omnius 1.0.841 → 1.0.843

package/dist/scripts/rapid-computer-use/model_gate.py

@@ -0,0 +1,755 @@
+#!/usr/bin/env python3
+"""Read-only model preflight and finite-choice evaluation. Never loads a model.
+
+Standard library only: importing this module cannot initialize CUDA. A short-lived
+operator statement binds an already resident runner to every live request. The
+operator may be the authorized Omnius/Codex agent; no extra user approval is implied.
+"""
+from __future__ import annotations
+
+import argparse
+import csv
+import hashlib
+import http.client
+import ipaddress
+import json
+import math
+import os
+from pathlib import Path
+import re
+import socket
+import subprocess
+import sys
+import threading
+import time
+import urllib.parse
+
+ROOT = Path(__file__).resolve().parents[2]
+DEFAULT_LOCK = ROOT / "computer-use/models.lock.yaml"
+MAX_JSON_BYTES = 1_048_576
+MAX_RESPONSE_BYTES = 65_536
+GPU_ID = re.compile(r"GPU-[a-fA-F0-9-]{36}\Z")
+REVISION = re.compile(r"(?:[a-f0-9]{40}|[a-f0-9]{64})\Z")
+ACTION_ID = re.compile(r"[A-Za-z0-9_.:-]{1,128}\Z")
+
+
+class GateError(ValueError):
+    pass
+
+
+def require(condition, reason):
+    if not condition:
+        raise GateError(reason)
+
+
+def strict_json(raw):
+    def unique(pairs):
+        result = {}
+        for key, value in pairs:
+            require(key not in result, f"duplicate JSON key: {key}")
+            result[key] = value
+        return result
+
+    def invalid(value):
+        raise GateError(f"non-finite JSON number: {value}")
+
+    try:
+        parsed = json.loads(raw, object_pairs_hook=unique, parse_constant=invalid)
+        pending = [(parsed, 0)]
+        count = 0
+        while pending:
+            value, depth = pending.pop()
+            count += 1
+            require(depth <= 64 and count <= 100_000, "JSON structure exceeds bounded depth or size")
+            if isinstance(value, float):
+                require(math.isfinite(value), "JSON numeric overflow")
+            if isinstance(value, (dict, list)):
+                pending.extend((item, depth + 1) for item in
+                               (value.values() if isinstance(value, dict) else value))
+        return parsed
+    except (ValueError, TypeError, UnicodeError, RecursionError) as error:
+        raise GateError(f"invalid JSON: {error}") from error
+
+
+def bounded_bytes(path):
+    with Path(path).open("rb") as stream:
+        raw = stream.read(MAX_JSON_BYTES + 1)
+    require(len(raw) <= MAX_JSON_BYTES, "JSON input exceeds size bound")
+    return raw
+
+
+def read_json_hashed(path):
+    raw = bounded_bytes(path)
+    return strict_json(raw), hashlib.sha256(raw).hexdigest()
+
+
+def read_json(path):
+    return read_json_hashed(path)[0]
+
+
+def digest(value):
+    return hashlib.sha256(json.dumps(value, sort_keys=True, separators=(",", ":"),
+                                     allow_nan=False).encode()).hexdigest()
+
+
+def write_json(path, value):
+    """Atomic owner-only artifact; a failed run cannot leave half a success report."""
+    destination = Path(path)
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    temporary = destination.with_name(destination.name + f".{os.getpid()}.tmp")
+    descriptor = os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    try:
+        with os.fdopen(descriptor, "w") as stream:
+            json.dump(value, stream, indent=2, allow_nan=False)
+            stream.write("\n")
+            stream.flush()
+            os.fsync(stream.fileno())
+        os.replace(temporary, destination)
+    finally:
+        temporary.unlink(missing_ok=True)
+
+
+def local_endpoint(url):
+    require(isinstance(url, str) and len(url) <= 512, "an exact endpoint is required")
+    parsed = urllib.parse.urlsplit(url)
+    require(parsed.scheme in ("http", "https") and parsed.hostname is not None,
+            "endpoint must be HTTP(S)")
+    require(not parsed.username and not parsed.password and not parsed.query and
+            not parsed.fragment, "endpoint credentials, query, and fragment are forbidden")
+    try:
+        address = ipaddress.ip_address(parsed.hostname)
+        port = parsed.port
+    except ValueError as error:
+        raise GateError("endpoint must use a literal loopback IP address") from error
+    require(address.is_loopback and port is not None and 1 <= port <= 65535,
+            "endpoint must include a loopback address and explicit port")
+    require("//" not in parsed.path and "/../" not in parsed.path and "%" not in parsed.path,
+            "endpoint path must be literal")
+    return parsed
+
+
+def local_json(url, body=None, headers=None, timeout=15):
+    parsed = local_endpoint(url)
+    require(0 < timeout <= 120, "HTTP timeout outside bounded range")
+    payload = None if body is None else json.dumps(body, allow_nan=False).encode()
+    deadline = time.monotonic() + timeout
+    connection_type = http.client.HTTPSConnection if parsed.scheme == "https" else http.client.HTTPConnection
+    connection = connection_type(parsed.hostname, parsed.port, timeout=timeout)
+    watchdog = None
+    expired = threading.Event()
+    try:
+        # Direct connection ignores proxy environment and never follows redirects.
