arxo-codegen 0.4.0__py3-none-any.whl

arxo_codegen/check_conformance.py

@@ -0,0 +1,414 @@
+"""Check current-release backend conformance without changing baselines.
+
+Every exported 0.2.11 / IR 0.7 vector is classified; executable inputs run on requested
+targets against its source ``expected.json``. An explicit active registry (format 0.3,
+one pin per vector with the digest of that vector's inputs) covers vectors absent
+from the historical registry; a pinned outcome must agree, an unpinned match
+must be pinned, and a changed or new vector colours only itself.
+"""
+from __future__ import annotations
+
+import argparse
+import collections
+import fnmatch
+import hashlib
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import time
+
+HERE = Path(__file__).resolve().parent
+if str(HERE) not in sys.path:
+    sys.path.insert(0, str(HERE))
+
+import check
+import core_support
+import inert
+
+ACTIVE_SEMANTICS = frozenset({"0.2.11"})
+ARCHIVED_SEMANTICS = frozenset()
+FORMAT = "law.codegen-conformance-report/0.1"
+
+
+def select_vectors(available: set[str], vectors: tuple[str, ...] = (),
+                   patterns: tuple[str, ...] = ()) -> set[str]:
+    """Resolve a union of exact IDs and shell patterns; typos never mean PASS."""
+    if not vectors and not patterns:
+        return set(available)
+    selected = set()
+    for ident in vectors:
+        if ident not in available:
+            raise ValueError(f"unknown active vector: {ident}")
+        selected.add(ident)
+    for pattern in patterns:
+        matches = {ident for ident in available if fnmatch.fnmatchcase(ident, pattern)}
+        if not matches:
+            raise ValueError(f"vector pattern matched no active vectors: {pattern}")
+        selected.update(matches)
+    return selected
+
+
+def selected_inert_witnesses(manifest: dict, selected: set[str]) -> tuple[dict, set[str]]:
+    """Selecting either half of an inertness proof includes and checks its pair."""
+    constructs = {name: row for name, row in manifest["constructs"].items()
+                  if selected.intersection((row["witness"], row["bare"]))}
+    required = {ident for row in constructs.values() for ident in (row["witness"], row["bare"])}
+    return dict(manifest, constructs=constructs), selected | required
+
+
+def _save(path: Path, report: dict) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(report, ensure_ascii=False, indent=2, sort_keys=True) + "\n", encoding="utf-8")
+
+
+def _bounded_runner(timeout: float, environment: dict[str, str], failures: list[dict]):
+    def run(command, cwd=None):
+        try:
+            result = subprocess.run(command, cwd=cwd, env=environment, text=True,
+                                    capture_output=True, timeout=timeout)
+        except subprocess.TimeoutExpired:
+            result = subprocess.CompletedProcess(command, 124, "", f"timeout after {timeout}s")
+        except OSError as exc:
+            result = subprocess.CompletedProcess(command, 127, "", str(exc))
+        # Exit 3 is the runner's named refusal protocol. execute() validates
+        # its JSON and requires every target to refuse identically; malformed
+        # refusal payloads still become crashes. Build errors are handled by
+        # build_projects regardless of their exit code.
+        if result.returncode not in (0, 3):
+            failures.append({
+                "command": [str(part) for part in command], "returncode": result.returncode,
+                "output": (result.stdout + result.stderr)[:4000],
+            })
+        return result
+    return run
+
+
+def run(fixtures: Path, core_kit: Path, *, timeout: float,
+        targets: tuple[str, ...] = ("py",), outcomes: Path | None = None,
+        vectors: tuple[str, ...] = (), vector_globs: tuple[str, ...] = ()) -> tuple[dict, int]:
+    core_support.configure_core_kit(core_kit)
+    core_support.validate_core_kit(core_kit)
+    gate = check.load_harness(fixtures.resolve())
+    fixture_manifest = check.validate_fixtures(fixtures)
+    if not targets or len(set(targets)) != len(targets) or set(targets) - {"py", "ts", "go"}:
+        raise ValueError("targets must be a nonempty distinct subset of py,ts,go")
+    emit = {lang: gate.D.emitter(lang) for lang in targets}
+    toolchains = {lang: descriptor.available() for lang, descriptor in emit.items()}
+    source_paths = sorted([*Path(__file__).parent.glob("*.py"),
+                           *(p for lang in ("py", "ts", "go")
+                             for p in (Path(__file__).parent / "targets" / lang).glob("*")
+                             if p.suffix in (".py", ".ts", ".go", ".json")),
+                           Path(__file__).parent / "runtime-cert.json",
+                           Path(__file__).parent / "inert-nodes.json",
+                           Path(__file__).parent / "harness/verify/ci/gates/backends/check_backends.py"])
+    # Tests and documentation are not execution inputs.
