sable-sphynx 0.7.0.dev0__py3-none-any.whl

sphynx/hosted/model_gcs.py

@@ -0,0 +1,181 @@
+"""Generation-pinned, streaming GCS staging for one registered binary model.
+
+This path is separate from the source/capture/report JSON store and its limits.
+Registration and approval pins are trusted operator inputs, never PR fields.
+No uploads, URL fetching, candidate execution or model loading are implemented.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+import hashlib
+import os
+from pathlib import Path
+import re
+import time
+from types import MappingProxyType
+
+from . import model_artifacts as models
+from .contracts import HostedError
+
+REGISTRATION_SCHEMA = "sphynx.hosted.registered-model-artifact.v1"
+CHUNK_BYTES = 1024 * 1024
+MAX_TOTAL_BYTES = 128 * 1024 * 1024
+STAGING_TIMEOUT_SECONDS = 180
+REQUEST_TIMEOUT_SECONDS = 15
+_DIGEST = re.compile(r"sha256:[0-9a-f]{64}\Z")
+_LOCATION = re.compile(r"gs://([a-z0-9][a-z0-9._-]{1,221}[a-z0-9])/([A-Za-z0-9_./-]+)#([1-9][0-9]{0,19})\Z")
+
+
+def _require(condition, code="invalid_registered_model"):
+    if not condition:
+        raise HostedError(code, "registered model receipt or staged bytes are invalid")
+
+
+def registered_model_prefix(manifest_digest):
+    _require(type(manifest_digest) is str and _DIGEST.fullmatch(manifest_digest))
+    return f"prepared/models/{models.MODEL_ID}/{models.REVISION}/{manifest_digest[7:]}/"
+
+
+@dataclass(frozen=True)
+class ModelObjectReceipt:
+    location: str
+    digest: str
+    size_bytes: int
+    bucket: str
+    object_name: str
+    generation: int
+
+    @classmethod
+    def from_dict(cls, value):
+        _require(type(value) is dict and set(value) == {"location", "digest", "size_bytes"})
+        location, digest, size = value["location"], value["digest"], value["size_bytes"]
+        match = _LOCATION.fullmatch(location) if type(location) is str and len(location) <= 2048 else None
+        _require(match is not None and not any(part in ("", ".", "..") for part in match.group(2).split("/")))
+        _require(type(digest) is str and _DIGEST.fullmatch(digest)
+                 and type(size) is int and 0 < size <= models.MAX_FILE_BYTES)
+        return cls(location, digest, size, match.group(1), match.group(2), int(match.group(3)))
+
+    def to_dict(self):
+        return {"location": self.location, "digest": self.digest, "size_bytes": self.size_bytes}
+
+
+@dataclass(frozen=True)
+class ModelRegistration:
+    model_ref: str
+    manifest_digest: str
+    object_prefix: str
+    files: tuple[tuple[str, ModelObjectReceipt], ...]
