deepstrike 0.2.63__tar.gz → 0.2.65__tar.gz

{deepstrike-0.2.63 → deepstrike-0.2.65}/Cargo.lock

@@ -254,7 +254,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-core"
-version = "0.2.63"
+version = "0.2.65"
 dependencies = [
  "compact_str",
  "deepstrike-tokenizer",
@@ -268,7 +268,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-node"
-version = "0.2.63"
+version = "0.2.65"
 dependencies = [
  "compact_str",
  "deepstrike-core",
@@ -280,7 +280,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-py"
-version = "0.2.63"
+version = "0.2.65"
 dependencies = [
  "compact_str",
  "deepstrike-core",
@@ -291,7 +291,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-sdk"
-version = "0.2.63"
+version = "0.2.65"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -327,7 +327,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-tokenizer"
-version = "0.2.63"
+version = "0.2.65"
 dependencies = [
  "pretty_assertions",
  "tiktoken-rs",
@@ -335,7 +335,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-wasm"
-version = "0.2.63"
+version = "0.2.65"
 dependencies = [
  "compact_str",
  "deepstrike-core",

{deepstrike-0.2.63 → deepstrike-0.2.65}/Cargo.toml

@@ -3,13 +3,13 @@ resolver = "2"
 members = ["crates/deepstrike-core", "crates/deepstrike-tokenizer", "crates/deepstrike-py"]
 
 [workspace.package]
-version = "0.2.63"
+version = "0.2.65"
 edition = "2024"
 repository = "https://github.com/kongusen/deepstrike"
 
 [workspace.dependencies]
-deepstrike-core = { path = "crates/deepstrike-core", version = "0.2.63" }
-deepstrike-tokenizer = { path = "crates/deepstrike-tokenizer", version = "0.2.63" }
+deepstrike-core = { path = "crates/deepstrike-core", version = "0.2.65" }
+deepstrike-tokenizer = { path = "crates/deepstrike-tokenizer", version = "0.2.65" }
 notify = "6"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

{deepstrike-0.2.63 → deepstrike-0.2.65}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deepstrike
-Version: 0.2.63
+Version: 0.2.65
 Requires-Dist: httpx>=0.27
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: anyio>=4.0