+    source_paths = [p for p in source_paths if not p.name.startswith("test_")]
+    source_hashes = {str(p.relative_to(Path(__file__).parent)): "sha256:" + hashlib.sha256(p.read_bytes()).hexdigest()
+                     for p in source_paths}
+    report: dict = {
+        "format": FORMAT,
+        "scope": {"activeSemanticVersions": sorted(ACTIVE_SEMANTICS), "targets": list(targets),
+                  "archivedSemanticVersions": sorted(ARCHIVED_SEMANTICS)},
+        "fixtureProvenance": fixture_manifest.get("provenance"),
+        "fixturePayloadSha256": fixture_payload_digest(fixture_manifest),
+        "generatorInputs": source_hashes,
+        "toolchains": {lang: value[1] for lang, value in toolchains.items()},
+        "vectors": [],
+        "commandFailures": [],
+    }
+    if not all(value[0] for value in toolchains.values()):
+        report["fatal"] = "required target unavailable"
+        return report, 1
+
+    pinned = json.loads(gate.MANIFEST.read_text(encoding="utf-8"))
+    if pinned.get("format") != gate.MANIFEST_FORMAT or not isinstance(pinned.get("vectors"), dict):
+        report["fatal"] = "invalid legacy backend outcome registry"
+        return report, 1
+    legacy = pinned["vectors"]
+    kinds = set.intersection(*(set(getattr(em, "QUERY_KINDS", {"truth"})) for em in emit.values()))
+    manifest_vectors = fixture_manifest.get("vectors")
+    if not isinstance(manifest_vectors, list):
+        report["fatal"] = "fixture manifest has no vector inventory"
+        return report, 1
+    declared: dict[str, str] = {}
+    for entry in manifest_vectors:
+        if not isinstance(entry, dict) or not isinstance(entry.get("id"), str) or not isinstance(entry.get("path"), str):
+            report["fatal"] = "fixture manifest has invalid vector entry"
+            return report, 1
+        if entry["id"] in declared:
+            report["fatal"] = "fixture manifest has duplicate vector id"
+            return report, 1
+        source = fixtures / entry["path"] / "ir.json"
+        try:
+            semantic = str(json.loads(source.read_text(encoding="utf-8")).get("semanticVersion", "0.2"))
+        except (OSError, json.JSONDecodeError) as exc:
+            report["fatal"] = "fixture manifest vector has unreadable CLIR: " + entry["id"]
+            return report, 1
+        declared[entry["id"]] = semantic
+
+    candidates = list(gate.candidates())
+    candidate_ids = [directory.name for directory, _layer in candidates]
+    duplicate_candidates = sorted({ident for ident in candidate_ids if candidate_ids.count(ident) > 1})
+    missing_candidates = sorted(set(declared) - set(candidate_ids))
+    unexpected_candidates = sorted(set(candidate_ids) - set(declared))
+    report["coverageFailures"] = {"duplicateCandidates": duplicate_candidates,
+                                  "missingCandidates": missing_candidates,
+                                  "unexpectedCandidates": unexpected_candidates}
+
+    archive = collections.Counter()
+    active: list[tuple[Path, str, str, dict]] = []
+    for directory, layer in candidates:
+        semantic = str(gate.load(directory, "ir.json").get("semanticVersion", "0.2"))
+        if semantic in ARCHIVED_SEMANTICS:
+            archive[semantic] += 1
+            continue
+        if semantic not in ACTIVE_SEMANTICS:
+            report.setdefault("unsupportedSemanticVersions", collections.Counter())[semantic] += 1
+            continue
+        row = {"id": directory.name, "layer": layer, "semanticVersion": semantic,
+               "legacyPinned": directory.name in legacy}
+        active.append((directory, layer, semantic, row))
+
+    all_active_ids = {directory.name for directory, *_ in active}
+    partial = bool(vectors or vector_globs or fixture_manifest.get("selection", {}).get("mode") == "partial")
+    selected = select_vectors(all_active_ids, vectors, vector_globs)
+    inert_manifest = inert.load()
+    if partial:
+        full_inert_manifest = inert_manifest
+        inert_manifest, selected = selected_inert_witnesses(inert_manifest, selected)
+        absent = selected - all_active_ids
+        if absent:
+            raise ValueError("selected inertness pair is absent: " + ", ".join(sorted(absent)))
