ]] || die "missing $MODFILE"\nSRC_SHA=$(sha256sum "$MODFILE" | cut -d\' \' -f1)\nTC_SHA=$(sha256sum lean-toolchain | cut -d\' \' -f1)\nLF_SHA=$(sha256sum lakefile.lean | cut -d\' \' -f1)\nLM_SHA=$(sha256sum lake-manifest.json | cut -d\' \' -f1)\nlog "== 1. source and pins"\nlog "repository HEAD: $HEAD_COMMIT"\nlog "pinned commit: $EXPECTED_COMMIT (src/, lean-toolchain, lakefile.lean, lake-manifest.json identical: yes)"\nlog "lean-toolchain: $TOOLCHAIN sha256 $TC_SHA"\nlog "lakefile.lean sha256 $LF_SHA"\nlog "lake-manifest sha256 $LM_SHA (mathlib $MATHLIB_REV)"\nlog "$MODFILE sha256 $SRC_SHA"\nev ""\n\n# ---------------------------------------------------------------- 2. toolchain\nlog "== 2. toolchain"\nif [[ -z "${LEAN_HOME:-}" ]]; then\n log "\\$ curl -sSLf -o lean.tar.zst $LEAN_URL"\n curl -sSLf -o "$WORK_DIR/lean.tar.zst" "$LEAN_URL" || die "toolchain download failed"\n got=$(sha256sum "$WORK_DIR/lean.tar.zst" | cut -d\' \' -f1)\n log "sha256(lean.tar.zst) = $got (expected $LEAN_SHA256)"\n [[ "$got" == "$LEAN_SHA256" ]] || die "toolchain sha256 mismatch"\n tar --zstd -xf "$WORK_DIR/lean.tar.zst" -C "$WORK_DIR" || die "toolchain extract failed"\n LEAN_HOME="$WORK_DIR/lean-$LEAN_VERSION-linux"\nelse\n log "using pre-installed LEAN_HOME (must be the official $LEAN_VERSION release; version and githash verified below)"\nfi\nLEAN="$LEAN_HOME/bin/lean"\n[[ -x "$LEAN" ]] || die "no lean binary at $LEAN"\nLEAN_VERSION_LINE=$("$LEAN" --version)\nlog "\\$ lean --version"\nlog "$LEAN_VERSION_LINE"\n[[ "$LEAN_VERSION_LINE" == *"version $LEAN_VERSION,"*"commit $LEAN_GITHASH"* ]] || die "lean is not $LEAN_VERSION ($LEAN_GITHASH)"\nev ""\n\n# ---------------------------------------------------------------- 3+4. check\nBUILD="$WORK_DIR/build"; LOGS="$WORK_DIR/logs"; AUDIT_DIR="$WORK_DIR/audit"\nmkdir -p "$BUILD" "$LOGS" "$AUDIT_DIR"\nAUDIT="$AUDIT_DIR/LeanProofUnitAudit.lean"\ncat > "$AUDIT" <<\'LEAN\'\nimport SpectreFinite.RadiusFiveRoot8Step1Chunk8_2Slice3\nimport Lean\n\n-- same namespace and `open`s as the published source file\nnamespace SpectreFinite.HexSearch.RadiusFive\nopen SpectreFinite.FiniteTable\nopen HigherFastChecking\n\n-- (a) the declaration has exactly the statement written in the published source\nexample :\n checkNarrowing ⟨table56Scope, RadiusFourPruning.stateRows8_2_3⟩\n root8Node0Domains0 root8Node0Domains1 = true :=\n SpectreFinite.HexSearch.RadiusFive.root8Node0Step1Chunk8_2_slice3_checked\n\n#check @SpectreFinite.HexSearch.RadiusFive.root8Node0Step1Chunk8_2_slice3_checked\n\n-- (b) human-readable transitive axiom report\n#print axioms SpectreFinite.HexSearch.RadiusFive.root8Node0Step1Chunk8_2_slice3_checked\n\n-- (c) machine audit: must be a theorem; axioms must be within the allowed set\nopen Lean Elab Command in\nrun_cmd do\n let n := ``SpectreFinite.HexSearch.RadiusFive.root8Node0Step1Chunk8_2_slice3_checked\n let env ← getEnv\n let some ci := env.find? n | throwError "AUDIT FAIL: {n} not found"\n unless ci matches .thmInfo _ do throwError "AUDIT FAIL: {n} is not a theorem"\n let axs ← liftCoreM (Lean.collectAxioms n)\n let allowed : List Name := [``propext, ``Classical.choice, ``Quot.sound]\n let bad := axs.toList.filter (fun a => !allowed.contains a)\n logInfo m!"AUDIT_AXIOMS: {axs.toList}"\n unless bad.isEmpty do throwError "AUDIT FAIL: disallowed axioms {bad}"\n logInfo m!"AUDIT OK: {n} is a theorem; axioms within [propext, Classical.choice, Quot.sound]"\n\nend SpectreFinite.HexSearch.RadiusFive\nLEAN\n\nSCHED="$WORK_DIR/sched.py"\ncat > "$SCHED" <<\'PY\'\n# Compile the transitive import closure of one module with `lean -o`, in\n# dependency order, then elaborate the audit file. Prints one line per module.