fable-engine 1.3.1__py3-none-any.whl

fable_v2/coder_fleet/property_oracle.py

@@ -0,0 +1,260 @@
+"""Property Oracle Engine for Boundary Matrix Generation and Algebraic Invariant Verification.
+
+Generates extreme edge-case fuzzing matrices and verifies roundtrip invariants
+(e.g., decode(encode(x)) == x) using isolated execution harnesses.
+"""
+from __future__ import annotations
+
+import base64
+import json
+import math
+import pickle
+import sys
+from typing import Any
+
+from .test_harness import TestHarnessEngine
+
+
+class PropertyOracleEngine:
+    """Engine for generating boundary property testing matrices and verifying algebraic invariants."""
+
+    def __init__(self, test_harness: TestHarnessEngine | None = None) -> None:
+        self._harness = test_harness or TestHarnessEngine()
+
+    def generate_property_matrix(self, types: list[str], count: int = 50) -> list[Any]:
+        """Generate extreme boundary values (empty strings, MAX_INT, unicode, negative values,
+
+        None, large lists, floats) for the specified types.
+        """
+        pools: list[list[Any]] = []
+        normalized_types = {t.lower().strip() for t in types}
+
+        if any(t in normalized_types for t in ("str", "string", "text")):
+            pools.append([
+                "",
+                " ",
+                "\t",
+                "\n",
+                "\r\n",
+                "\x00",
+                "null",
+                "None",
+                "undefined",
+                "0",
+                "-1",
+                "🔥🚀✨🎉",
+                "A" * 1024,
+                "a\x00b\x00c",
+                "<script>alert('xss')</script>",
+                "' OR '1'='1' --",
+                '{"key": "value", "nested": [1, 2]}',
+                "https://example.com/api?q=test&page=1",
+                "c:\\Windows\\System32\\cmd.exe",
+                "/dev/null",
+            ])
+
+        if any(t in normalized_types for t in ("int", "integer", "number")):
+            pools.append([
+                0,
+                1,
+                -1,
+                2,
+                -2,
+                42,
+                -42,
+                100,
+                -100,
+                255,
+                256,
+                65535,
+                65536,
+                2**31 - 1,
+                -2**31,
+                2**63 - 1,
+                -2**63,
+                10**18,
+                -10**18,
+                sys.maxsize,
+                -sys.maxsize - 1,
+            ])
+
+        if any(t in normalized_types for t in ("float", "decimal", "real")):
+            pools.append([
+                0.0,
+                -0.0,
+                1.0,
+                -1.0,
+                0.5,
+                -0.5,
+                math.pi,
+                math.e,
+                1e-15,
+                1e15,
+                1e-300,
+                1e300,
+                float("inf"),
+                float("-inf"),
+            ])
+
+        if any(t in normalized_types for t in ("bool", "boolean")):
+            pools.append([True, False])
+
+        if any(t in normalized_types for t in ("list", "array", "sequence")):
+            pools.append([
+                [],
+                [None],
+                [0],
+                [""],
+                [True, False],
+                [1, 2, 3, 4, 5],
+                ["alpha", "beta", "gamma"],
+                [[], [[]]],
+                list(range(50)),
+                [0] * 100,
+            ])
+
+        if any(t in normalized_types for t in ("dict", "map", "object")):
+            pools.append([
+                {},
+                {"": ""},
+                {"key": "value"},
+                {"a": 1, "b": 2, "c": 3},
+                {"nested": {"level1": {"level2": True}}},
+                {"list": [1, 2, 3]},
+            ])
+
+        if any(t in normalized_types for t in ("none", "null", "nonetype")):
+            pools.append([None])
+
+        if any(t in normalized_types for t in ("bytes", "binary")):
+            pools.append([
+                b"",
+                b"\x00",
+                b"hello world",
+                b"\xff\xfe\xfd\xfc",
+                bytes([i % 256 for i in range(128)]),
+            ])
+
+        if not pools:
+            pools.append(["", 0, 0.0, False, None, [], {}])
+
+        # Interleave round-robin across all requested pools to ensure balanced coverage
+        result: list[Any] = []
+        max_pool_len = max(len(p) for p in pools)
+        for idx in range(max_pool_len):
+            for pool in pools:
+                if idx < len(pool):
+                    result.append(pool[idx])
+                    if len(result) >= count:
+                        return result
+
+        # If count still exceeds unique items, cycle through
+        cycle_idx = 0
+        while len(result) < count and pools:
+            pool = pools[cycle_idx % len(pools)]
+            result.append(pool[(cycle_idx // len(pools)) % len(pool)])
+            cycle_idx += 1
+
+        return result[:count]
+
+    def verify_algebraic_invariants(
+        self,
+        module_code: str,
+        encode_fn: str,
+        decode_fn: str,
+        sample_inputs: list[Any],
+    ) -> dict[str, Any]:
+        """Test decode(encode(x)) == x roundtrip consistency."""
