mxready 1.0.0__py3-none-any.whl

mxready/verification/bundle.py

@@ -0,0 +1,137 @@
+from __future__ import annotations
+
+import io
+import json
+import zipfile
+from importlib.resources import files as resource_files
+
+from mxready import __version__
+from mxready.models import ScanReport
+from mxready.resources import verification_schema_bytes
+from mxready_runner.contracts import DEFAULT_CHECKS
+
+_RUNNER_FILES = (
+    "__init__.py",
+    "__main__.py",
+    "cli.py",
+    "execute.py",
+    "inspect.py",
+    "contracts.py",
+    "process.py",
+    "redact.py",
+    "schema.py",
+)
+_SECURITY_NOTE = """# MXReady remote verification safety
+
+This archive runs only on a host controlled by you.
+
+- Read `mxready.yml` and every project command before running it.
+- Environment inspection uses the fixed commands listed in the manifest.
+- Project commands run only after your explicit approval.
+- Use `run --repo-dir /path/to/clean/checkout`; HEAD must match the manifest.
+- Keep the manifest and result outside the checkout. Tracked and untracked changes
+  are rejected before and after project commands; ignored build outputs are permitted.
+- `inspect` only checks the environment and does not verify project source.
+- The runner never uses `sudo`, installs packages, or changes GPU drivers.
+- Commands use argument arrays with `shell=False` and bounded timeouts.
+- Output is redacted and truncated, but review `result.json` before sharing it.
+"""
+
+_PROJECT_COMMANDS_EXAMPLE = (
+    json.dumps(
+        [
+            {
+                "id": "example-cuda-smoke",
+                "command": [
+                    "python",
+                    "-c",
+                    (
+                        "import torch, your_extension; "
+                        "a=torch.randn(1024, device='cuda'); "
+                        "b=torch.randn(1024, device='cuda'); "
+                        "actual=your_extension.ops.mymuladd(a, b, 1.0); "
+                        "torch.testing.assert_close(actual, a * b + 1.0); "
+                        "print('MXReady example CUDA smoke passed')"
+                    ),
+                ],
+                "timeout_seconds": 120,
+            }
+        ],
+        ensure_ascii=False,
+        indent=2,
+    )
+    + "\n"
+)
+
+
+def build_verification_bundle(report: ScanReport) -> bytes:
+    """Build a deterministic, self-contained verification ZIP."""
+    files: list[tuple[str, bytes]] = [
+        (
+            "mxready.yml",
+            (
+                json.dumps(
+                    _build_manifest(report),
+                    ensure_ascii=False,
+                    indent=2,
+                    sort_keys=True,
+                )
+                + "\n"
+            ).encode("utf-8"),
+        ),
+        ("SECURITY.md", _SECURITY_NOTE.encode("utf-8")),
+        (
+            "project-commands.example.json",
+            _PROJECT_COMMANDS_EXAMPLE.encode("utf-8"),
+        ),
+    ]
+
+    for filename in _RUNNER_FILES:
+        files.append(
+            (
+                f"mxready_runner/{filename}",
+                resource_files("mxready_runner").joinpath(filename).read_bytes(),
+            )
+        )
+    files.append(
+        (
+            "schemas/verification-result-v1.json",
+            verification_schema_bytes(),
+        )
+    )
+
+    output = io.BytesIO()
+    with zipfile.ZipFile(output, mode="w") as archive:
+        for name, content in files:
+            _write_deterministic_file(archive, name, content)
+    return output.getvalue()
+
+
+def _build_manifest(report: ScanReport) -> dict:
+    return {
+        "schema_version": "1.0",
+        "scan_id": str(report.scan_id),
+        "repository_url": report.repository.url,
+        "repository_commit": report.repository.commit,
+        "runner_version": __version__,
+        "checks": [
+            {
+                "id": check.id,
+                "command": check.command,
+                "timeout_seconds": check.timeout_seconds,
+            }
+            for check in DEFAULT_CHECKS
+        ],
+        "project_commands": [],
+    }
+
+
+def _write_deterministic_file(
+    archive: zipfile.ZipFile,
+    name: str,
+    content: bytes,
+) -> None:
+    info = zipfile.ZipInfo(name, date_time=(1980, 1, 1, 0, 0, 0))
+    info.compress_type = zipfile.ZIP_DEFLATED
+    info.external_attr = 0o644 << 16
+    archive.writestr(info, content)

