arxo-codegen 0.4.0__py3-none-any.whl

arxo_codegen/check.py

@@ -0,0 +1,158 @@
+"""Run the existing backend harness against a verified exported fixture kit.
+
+The harness is transitional: its source remains in law-dsl until ownership is
+switched. Only fixtures exported from a trusted core checkout should be used.
+"""
+from __future__ import annotations
+
+import argparse
+import hashlib
+import importlib.util
+import json
+import os
+from pathlib import Path
+import sys
+
+HERE = Path(__file__).resolve().parent
+sys.path.insert(0, str(HERE))
+
+import runtime_cert
+
+
+def validate_fixtures(root: Path) -> dict:
+    root = root.resolve()
+    manifest = json.loads((root / "manifest.json").read_text(encoding="utf-8"))
+    if manifest.get("format") != "law.codegen-fixtures/0.1":
+        raise ValueError("unsupported codegen fixture format")
+    seen = set()
+    for row in manifest["files"]:
+        rel = row["path"]
+        path = root / rel
+        if (not isinstance(rel, str) or Path(rel).is_absolute() or ".." in Path(rel).parts
+                or rel in seen or path.is_symlink() or not path.resolve().is_relative_to(root)):
+            raise ValueError("invalid codegen fixture path")
+        seen.add(rel)
+        data = path.read_bytes()
+        if row["sha256"] != "sha256:" + hashlib.sha256(data).hexdigest() or row["bytes"] != len(data):
+            raise ValueError(f"codegen fixture hash mismatch: {rel}")
+    required = {"verify/ci/gates/backends/check_backends.py", "verify/ci/gates/backends/l1_fixtures.py",
+                "runtime/runtime-cert.json", "data/backends-vectors.json"}
+    if not required <= seen:
+        raise ValueError("incomplete codegen fixture kit")
+    actual = {p.relative_to(root).as_posix() for p in root.rglob("*") if p.is_file()}
+    if actual != seen | {"manifest.json"}:
+        raise ValueError("unlisted codegen fixture files")
+    return manifest
+
+
+def load_harness(root: Path):
+    validate_fixtures(root)
+    import core_support
+    import deliver
+    import plan
+    owned_harness = HERE / "harness/verify/ci/gates/backends"
+    # Once extracted, harness code is owned/versioned with codegen. During
+    # transition the exported copy keeps source-checkout invocation working.
+    gate_dir = owned_harness if owned_harness.is_dir() else root / "verify/ci/gates/backends"
+    old_path = sys.path[:]
+    old_bytecode = sys.dont_write_bytecode
+    old_fx = sys.modules.pop("l1_fixtures", None)
+    try:
+        sys.dont_write_bytecode = True
+        sys.path.insert(0, str(gate_dir))
+        spec = importlib.util.spec_from_file_location("_codegen_fixture_gate", gate_dir / "check_backends.py")
+        gate = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(gate)
+    finally:
+        sys.path[:] = old_path
+        sys.dont_write_bytecode = old_bytecode
+        sys.modules.pop("l1_fixtures", None)
+        if old_fx is not None:
+            sys.modules["l1_fixtures"] = old_fx
+    gate.ROOT = root
+    gate.BACKENDS = HERE
+    gate.VECTORS = root / "vectors"
+    gate.CLIR = root / "corpus/clir"
+    gate.CERT = root / "runtime/runtime-cert.json"
+    gate.MANIFEST = root / "data/backends-vectors.json"
+    gate.P = plan
+    gate.D = deliver
+    gate.canon_value = lambda value: core_support.canonical_bytes(value, document=False).decode("utf-8")
+    _install_profiled_certifier(gate)
+    return gate
+
+
+def _install_profiled_certifier(gate) -> None:
+    """Apply the installable runtime contract without modifying the archived gate.
+
+    The source-tree gate deliberately keeps its historical all-fixture
+    certification during the transition.  The packaged wrapper instead gives
+    each target the fixture subset declared in :mod:`runtime_cert`; returning
+    the same ``list[str]`` shape keeps the gate's normal failure path intact.