\nimport os, re, subprocess, sys, time, concurrent.futures as cf\nlean, src, build, logs, target, audit, jobs = sys.argv[1:8]\nextra = sys.argv[8:]\ncore = {"Init", "Std", "Lean", "Lake"}\nimp = re.compile(r"^\\s*(?:public\\s+)?(?:meta\\s+)?import\\s+(?:all\\s+)?(.+)$")\ndef path(m): return os.path.join(src, *m.split(".")) + ".lean"\ndeps, stack = {}, [target]\nwhile stack:\n m = stack.pop()\n if m in deps: continue\n p = path(m)\n if not os.path.exists(p):\n print(f"MISSING-MODULE {m}", flush=True); sys.exit(3)\n ds = []\n for line in open(p, encoding="utf-8"):\n r = imp.match(line)\n if r:\n for d in r.group(1).split():\n if d.split(".")[0] in core: continue\n if not os.path.exists(path(d)):\n print(f"NON-LOCAL-IMPORT {m} -> {d} (would need Lake packages)", flush=True); sys.exit(3)\n ds.append(d)\n deps[m] = ds; stack += ds\nprint(f"CLOSURE {len(deps)} project modules (all other imports are Lean core)", flush=True)\nenv = dict(os.environ, LEAN_PATH=build)\ndef compile_(m):\n base = os.path.join(build, *m.split("."))\n os.makedirs(os.path.dirname(base), exist_ok=True)\n cmd = [lean, "-R", src, "-o", base + ".olean", "-i", base + ".ilean", *extra, path(m)]\n t = time.time()\n r = subprocess.run(cmd, env=env, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)\n open(os.path.join(logs, m + ".log"), "wb").write(r.stdout)\n return m, r.returncode, time.time() - t\ndone, failed, running = set(), [], {}\nwith cf.ThreadPoolExecutor(int(jobs)) as ex:\n while len(done) < len(deps) and not failed:\n for m, ds in deps.items():\n if m not in done and m not in running and all(d in done for d in ds):\n running[m] = ex.submit(compile_, m)\n fin, _ = cf.wait(running.values(), return_when=cf.FIRST_COMPLETED)\n for f in fin:\n m, rc, dt = f.result(); del running[m]\n print(f"MODULE {m} exit={rc} seconds={dt:.1f}", flush=True)\n (done.add(m) if rc == 0 else failed.append(m))\nif failed:\n print(f"COMPILE-FAILED {failed}", flush=True); sys.exit(1)\ncmd = [lean, *extra, audit]\nprint("AUDIT-COMMAND LEAN_PATH= " + " ".join(["lean", *extra, os.path.basename(audit)]), flush=True)\nr = subprocess.run(cmd, env=env, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)\nopen(os.path.join(logs, "audit.log"), "wb").write(r.stdout)\nprint(f"AUDIT exit={r.returncode}", flush=True)\nsys.exit(0 if r.returncode == 0 else 1)\nPY\n\nlog "== 3. compile transitive closure + 4. audit (single budget: timeout ${CHECK_TIMEOUT}s)"\nCMD=(timeout --kill-after=10 "$CHECK_TIMEOUT" python3 -I "$SCHED" "$LEAN" "$REPO/src" "$BUILD" "$LOGS" "$MODULE" "$AUDIT" "$JOBS" "${LEAN_ARGS[@]}")\nlog "\\$ timeout --kill-after=10 $CHECK_TIMEOUT python3 -I sched.py src $MODULE LeanProofUnitAudit.lean $JOBS ${LEAN_ARGS[*]}"\nlog " per module: LEAN_PATH= lean -R src -o /M.olean -i /M.ilean ${LEAN_ARGS[*]} src/M.lean"\nT0=$(date +%s)\n"${CMD[@]}" > "$WORK_DIR/sched.out" 2>&1\nCHECK_EXIT=$?