+        report["inertWitnessesNotChecked"] = sorted(set(full_inert_manifest["constructs"]) -
+                                                   set(inert_manifest["constructs"]))
+        active = [item for item in active if item[0].name in selected]
+    report["scope"].update(mode="partial" if partial else "full",
+                           requestedVectors=list(vectors), requestedVectorGlobs=list(vector_globs),
+                           totalActive=fixture_manifest.get("selection", {}).get("availableVectors", len(all_active_ids)),
+                           activeInBundle=len(all_active_ids), selectedVectors=sorted(selected))
+
+    executable: list[tuple[Path, dict, dict]] = []
+    for directory, layer, _semantic, row in active:
+        outcome, plan, errors = gate.classify(directory, kinds, emit, layer)
+        row["classification"] = outcome or "executable"
+        if errors:
+            row["classificationErrors"] = errors
+        if outcome is None:
+            executable.append((directory, row, plan))
+        else:
+            row["actual"] = outcome
+            row["legacyExpected"] = legacy.get(directory.name)
+            row["legacyMatch"] = outcome == legacy.get(directory.name) if directory.name in legacy else None
+        report["vectors"].append(row)
+
+    environment = dict(os.environ)
+    with tempfile.TemporaryDirectory(prefix="codegen-conformance-") as temporary:
+        work = Path(temporary)
+        (work / "tmp").mkdir()
+        environment.update(PYTHONPYCACHEPREFIX=str(work / "pycache"), TMPDIR=str(work / "tmp"),
+                           GOCACHE=str(work / "gocache"), GOMODCACHE=str(work / "gomodcache"),
+                           GOMAXPROCS="2", GOFLAGS="-p=2")
+        gate.sh = _bounded_runner(timeout, environment, report["commandFailures"])
+        projects = {lang: [] for lang in targets}
+        for directory, row, plan in executable:
+            for lang in targets:
+                project = work / directory.name / lang
+                gate.D.emit_project(plan, lang, project)
+                projects[lang].append(project)
+        build_errors = gate.build_projects(emit, projects, work)
+        if build_errors:
+            report["buildErrors"] = build_errors
+            return report, 1
+        for directory, row, _plan in executable:
+            outcome, errors = gate.execute(emit, directory, work, list(targets))
+            row["actual"] = outcome
+            row["executionErrors"] = errors
+            row["legacyExpected"] = legacy.get(directory.name)
+            row["legacyMatch"] = outcome == legacy.get(directory.name) if directory.name in legacy else None
+
+    report["sourceChangedDuringRun"] = [str(p.relative_to(Path(__file__).parent)) for p in source_paths
+        if source_hashes[str(p.relative_to(Path(__file__).parent))] != "sha256:" + hashlib.sha256(p.read_bytes()).hexdigest()]
+    check.validate_fixtures(fixtures)
+    counts = collections.Counter(row["classification"] for row in report["vectors"])
+    executions = collections.Counter(row.get("actual", "not-executed") for row in report["vectors"])
+    unpinned = [row["id"] for row in report["vectors"] if not row["legacyPinned"]]
+    legacy_mismatches = [row["id"] for row in report["vectors"] if row["legacyPinned"] and not row.get("legacyMatch")]
+    golden_mismatches = [row["id"] for row in report["vectors"] if row.get("actual") == "divergence"]
+    errors = [row["id"] for row in report["vectors"] if row.get("classificationErrors") or row.get("executionErrors")]
+    report["summary"] = {
+        "archivedWithdrawn": sum(archive.values()), "archivedBySemanticVersion": dict(sorted(archive.items())),
+        "active": len(report["vectors"]), "executable": len(executable),
+        "classifications": dict(sorted(counts.items())), "outcomes": dict(sorted(executions.items())),
+        "legacyPinned": len(report["vectors"]) - len(unpinned), "unpinned": unpinned,
+        "goldenMismatches": golden_mismatches, "legacyMismatches": legacy_mismatches,
+        "executionErrors": errors,
+    }
+    # W1: каждая строка манифеста инертности держится парой-свидетелем;
+    # строка без свидетеля, свидетель не «match» или половины пары с разными
+    # документами — отказ ворот (CODEGEN-COVERAGE-PLAN §1.1).