mxready/verification/validation.py

@@ -0,0 +1,101 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import UTC, datetime, timedelta
+
+from pydantic import ValidationError
+
+from mxready.errors import MxReadyError
+from mxready.models import ScanReport, VerificationRun, VerificationStatus
+from mxready_runner.contracts import DEFAULT_CHECKS
+
+MAX_VERIFICATION_UPLOAD_BYTES = 1_048_576
+MAX_FUTURE_SKEW = timedelta(minutes=10)
+VERIFICATION_MAX_AGE = timedelta(days=30)
+_REQUIRED_HARDWARE_CHECKS = frozenset({"mx-smi", "pytorch-device"})
+_REQUIRED_ENV_CHECK_IDS = frozenset(spec.id for spec in DEFAULT_CHECKS)
+
+
+@dataclass(frozen=True, slots=True)
+class ValidatedVerification:
+    run: VerificationRun
+    status: VerificationStatus
+
+
+def validate_verification_upload(
+    report: ScanReport,
+    payload: bytes,
+    *,
+    now: datetime,
+) -> ValidatedVerification:
+    if len(payload) > MAX_VERIFICATION_UPLOAD_BYTES:
+        raise MxReadyError(
+            "UPLOAD_TOO_LARGE",
+            "Verification results must not exceed 1 MiB.",
+        )
+    try:
+        run = VerificationRun.model_validate_json(payload)
+    except (ValidationError, ValueError, UnicodeError) as error:
+        raise _invalid_schema() from error
+
+    if run.scan_id != report.scan_id:
+        raise MxReadyError(
+            "VERIFICATION_SCHEMA_INVALID",
+            "The verification result belongs to a different scan.",
+        )
+    if run.repository_commit != report.repository.commit:
+        raise MxReadyError(
+            "VERIFICATION_COMMIT_MISMATCH",
+            "The verification result was produced for a different commit.",
+        )
+
+    now_utc = _require_aware(now, "current time").astimezone(UTC)
+    started_at = _require_aware(run.started_at, "start time").astimezone(UTC)
+    finished_at = _require_aware(run.finished_at, "finish time").astimezone(UTC)
+    if finished_at < started_at:
+        raise _invalid_schema()
+    if finished_at > now_utc + MAX_FUTURE_SKEW:
+        raise _invalid_schema()
+
+    if not _env_checks_complete(run):
+        raise _invalid_schema()
+
+    return ValidatedVerification(run=run, status=verification_status_at(run, now=now_utc))
+
+
+def verification_status_at(run: VerificationRun, *, now: datetime) -> VerificationStatus:
+    """Derive time-dependent status without mutating the historical result."""
+    if now.astimezone(UTC) - run.finished_at.astimezone(UTC) > VERIFICATION_MAX_AGE:
+        status = VerificationStatus.STALE
+    elif run.overall_status == "passed" and _hardware_checks_passed(run):
+        status = VerificationStatus.VERIFIED
+    else:
+        status = VerificationStatus.FAILED
+    return status
+
+
+def _hardware_checks_passed(run: VerificationRun) -> bool:
+    passed = {check.id for check in run.checks if check.status == "passed"}
+    return passed >= _REQUIRED_HARDWARE_CHECKS
+
+
+def _env_checks_complete(run: VerificationRun) -> bool:
+    """Reject selectively-reported results that omit runner environment checks."""
+    submitted = {check.id for check in run.checks}
+    return submitted >= _REQUIRED_ENV_CHECK_IDS
+
+
+def _require_aware(value: datetime, label: str) -> datetime:
+    if value.tzinfo is None or value.utcoffset() is None:
+        raise MxReadyError(
+            "VERIFICATION_SCHEMA_INVALID",
+            f"The verification {label} must include a UTC offset.",
+        )
+    return value
+
+
+def _invalid_schema() -> MxReadyError:
+    return MxReadyError(
+        "VERIFICATION_SCHEMA_INVALID",
+        "The verification result does not match schema version 1.0.",
+    )