arxo-codegen 0.4.0__py3-none-any.whl

arxo_codegen/check_packages.py

@@ -0,0 +1,281 @@
+"""Пакеты трёх целей против плоского API на проверенном комплекте (DECISION-0423 §2.7).
+
+Шаг приёмки шага 5: для API-пакетов комплекта (`corpus/clir`) печатается
+устанавливаемый пакет каждой цели (`package.py`) и ставится так, как его
+получит потребитель: Python — каталогом пакета из `src/` на пути импорта,
+TypeScript — тарболом `npm pack`, установленным без сети, Go — модулем-
+потребителем с `replace`. Задания `check_api` исполняются через
+опубликованную поверхность пакета (реестры вопросов и входов) и обязаны дать
+те же исходы, что плоское API Python; пример из README пакета обязан
+исполниться; паспорт пакета называет семантический хэш канона.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+from pathlib import Path
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+import tomllib
+
+HERE = Path(__file__).resolve().parent
+sys.path.insert(0, str(HERE))
+
+FENCE = {"py": "python", "ts": "ts", "go": "go"}
+GO_EXPORTED = ("TermFromNode", "Inputs", "Negated", "Questions", "CallOptions", "RefusedError", "Fact")
+
+
+def _names(lang: str, name: str) -> dict:
+    """Имена пакета проверки: семья имён производной не выбрана (§6), поэтому
+    приёмка берёт нейтральные имена, не занимающие ничего в реестрах."""
+    return {"py": {"name": f"codegen-check-{name}"},
+            "ts": {"name": f"@codegen-check/{name}"},
+            "go": {"name": name, "module": f"example.com/codegen-check/{name}"}}[lang]
+
+
+def _example(readme: str, lang: str) -> str | None:
+    hit = re.search(rf"```{FENCE[lang]}\n(.*?)```", readme, re.S)
+    return hit.group(1) if hit else None
+
+
+def _run(cmd: list, cwd: Path, env: dict | None = None, timeout: float = 600) -> subprocess.CompletedProcess:
+    return subprocess.run([str(c) for c in cmd], cwd=cwd, env=env, capture_output=True, text=True,
+                          timeout=timeout, check=False)
+
+
+def _batch(gate, res: subprocess.CompletedProcess) -> tuple[str, object]:
+    """Разбор ответа харнесса как у `_api_batch` ворот: исход задания —
+    ('answer', ключ) либо ('refused', текст)."""
+    if res.returncode != 0:
+        return "crash", f"код {res.returncode}: {gate.crash_line(res.stderr or res.stdout)}"
+    try:
+        out = json.loads(res.stdout)
+        return "answers", [("refused", a["refused"]) if "refused" in a else ("answer", gate.answer_key(a))
+                           for a in out["answers"]]
+    except (ValueError, KeyError, TypeError):
+        return "crash", f"ответ пакета не JSON: {res.stdout[:200]!r}"
+
+
+def consume_py(gate, em, pkg: Path, consumer: Path, bpath: Path) -> tuple[tuple, subprocess.CompletedProcess | None]:
+    import package as PK
+    project = tomllib.loads((pkg / "pyproject.toml").read_text(encoding="utf-8"))["project"]
+    imp = PK.py_import_name(project["name"])
+    site = consumer / "site"
+    shutil.copytree(pkg / "src" / imp, site / imp)
+    harness = (Path(em.__file__).parent / "apicheck.py").read_text(encoding="utf-8")
+    harness = PK.rewrite(harness, [("import runtime as RT", f"from {imp}._internal import runtime as RT"),
+                                   ("import api ", f"import {imp} as api ")], "apicheck.py")
+    (consumer / "apicheck.py").write_text(harness, encoding="utf-8")
+    env = dict(os.environ, PYTHONPATH=str(site))
+    answers = _batch(gate, _run([sys.executable, consumer / "apicheck.py", bpath], consumer, env))