+    inert_table, inert_failures = inert.witness_failures(inert_manifest, report["vectors"], gate.VECTORS)
+    report["inertWitnesses"] = inert_table
+    report["summary"]["inertFailures"] = inert_failures
+    # Partial development checks can exercise new goldens before release pinning.
+    # They do not certify the full registry; an explicit registry stays strict.
+    pin_failures = [] if partial else unpinned
+    if outcomes is not None:
+        registry = json.loads(outcomes.read_text(encoding="utf-8"))
+        validate_outcomes(registry, targets)
+        digests = vector_input_digests(fixture_manifest)
+        pins = registry["vectors"]
+        mismatches, unpinned_matches, unpinned_refusals, stale = [], [], [], []
+        for row in report["vectors"]:
+            pin = pins.get(row["id"])
+            actual = row.get("actual")
+            if pin is None:
+                row["pin"] = "unpinned"
+                (unpinned_matches if actual == "match" or str(actual).startswith("structural:")
+                 else unpinned_refusals).append(row["id"])
+                continue
+            row["pin"] = "fresh" if pin["inputsSha256"] == digests.get(row["id"]) else "stale"
+            row["pinnedExpected"] = pin["outcome"]
+            if row["pin"] == "stale":
+                stale.append(row["id"])
+            if pin["outcome"] != actual:
+                mismatches.append(row["id"])
+        orphans = [] if fixture_manifest.get("selection", {}).get("mode") == "partial" else sorted(set(pins) - all_active_ids)
+        pin_failures = mismatches + unpinned_matches + unpinned_refusals + stale + orphans
+        report["orphanPinsNotChecked"] = fixture_manifest.get("selection", {}).get("mode") == "partial"
+        report["summary"]["activeRegistryMismatches"] = mismatches
+        report["summary"]["unpinnedMatches"] = unpinned_matches
+        report["summary"]["unpinnedRefusals"] = unpinned_refusals
+        report["summary"]["stalePins"] = stale
+        report["summary"]["orphanPins"] = orphans
+        report["outcomeRegistry"] = str(outcomes)
+    coverage = report["coverageFailures"]
+    legacy_failures = [] if partial or outcomes is not None else legacy_mismatches
+    return report, int(bool(pin_failures or golden_mismatches or legacy_failures or errors or report["commandFailures"]
+                            or inert_failures
+                            or coverage["duplicateCandidates"] or coverage["missingCandidates"]
+                            or coverage["unexpectedCandidates"] or report.get("unsupportedSemanticVersions")
+                            or report.get("sourceChangedDuringRun") or not report["vectors"]))
+
+
+def fixture_payload_digest(manifest: dict) -> str:
+    # Publisher provenance and local source paths may change while the exact
+    # delivered inputs stay the same. Pin every delivered path and byte hash.