+    bucket: str
+
+    @classmethod
+    def from_dict(cls, value, *, trusted_bucket, approved_manifest_pins):
+        _require(type(trusted_bucket) is str and bool(re.fullmatch(r"[a-z0-9][a-z0-9._-]{1,221}[a-z0-9]", trusted_bucket)))
+        _require(isinstance(approved_manifest_pins, (dict, MappingProxyType))
+                 and set(approved_manifest_pins) == {models.MODEL_REF}, "unapproved_model_manifest")
+        _require(type(value) is dict and set(value) == {"schema_version", "model_ref", "manifest_digest", "object_prefix", "files"})
+        _require(value["schema_version"] == REGISTRATION_SCHEMA and value["model_ref"] == models.MODEL_REF)
+        inventory = models.model_artifact_inventory()
+        expected_pin = inventory["manifest.json"]["digest"]
+        _require(approved_manifest_pins[models.MODEL_REF] == expected_pin
+                 and value["manifest_digest"] == expected_pin, "unapproved_model_manifest")
+        prefix = registered_model_prefix(expected_pin)
+        _require(value["object_prefix"] == prefix, "unregistered_model_object")
+        _require(type(value["files"]) is dict and set(value["files"]) == set(inventory), "model_closure_mismatch")
+        receipts = []
+        for relative, expected in sorted(inventory.items()):
+            receipt = ModelObjectReceipt.from_dict(value["files"][relative])
+            _require(receipt.bucket == trusted_bucket and receipt.object_name == prefix + relative, "unregistered_model_object")
+            _require(receipt.digest == expected["digest"] and receipt.size_bytes == expected["size_bytes"], "model_receipt_identity_mismatch")
+            receipts.append((relative, receipt))
+        _require(sum(receipt.size_bytes for _, receipt in receipts) <= MAX_TOTAL_BYTES)
+        return cls(models.MODEL_REF, expected_pin, prefix, tuple(receipts), trusted_bucket)
+
+    def to_dict(self):
+        return {"schema_version": REGISTRATION_SCHEMA, "model_ref": self.model_ref,
+                "manifest_digest": self.manifest_digest, "object_prefix": self.object_prefix,
+                "files": {name: receipt.to_dict() for name, receipt in self.files}}
+
+
+class RegisteredModelStager:
+    """Read only exact registered generations using a trusted platform GCS client."""
+
+    def __init__(self, registration, *, trusted_bucket, approved_manifest_pins, client=None):
+        self.registration = ModelRegistration.from_dict(registration, trusted_bucket=trusted_bucket,
+                                                        approved_manifest_pins=approved_manifest_pins)
+        self._provided_client = client
+
+    def _client(self):
+        if self._provided_client is None:
+            try:
+                from google.cloud import storage
+                self._provided_client = storage.Client()
+            except Exception:
+                raise HostedError("model_store_unavailable", "trusted model storage client is unavailable") from None
+        return self._provided_client
+
+    def _stream(self, receipt, destination, deadline):
+        """Bounded reads and writes; a large weight is never parsed as JSON."""
+        temporary = destination.with_name(destination.name + ".part")
+        try:
+            blob = self._client().bucket(receipt.bucket).blob(receipt.object_name, generation=receipt.generation)
+            _require(time.monotonic() < deadline, "model_staging_timeout")
+            blob.reload(if_generation_match=receipt.generation, timeout=REQUEST_TIMEOUT_SECONDS, retry=None)
+            _require(type(blob.size) is int and blob.size == receipt.size_bytes
+                     and int(blob.generation) == receipt.generation, "model_generation_metadata_mismatch")
+            digest, observed = hashlib.sha256(), 0
+            with blob.open("rb", chunk_size=CHUNK_BYTES, if_generation_match=receipt.generation,
+                           timeout=REQUEST_TIMEOUT_SECONDS, retry=None) as stream:
+                descriptor = os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+                with os.fdopen(descriptor, "wb") as target:
+                    while True:
+                        _require(time.monotonic() < deadline, "model_staging_timeout")
+                        block = stream.read(CHUNK_BYTES)
+                        _require(time.monotonic() < deadline, "model_staging_timeout")
+                        _require(type(block) is bytes and len(block) <= CHUNK_BYTES, "invalid_model_stream")
+                        if not block:
+                            break
+                        observed += len(block)
+                        _require(observed <= receipt.size_bytes, "model_stream_size_mismatch")
+                        digest.update(block); target.write(block)
+                    target.flush(); os.fsync(target.fileno())
+            _require(observed == receipt.size_bytes, "model_stream_size_mismatch")
+            _require("sha256:" + digest.hexdigest() == receipt.digest, "model_stream_digest_mismatch")
+            # The directory is fresh and receipt names come from the fixed local
+            # inventory, so a previous file cannot be silently replaced.