+    """
+    def certify(emit: dict, work: Path, active: list[str]) -> list[str]:
+        errors, reports = [], {}
+        for lang in active:
+            try:
+                report, target_errors = runtime_cert.certify_target(
+                    lang, emit[lang], work, gate.CERT, gate.D.emit_project,
+                    gate.build_projects, gate.run_target,
+                )
+                reports[lang] = report
+                errors.extend(target_errors)
+            except runtime_cert.FixtureError as exc:
+                errors.append(f"сертификация {lang}: неверный capability-контракт: {exc}")
+        gate.RUNTIME_CERT_REPORTS = reports
+        summary = []
+        for lang in active:
+            report = reports.get(lang)
+            if report is None:
+                continue
+            skipped_ops = ",".join(report["unsupportedOperations"]) or "—"
+            skipped_literals = ",".join(report["unsupportedLiteralTags"]) or "—"
+            summary.append(f"{lang}: {len(report['checkedFixtureIds'])} cases; "
+                           f"ops вне профиля: {skipped_ops}; literals вне профиля: {skipped_literals}")
+        if summary:
+            print("check_backends: installed runtime profiles — " + " | ".join(summary))
+        return errors
+
+    gate.certify = certify
+
+
+def main(argv: list[str] | None = None) -> int:
+    ap = argparse.ArgumentParser(description=__doc__, allow_abbrev=False)
+    ap.add_argument("--fixtures", required=True, type=Path)
+    ap.add_argument("--core-kit", required=True, type=Path)
+    ap.add_argument("--active-canaries", type=Path)
+    ap.add_argument("--active-canary-targets")
+    args, remaining = ap.parse_known_args(argv)
+    import core_support
+    core_support.configure_core_kit(args.core_kit)
+    core_support.validate_core_kit(args.core_kit)
+    gate = load_harness(args.fixtures.resolve())
+    if args.active_canaries is not None:
+        def active_value_canaries(_emit, _work):
+            import check_active_canaries
+            capable = tuple(lang for lang in ("py", "ts", "go") if lang in _emit)
+            if args.active_canary_targets is not None:
+                requested = tuple(x for x in args.active_canary_targets.split(',') if x)
+                if set(capable) != set(requested) or len(requested) != len(capable):
+                    return ["active value canaries must cover all active primary targets: " + ",".join(capable)], []
+            if not capable:
+                return [], ["active value canaries: no primary targets in this profile"]
+            try:
+                lines = check_active_canaries.verify(args.active_canaries, core_kit=args.core_kit, targets=capable)
+            except check_active_canaries.CanaryError as exc:
+                return ["active value canaries: " + str(exc)], []
+            return [], ["active value canaries: " + line for line in lines]
+        gate.value_canaries = active_value_canaries
+    old_argv = sys.argv[:]
+    try:
+        sys.argv = ["arxo-codegen-check", *remaining]
+        return gate.main()
+    finally:
+        sys.argv[:] = old_argv
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

arxo_codegen/check_active_canaries.py

@@ -0,0 +1,262 @@
+"""Standalone verifier for a published active-canary bundle.
+
+The bundle contains frozen lawref outcomes produced by the publisher.  This
+consumer never imports lawref or the monorepo CI gate: it verifies the bundle
+inventory, rebuilds each supported plan with the installed code generator, and
+executes the Python baseline and named mutation against the frozen oracle.
+"""
+from __future__ import annotations
+
+import argparse
+import copy
+import hashlib
+import json
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import os
+
+HERE = Path(__file__).resolve().parent
+if str(HERE) not in sys.path:
+    sys.path.insert(0, str(HERE))
+# Keep one flat core_support module with plan/deliver, both in a checkout and
+# in the installed package layout (deliver deliberately uses this convention).