+        connection.connect()
+        remaining = deadline - time.monotonic()
+        require(remaining > 0, "local HTTP total deadline exceeded")
+        transport = connection.sock
+        transport.settimeout(remaining)
+        def interrupt():
+            expired.set()
+            try:
+                # HTTPResponse can take ownership of this socket; closing only the
+                # connection would not interrupt a slow-drip header/body read.
+                transport.shutdown(socket.SHUT_RDWR)
+            except OSError:
+                pass
+        watchdog = threading.Timer(remaining, interrupt)
+        watchdog.daemon = True
+        watchdog.start()
+        connection.request("GET" if body is None else "POST", parsed.path or "/", body=payload,
+                           headers={"Content-Type": "application/json", **(headers or {})})
+        response = connection.getresponse()
+        require(response.status == 200, "model endpoint did not return HTTP 200")
+        raw = response.read(MAX_RESPONSE_BYTES + 1)
+        require(not expired.is_set() and time.monotonic() < deadline, "local HTTP total deadline exceeded")
+        require(len(raw) <= MAX_RESPONSE_BYTES, "model response exceeds size bound")
+        return strict_json(raw)
+    except (OSError, http.client.HTTPException) as error:
+        if expired.is_set() or time.monotonic() >= deadline:
+            raise GateError("local HTTP total deadline exceeded") from error
+        raise GateError(f"local endpoint unavailable: {type(error).__name__}") from error
+    finally:
+        if watchdog:
+            watchdog.cancel()
+        connection.close()
+
+
+def command(argv):
+    try:
+        result = subprocess.run(argv, check=False, capture_output=True, text=True, timeout=15)
+    except (OSError, subprocess.TimeoutExpired) as error:
+        raise GateError(f"preflight command unavailable: {argv[0]}") from error
+    require(result.returncode == 0 and not result.stderr.strip(),
+            f"preflight command failed or reported an error: {argv[0]}")
+    require(len(result.stdout) <= MAX_JSON_BYTES, "preflight command output exceeds bound")
+    return result.stdout
+
+
+def validate_selection(selection, lock):
+    require(isinstance(selection, dict), "selection must be an object")
+    require(selection.get("schema") == "omnius.computer-use.model-selection.v1",
+            "unsupported selection schema")
+    registry = lock.get("models", {})
+    require(selection.get("model_id") in registry, "model is absent from source lock")
+    model = registry[selection["model_id"]]
+    require(selection.get("weights_revision") == model["weights"]["revision"],
+            "selected weights do not match source lock")
+    require(selection.get("runtime_revision") == model["runtime"]["revision"],
+            "selected runtime does not match source lock")
+    require(REVISION.fullmatch(selection["weights_revision"]) is not None,
+            "model weight revision must be immutable")
+    require(isinstance(selection.get("model"), str) and 0 < len(selection["model"]) <= 256,
+            "exact served model tag required")
+    require(selection.get("protocol") in ("systemone", "ollama-chat", "moondream-point"),
+            "unsupported model request protocol")
+    require(selection["protocol"] in model["runtime"].get("protocols", []),
+            "selected model/runtime protocol has not been resolved in the source lock")
+    require(service_mode(selection) in ("broker", "leased-external"), "unsupported service mode")
+    require(selection["protocol"] == "ollama-chat" or service_mode(selection) == "leased-external",
+            "non-Ollama services require a scoped external lease")
+    endpoint = local_endpoint(selection.get("endpoint"))
+    expected_path = {"systemone": "/v1/systemone", "ollama-chat": "/api/chat",
+                     "moondream-point": "/v1/point"}[selection["protocol"]]
+    require(endpoint.path.endswith(expected_path), "endpoint does not match selected protocol")
+    scope = selection.get("gpu_uuids")
+    require(isinstance(scope, list) and 0 < len(scope) <= 3 and len(set(scope)) == len(scope)
+            and all(isinstance(gpu, str) and GPU_ID.fullmatch(gpu) for gpu in scope),
+            "exact nonempty GPU UUID scope required")
+    return model
+
+
+def service_mode(selection):
+    return selection.get("service_mode", "broker" if selection.get("protocol") == "ollama-chat"
+                         else "leased-external")
+
+
+def validate_broker(discovery, selection):
+    require(isinstance(discovery, dict) and
+            discovery.get("schema") == "io.ollama-unify.gpu-negotiator.discovery.v1",
+            "broker discovery missing or incompatible")
+    require(discovery.get("available") is True and discovery.get("backend_available") is True
+            and discovery.get("backend") == "cuda", "CUDA broker unavailable")
+    health = discovery.get("gpu_health", {})
+    require(health.get("supported") is True and health.get("admission_blocked") is False
+            and not health.get("error") and not health.get("missing_selected_gpu_ids"),
+            "GPU broker blocks admission or cannot verify all selected hardware")
+    require(all(value in ("None", "none", "No action", None) for value in
+                health.get("recovery_actions", {}).values()), "NVIDIA recovery is required")
+    require(not discovery.get("draining"), "GPU broker is draining")
+    scope = set(selection["gpu_uuids"])
+    require(scope.issubset(set(discovery.get("selected_gpu_ids", []))),
+            "selected GPU is outside broker scope")
+    require(scope.issubset({row.get("uuid") for row in discovery.get("gpus", [])}),
+            "selected GPU missing from live broker inventory")
+    quarantined = discovery.get("unregistered_gpu_quarantine", [])
+    require(not quarantined, "unregistered CUDA workloads require broker resolution")
+    for lease in discovery.get("active_leases", []):
+        affected = not lease.get("gpu_uuids") or bool(scope.intersection(lease["gpu_uuids"]))
+        require(not (affected and lease.get("state") in ("pending", "revoking")),
+                "selected GPU has a pending or revoking lease")
+
+
+def process_identity(pid):
+    require(isinstance(pid, int) and not isinstance(pid, bool) and pid > 0, "invalid runner PID")
+    try:
+        stat = Path(f"/proc/{pid}/stat").read_text()
+        # comm may contain spaces or parentheses; fields after its last ')' start at state (3).