deepstrike-0.2.65/crates/deepstrike-core/src/bin/ds-chain-validator.rs

@@ -0,0 +1,375 @@
+//! `ds-chain-validator` — the P7-S5 chain validator CLI: rules C1–C4 (batch 1), C6/C8
+//! (batch 3, SessionLog plane), C5 (batch 2, checkpoint plane).
+//!
+//! Host-ops tooling: CI gates and incident triage run the same knife. Input is a journal prefix
+//! — a sequence of kernel record blobs — grouped into per-operation chain segments, each judged
+//! independently. Record bytes are passed through untouched: a verdict is about the bytes the
+//! host durably wrote, never about a re-serialization.
+//!
+//! Exit codes (P7 §3.2): `0` every check green (degraded hops and deferred scope do not count
+//! against green), `1` a violation was proven, `2` the evidence was insufficient (nothing
+//! judgeable, or unparseable blobs and no proven violation). `64` is a usage error.
+//!
+//! Journal input forms, per `--journal` path:
+//! - a directory: every `*.json` file inside (name-sorted), each file one record;
+//! - a file holding one JSON object: one record;
+//! - a file holding a JSON array: its elements, one record each;
+//! - anything else: JSON Lines — one record per non-empty line.
+//!
+//! SessionLog input forms (batch 3), per `--session-log` path:
+//! - a directory: every `*.json`/`*.jsonl` file inside (name-sorted), each file one session
+//!   stream — events keep the file's append order, and streams never cross-join;
+//! - a file: one stream — a JSON object (one event), a JSON array (one event per element), or
+//!   JSON Lines (one event per non-empty line).
+//!
+//! Checkpoint input forms (batch 2), per `--checkpoint` path — same shapes as the journal:
+//! a directory of `*.json` checkpoints, a JSON object (one checkpoint), a JSON array, or JSON
+//! Lines. A golden-fixture wrapper (a JSON object holding a nested `checkpoint` document
+//! beside its ack/restore metadata) is unwrapped automatically. Without this plane C5 is
+//! deferred, not red; `--strict` arms the re-plan replay.
+
+use std::path::{Path, PathBuf};
+use std::process::ExitCode;
+
+use deepstrike_core::runtime::chain_validator::{
+    ValidationReport, Verdict, validate_journal, validate_with_checkpoint,
+};
+
+const USAGE: &str = "Usage: ds-chain-validator [--journal <path>...] [--session-log <path>...] \
+                     [--checkpoint <path>...] [--strict] [--format human|json]\n\
+                     \x20                    (at least one evidence plane is required)\n\
+                     \n\
+                     Validates a kernel journal prefix against P2 §5 rules C1–C5, marking\n\
+                     degraded evidence per C7. With --session-log, the batch-3 cross-checks\n\
+                     (C6/C8) join the SessionLog evidence plane against the journal. With\n\
+                     --checkpoint, the batch-2 rule (C5) anchors each checkpoint against the\n\
+                     journal: genesis/covered-head/tail digests (C5a) and the launch-token\n\
+                     ledger (C5b).\n\
+                     Exit codes: 0 = all green, 1 = violation proven, 2 = evidence insufficient.\n\
+                     \n\
+                     --journal <path>     record source: directory of *.json records, a JSON\n\
+                     \x20                    object/array file, or a JSONL file (repeatable)\n\
+                     --session-log <path> session-log source: a directory (each *.json/*.jsonl\n\
+                     \x20                    file is one append-ordered stream) or a single\n\
+                     \x20                    stream file — object/array/JSONL (repeatable)\n\
+                     --checkpoint <path>  checkpoint source: directory of *.json checkpoints,\n\
+                     \x20                    a JSON object/array file, or a JSONL file\n\
+                     \x20                    (repeatable; golden-fixture wrappers holding a\n\
+                     \x20                    nested `checkpoint` are unwrapped). Omit it and\n\
+                     \x20                    C5 is deferred, not red\n\
+                     --strict             with --checkpoint: re-plan the journal prefix from\n\
+                     \x20                    genesis through the covered step and require the\n\
+                     \x20                    re-derived state digest and launch-token ledger to\n\
+                     \x20                    match the checkpoint (costs one full fold)\n\
+                     --format <mode>      human (default) or json";
+
+fn main() -> ExitCode {
+    let mut journals: Vec<PathBuf> = Vec::new();
+    let mut session_logs: Vec<PathBuf> = Vec::new();
+    let mut checkpoints: Vec<PathBuf> = Vec::new();
+    let mut strict = false;
+    let mut format = "human".to_string();
+    let mut args = std::env::args().skip(1);
+    while let Some(arg) = args.next() {
+        match arg.as_str() {
+            "--journal" => {
+                let Some(path) = args.next() else {
+                    return usage("--journal requires a path");
+                };
+                journals.push(PathBuf::from(path));
+            }
+            "--session-log" => {
+                let Some(path) = args.next() else {
+                    return usage("--session-log requires a path");
+                };
+                session_logs.push(PathBuf::from(path));
+            }
+            "--checkpoint" => {
+                let Some(path) = args.next() else {
+                    return usage("--checkpoint requires a path");
+                };
+                checkpoints.push(PathBuf::from(path));
+            }