+import core_support  # noqa: E402
+import deliver as D  # noqa: E402
+import plan as P  # noqa: E402
+import target_runner as TR  # noqa: E402
+
+FORMAT = "law.codegen-active-canaries/0.1"
+SEMANTIC = "0.2.11"
+REQUIRED = {
+    "LAY-L0-RAT-DYN-DECIMAL-KEPT": "kindChecks",
+    "LAY-L0-RAT-GUARD-DYN-MIX": "err",
+    "LAY-L0-RAT-HEAD-DIV-ZERO": "headFallible",
+    "LAY-L0-RAT-DYN-RATIONAL-KEPT": "lk",
+    "LAY-L0-QTY-GUARD-DIMENSION": "err",
+    "LAY-L0-QTY-ADD-DIMENSION": "headFallible",
+}
+EXPECTED_REFUSALS = {"LAY-L0-RAT-GUARD-DYN-MIX": "NUMBER_UNAVAILABLE"}
+SOURCE_FILES = {"source.law", "source.ir.json", "source.case.json", "source.query.json"}
+DERIVED_FILES = {"ir.json", "case.json", "query.json", "oracle.outcome.json",
+                 "backend.baseline.json", "backend.mutated.json"}
+
+
+class CanaryError(RuntimeError):
+    pass
+
+
+def _sha(data: bytes) -> str:
+    return "sha256:" + hashlib.sha256(data).hexdigest()
+
+
+def _read_json(path: Path) -> dict:
+    try:
+        obj = json.loads(path.read_bytes())
+    except (OSError, UnicodeDecodeError, json.JSONDecodeError) as exc:
+        raise CanaryError(f"invalid JSON: {path.name}") from exc
+    if not isinstance(obj, dict):
+        raise CanaryError(f"JSON object required: {path.name}")
+    return obj
+
+
+def _safe_relative(value: object) -> Path:
+    if not isinstance(value, str):
+        raise CanaryError("invalid manifest path")
+    path = Path(value)
+    if path.is_absolute() or not value or ".." in path.parts:
+        raise CanaryError("unsafe manifest path")
+    return path
+
+
+def _canary_id(value: object) -> str:
+    if not isinstance(value, str) or not value or Path(value).name != value or not value.isascii() \
+            or any(char not in "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-" for char in value):
+        raise CanaryError("unsafe canary id")
+    return value
+
+
+def _outcome(document: dict) -> dict:
+    if "refused" in document:
+        return {"refused": document["refused"]}
+    issues = document.get("issues", [])
+    if not isinstance(issues, list):
+        raise CanaryError("backend outcome has invalid issues")
+    codes = sorted(item.get("code") if isinstance(item, dict) else str(item)
+                   for item in issues if isinstance(item, str) or isinstance(item, dict) and item.get("code"))
+    result = (document.get("results") or [{}])[0]
+    if not isinstance(result, dict):
+        raise CanaryError("oracle result is invalid")
+    return {"truthStatus": result.get("truthStatus", document.get("truthStatus")),
+            "evaluationStatus": result.get("evaluationStatus", document.get("evaluationStatus")),
+            "issues": codes}
+
+
+def _mutate(plan: dict, field: str) -> dict:
+    out = copy.deepcopy(plan)
+    for rule in out.get("rules", []):
+        if field in ("kindChecks", "headFallible"):
+            rule.pop(field, None)
+        elif field == "err":
+            for guard in rule.get("guards", []):
+                guard.pop("err", None)
+    if field == "lk":
+        stack = [out]
+        while stack:
+            item = stack.pop()
+            if isinstance(item, dict):
+                if item.get("k") == "bin" and item.get("op") == "div" and "lk" in item:
+                    item["lk"] = item["rk"] = "d"
+                stack.extend(value for value in item.values() if isinstance(value, (dict, list)))
+            elif isinstance(item, list):
+                stack.extend(item)
+    return out
+
+
+def _run(plan: dict, case: Path, query: Path, target: str = "py", env=None) -> dict:
+    with tempfile.TemporaryDirectory(prefix="codegen-canary-") as temp:
+        project = Path(temp) / target
+        D.emit_project(plan, target, project)
+        emit={target:D.emitter(target)}
+        failures=TR.build_projects(emit,{target:[project]},Path(temp),env)
+        if failures: raise CanaryError(failures[0])
+        kind,response=TR.run_target(emit[target],project,"runner",[str(case),str(query)],env)
+        if kind == "refused": return _outcome({"refused": response})
+        if kind != "answer": raise CanaryError(f"generated {target} runner {kind}: {response}")
+        return _outcome(response)
+
+
+def load(bundle: Path) -> tuple[dict, list[dict]]:
+    bundle = Path(bundle).resolve()
+    if bundle.is_symlink() or not bundle.is_dir():
+        raise CanaryError("canary bundle is not a directory")
+    if any(path.is_symlink() for path in bundle.rglob("*")):
+        raise CanaryError("canary bundle contains a symlink")
+    manifest = _read_json(bundle / "manifest.json")
+    if manifest.get("format") != FORMAT or manifest.get("semanticVersion") != SEMANTIC:
+        raise CanaryError("unsupported canary bundle format or semantic version")
+    rows = manifest.get("canaries")
+    unsupported = manifest.get("unsupported")
+    if not isinstance(rows, list) or not isinstance(unsupported, list):
+        raise CanaryError("canary bundle has invalid rows")
+    known = {"manifest.json"}
+    seen = set()
+    all_rows: dict[str, dict] = {}
+    for row in rows:
+        if not isinstance(row, dict):
+            raise CanaryError("invalid canary row")
+        ident = _canary_id(row.get("id"))
+        if ident in seen:
+            raise CanaryError("duplicate canary id")
+        seen.add(ident); all_rows[ident] = row
+        prefix = Path("canaries") / ident
+        known.update((prefix / name).as_posix() for name in (
+            "source.law", "source.ir.json", "source.case.json", "source.query.json",
+            "ir.json", "case.json", "query.json", "oracle.outcome.json",
+            "backend.baseline.json", "backend.mutated.json"))
+        if row.get("semanticVersion") != SEMANTIC or row.get("mutation") != REQUIRED.get(ident):
+            raise CanaryError("invalid canary semantic provenance")