+    payload = {"format": manifest.get("format"),
+               "files": sorted(({key: row[key] for key in ("path", "sha256", "bytes")}
+                                for row in manifest["files"]), key=lambda row: row["path"]),
+               "vectors": manifest.get("vectors"), "api": manifest.get("api")}
+    return "sha256:" + hashlib.sha256(json.dumps(payload, sort_keys=True,
+                                                separators=(",", ":")).encode()).hexdigest()
+
+
+REGISTRY_FORMAT = "law.codegen-active-outcomes/0.3"
+ALLOWED_OUTCOMES = ("plan: ", "query: ", "golden: ", "structural: ", "runtime: ", "capability: ")
+
+
+def vector_input_digests(manifest: dict) -> dict[str, str]:
+    """Хэш входов КАЖДОГО вектора: пути, байты и размеры его файлов в фикстуре
+    (формат реестра 0.3). Изменение или появление одного вектора красит только
+    его пин; провенанс фикстуры и чужие векторы на хэш не влияют."""
+    files = sorted(({key: row[key] for key in ("path", "sha256", "bytes")} for row in manifest["files"]),
+                   key=lambda row: row["path"])
+    out: dict[str, str] = {}
+    for entry in manifest.get("vectors") or []:
+        prefix = entry["path"].rstrip("/") + "/"
+        own = [row for row in files if row["path"].startswith(prefix)]
+        out[entry["id"]] = "sha256:" + hashlib.sha256(
+            json.dumps(own, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
+    return out
+
+
+def pin_outcome(pin) -> str | None:
+    """Исход пина: формат 0.3 — объект `{outcome, inputsSha256}`; строка
+    прежнего формата 0.2 читается ради миграции реестра."""
+    if isinstance(pin, dict):
+        return pin.get("outcome")
+    return pin if isinstance(pin, str) else None
+
+
+def validate_outcomes(registry: dict, targets: tuple[str, ...]) -> None:
+    """A reviewed active registry may add pins, never bless a crash/divergence.
+
+    Формат 0.3: реестр закреплён по хэшу входов каждого вектора, а не всей
+    фикстуры. Полнота относительно активного набора проверяется в `run`
+    поимённо: незакреплённое совпадение и расхождение с пином — отказ,
+    незакреплённый отказ и устаревший хэш при том же исходе — предупреждение.
+    """
+    if registry.get("format") != REGISTRY_FORMAT:
+        raise ValueError("invalid active outcome registry format")
+    if registry.get("semanticVersions") != sorted(ACTIVE_SEMANTICS):
+        raise ValueError("active registry semantic scope mismatch")
+    if registry.get("targets") != ["py", "ts", "go"] or not set(targets) <= set(registry["targets"]):
+        raise ValueError("active registry target scope mismatch")
+    vectors = registry.get("vectors")
+    if not isinstance(vectors, dict):
+        raise ValueError("active registry has no vector pins")
+    for ident, pin in vectors.items():
+        if not isinstance(pin, dict) or not isinstance(pin.get("inputsSha256"), str) \
+                or not pin["inputsSha256"].startswith("sha256:"):
+            raise ValueError(f"active registry pin without inputs digest: {ident}")
+        value = pin.get("outcome")
+        if not isinstance(value, str) or not (value == "match" or value.startswith(ALLOWED_OUTCOMES)):
+            raise ValueError("active registry cannot pin a crash, divergence, or unknown outcome")
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__, allow_abbrev=False)
+    parser.add_argument("--fixtures", required=True, type=Path)
+    parser.add_argument("--core-kit", required=True, type=Path)
+    parser.add_argument("--report", required=True, type=Path)
+    parser.add_argument("--targets", default="py", help="comma-separated py,ts,go")
+    parser.add_argument("--outcomes", type=Path, help="reviewed codegen-owned active outcome registry")
+    parser.add_argument("--vector", action="append", default=[], metavar="ID",
+                        help="check this exact active vector ID (repeatable; partial report)")
+    parser.add_argument("--vector-glob", action="append", default=[], metavar="PATTERN",
+                        help="check matching active vector IDs (repeatable; quote shell patterns)")
+    parser.add_argument("--timeout", type=float, default=30.0, help="seconds per generated runner command")
+    args = parser.parse_args(argv)
+    if args.timeout <= 0:
+        parser.error("--timeout must be positive")