\nELAPSED=$(( $(date +%s) - T0 ))\nMODULE_COUNT=$(grep -c \'^MODULE .* exit=0 \' "$WORK_DIR/sched.out" || true)\nev ""\nev "--- scheduler output (one line per compiled module) ---"\ncat "$WORK_DIR/sched.out" >> "$EVIDENCE"\nev "--- end scheduler output ---"\nlog "check exit status: $CHECK_EXIT elapsed: ${ELAPSED}s"\nev ""\nTLOG="$LOGS/$MODULE.log"\nif [[ -f "$TLOG" ]]; then\n ev "--- Lean output for $MODFILE (contains the source\'s own #print axioms) ---"\n cat "$TLOG" >> "$EVIDENCE"; ev "--- end ---"; ev ""\nfi\nif [[ -f "$LOGS/audit.log" ]]; then\n ev "--- audit file LeanProofUnitAudit.lean ---"; cat "$AUDIT" >> "$EVIDENCE"; ev "--- end ---"; ev ""\n ev "--- Lean output for audit file ---"; cat "$LOGS/audit.log" >> "$EVIDENCE"; ev "--- end ---"; ev ""\nfi\n# any non-empty output from dependency modules (warnings, sorry, etc.)\nfor f in "$LOGS"/*.log; do\n [[ "$f" == "$TLOG" || "$f" == "$LOGS/audit.log" ]] && continue\n if [[ -s "$f" ]]; then ev "--- non-empty Lean output: $(basename "$f") ---"; cat "$f" >> "$EVIDENCE"; ev "--- end ---"; fi\ndone\n\n# ---------------------------------------------------------------- 5. verdict\nif (( CHECK_EXIT == 124 || CHECK_EXIT == 137 )); then\n log "RESULT: INCONCLUSIVE (time budget of ${CHECK_TIMEOUT}s exhausted; not a pass)"\n write_receipt "INCONCLUSIVE" 2 "proof-checking invocation exceeded ${CHECK_TIMEOUT}s"; exit 2\nfi\n# single-line machine report from audit step (c); `#print axioms` text is kept in the evidence\nAXLINE=$(grep -h "^AUDIT_AXIOMS: " "$LOGS/audit.log" 2>/dev/null | head -1)\nAXIOMS_JSON=$(printf \'%s\' "$AXLINE" | python3 -I -c \'import sys,json,re; s=sys.stdin.read(); m=re.search(r"\\[(.*)\\]",s); print(json.dumps(sorted(x.strip() for x in m.group(1).split(",") if x.strip())) if m else "null")\')\nok=1\n(( CHECK_EXIT == 0 )) || ok=0\ngrep -q "AUDIT OK:" "$LOGS/audit.log" 2>/dev/null || ok=0\n[[ "$AXIOMS_JSON" != "null" ]] || ok=0\nfor a in $(printf \'%s\' "$AXIOMS_JSON" | python3 -I -c \'import sys,json; print(" ".join(json.load(sys.stdin) or []))\'); do\n [[ " $ALLOWED_AXIOMS " == *" $a "* ]] || { log "disallowed axiom: $a"; ok=0; }\ndone\nif grep -lE "declaration uses .sorry.|error:" "$LOGS"/*.log 2>/dev/null | grep -q .; then log "sorry warning or error found in Lean output of: $(grep -lE "declaration uses .sorry.|error:" "$LOGS"/*.log | xargs -n1 basename | tr \'\\n\' \' \')"; ok=0; fi\nlog "axioms reported: $AXIOMS_JSON"\nlog "finished_utc: $(now)"\nif (( ok )); then\n log "RESULT: PASS (helper declaration checked; axioms within allowed set)"\n write_receipt "PASS" 0 "declaration elaborated and kernel-checked by Lean $LEAN_VERSION; axioms within allowed set"; exit 0\nfi\nlog "RESULT: FAIL"\nwrite_receipt "FAIL" 1 "Lean check or axiom audit did not succeed (see evidence.txt)"; exit 1\n'} for name,source in sources.items(): (code/name).write_text(source) (code/'reference').mkdir() for name,source in references.items(): (code/'reference'/name).write_text(source) sys.path.insert(0,str(code)) from replay_main import main sys.exit(main()) IMD_BRANCH_B_PYTHON