+    sample = _example((pkg / "README.md").read_text(encoding="utf-8"), "py")
+    if sample is None:
+        return answers, None
+    (consumer / "example.py").write_text(sample, encoding="utf-8")
+    return answers, _run([sys.executable, consumer / "example.py"], consumer, env)
+
+
+def consume_ts(gate, em, pkg: Path, consumer: Path, bpath: Path) -> tuple[tuple, subprocess.CompletedProcess | None]:
+    npm = shutil.which("npm")
+    modules = em.toolchain()
+    name = json.loads((pkg / "package.json").read_text(encoding="utf-8"))["name"]
+    consumer.mkdir(parents=True, exist_ok=True)
+    packed = _run([npm, "pack", pkg, "--silent", "--pack-destination", consumer], consumer)
+    if packed.returncode:
+        return ("crash", "npm pack: " + gate.crash_line(packed.stderr or packed.stdout)), None
+    tarball = consumer / packed.stdout.strip().splitlines()[-1]
+    (consumer / "package.json").write_text('{"name": "consumer", "private": true}\n', encoding="utf-8")
+    installed = _run([npm, "install", "--offline", "--no-audit", "--no-fund", "--silent", tarball], consumer)
+    if installed.returncode:
+        return ("crash", "npm install: " + gate.crash_line(installed.stderr or installed.stdout)), None
+    base = f"./node_modules/{name}/dist/internal"
+    harness = (Path(em.__file__).parent / "apicheck.ts").read_text(encoding="utf-8")
+    for old, new in (('from "./runtime"', f'from "{base}/runtime"'), ('from "./apiBase"', f'from "{base}/apiBase"'),
+                     ('from "./api"', f'from "{name}"'), ('from "./evaluate"', f'from "{base}/evaluate"')):
+        if harness.count(old) != 1:
+            return ("crash", f"apicheck.ts: ожидался один импорт {old}"), None
+        harness = harness.replace(old, new)
+    (consumer / "apicheck.ts").write_text(harness, encoding="utf-8")
+    sample = _example((pkg / "README.md").read_text(encoding="utf-8"), "ts")
+    files = ["apicheck.ts"]
+    if sample is not None:
+        (consumer / "example.ts").write_text(sample, encoding="utf-8")
+        files.append("example.ts")
+    built = _run([modules / ".bin" / "tsc", "--target", "es2022", "--module", "commonjs", "--strict",
+                  "--typeRoots", modules / "@types", "--types", "node", *files], consumer)
+    if built.returncode:
+        return ("crash", "tsc потребителя: " + (built.stdout + built.stderr)[:600]), None
+    # JS рядом с исходником: относительный путь в node_modules верен и для tsc, и для node.
+    answers = _batch(gate, _run(["node", consumer / "apicheck.js", bpath], consumer))
+    return answers, (_run(["node", consumer / "example.js"], consumer) if sample is not None else None)
+
+
+def consume_go(gate, em, pkg: Path, consumer: Path, bpath: Path, module: str) -> tuple[tuple, subprocess.CompletedProcess | None]:
+    consumer.mkdir(parents=True, exist_ok=True)
+    (consumer / "go.mod").write_text(f"module consumer\n\ngo {em.TOOLCHAIN_MIN}\n\nrequire {module} v0.0.0\n\n"
+                                     f"replace {module} => {pkg}\n", encoding="utf-8")
+    harness = (Path(em.__file__).parent / "apicheck.go").read_text(encoding="utf-8")
+    harness = harness.replace("//go:build apicheck\n\n", "", 1)
+    harness, count = re.subn(r'(\t"sync"\n)\)', rf'\1\n\tlib "{module}"\n)', harness, count=1)
+    if count != 1:
+        return ("crash", "apicheck.go: блок импортов незнаком"), None
+    for ident in GO_EXPORTED:
+        harness = re.sub(rf"(?<![\w.]){ident}\b", f"lib.{ident}", harness)
+    harness += ("\nfunc asList(v interface{}) []interface{} {\n\tl, _ := v.([]interface{})\n\treturn l\n}\n")
+    (consumer / "apicheck").mkdir()
+    (consumer / "apicheck" / "main.go").write_text(harness, encoding="utf-8")
+    env = dict(os.environ, GOFLAGS="-mod=mod")
+    built = _run(["go", "build", "-o", consumer / "bin" / "apicheck", "./apicheck"], consumer, env)
+    if built.returncode:
+        return ("crash", "go build харнесса: " + (built.stdout + built.stderr)[:600]), None
+    answers = _batch(gate, _run([consumer / "bin" / "apicheck", bpath], consumer, env))
+    sample = _example((pkg / "README.md").read_text(encoding="utf-8"), "go")
+    if sample is None:
+        return answers, None
+    (consumer / "example").mkdir()
+    (consumer / "example" / "main.go").write_text(sample, encoding="utf-8")
+    built = _run(["go", "build", "-o", consumer / "bin" / "example", "./example"], consumer, env)
+    if built.returncode:
+        return answers, built
+    return answers, _run([consumer / "bin" / "example"], consumer, env)
+
+
+SPOIL = ('evaluation_status=doc["evaluationStatus"], issues=tuple(doc["issues"])',
+         'evaluation_status="COMPUTED", issues=()')
+
+
+def canary_py(gate, consumer: Path, bpath: Path, reference: list, name: str) -> list[str]:
+    """Канарейка: в установленном пакете Python общая часть API отвечает
+    `COMPUTED` без issues вместо ответа `evaluate`. На заданиях с литералом
+    чужого типа эталон — `TYPE_ERROR`, поэтому исходы обязаны разойтись —
+    иначе шаг не видит того, что отвечает опубликованная поверхность."""
+    bases = list((consumer / "site").glob("*/_internal/api_base.py"))
+    if len(bases) != 1:
+        return [f"пакет {name}: канарейке нечего портить — нет _internal/api_base.py"]
+    text = bases[0].read_text(encoding="utf-8")
+    if SPOIL[0] not in text:
+        return [f"пакет {name}: канарейка не нашла, что портить в api_base.py"]
+    bases[0].write_text(text.replace(*SPOIL), encoding="utf-8")
+    try:
+        env = dict(os.environ, PYTHONPATH=str(consumer / "site"))
+        kind, outs = _batch(gate, _run([sys.executable, consumer / "apicheck.py", bpath], consumer, env))
+    finally:
+        bases[0].write_text(text, encoding="utf-8")
+    if kind == "answers" and outs == reference:
+        return [f"пакет {name}: канарейка — порча статуса и issues в пакете не видна шагу"]
+    return []
+
+
+def package_check(gate, emit: dict, active: list[str], work: Path) -> tuple[list[str], int]:
+    import package as PK
+    P, D = gate.P, gate.D
+    problems, checked = [], 0
+    for name in gate.API_PACKAGES + gate.API_PACKAGES_L1:
+        path = gate.CLIR / f"{name}.lawir.json"
+        if not path.exists():
+            problems.append(f"пакет {name}: снимка нет")
+            continue
+        ir = json.loads(path.read_text(encoding="utf-8"))
+        world = P.resolve_world(ir, P.world_index(gate.ROOT)) if ir.get("imports") else []
+        pl = P.build_plan(ir, world)
+        jobs = gate.api_jobs(pl)
+        root = work / name
+        root.mkdir(parents=True)
+        for j, job in enumerate(jobs):
+            job["queryId"] = f"urn:query:apicheck:{j}"
+        bpath = root / "batch.json"
+        bpath.write_text(json.dumps({"batch": jobs, "concurrent": False}, ensure_ascii=False), encoding="utf-8")
+        # Эталон — плоское API Python: его с раннером всех целей уже сверил check_api.