+    started = time.perf_counter()
+    try:
+        report, status = run(args.fixtures, args.core_kit, timeout=args.timeout,
+                             targets=tuple(args.targets.split(",")), outcomes=args.outcomes,
+                             vectors=tuple(args.vector), vector_globs=tuple(args.vector_glob))
+    except Exception as exc:
+        report, status = {"format": FORMAT, "fatal": str(exc),
+                          "scope": {"mode": "partial" if args.vector or args.vector_glob else "full",
+                                    "requestedVectors": args.vector,
+                                    "requestedVectorGlobs": args.vector_glob}}, 1
+    report["elapsedSeconds"] = time.perf_counter() - started
+    _save(args.report, report)
+    summary = report.get("summary", {})
+    if "fatal" in report:
+        print("conformance: FAILED — " + report["fatal"])
+        return status
+    if report.get("scope", {}).get("mode") == "partial":
+        print(f"conformance: PARTIAL — selected {len(report['scope']['selectedVectors'])} "
+              f"of {report['scope']['totalActive']} active vectors")
+    print("conformance: active {active}; executable {executable}; withdrawn {archivedWithdrawn}; "
+          "unpinned {unpinned}; mismatches {mismatches}".format(
+              active=summary.get("active", 0), executable=summary.get("executable", 0),
+              archivedWithdrawn=summary.get("archivedWithdrawn", 0),
+              unpinned=len(summary.get("unpinned", [])), mismatches=len(summary.get("goldenMismatches", [])),
+          ))
+    if "activeRegistryMismatches" in summary:
+        print("conformance: registry 0.3 — mismatches {m}; unpinned matches {um}; unpinned refusals {ur}; "
+              "stale pins {st}; orphan pins {orph}".format(
+                  m=len(summary["activeRegistryMismatches"]), um=len(summary.get("unpinnedMatches", [])),
+                  ur=len(summary.get("unpinnedRefusals", [])), st=len(summary.get("stalePins", [])),
+                  orph=len(summary.get("orphanPins", []))))
+        for label, key in (("mismatch", "activeRegistryMismatches"), ("unpinned match", "unpinnedMatches"),
+                           ("stale pin", "stalePins")):
+            for ident in summary.get(key, [])[:20]:
+                print(f"  {label}: {ident}")
+    return status
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

arxo_codegen/check_matrix.py

@@ -0,0 +1,131 @@
+"""Bounded cross-target acceptance: runtime contract and three active models.
+
+This does not replace the complete conformance gate or Excel recalculation.
+Unavailable toolchains are reported separately and fail only when required.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+
+HERE = Path(__file__).resolve().parent
+sys.path.insert(0, str(HERE))
+import check
+import core_support
+import runtime_cert
+
+PROBES = ("ERR-E0241-SYNC-RANK-WITNESS-V02", "ERR-E0242-KEY-PER-RELATION",
+          "ERR-E0248-EXACT-BYTES-HASH-OK")
+
+
+def main(argv=None) -> int:
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("--core-kit", type=Path, required=True)
+    ap.add_argument("--fixtures", type=Path, required=True)
+    ap.add_argument("--targets", default="all")
+    ap.add_argument("--require", default="py")
+    ap.add_argument("--timeout", type=float, default=90, help="seconds per compiler/runner command")
+    ap.add_argument("--report", type=Path, required=True)
+    args = ap.parse_args(argv)
+    if args.timeout <= 0:
+        ap.error("--timeout must be positive")
+    core_support.configure_core_kit(args.core_kit)
+    core_support.validate_core_kit(args.core_kit)
+    gate = check.load_harness(args.fixtures.resolve())
+    known = gate.D.targets(protocol="runner")
+    wanted = known if args.targets == "all" else args.targets.split(",")
+    required = set(filter(None, args.require.split(",")))
+    if not wanted or len(set(wanted)) != len(wanted) or set(wanted) - set(known) or required - set(wanted):
+        ap.error("targets must be unique known runner targets and include --require")
+    vectors = {p.name: (p, layer) for p, layer in gate.candidates() if p.name in PROBES}
+    if set(vectors) != set(PROBES):
+        raise RuntimeError("acceptance probes missing from fixture kit")
+
+    command_failures = []