+        start_ticks = int(stat.rsplit(")", 1)[1].split()[19])
+        raw = Path(f"/proc/{pid}/cmdline").read_bytes()
+    except (OSError, ValueError, IndexError) as error:
+        raise GateError(f"runner identity cannot be verified: PID {pid}") from error
+    require(bool(raw), "runner has no command identity")
+    return {"pid": pid, "start_ticks": start_ticks, "command_sha256": hashlib.sha256(raw).hexdigest()}
+
+
+def process_cuda_scope(pid):
+    try:
+        entries = Path(f"/proc/{pid}/environ").read_bytes().split(b"\0")
+        values = [row.split(b"=", 1)[1].decode() for row in entries if row.startswith(b"CUDA_VISIBLE_DEVICES=")]
+    except (OSError, UnicodeError) as error:
+        raise GateError("cannot inspect actual process CUDA visibility") from error
+    require(len(values) == 1, "actual process lacks exact CUDA visibility")
+    return values[0].split(",")
+
+
+def descends_from(pid, ancestor):
+    seen = set()
+    for _ in range(64):
+        if pid == ancestor:
+            return True
+        if pid <= 1 or pid in seen:
+            return False
+        seen.add(pid)
+        try:
+            pid = int(Path(f"/proc/{pid}/stat").read_text().rsplit(")", 1)[1].split()[1])
+        except (OSError, ValueError, IndexError) as error:
+            raise GateError("runner process ancestry cannot be verified") from error
+    raise GateError("runner process ancestry exceeds bound")
+
+
+def endpoint_listener_matches(endpoint, pid):
+    parsed = local_endpoint(endpoint)
+    target = ipaddress.ip_address(parsed.hostname)
+    inodes = set()
+    try:
+        for family, name in ((socket.AF_INET, "tcp"), (socket.AF_INET6, "tcp6")):
+            for line in Path(f"/proc/{pid}/net/{name}").read_text().splitlines()[1:]:
+                fields = line.split()
+                address_hex, port_hex = fields[1].split(":")
+                if fields[3] != "0A" or int(port_hex, 16) != parsed.port:
+                    continue
+                raw = bytes.fromhex(address_hex)
+                raw = b"".join(raw[i:i + 4][::-1] for i in range(0, len(raw), 4))
+                address = ipaddress.ip_address(socket.inet_ntop(family, raw))
+                if address == target:
+                    inodes.add(fields[9])
+        require(bool(inodes), "exact loopback endpoint is not listening")
+        for descriptor in Path(f"/proc/{pid}/fd").iterdir():
+            try:
+                link = os.readlink(descriptor)
+            except FileNotFoundError:
+                continue
+            if any(link == f"socket:[{inode}]" for inode in inodes):
+                return True
+    except (OSError, ValueError, IndexError) as error:
+        raise GateError("endpoint listener ownership cannot be verified") from error
+    return False
+
+
+def collect_service_identity(selection, receipt, runners):
+    server = receipt.get("server", {})
+    identity = process_identity(server.get("pid"))
+    require(endpoint_listener_matches(selection["endpoint"], identity["pid"]),
+            "endpoint listener is not the attested server process")
+    related = [row["pid"] for row in runners if descends_from(row["pid"], identity["pid"])]
+    require(set(related) == {row["pid"] for row in receipt.get("runners", [])},
+            "receipt does not cover the endpoint's exact resident runner set")
+    return {"server": identity, "listener_verified": True,
+            "cuda_visible_devices": process_cuda_scope(identity["pid"]),
+            "runner_scopes": {str(pid): process_cuda_scope(pid) for pid in set(related)},
+            "runner_ancestry_verified": sorted(set(related))}
+
+
+def parse_gpu_rows(raw):
+    result = []
+    for row in csv.reader(raw.splitlines(), skipinitialspace=True):
+        require(len(row) == 4, "unrecognized nvidia-smi GPU inventory")
+        try:
+            result.append({"uuid": row[0].strip(), "name": row[1].strip(),
+                           "memory_mib": int(row[2]), "compute_capability": float(row[3])})
+        except ValueError as error:
+            raise GateError("invalid nvidia-smi GPU inventory") from error
+    return result
+
+
+def parse_runner_rows(raw):
+    result = []
+    for row in csv.reader(raw.splitlines(), skipinitialspace=True):
+        require(len(row) == 3, "unrecognized nvidia-smi runner inventory")
+        try:
+            result.append({"pid": int(row[0]), "gpu_uuid": row[1].strip(),
+                           "used_mib": int(row[2])})
+        except ValueError as error:
+            raise GateError("unverifiable nvidia-smi runner memory") from error
+    return result
+
+
+def collect_snapshot(selection, runtime_receipt):
+    # Test broker health before inspecting/connecting to any selected model endpoint.