+        flat = root / "flat-py"
+        D.emit_project(pl, "py", flat)
+        shutil.copyfile(Path(emit["py"].__file__).parent / "apicheck.py", flat / "apicheck.py")
+        kind, reference = gate._api_batch(emit["py"], flat, bpath)
+        if kind == "crash":
+            problems.append(f"пакет {name}: плоское API Python — КРАХ {reference}")
+            continue
+        digest = D.semantic_hash(ir)
+        for lang in active:
+            names = _names(lang, name)
+            pkg = root / lang / "package"
+            try:
+                passport = PK.package(ir, lang, pkg, name=names["name"], version="0.0.0",
+                                      module=names.get("module"), world=world)
+            except (PK.PackageError, P.Refused) as exc:
+                problems.append(f"пакет {name}/{lang}: упаковка отказала — {exc}")
+                continue
+            if passport["semanticHash"] != digest:
+                problems.append(f"пакет {name}/{lang}: паспорт называет чужой семантический хэш")
+            consumer = root / lang / "consumer"
+            consumer.mkdir(parents=True, exist_ok=True)
+            if lang == "py":
+                (kind, outs), sample = consume_py(gate, emit[lang], pkg, consumer, bpath)
+            elif lang == "ts":
+                (kind, outs), sample = consume_ts(gate, emit[lang], pkg, consumer, bpath)
+            else:
+                (kind, outs), sample = consume_go(gate, emit[lang], pkg, consumer, bpath, names["module"])
+            if kind == "crash":
+                problems.append(f"пакет {name}/{lang}: КРАХ {outs}")
+                continue
+            if outs != reference:
+                diff = [j for j, (a, b) in enumerate(zip(outs, reference)) if a != b]
+                problems.append(f"пакет {name}/{lang}: исходы разошлись с плоским API, задания {diff[:8]}"
+                                + ("" if len(outs) == len(reference) else f", ответов {len(outs)} из {len(reference)}"))
+            else:
+                checked += len(outs)
+            if lang == "py":
+                problems += canary_py(gate, consumer, bpath, reference, name)
+            if sample is None:
+                problems.append(f"пакет {name}/{lang}: в README нет исполняемого примера")
+            elif sample.returncode:
+                problems.append(f"пакет {name}/{lang}: пример README упал — {gate.crash_line(sample.stderr or sample.stdout)}")
+    return problems, checked
+
+
+def main(argv: list[str] | None = None) -> int:
+    ap = argparse.ArgumentParser(description=__doc__, allow_abbrev=False)
+    ap.add_argument("--fixtures", required=True, type=Path)
+    ap.add_argument("--core-kit", required=True, type=Path)
+    ap.add_argument("--targets", default="py,ts,go", help="цели пакетов через запятую")
+    ap.add_argument("--require", default="", help="цели, отсутствие тулчейна которых — отказ")
+    ap.add_argument("--keep", type=Path, help="сохранить пакеты и потребителей")
+    args = ap.parse_args(argv)
+    import core_support
+    core_support.configure_core_kit(args.core_kit)
+    core_support.validate_core_kit(args.core_kit)
+    import check
+    gate = check.load_harness(args.fixtures.resolve())
+    wanted = [x for x in args.targets.split(",") if x]
+    emit = {lang: gate.D.emitter(lang) for lang in {"py", *wanted}}
+    tools = {lang: emit[lang].available() for lang in wanted}
+    if "ts" in tools and tools["ts"][0] and not shutil.which("npm"):
+        tools["ts"] = (False, "нет npm для npm pack")
+    active = [lang for lang in wanted if tools[lang][0]]
+    for lang in wanted:
+        if not tools[lang][0]:
+            print(f"check_packages: цель {lang} ПРОПУЩЕНА — {tools[lang][1]}")
+    missing = [x for x in args.require.split(",") if x and x not in active]
+    if missing:
+        print(f"check_packages: обязательные цели без тулчейна: {', '.join(missing)}")
+        return 1
+    if not active:
+        print("check_packages: нет ни одной цели с тулчейном")
+        return 1
+    if args.keep:
+        work = args.keep.resolve()
+        work.mkdir(parents=True, exist_ok=True)
+        problems, checked = package_check(gate, emit, active, work)
+    else:
+        with tempfile.TemporaryDirectory(prefix="codegen-packages-") as tmp:
+            problems, checked = package_check(gate, emit, active, Path(tmp))
+    for line in problems:
+        print("check_packages: " + line)
+    print(f"check_packages: цели {', '.join(active)}; сверено заданий {checked}; проблем {len(problems)}")
+    return 1 if problems or not checked else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

arxo_codegen/check_semantic_probes.py

@@ -0,0 +1,293 @@
+"""Verify the published E-0195/E-0202 semantic-probe delivery.