+    cache_env = dict(os.environ)
+
+    def bounded(cmd, cwd=None):
+        try:
+            result = subprocess.run(cmd, cwd=cwd, env=cache_env, text=True, capture_output=True, timeout=args.timeout)
+        except subprocess.TimeoutExpired:
+            result = subprocess.CompletedProcess(cmd, 124, "", f"timeout after {args.timeout}s")
+        except OSError as exc:
+            result = subprocess.CompletedProcess(cmd, 127, "", str(exc))
+        if result.returncode:
+            command_failures.append({"command": list(map(str, cmd)), "returncode": result.returncode,
+                                     "output": (result.stdout + result.stderr)[:4000]})
+        return result
+
+    gate.sh = bounded
+    report = {"format": "law.codegen-matrix/0.1", "scope": "runtime-cert-and-three-active-models",
+              "probes": list(PROBES), "targets": {}, "xlsx": "not-in-runner-matrix"}
+
+    def save():
+        args.report.parent.mkdir(parents=True, exist_ok=True)
+        args.report.write_text(json.dumps(report, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
+
+    with tempfile.TemporaryDirectory(prefix="codegen-matrix-") as tmp:
+        work = Path(tmp)
+        cache_env.update(GOCACHE=str(work / "go-cache"),
+                         CLANG_MODULE_CACHE_PATH=str(work / "clang-cache"),
+                         SWIFT_MODULECACHE_PATH=str(work / "swift-cache"))
+        for lang in wanted:
+            command_failures.clear()
+            em = gate.D.emitter(lang)
+            available, reason = em.available()
+            if not available:
+                report["targets"][lang] = {"status": "unavailable", "reason": reason}
+                print(f"matrix: {lang}: unavailable — {reason}", flush=True)
+                save()
+                continue
+            print(f"matrix: {lang}: checking ({reason})", flush=True)
+            active = {lang: em}
+            target_work = work / lang
+            errors = gate.version_probe(active)
+            runtime_report = {}
+            try:
+                runtime_report, cert_errors = runtime_cert.certify_target(
+                    lang, em, target_work, gate.CERT, gate.D.emit_project,
+                    gate.build_projects, gate.run_target,
+                )
+                errors += cert_errors
+            except runtime_cert.FixtureError as exc:
+                errors.append(f"сертификация {lang}: неверный capability-контракт: {exc}")
+            outcomes = {}
+            if not errors:
+                projects = []
+                for name in PROBES:
+                    directory, layer = vectors[name]
+                    outcome, plan, problems = gate.classify(directory, set(getattr(em, "QUERY_KINDS", {"truth"})), active, layer)
+                    if outcome is not None or problems:
+                        errors.append(f"{name}: not executable: {outcome}; {problems}")
+                        continue
+                    project = target_work / name / lang
+                    gate.D.emit_project(plan, lang, project)
+                    projects.append(project)
+                if not errors:
+                    errors += gate.build_projects(active, {lang: projects}, target_work)
+                if not errors:
+                    for name in PROBES:
+                        outcome, problems = gate.execute(active, vectors[name][0], target_work, [lang])
+                        outcomes[name] = outcome
+                        errors += problems
+                        if outcome != "match":
+                            errors.append(f"{name}: expected match, got {outcome}")
+            report["targets"][lang] = {"status": "fail" if errors else "pass", "toolchain": reason,
+                "runtimeCases": len(runtime_report.get("checkedFixtureIds", [])),
+                "runtimeCertification": runtime_report,
+                "modelOutcomes": outcomes, "errors": errors, "failedCommands": list(command_failures)}
+            print(f"matrix: {lang}: {report['targets'][lang]['status']}", flush=True)
+            save()
+    return int(any(row["status"] == "fail" or (lang in required and row["status"] != "pass")
+                   for lang, row in report["targets"].items()))
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())