+            "--strict" => strict = true,
+            "--format" => {
+                let Some(mode) = args.next() else {
+                    return usage("--format requires human or json");
+                };
+                if mode != "human" && mode != "json" {
+                    return usage("--format requires human or json");
+                }
+                format = mode;
+            }
+            "--help" | "-h" => {
+                println!("{USAGE}");
+                return ExitCode::from(0);
+            }
+            _ => return usage(&format!("unknown argument: {arg}")),
+        }
+    }
+    if journals.is_empty() && session_logs.is_empty() && checkpoints.is_empty() {
+        return usage("at least one --journal, --session-log, or --checkpoint path is required");
+    }
+
+    let mut blobs: Vec<Vec<u8>> = Vec::new();
+    for path in &journals {
+        match read_journal(path, &mut blobs) {
+            Ok(count) => eprintln!("read {count} record blob(s) from {}", path.display()),
+            Err(message) => {
+                eprintln!("ds-chain-validator: {message}");
+                return ExitCode::from(2);
+            }
+        }
+    }
+
+    let mut streams: Vec<Vec<Vec<u8>>> = Vec::new();
+    for path in &session_logs {
+        let streams_before = streams.len();
+        match read_session_log(path, &mut streams) {
+            Ok(count) => eprintln!(
+                "read {count} session event(s) in {} stream(s) from {}",
+                streams.len() - streams_before,
+                path.display()
+            ),
+            Err(message) => {
+                eprintln!("ds-chain-validator: {message}");
+                return ExitCode::from(2);
+            }
+        }
+    }
+
+    let mut checkpoint_blobs: Vec<Vec<u8>> = Vec::new();
+    for path in &checkpoints {
+        match read_checkpoint(path, &mut checkpoint_blobs) {
+            Ok(count) => eprintln!("read {count} checkpoint blob(s) from {}", path.display()),
+            Err(message) => {
+                eprintln!("ds-chain-validator: {message}");
+                return ExitCode::from(2);
+            }
+        }
+    }
+
+    let report = if session_logs.is_empty() && checkpoints.is_empty() {
+        validate_journal(&blobs)
+    } else {
+        validate_with_checkpoint(&blobs, &streams, &checkpoint_blobs, strict)
+    };
+    match format.as_str() {
+        "json" => match serde_json::to_string_pretty(&report) {
+            Ok(json) => println!("{json}"),
+            Err(error) => {
+                eprintln!("ds-chain-validator: could not serialize the report: {error}");
+                return ExitCode::from(2);
+            }
+        },
+        _ => print_human(&report),
+    }
+
+    let code = report.exit_code();
+    ExitCode::from(u8::try_from(code).unwrap_or(2))
+}
+
+fn usage(message: &str) -> ExitCode {
+    eprintln!("ds-chain-validator: {message}\n\n{USAGE}");
+    ExitCode::from(64)
+}
+
+/// Collect record blobs from one journal source. Byte-exactness is the whole game: directory
+/// entries and whole-file objects pass through raw; array elements and JSONL lines are handed
+/// over exactly as found (array elements are re-emitted compactly — safe because the record's
+/// self-digest is computed from its decoded fields, not its input byte layout).
+fn read_journal(path: &Path, blobs: &mut Vec<Vec<u8>>) -> Result<usize, String> {
+    let before = blobs.len();
+    if path.is_dir() {
+        let mut entries: Vec<PathBuf> = std::fs::read_dir(path)
+            .map_err(|error| format!("cannot read directory {}: {error}", path.display()))?
+            .filter_map(|entry| entry.ok().map(|entry| entry.path()))
+            .filter(|entry| {
+                entry
+                    .extension()
+                    .is_some_and(|extension| extension == "json")
+            })
+            .collect();
+        entries.sort();
+        for entry in entries {
+            let bytes = std::fs::read(&entry)
+                .map_err(|error| format!("cannot read {}: {error}", entry.display()))?;
+            blobs.push(bytes);
+        }
+        return Ok(blobs.len() - before);
+    }
+    let bytes =
+        std::fs::read(path).map_err(|error| format!("cannot read {}: {error}", path.display()))?;
+    split_blob_file(&bytes, blobs);
+    Ok(blobs.len() - before)
+}
+
+/// Collect SessionLog event streams from one session-log source. Unlike the journal plane,
+/// append order within one file is meaningful, so **each file becomes one stream** — for a
+/// directory, every `*.json`/`*.jsonl` file inside (name-sorted); for a single path, the file
+/// itself. Event blobs within a stream preserve the file's order.
+fn read_session_log(path: &Path, streams: &mut Vec<Vec<Vec<u8>>>) -> Result<usize, String> {
+    let mut added = 0usize;
+    if path.is_dir() {
+        let mut entries: Vec<PathBuf> = std::fs::read_dir(path)
+            .map_err(|error| format!("cannot read directory {}: {error}", path.display()))?
+            .filter_map(|entry| entry.ok().map(|entry| entry.path()))
+            .filter(|entry| {
+                entry.extension().is_some_and(|extension| {
+                    extension == "json" || extension == "jsonl"
+                })
+            })
+            .collect();
+        entries.sort();
+        for entry in entries {
+            let bytes = std::fs::read(&entry)
+                .map_err(|error| format!("cannot read {}: {error}", entry.display()))?;
+            let mut stream = Vec::new();
+            split_blob_file(&bytes, &mut stream);
+            added += stream.len();
+            streams.push(stream);