+
+The delivery is deliberately self-contained: this checker only needs the
+published CLIR documents and a validated codegen core kit.  It does not import
+lawref or a monorepo CI harness.
+"""
+from __future__ import annotations
+
+import argparse
+import os
+import hashlib
+import json
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+
+HERE = Path(__file__).resolve().parent
+if str(HERE) not in sys.path:
+    sys.path.insert(0, str(HERE))
+
+import core_support  # noqa: E402
+import deliver as D  # noqa: E402
+import plan as P  # noqa: E402
+import target_runner as T  # noqa: E402
+from check_active_canaries import CanaryError  # noqa: E402
+
+
+FORMAT = "law.codegen-semantic-probes/0.1"
+SEMANTIC = "0.2.11"
+FILES = frozenset({
+    "ir.json", "case.json", "query.json", "mutation.json", "oracle.json",
+    "baseline.json", "mutated.json",
+})
+E0195 = {
+    "empty-mismatch": ("absent", "urn:law:std#Integer", "urn:law:std#Money", True),
+    "empty-match": ("absent", "urn:law:std#Money", "urn:law:std#Integer", True),
+    "nonempty-mismatch": ("order_amount", "urn:law:std#Integer", "urn:law:std#Money", False),
+}
+E0202 = {
+    "i64-max": 2 ** 63 - 1,
+    "i64-min": -(2 ** 63),
+    "i64-over": 2 ** 63,
+    "i64-under": -(2 ** 63) - 1,
+    "i64-float": 1.5,
+}
+REQUIRED = frozenset(E0195) | frozenset(E0202)
+
+
+
+def _sha(data: bytes) -> str:
+    return "sha256:" + hashlib.sha256(data).hexdigest()
+
+
+
+def _read_json(path: Path) -> dict:
+    try:
+        value = json.loads(path.read_bytes())
+    except (OSError, UnicodeDecodeError, json.JSONDecodeError) as exc:
+        raise CanaryError(f"invalid JSON: {path.name}") from exc
+    if not isinstance(value, dict):
+        raise CanaryError(f"JSON object required: {path.name}")
+    return value
+
+
+
+def _probe_id(value: object) -> str:
+    if not isinstance(value, str) or value not in REQUIRED:
+        raise CanaryError("unknown semantic probe id")
+    return value
+
+
+
+def _type_name(query: dict) -> str | None:
+    try:
+        value = query["term"]["options"]["empty"]
+        return value["type"]["name"]
+    except (KeyError, TypeError):
+        return None
+
+
+
+def _predicate(query: dict) -> str | None:
+    try:
+        return query["term"]["input"]["generator"]["formula"]["predicate"]
+    except (KeyError, TypeError):
+        return None
+
+
+
+def _validate_policy(ident: str, row: dict, base: Path) -> None:
+    """Check the named witness, not only its hash inventory."""
+    migration = row.get("migration")
+    if (not isinstance(migration, dict) or set(migration) != {"field", "from", "to", "rationale"}
+            or any(not isinstance(migration[key], str) or not migration[key].strip() for key in migration)):
+        raise CanaryError(f"{ident}: migration provenance is missing")
+    query = _read_json(base / "query.json")
+    mutation = _read_json(base / "mutation.json")
+    if ident in E0195:
+        predicate, policy, mutation_policy, changes = E0195[ident]
+        expected_predicate = "urn:law:vectors:err-e0195#" + predicate
+        if (_predicate(query) != expected_predicate or _predicate(mutation) != expected_predicate
+                or _type_name(query) != policy or _type_name(mutation) != mutation_policy):
+            raise CanaryError(f"{ident}: invalid E0195 empty-policy witness")
+        if row.get("kind") != "E0195" or row.get("mutationChanges") is not changes:
+            raise CanaryError(f"{ident}: invalid E0195 mutation policy")
+        return
+    value = E0202[ident]
+    try:
+        query_value = query["term"]["value"]
+        mutation_value = mutation["term"]["value"]
+    except (KeyError, TypeError) as exc:
+        raise CanaryError(f"{ident}: invalid E0202 term witness") from exc
+    # Equality alone would accept a float representation of a 64-bit integer.