+        if row.get("expectedRefusal") != EXPECTED_REFUSALS.get(ident):
+            raise CanaryError("invalid current refusal qualification")
+        for key, required in (("sourceFiles", SOURCE_FILES), ("files", DERIVED_FILES)):
+            inventory = row.get(key)
+            if not isinstance(inventory, dict) or set(inventory) != required:
+                raise CanaryError("canary row lacks file provenance")
+            for name, digest in inventory.items():
+                path = prefix / _safe_relative(name)
+                if digest != _sha((bundle / path).read_bytes()):
+                    raise CanaryError("canary file hash mismatch: " + path.as_posix())
+    for row in unsupported:
+        if not isinstance(row, dict):
+            raise CanaryError("invalid unsupported canary row")
+        ident = _canary_id(row.get("id"))
+        if ident in all_rows or row.get("mutation") != REQUIRED.get(ident) or not isinstance(row.get("reason"), str):
+            raise CanaryError("invalid unsupported canary provenance")
+        all_rows[ident] = row
+    if set(all_rows) != set(REQUIRED):
+        raise CanaryError("required canary inventory is incomplete")
+    actual = {path.relative_to(bundle).as_posix() for path in bundle.rglob("*") if path.is_file()}
+    if actual != known:
+        raise CanaryError("canary bundle inventory differs from manifest")
+    return manifest, rows
+
+
+def verify(bundle: Path, *, allow_partial: bool = False, core_kit: Path | None = None,
+           targets: tuple[str,...] = ("py",)) -> list[str]:
+    if core_kit is None:
+        raise CanaryError("--core-kit is required for standalone canary verification")
+    previous = core_support._configured_kit
+    core_support.configure_core_kit(core_kit)
+    try:
+        if not targets or len(set(targets)) != len(targets) or any(t not in ("py","ts","go") for t in targets): raise CanaryError("unknown active canary target")
+        core_support.validate_core_kit(core_kit)
+        bundle = Path(bundle).resolve()
+        manifest, rows = load(bundle)
+        messages: list[str] = []
+        cache_directory = tempfile.TemporaryDirectory(prefix="codegen-active-env-")
+        env = dict(os.environ, GOCACHE=str(Path(cache_directory.name) / "gocache"),
+                   GOMODCACHE=str(Path(cache_directory.name) / "gomodcache"))
+        for row in rows:
+            base = bundle / "canaries" / row["id"]
+            ir, case, query = (_read_json(base / name) for name in ("ir.json", "case.json", "query.json"))
+            if row.get("expectedRefusal"):
+                try:
+                    P.build_plan(ir, resources={})
+                except P.Refused as exc:
+                    if not str(exc).startswith(row["expectedRefusal"] + ":"):
+                        raise CanaryError("wrong qualified canary refusal") from exc
+                    for name in ("backend.baseline.json", "backend.mutated.json"):
+                        if _read_json(base / name) != {"refused": str(exc)}:
+                            raise CanaryError("qualified refusal differs from frozen evidence")
+                else:
+                    raise CanaryError("qualified canary unexpectedly admitted")
+                messages.append(f"EXPECTED_REFUSAL {row['id']}: {row['expectedRefusal']}")
+                continue
+            plan = P.build_plan(ir, resources={})
+            mutation = _mutate(plan, row["mutation"])
+            if mutation == plan:
+                raise CanaryError(f"{row['id']}: mutation does not change rebuilt plan")
+            expected = _read_json(base / "oracle.outcome.json")
+            frozen_baseline = _read_json(base / "backend.baseline.json")
+            frozen_mutated = _read_json(base / "backend.mutated.json")
+            for target in targets:
+                baseline = _run(plan, base / "case.json", base / "query.json",target,env)
+                changed = _run(mutation, base / "case.json", base / "query.json",target,env)
+                if baseline != expected or baseline != frozen_baseline:
+                    raise CanaryError(f"{row['id']} {target}: baseline differs from frozen evidence")
+                if changed != frozen_mutated or changed == baseline:
+                    raise CanaryError(f"{row['id']} {target}: mutation witness did not fail")
+            messages.append(f"PASS {row['id']} ({','.join(targets)})")
+        unsupported = manifest["unsupported"]
+        if unsupported:
+            names = ", ".join(str(row["id"]) for row in unsupported)
+            if not allow_partial:
+                raise CanaryError("unsupported required canaries: " + names)
+            messages.append("PARTIAL unsupported required canaries: " + names)
+        return messages
+    finally:
+        if "cache_directory" in locals():
+            cache_directory.cleanup()
+        core_support.configure_core_kit(previous)
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--bundle", type=Path, required=True)
+    parser.add_argument("--core-kit", type=Path)
+    parser.add_argument("--allow-partial", action="store_true", help="report unsupported rows as PARTIAL, never PASS")
+    parser.add_argument("--targets", default="py", help="comma-separated py,ts,go")
+    args = parser.parse_args(argv)
+    try:
+        for line in verify(args.bundle, allow_partial=args.allow_partial, core_kit=args.core_kit,
+                           targets=tuple(x for x in args.targets.split(',') if x)):
+            print(line)
+    except (CanaryError, core_support.CoreKitError, P.Refused) as exc:
+        print(f"FAIL: {exc}", file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

arxo_codegen/check_api.py

@@ -0,0 +1,76 @@
+"""API порождённого модуля против раннера на проверенном комплекте (DECISION-0423 §2.6).