+    discovery = strict_json(command(["docker", "gpu", "discover"]))
+    validate_broker(discovery, selection)
+    gpus = parse_gpu_rows(command(["nvidia-smi", "--query-gpu=uuid,name,memory.total,compute_cap",
+                                   "--format=csv,noheader,nounits"]))
+    runners = parse_runner_rows(command(["nvidia-smi", "--query-compute-apps=pid,gpu_uuid,used_gpu_memory",
+                                         "--format=csv,noheader,nounits"]))
+    identities = [process_identity(row["pid"]) for row in runtime_receipt.get("runners", [])]
+    snapshot = {"observed_at": time.time(), "discovery": discovery, "gpus": gpus,
+                "runners": runners, "processes": identities,
+                "boot_id": Path("/proc/sys/kernel/random/boot_id").read_text().strip()}
+    if service_mode(selection) == "leased-external":
+        snapshot["service_identity"] = collect_service_identity(selection, runtime_receipt, runners)
+    if selection["protocol"] == "ollama-chat":
+        base = selection["endpoint"].removesuffix("/api/chat")
+        if service_mode(selection) == "broker":
+            require(base == discovery.get("public_ollama_api", "").rstrip("/"),
+                    "Ollama must use public broker endpoint")
+        snapshot["ollama_ps"] = local_json(base + "/api/ps")
+        snapshot["ollama_version"] = local_json(base + "/api/version")
+    return snapshot
+
+
+def verify_preflight(selection, lock, receipt, snapshot, now=None):
+    now = time.time() if now is None else now
+    validate_selection(selection, lock)
+    validate_broker(snapshot["discovery"], selection)
+    require(0 <= now - snapshot.get("observed_at", 0) <= 30, "hardware observation is stale")
+    require(receipt.get("schema") == "omnius.computer-use.resident-runtime.v1" and
+            receipt.get("loaded") is True, "resident-runtime receipt is required")
+    for key in ("endpoint", "protocol", "model", "model_id", "weights_revision", "runtime_revision", "gpu_uuids"):
+        require(receipt.get(key) == selection.get(key), f"runtime receipt mismatch: {key}")
+    require(service_mode(receipt) == service_mode(selection), "runtime receipt service mode mismatch")
+    require(receipt.get("boot_id") == snapshot.get("boot_id") and bool(snapshot.get("boot_id")),
+            "runtime receipt belongs to another boot")
+    require(receipt.get("cuda_visible_devices") == selection["gpu_uuids"],
+            "server GPU visibility differs from reserved UUIDs")
+    scope = set(selection["gpu_uuids"])
+    inventory = {row["uuid"]: row for row in snapshot["gpus"]}
+    for gpu in scope:
+        require(gpu in inventory, "requested accelerator is missing")
+        hardware = inventory[gpu]
+        require("A100" in hardware["name"] and hardware["memory_mib"] >= 80_000
+                and math.isfinite(hardware["compute_capability"])
+                and hardware["compute_capability"] >= 8.0,
+                "requested test requires a capable A100 80 GB; no CPU or small-GPU fallback")
+    claimed = receipt.get("runners")
+    require(isinstance(claimed, list) and 0 < len(claimed) <= 16, "runner identities are required")
+    require(len({row.get("pid") for row in claimed}) == len(claimed), "duplicate runner identity")
+    require(sorted(claimed, key=lambda row: row["pid"]) ==
+            sorted(snapshot.get("processes", []), key=lambda row: row["pid"]),
+            "runner restarted or command identity changed")
+    actual_scope = set()
+    for identity in claimed:
+        allocations = [row for row in snapshot["runners"] if row["pid"] == identity["pid"]]
+        require(bool(allocations) and all(row["used_mib"] > 0 for row in allocations),
+                "requested model runner is not resident in VRAM")
+        placement = {row["gpu_uuid"] for row in allocations}
+        require(placement.issubset(scope), "test runner is resident on an unintended GPU")
+        actual_scope.update(placement)
+    require(actual_scope == scope, "actual runner placement does not cover exact requested scope")
+    if service_mode(selection) == "leased-external":
+        require(isinstance(receipt.get("lease_owner"), str) and bool(receipt["lease_owner"]),
+                "external CUDA service must name its lease owner")
+        require(any(lease.get("owner") == receipt["lease_owner"] and lease.get("state") == "active"
+                    and set(lease.get("gpu_uuids", [])) == scope
+                    for lease in snapshot["discovery"].get("active_leases", [])),
+                "external service lacks its exact active CUDA lease")
+        actual = snapshot.get("service_identity", {})
+        require(actual.get("listener_verified") is True and actual.get("server") == receipt.get("server")