+    if (type(query_value) is not type(value) or query_value != value
+            or type(mutation_value) is not type(value) or mutation_value != value
+            or mutation != query):
+        raise CanaryError(f"{ident}: invalid E0202 canonical number witness")
+    if row.get("kind") != "E0202" or row.get("mutationChanges") is not False:
+        raise CanaryError(f"{ident}: invalid E0202 mutation policy")
+
+
+
+def load(bundle: Path) -> tuple[Path, list[dict]]:
+    """Validate a complete, regular-file-only semantic-probe bundle."""
+    supplied = Path(bundle)
+    if supplied.is_symlink() or not supplied.is_dir():
+        raise CanaryError("semantic-probe bundle is not a directory")
+    bundle = supplied.resolve()
+    if any(path.is_symlink() for path in bundle.rglob("*")):
+        raise CanaryError("semantic-probe bundle contains a symlink")
+    manifest = _read_json(bundle / "manifest.json")
+    if manifest.get("format") != FORMAT or manifest.get("semanticVersion") != SEMANTIC:
+        raise CanaryError("unsupported semantic-probe bundle format or semantic version")
+    rows = manifest.get("probes")
+    if not isinstance(rows, list) or len(rows) != len(REQUIRED):
+        raise CanaryError("semantic-probe inventory is incomplete")
+
+    known = {"manifest.json"}
+    seen: set[str] = set()
+    checked: list[dict] = []
+    for row in rows:
+        if not isinstance(row, dict):
+            raise CanaryError("invalid semantic-probe row")
+        ident = _probe_id(row.get("id"))
+        if ident in seen:
+            raise CanaryError("duplicate semantic-probe id")
+        seen.add(ident)
+        files = row.get("files")
+        if not isinstance(files, dict) or set(files) != FILES:
+            raise CanaryError(f"{ident}: invalid probe file inventory")
+        prefix = Path("probes") / ident
+        for name, digest in files.items():
+            if not isinstance(digest, str) or not digest.startswith("sha256:"):
+                raise CanaryError(f"{ident}: invalid probe hash")
+            path = bundle / prefix / name
+            if path.is_symlink() or not path.is_file() or digest != _sha(path.read_bytes()):
+                raise CanaryError(f"{ident}: probe file hash mismatch")
+            known.add((prefix / name).as_posix())
+        _validate_policy(ident, row, bundle / prefix)
+        checked.append(row)
+    if seen != REQUIRED:
+        raise CanaryError("semantic-probe inventory is incomplete")
+    actual = {path.relative_to(bundle).as_posix() for path in bundle.rglob("*") if path.is_file()}
+    if actual != known:
+        raise CanaryError("semantic-probe bundle inventory differs from manifest")
+    return bundle, sorted(checked, key=lambda row: row["id"])
+
+
+
+def _wire(document: dict) -> dict:
+    """The published normative wire shape, excluding runner-local queryId."""
+    if "refused" in document:
+        refusal = document["refused"]
+        if not isinstance(refusal, str):
+            raise CanaryError("generated Python runner returned invalid refusal")
+        return {"refused": refusal}
+    results = document.get("results") or [{}]
+    if not isinstance(results, list) or not results or not isinstance(results[0], dict):
+        raise CanaryError("generated Python runner returned invalid results")
+    issues = document.get("issues", [])
+    if not isinstance(issues, list):
+        raise CanaryError("generated Python runner returned invalid issues")
+    result = results[0]
+    wire: dict = {}
+    for key in ("resultKind", "truthStatus", "evaluationStatus", "value"):
+        value = result.get(key, document.get(key))
+        if value is not None:
+            wire[key] = value
+    wire["issues"] = [item.get("code") if isinstance(item, dict) else item for item in issues]
+    return wire
+
+
+
+def _response(kind: str, payload: object, target: str) -> dict:
+    """Validate the common runner exit protocol and retain the normative wire."""