+        if not sample_inputs:
+            return {
+                "total_tested": 0,
+                "passed": 0,
+                "failed": 0,
+                "success_rate": 1.0,
+                "roundtrip_invariant_holds": True,
+                "failure_examples": [],
+            }
+
+        encoded_payload = base64.b64encode(pickle.dumps(sample_inputs)).decode("ascii")
+
+        driver = f"""
+import base64
+import json
+import pickle
+import sys
+
+{module_code}
+
+raw_inputs = pickle.loads(base64.b64decode("{encoded_payload}".encode("ascii")))
+encoder = globals().get("{encode_fn}")
+decoder = globals().get("{decode_fn}")
+
+if encoder is None or decoder is None:
+    print("__INVARIANT_OUTPUT__" + json.dumps({{"error": "Target functions not found in module"}}))
+    sys.exit(0)
+
+total = len(raw_inputs)
+passed = 0
+failed = 0
+failure_examples = []
+
+for item in raw_inputs:
+    try:
+        enc = encoder(item)
+        dec = decoder(enc)
+        # Handle float nan comparison
+        if isinstance(item, float) and item != item:
+            is_equal = isinstance(dec, float) and dec != dec
+        else:
+            is_equal = (dec == item)
+
+        if is_equal:
+            passed += 1
+        else:
+            failed += 1
+            if len(failure_examples) < 10:
+                failure_examples.append({{
+                    "input": repr(item),
+                    "encoded": repr(enc),
+                    "decoded": repr(dec),
+                    "reason": "dec(enc(x)) != x",
+                }})
+    except Exception as exc:
+        failed += 1
+        if len(failure_examples) < 10:
+            failure_examples.append({{
+                "input": repr(item),
+                "error": f"{{type(exc).__name__}}: {{exc}}",
+                "reason": "Exception during roundtrip",
+            }})
+
+output = {{
+    "total_tested": total,
+    "passed": passed,
+    "failed": failed,
+    "success_rate": round(passed / max(1, total), 4),
+    "roundtrip_invariant_holds": failed == 0,
+    "failure_examples": failure_examples,
+}}
+print("__INVARIANT_OUTPUT__" + json.dumps(output))
+"""
+        res = self._harness.run_scratch_test(driver, timeout_sec=6.0)
+        marker = "__INVARIANT_OUTPUT__"
+
+        if marker in res.get("stdout", ""):
+            payload_str = res["stdout"].split(marker, 1)[1].strip()
+            try:
+                data = json.loads(payload_str)
+                return data
+            except json.JSONDecodeError:
+                pass
+
+        return {
+            "total_tested": len(sample_inputs),
+            "passed": 0,
+            "failed": len(sample_inputs),
+            "success_rate": 0.0,
+            "roundtrip_invariant_holds": False,
+            "error": res.get("stderr") or "Failed to execute roundtrip verification",
+            "failure_examples": [],
+        }

fable_v2/coder_fleet/receipt_attestor.py

@@ -0,0 +1,122 @@
+"""Receipt Attestor Engine for Cryptographic Tool Execution Attestation.
+
+Records process execution telemetry (PID, exit code, stdout/stderr hashes, timestamps)
+and signs them using HMAC-SHA256 into a tamper-evident ToolReceipt.
+"""
+from __future__ import annotations
+
+import hashlib
+import hmac
+import subprocess
+import time
+import uuid
+from datetime import datetime, timezone
+from typing import Any
+
+
+class ReceiptAttestorEngine:
+    """Engine for attesting subprocess execution and cryptographically verifying execution receipts."""