+                and bool(receipt.get("server")), "endpoint server identity is unverified or changed")
+        require(actual.get("cuda_visible_devices") == selection["gpu_uuids"],
+                "actual server CUDA visibility differs from reserved UUIDs")
+        require(actual.get("runner_ancestry_verified") == sorted(row["pid"] for row in claimed),
+                "runner is not a descendant of the endpoint server")
+        require(actual.get("runner_scopes") == {str(row["pid"]): selection["gpu_uuids"] for row in claimed},
+                "actual runner CUDA visibility differs from reserved UUIDs")
+    if selection["protocol"] == "ollama-chat":
+        if service_mode(selection) == "broker":
+            require(selection["endpoint"] == snapshot["discovery"].get("public_ollama_api", "").rstrip("/") + "/api/chat",
+                    "Ollama request bypasses the public broker")
+        require(snapshot.get("ollama_version", {}).get("version") == selection["runtime_revision"],
+                "Ollama runtime changed")
+        models = [row for row in snapshot.get("ollama_ps", {}).get("models", [])
+                  if row.get("name", row.get("model")) == selection["model"]
+                  and row.get("digest") == selection["weights_revision"]]
+        require(bool(models), "exact model tag and digest are not resident")
+        if service_mode(selection) == "broker":
+            require(all(set(row.get("gpu_uuids", [row.get("gpu_uuid")])) == scope for row in models),
+                    "broker model placement differs from observed runner scope")
+        else:
+            require(len(snapshot["ollama_ps"]["models"]) == len(models) == 1,
+                    "leased test endpoint must have exactly the selected resident model")
+            require(models[0].get("context_length") == 8192 and models[0].get("size_vram", 0) > 0,
+                    "leased model must remain resident at the bounded 8192 context")
+    else:
+        # Non-Ollama weight identity is the trusted launcher's assertion, not a
+        # tensor introspection claim. Actual endpoint/PID/GPU identity is checked
+        # independently above; an unrelated resident PID cannot satisfy it.
+        require(receipt.get("attestation_source") == "host-launcher",
+                "external model identity requires a trusted host-launcher receipt")
+    identity = {"selection": selection, "boot_id": snapshot["boot_id"], "runners": claimed,
+                "receipt_sha256": digest(receipt)}
+    return {"schema": "omnius.computer-use.preflight.v1", "status": "ready_for_statement",
+            "observed_at": snapshot["observed_at"], "fingerprint": digest(identity),
+            **identity, "gpus": [inventory[gpu] for gpu in selection["gpu_uuids"]],
+            "resident_vram_mib": sum(row["used_mib"] for row in snapshot["runners"]
+                                     if row["pid"] in {item["pid"] for item in claimed})}
+
+
+def approve_preflight(preflight, statement, now=None, ttl=120):
+    now = time.time() if now is None else now
+    require(preflight.get("status") == "ready_for_statement", "preflight did not pass")
+    require(0 <= now - preflight["observed_at"] <= 30, "preflight is stale")
+    require(isinstance(statement, str) and 20 <= len(statement) <= 2000,
+            "record the exact preflight commentary before approving")
+    require(0 < ttl <= 300, "approval lifetime must be at most five minutes")
+    return {"schema": "omnius.computer-use.inference-approval.v1",
+            "fingerprint": preflight["fingerprint"], "selection": preflight["selection"],
+            "issued_at": now, "expires_at": now + ttl, "preflight_statement": statement}
+
+
+def verify_approval(approval, preflight, now=None):
+    now = time.time() if now is None else now
+    require(approval.get("schema") == "omnius.computer-use.inference-approval.v1",
+            "explicit preflight statement approval is required")
+    issued, expires = approval.get("issued_at", 0), approval.get("expires_at", 0)
+    require(isinstance(issued, (int, float)) and isinstance(expires, (int, float)) and
+            math.isfinite(issued) and math.isfinite(expires) and
+            issued <= now < expires and 0 < expires - issued <= 300,
+            "preflight approval is expired or has an invalid lifetime")
+    require(approval.get("fingerprint") == preflight["fingerprint"] and
+            approval.get("selection") == preflight["selection"],
+            "approval does not match the current endpoint, model, and resident runner")
+    require(isinstance(approval.get("preflight_statement"), str) and
+            len(approval["preflight_statement"]) >= 20, "preflight commentary is missing")
+
+
+def finite_request(model, case):