+    if kind == "crash":
+        raise CanaryError(f"generated {target} runner crashed: {payload}")
+    if kind == "refused":
+        if not isinstance(payload, str):
+            raise CanaryError(f"generated {target} runner returned invalid refusal")
+        return {"refused": payload}
+    if kind != "answer" or not isinstance(payload, dict):
+        raise CanaryError(f"generated {target} runner returned invalid response")
+    if "refused" in payload:
+        raise CanaryError(f"generated {target} runner returned refusal with success status")
+    return _wire(payload)
+
+
+def _targets(value: tuple[str, ...]) -> tuple[str, ...]:
+    known = set(D.targets(protocol="runner"))
+    if not value or len(set(value)) != len(value) or any(target not in known for target in value):
+        raise CanaryError("targets must be unique known runner targets")
+    unavailable = []
+    for target in value:
+        available, reason = D.emitter(target).available()
+        if not available:
+            unavailable.append(f"{target} ({reason})")
+    if unavailable:
+        raise CanaryError("required semantic-probe targets unavailable: " + ", ".join(unavailable))
+    return value
+
+
+def verify(bundle: Path, core_kit: Path, *, targets: tuple[str, ...] = ("py",)) -> list[str]:
+    previous = core_support._configured_kit
+    core_support.configure_core_kit(core_kit)
+    try:
+        core_support.validate_core_kit(core_kit)
+        bundle, rows = load(bundle)
+        targets = _targets(targets)
+        emit = {target: D.emitter(target) for target in targets}
+        prepared = []
+        for row in rows:
+            ident = row["id"]
+            base = bundle / "probes" / ident
+            prepared.append((row, base, P.build_plan(_read_json(base / "ir.json"), resources={})))
+        with tempfile.TemporaryDirectory(prefix="codegen-semantic-probes-") as temporary:
+            work = Path(temporary)
+            environment = dict(os.environ, GOCACHE=str(work / "go-cache"),
+                               CLANG_MODULE_CACHE_PATH=str(work / "clang-cache"),
+                               SWIFT_MODULECACHE_PATH=str(work / "swift-cache"))
+            projects = {target: [] for target in targets}
+            for row, _base, plan in prepared:
+                for target in targets:
+                    project = work / row["id"] / target
+                    D.emit_project(plan, target, project)
+                    projects[target].append(project)
+            failures = T.build_projects(emit, projects, work, environment)
+            if failures:
+                raise CanaryError("semantic-probe build failed: " + "\n".join(failures))
+            messages: list[str] = []
+            for row, base, _plan in prepared:
+                ident = row["id"]
+                oracle = _read_json(base / "oracle.json")
+                frozen_baseline = _read_json(base / "baseline.json")
+                frozen_mutated = _read_json(base / "mutated.json")
+                for target in targets:
+                    descriptor = emit[target]
+                    project = work / ident / target
+                    baseline = _response(*T.run_target(descriptor, project, "runner",
+                                                       [str(base / "case.json"), str(base / "query.json")], environment), target)
+                    mutated = _response(*T.run_target(descriptor, project, "runner",
+                                                      [str(base / "case.json"), str(base / "mutation.json")], environment), target)
+                    if baseline != oracle or baseline != frozen_baseline:
+                        raise CanaryError(f"{ident}/{target}: baseline differs from frozen evidence")
+                    if mutated != frozen_mutated:
+                        raise CanaryError(f"{ident}/{target}: mutation differs from frozen evidence")
+                    if row["mutationChanges"] and mutated == baseline:
+                        raise CanaryError(f"{ident}/{target}: mutation witness did not change the result")
+                messages.append(f"PASS {ident} ({','.join(targets)})")
+        return messages
+    finally:
+        core_support.configure_core_kit(previous)
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--bundle", type=Path, required=True)
+    parser.add_argument("--core-kit", type=Path, required=True)
+    parser.add_argument("--targets", default="py", help="required runner targets, comma-separated")
+    args = parser.parse_args(argv)
+    try:
+        targets = tuple(target for target in args.targets.split(",") if target)
+        for message in verify(args.bundle, args.core_kit, targets=targets):
+            print(message)
+    except (CanaryError, core_support.CoreKitError, P.Refused) as exc:
+        print(f"FAIL: {exc}", file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())