+
+    def __init__(self, secret_key: bytes | None = None) -> None:
+        self._secret_key = secret_key or hashlib.sha256(b"fable_receipt_attestor_default_secret").digest()
+
+    def _compute_signature(
+        self,
+        cmd: list[str],
+        cwd: str,
+        pid: int,
+        started_at: str,
+        finished_at: str,
+        exit_code: int,
+        stdout_hash: str,
+        stderr_hash: str,
+    ) -> str:
+        payload = f"{' '.join(cmd)}|{cwd}|{pid}|{started_at}|{finished_at}|{exit_code}|{stdout_hash}|{stderr_hash}"
+        return hmac.new(self._secret_key, payload.encode("utf-8"), hashlib.sha256).hexdigest()
+
+    def attest_execution(self, cmd: list[str], cwd: str = ".") -> dict[str, Any]:
+        """Execute subprocess, record OS PID, start/end time, exit code, stdout hash,
+
+        and HMAC-SHA256 signature, creating a tamper-evident ToolReceipt.
+        """
+        started_at = datetime.now(timezone.utc).isoformat()
+        t0 = time.perf_counter()
+
+        proc = subprocess.Popen(
+            cmd,
+            cwd=cwd,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            text=True,
+        )
+        pid = proc.pid
+        stdout, stderr = proc.communicate()
+        duration_ms = (time.perf_counter() - t0) * 1000.0
+        finished_at = datetime.now(timezone.utc).isoformat()
+        exit_code = proc.returncode
+
+        stdout_hash = hashlib.sha256(stdout.encode("utf-8")).hexdigest()
+        stderr_hash = hashlib.sha256(stderr.encode("utf-8")).hexdigest()
+
+        signature = self._compute_signature(
+            cmd=cmd,
+            cwd=cwd,
+            pid=pid,
+            started_at=started_at,
+            finished_at=finished_at,
+            exit_code=exit_code,
+            stdout_hash=stdout_hash,
+            stderr_hash=stderr_hash,
+        )
+
+        receipt_id = f"rcpt_{uuid.uuid4().hex[:12]}"
+
+        return {
+            "receipt_id": receipt_id,
+            "cmd": list(cmd),
+            "cwd": cwd,
+            "pid": pid,
+            "started_at": started_at,
+            "finished_at": finished_at,
+            "duration_ms": round(duration_ms, 2),
+            "exit_code": exit_code,
+            "stdout": stdout,
+            "stderr": stderr,
+            "stdout_hash": stdout_hash,
+            "stderr_hash": stderr_hash,
+            "signature": signature,
+            "tamper_evident": True,
+        }
+
+    def verify_receipt(self, receipt: dict[str, Any]) -> bool:
+        """Validate hash and HMAC-SHA256 signature integrity of a ToolReceipt."""
+        if not isinstance(receipt, dict):
+            return False
+
+        required = ("cmd", "cwd", "pid", "started_at", "finished_at", "exit_code", "stdout_hash", "stderr_hash", "signature")
+        if not all(k in receipt for k in required):
+            return False
+
+        # If full stdout / stderr text is provided, verify against hashes
+        if "stdout" in receipt:
+            actual_stdout_hash = hashlib.sha256(str(receipt["stdout"]).encode("utf-8")).hexdigest()
+            if actual_stdout_hash != receipt["stdout_hash"]:
+                return False
+
+        if "stderr" in receipt:
+            actual_stderr_hash = hashlib.sha256(str(receipt["stderr"]).encode("utf-8")).hexdigest()
+            if actual_stderr_hash != receipt["stderr_hash"]:
+                return False
+
+        expected_sig = self._compute_signature(
+            cmd=receipt["cmd"],
+            cwd=receipt["cwd"],
+            pid=int(receipt["pid"]),
+            started_at=str(receipt["started_at"]),
+            finished_at=str(receipt["finished_at"]),
+            exit_code=int(receipt["exit_code"]),
+            stdout_hash=str(receipt["stdout_hash"]),
+            stderr_hash=str(receipt["stderr_hash"]),
+        )
+
+        return hmac.compare_digest(expected_sig, str(receipt["signature"]))