+    require(isinstance(case, dict), "decision case must be an object")
+    actions = case.get("legal_actions")
+    require(isinstance(actions, list) and 2 <= len(actions) <= 50, "require two to fifty legal choices")
+    criteria = {}
+    kinds = set()
+    for action in actions:
+        require(isinstance(action, dict) and isinstance(action.get("id"), str)
+                and ACTION_ID.fullmatch(action["id"]), "invalid candidate ID")
+        require(action["id"] not in criteria, "duplicate candidate ID")
+        require(isinstance(action.get("description"), str) and 0 < len(action["description"]) <= 1000,
+                "candidate description is missing or too long")
+        require(action.get("kind") in ("action", "observe", "abstain"), "invalid candidate kind")
+        kinds.add(action["kind"])
+        criteria[action["id"]] = action["description"]
+    require({"observe", "abstain"}.issubset(kinds), "observe and abstain must remain legal")
+    state = case.get("state")
+    require(isinstance(state, str) and 0 < len(state) <= 20_000, "compact redacted state required")
+    return {"model": model, "state": state, "questions": {"action": {
+        "type": "choice", "instructions": "Choose one supplied legal action. Observe or abstain if unsure.",
+        "criteria": criteria}}}
+
+
+def finite_answer(response, request):
+    require(isinstance(response, dict), "decision response must be an object")
+    answers = response.get("answers")
+    require(isinstance(answers, dict) and isinstance(answers.get("action"), dict),
+            "typed action answer missing")
+    answer = answers["action"]
+    require(answer.get("type", "choice") == "choice", "decision answer has wrong type")
+    choices = request["questions"]["action"]["criteria"]
+    choice = answer.get("choice")
+    require(isinstance(choice, str) and choice in choices, "model returned an unadvertised action")
+    probabilities = answer.get("probabilities")
+    if probabilities is not None:
+        require(isinstance(probabilities, dict) and set(probabilities) == set(choices),
+                "probabilities must cover the exact legal action set")
+        require(all(isinstance(value, (int, float)) and not isinstance(value, bool)
+                    and math.isfinite(value) and 0 <= value <= 1 for value in probabilities.values()),
+                "probabilities must be finite values in [0,1]")
+        require(abs(sum(probabilities.values()) - 1) <= 0.02, "probabilities do not sum to one")
+    # Returned tools, code, risk, permissions and confidence never become executable authority.
+    return {"choice": choice, "probabilities": probabilities,
+            "probability_kind": "native_distribution" if probabilities is not None else "none"}
+
+
+def quantiles(values):
+    require(all(isinstance(value, (int, float)) and not isinstance(value, bool)
+                and math.isfinite(value) and value >= 0 for value in values), "invalid latency sample")
+    if not values:
+        return {"p50": None, "p95": None, "p99": None}
+    ordered = sorted(values)
+    def percentile(q):
+        index = (len(ordered) - 1) * q
+        lower, upper = math.floor(index), math.ceil(index)
+        return ordered[lower] + (ordered[upper] - ordered[lower]) * (index - lower)
+    return {name: percentile(q) for name, q in (("p50", .5), ("p95", .95), ("p99", .99))}
+
+
+def decision_metrics(rows, source, threshold=.9):
+    require(source in ("live_model", "synthetic_fixture_replay"), "measurement provenance required")
+    require(0 <= threshold <= 1 and math.isfinite(threshold), "invalid confidence threshold")
+    correct = sum(row.get("choice") == row.get("label") and row.get("status") == "ok" for row in rows)
+    valid = [row for row in rows if row.get("status") == "ok"]
+    calibrated = []
+    for row in valid:
+        request = finite_request("metrics-only", row)
+        answer = finite_answer({"answers": {"action": row}}, request)
+        require(row.get("label") in request["questions"]["action"]["criteria"], "unknown reference label")
+        require(row.get("label_source") in ("fixture_expectation", "verified_ui_receipt"),
+                "unverified success cannot be an evaluation label")
+        if row["label_source"] == "verified_ui_receipt":
+            require(re.fullmatch(r"[a-f0-9]{64}", row.get("verification_sha256", "")) is not None,
+                    "verified UI label requires its receipt hash")
+        if answer["probabilities"] is not None:
+            calibrated.append((row, answer["probabilities"]))
+    brier = sum(sum((p - int(key == row["label"])) ** 2 for key, p in probs.items())
+                for row, probs in calibrated) / len(calibrated) if calibrated else None