+
+Шаг приёмки: для API-пакетов комплекта (`corpus/clir`) печатаются проекты
+целей с API, и каждое задание — положительное, с отрицательным фактом L1, с
+литералом чужого типа (§189), с синтетическим конфликтом ключа §45.1 —
+исполняется раннером и харнессом API; исходы обязаны совпасть у API и раннера
+каждой цели и у целей между собой. Затем пакет заданий с повтором
+исполняется одним процессом последовательно и параллельно, и канарейка
+портит общую часть API Python — расхождение обязано найтись.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+import sys
+import tempfile
+
+HERE = Path(__file__).resolve().parent
+sys.path.insert(0, str(HERE))
+
+
+def main(argv: list[str] | None = None) -> int:
+    ap = argparse.ArgumentParser(description=__doc__, allow_abbrev=False)
+    ap.add_argument("--fixtures", required=True, type=Path)
+    ap.add_argument("--core-kit", required=True, type=Path)
+    ap.add_argument("--targets", default="py,ts,go", help="цели с API через запятую")
+    ap.add_argument("--require", default="", help="цели, отсутствие тулчейна которых — отказ")
+    ap.add_argument("--keep", type=Path, help="сохранить проекты")
+    ap.add_argument("--report", type=Path)
+    args = ap.parse_args(argv)
+    import core_support
+    core_support.configure_core_kit(args.core_kit)
+    core_support.validate_core_kit(args.core_kit)
+    import check
+    gate = check.load_harness(args.fixtures.resolve())
+    wanted = [x for x in args.targets.split(",") if x]
+    emit = {}
+    for lang in wanted:
+        em = gate.D.emitter(lang)
+        if not (getattr(em, "API", None) and hasattr(em, "emit_api")):
+            print(f"check_api: у цели {lang} нет API")
+            return 1
+        emit[lang] = em
+    tools = {lang: emit[lang].available() for lang in wanted}
+    active = [lang for lang in wanted if tools[lang][0]]
+    for lang in wanted:
+        if not tools[lang][0]:
+            print(f"check_api: цель {lang} ПРОПУЩЕНА — {tools[lang][1]}")
+    missing = [x for x in args.require.split(",") if x and x not in active]
+    if missing:
+        print(f"check_api: обязательные цели без тулчейна: {', '.join(missing)}")
+        return 1
+    if not active:
+        print("check_api: нет ни одной цели с тулчейном")
+        return 1
+    emit = {lang: emit[lang] for lang in active}
+    if args.keep:
+        work = args.keep.resolve()
+        work.mkdir(parents=True, exist_ok=True)
+        problems, checked = gate.api_check(emit, work, active)
+    else:
+        with tempfile.TemporaryDirectory(prefix="codegen-api-") as tmp:
+            problems, checked = gate.api_check(emit, Path(tmp), active)
+    for line in problems:
+        print("check_api: " + line)
+    print(f"check_api: цели {', '.join(active)}; сверено заданий {checked}; проблем {len(problems)}")
+    if args.report:
+        args.report.write_text(json.dumps({"format": "law.codegen-api-check/0.1", "targets": active,
+                                           "checked": checked, "problems": problems},
+                                          ensure_ascii=False, indent=1) + "\n", encoding="utf-8")
+    return 1 if problems or not checked else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())