+        }
+        return Ok(added);
+    }
+    let bytes =
+        std::fs::read(path).map_err(|error| format!("cannot read {}: {error}", path.display()))?;
+    let mut stream = Vec::new();
+    split_blob_file(&bytes, &mut stream);
+    added += stream.len();
+    streams.push(stream);
+    Ok(added)
+}
+
+/// Collect checkpoint blobs from one checkpoint-plane source — the same shapes the journal
+/// accepts: a directory of `*.json` files (name-sorted), a whole-file JSON object, a JSON
+/// array (one checkpoint per element), or JSON Lines. Bytes pass through untouched, with one
+/// accommodation for the published artifact shape: a blob that parses as a JSON object
+/// carrying a nested `checkpoint` object (the golden-fixture wrapper, which also holds
+/// ack/restore metadata) contributes that nested document instead — re-serialized compactly,
+/// digest-safe because a checkpoint's self-digest is computed from its decoded fields, not
+/// its input byte layout. Every verdict about the bytes belongs to the validator's decoder.
+fn read_checkpoint(path: &Path, blobs: &mut Vec<Vec<u8>>) -> Result<usize, String> {
+    let before = blobs.len();
+    read_journal(path, blobs)?;
+    for blob in &mut blobs[before..] {
+        if let Ok(serde_json::Value::Object(map)) =
+            serde_json::from_slice::<serde_json::Value>(blob)
+            && let Some(nested) = map.get("checkpoint")
+            && nested.is_object()
+        {
+            *blob = serde_json::to_vec(nested).unwrap_or_default();
+        }
+    }
+    Ok(blobs.len() - before)
+}
+
+/// Split one file's bytes into blobs: a JSON array yields one blob per element, a single JSON
+/// value yields one blob, anything else parses as JSON Lines. Array elements are re-emitted
+/// compactly — safe for journal records because the record's self-digest is computed from its
+/// decoded fields, not its input byte layout, and safe for SessionLog events because the
+/// session plane is opaque JSON throughout.
+fn split_blob_file(bytes: &[u8], blobs: &mut Vec<Vec<u8>>) {
+    match serde_json::from_slice::<serde_json::Value>(bytes) {
+        Ok(serde_json::Value::Array(records)) => {
+            for record in records {
+                blobs.push(serde_json::to_vec(&record).unwrap_or_default());
+            }
+        }
+        Ok(_) => blobs.push(bytes.to_vec()),
+        Err(_) => {
+            for line in bytes.split(|byte| *byte == b'\n') {
+                let line = trim_ascii(line);
+                if !line.is_empty() {
+                    blobs.push(line.to_vec());
+                }
+            }
+        }
+    }
+}
+
+fn trim_ascii(bytes: &[u8]) -> &[u8] {
+    let start = bytes
+        .iter()
+        .position(|byte| !byte.is_ascii_whitespace())
+        .unwrap_or(bytes.len());
+    let end = bytes
+        .iter()
+        .rposition(|byte| !byte.is_ascii_whitespace())
+        .map_or(start, |position| position + 1);
+    &bytes[start..end]
+}
+
+fn print_human(report: &ValidationReport) {
+    for segment in &report.segments {
+        println!("segment {} ({} hop(s))", segment.operation_id, segment.hops);
+        for rule in &segment.rules {
+            let label = match rule.verdict {
+                Verdict::Pass => "pass",
+                Verdict::Fail => "FAIL",
+                Verdict::Degraded => "degraded",
+            };
+            println!("  {} {label}: {}", rule.rule, rule.detail);
+        }
+        for hop in &segment.degraded_hops {
+            println!(
+                "  degraded hop #{} (step {}): {}",
+                hop.ordinal,
+                hop.step_seq.map_or("?".to_string(), |seq| seq.to_string()),
+                hop.reason,
+            );
+        }
+    }
+    if report.unparseable_records > 0 {
+        println!(
+            "unparseable record blob(s): {} (evidence insufficient, not a violation)",
+            report.unparseable_records
+        );
+    }
+    if let Some(events) = report.session_events {
+        println!("session-log plane: {events} parseable event(s)");
+    }
+    if report.unparseable_events > 0 {
+        println!(
+            "unparseable session event blob(s): {} (evidence insufficient, not a violation)",
+            report.unparseable_events
+        );
+    }
+    if let Some(checkpoints) = report.checkpoints {
+        println!("checkpoint plane: {checkpoints} parseable checkpoint(s)");
+    }
+    if report.unparseable_checkpoints > 0 {
+        println!(
+            "unparseable checkpoint blob(s): {} (evidence insufficient, not a violation)",
+            report.unparseable_checkpoints
+        );
+    }
+    for rule in &report.cross_checks {
+        let label = match rule.verdict {
+            Verdict::Pass => "pass",
+            Verdict::Fail => "FAIL",
+            Verdict::Degraded => "degraded",
+        };
+        println!("cross-check {} {label}: {}", rule.rule, rule.detail);
+    }
+    for rule in &report.checkpoint_checks {
+        let label = match rule.verdict {
+            Verdict::Pass => "pass",
+            Verdict::Fail => "FAIL",
+            Verdict::Degraded => "degraded",
+        };
+        println!("checkpoint-check {} {label}: {}", rule.rule, rule.detail);
+    }
+    for deferred in &report.deferred {
+        println!("deferred: {deferred}");
+    }
+    let segments = report.segments.len();
+    let verdict = match report.exit_code() {
+        0 => "all green",
+        1 => "VIOLATION",
+        _ => "evidence insufficient",
+    };
+    println!(
+        "summary: {segments} segment(s), exit {} ({verdict})",
+        report.exit_code()
+    );
+}