+    bins = [[] for _ in range(10)]
+    accepted = []
+    for row, probs in calibrated:
+        confidence = probs[row["choice"]]
+        success = row["choice"] == row["label"]
+        bins[min(int(confidence * 10), 9)].append((confidence, success))
+        if confidence >= threshold:
+            accepted.append(success)
+    ece = sum(abs(sum(conf for conf, _ in group) / len(group) - sum(ok for _, ok in group) / len(group))
+              * len(group) / len(calibrated) for group in bins if group) if calibrated else None
+    quality = {"accuracy_including_errors": correct / len(rows) if rows else None,
+               "native_probability_count": len(calibrated), "multiclass_brier_sum": brier,
+               "ece_10_equal_width_bins": ece, "selective_threshold": threshold,
+               "selective_coverage": len(accepted) / len(rows) if calibrated else None,
+               "selective_risk": 1 - sum(accepted) / len(accepted) if accepted else None}
+    return {"measurement_kind": source, "count": len(rows), "valid_count": len(valid),
+            "error_count": len(rows) - len(valid),
+            "model_quality_metrics": quality if source == "live_model" else None,
+            "fixture_contract_metrics": quality if source == "synthetic_fixture_replay" else None,
+            "stage_latency_ms": {"rank": quantiles([row["latency_ms"] for row in rows
+                                                     if "latency_ms" in row]),
+                                 **{key: None for key in ("observe", "ground", "plan", "queue", "execute", "verify")}},
+            "cold_start_measured": False, "peak_vram_mib": None,
+            "limitations": ["Choice accuracy is not GUI task completion.",
+                            "Rank timing includes local HTTP transport; no forward-only timing is claimed.",
+                            "No cold-start or continuously sampled peak VRAM measurement was performed."]}
+
+
+def load_corpus(path):
+    raw = bounded_bytes(path)
+    rows = [strict_json(line) for line in raw.splitlines() if line.strip()]
+    require(0 < len(rows) <= 1000, "corpus must contain one to one thousand cases")
+    require(len({row.get("id") for row in rows}) == len(rows), "corpus case IDs must be unique")
+    for row in rows:
+        request = finite_request("corpus-check", row)
+        require(isinstance(row.get("id"), str) and bool(row["id"]), "corpus case ID required")
+        require(row.get("label") in request["questions"]["action"]["criteria"], "reference label is not legal")
+        require(row.get("label_source") in ("fixture_expectation", "verified_ui_receipt"),
+                "unverified success cannot label a case")
+    return rows, hashlib.sha256(raw).hexdigest()
+
+
+def verify_corpus_lock(lock, sha, point=False):
+    key = "point_corpus_sha256" if point else "corpus_sha256"
+    require(lock.get("benchmark", {}).get(key) == sha,
+            "validated corpus bytes do not match the frozen source lock")
+
+
+def ollama_finite_request(selection, finite):
+    choices = finite["questions"]["action"]["criteria"]
+    return {"model": selection["model"], "stream": False, "think": False,
+            "keep_alive": "10m", "options": {"num_ctx": 8192, "num_predict": 256, "temperature": 0},
+            "format": {"type": "object", "properties": {"choice": {"type": "string", "enum": list(choices)}},
+                       "required": ["choice"], "additionalProperties": False},
+            "messages": [{"role": "system", "content": "Choose exactly one supplied legal action. Observe or abstain if unsure. Return only the JSON object with choice. Do not invent probabilities."},
+                         {"role": "user", "content": json.dumps({"state": finite["state"], "choices": choices})}]}
+
+
+def ollama_finite_answer(response, selection, request):
+    require(response.get("done") is True and response.get("model") == selection["model"],
+            "bounded Ollama decision did not complete for selected model")
+    value = strict_json(response.get("message", {}).get("content", ""))
+    require(isinstance(value, dict) and set(value) == {"choice"}, "Ollama decision must contain only choice")
+    return finite_answer({"answers": {"action": {"choice": value["choice"]}}}, request)
+
+
+def run_policy_benchmark(selection, lock, receipt, approval, cases, collector=collect_snapshot,
+                         sender=local_json, clock=time.time, timer=time.perf_counter, checkpoint=None):
+    require(selection.get("protocol") in ("systemone", "ollama-chat"), "policy protocol unsupported")
+    rows = []
+    for case in cases:
+        request = finite_request(selection["model"], case)
+        # Recheck for every request, not just before the first warm-up.
+        try:
+            preflight = verify_preflight(selection, lock, receipt, collector(selection, receipt), clock())
+            verify_approval(approval, preflight, clock())
+        except GateError as error:
+            error.partial_rows = rows
+            raise
+        started = timer()
+        try:
+            if selection["protocol"] == "ollama-chat":
+                response = sender(selection["endpoint"], ollama_finite_request(selection, request),
+                                  headers={"X-Ollama-Unify-GPU-UUIDs": ",".join(selection["gpu_uuids"])}, timeout=60)
+                answer = ollama_finite_answer(response, selection, request)
+            else:
+                answer = finite_answer(sender(selection["endpoint"], request, timeout=30), request)
+            rows.append({**case, **answer, "status": "ok", "latency_ms": (timer() - started) * 1000})
+        except GateError as error:
+            rows.append({**case, "status": "error", "error": str(error),
+                         "latency_ms": (timer() - started) * 1000})
+        if checkpoint:
+            checkpoint(rows)
+    return rows
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--lock", type=Path, default=DEFAULT_LOCK)
+    commands = parser.add_subparsers(dest="command", required=True)
+    for name in ("preflight", "approve", "benchmark-policy", "smoke-planner"):
+        item = commands.add_parser(name)
+        item.add_argument("--selection", required=True, type=Path)
+        item.add_argument("--runtime-receipt", required=True, type=Path)
+        item.add_argument("--output", required=True, type=Path)
+        if name == "approve":
+            item.add_argument("--statement", required=True)
+        if name in ("benchmark-policy", "smoke-planner"):
+            item.add_argument("--approval", required=True, type=Path)
+        if name == "benchmark-policy":
+            item.add_argument("--corpus", required=True, type=Path)
+    check = commands.add_parser("check-corpus")
+    check.add_argument("--corpus", required=True, type=Path)
+    args = parser.parse_args(argv)
+    inference_attempted = False
+    try:
+        if args.command == "check-corpus":
+            cases, sha = load_corpus(args.corpus)
+            print(json.dumps({"status": "valid", "cases": len(cases), "sha256": sha,
+                              "model_inference_performed": False}))
+            return 0
+        selection, receipt = read_json(args.selection), read_json(args.runtime_receipt)
+        lock, lock_sha = read_json_hashed(args.lock)
+        validate_selection(selection, lock)
+        preflight = verify_preflight(selection, lock, receipt, collect_snapshot(selection, receipt))
+        if args.command == "preflight":
+            result = preflight
+        elif args.command == "approve":
+            result = approve_preflight(preflight, args.statement)
+        else:
+            approval = read_json(args.approval)
+            verify_approval(approval, preflight)
+            write_json(args.output, {"schema": "omnius.computer-use.run-start.v1", "status": "in_progress",
+                                     "selection": selection, "preflight_fingerprint": preflight["fingerprint"],
+                                     "models_lock_sha256": lock_sha})
+            if args.command == "benchmark-policy":
+                cases, sha = load_corpus(args.corpus)
+                verify_corpus_lock(lock, sha)
+                def checkpoint(rows):
+                    write_json(args.output, {"schema": "omnius.computer-use.policy-report.v1",
+                                             "status": "in_progress", "selection": selection,
+                                             "corpus_sha256": sha, "rows": rows})
+                inference_attempted = True
+                rows = run_policy_benchmark(selection, lock, receipt, approval, cases, checkpoint=checkpoint)
+                result = {"schema": "omnius.computer-use.policy-report.v1", "selection": selection,
+                          "status": "completed" if all(row["status"] == "ok" for row in rows)
+                          else "completed_with_errors", "corpus_sha256": sha, "rows": rows,
+                          "models_lock_sha256": lock_sha,
+                          "preflight_fingerprint": preflight["fingerprint"],
+                          "corpus_purpose": "finite action selection; no UI input or task completion",
+                          **decision_metrics(rows, "live_model")}
+            else:
+                require(selection["protocol"] == "ollama-chat", "planner smoke requires Ollama chat")
+                body = {"model": selection["model"], "stream": False, "think": False,
+                        "messages": [{"role": "user", "content": "Return only the JSON object {\"ready\":true}."}],
+                        "format": "json", "keep_alive": "10m",
+                        "options": {"num_ctx": 8192, "num_predict": 32, "temperature": 0}}
+                started = time.perf_counter()
+                inference_attempted = True
+                response = local_json(selection["endpoint"], body, headers={
+                    "X-Ollama-Unify-GPU-UUIDs": ",".join(selection["gpu_uuids"])}, timeout=60)
+                require(response.get("done") is True and response.get("model") == selection["model"],
+                        "planner smoke did not complete for the selected tag")
+                require(strict_json(response.get("message", {}).get("content", "")) == {"ready": True},
+                        "planner smoke did not return the requested structured output")
+                result = {"schema": "omnius.computer-use.planner-smoke.v1", "status": "passed",
+                          "selection": selection, "latency_ms": (time.perf_counter() - started) * 1000,
+                          "task_completion_claimed": False}
+        write_json(args.output, result)
+        print(json.dumps({"status": result.get("status", "recorded"), "artifact": str(args.output)}))
+        return 3 if result.get("status") == "completed_with_errors" else 0
+    except (GateError, OSError, KeyError, TypeError) as error:
+        failure = {"schema": "omnius.computer-use.gate-failure.v1", "status": "blocked",
+                   "reason": str(error), "inference_status": "possibly_started" if inference_attempted
+                   else "not_attempted", "partial_rows": getattr(error, "partial_rows", [])}
+        if hasattr(args, "output"):
+            write_json(args.output, failure)
+        print(json.dumps(failure), file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())