+            _require(not destination.exists(), "model_staging_conflict")
+            temporary.rename(destination)
+        except HostedError:
+            raise
+        except Exception:
+            raise HostedError("model_store_unavailable", "registered model object retrieval failed") from None
+        finally:
+            if temporary.is_file():
+                _require(temporary.resolve().is_relative_to(destination.parent.resolve()), "invalid_model_staging_path")
+                temporary.unlink()
+
+    def stage(self, output_dir):
+        """Create a fresh validated package; return only after all files pass.
+
+        On failure the unadmitted fresh directory can retain successfully staged
+        objects; no success receipt is returned. Read-only mode is a file guard,
+        not a substitute for a read-only mount and an unprivileged sandbox UID.
+        """
+        output = Path(output_dir).absolute()
+        _require(not output.exists(), "model_staging_exists")
+        output.mkdir(parents=True, mode=0o700, exist_ok=False)
+        root = models._root(output)
+        deadline = time.monotonic() + STAGING_TIMEOUT_SECONDS
+        for relative, receipt in self.registration.files:
+            destination = root.joinpath(*relative.split("/"))
+            destination.parent.mkdir(parents=True, mode=0o700, exist_ok=True)
+            _require(destination.parent.resolve().is_relative_to(root), "invalid_model_staging_path")
+            self._stream(receipt, destination, deadline)
+        verified = models.load_model_artifact(root, expected_manifest_sha256=self.registration.manifest_digest,
+                                               registered_asset_locators=models.REGISTERED_MODEL_LOCATORS)
+        for path in root.rglob("*"):
+            if path.is_file():
+                path.chmod(0o444)
+        for path in sorted((path for path in root.rglob("*") if path.is_dir()), key=lambda path: len(path.parts), reverse=True):
+            path.chmod(0o555)
+        root.chmod(0o555)
+        return verified

sphynx/hosted/model_history.py

@@ -0,0 +1,84 @@
+"""Additive model-session provenance; metadata never proves actual weight use."""
+from copy import deepcopy
+import hashlib
+import re
+
+from ..contracts import canonical_json,ContractError
+from .contracts import HostedError
+from .model_session import SESSION_POLICY,TIMING_POLICY
+
+SCHEMA="sphynx.hosted.model-session.reproducibility.v1"
+PREPARED_SCHEMA="sphynx.hosted.prepared-submission.v3"
+
+
+def _require(ok):
+    if not ok: raise HostedError("model_history_identity_mismatch","model session history differs from the operator-pinned closure")
+
+
+def same_json(a,b):
+    try:return canonical_json(a)==canonical_json(b)
+    except (ValueError,TypeError,RecursionError):return False
+
+
+def validate_model_history_identity(manifest,runtime):
+    from .model_admission import validate_model_runtime
+    _require(type(manifest) is dict and manifest.get("schema_version")==PREPARED_SCHEMA)
+    admission=validate_model_runtime(manifest.get("model_runtime"))
+    _require(type(runtime) is dict and same_json(runtime.get("resource_policy"),SESSION_POLICY)
+        and same_json(runtime.get("timing_policy"),TIMING_POLICY)
+        and runtime.get("image_digest")==admission["image_digest"]
+        and runtime.get("model_manifest_digest")==admission["manifest_digest"]
+        and type(runtime.get("runsc_sha256")) is str and re.fullmatch("[0-9a-f]{64}",runtime["runsc_sha256"]))
+    config=manifest.get("candidate_configuration")
+    _require(type(config) is dict and config.get("model")=={"kind":"registered","ref":admission["model_ref"]}
+        and config.get("runtime")=={"profile":"python-minilm-cpu.v1","python":"3.12","transport":"jsonl-session.v1"})
+    return admission
+
+
+def model_reproduction_record(manifest,runtime,*,helper_digest,baseline_digest,requests,platform=None):
+    admission=validate_model_history_identity(manifest,runtime)
+    _require(type(requests) is list and all(type(v) is dict for v in requests)
+        and all(type(v) is str and re.fullmatch("sha256:[0-9a-f]{64}",v) for v in (helper_digest,baseline_digest)))
+    config=manifest["candidate_configuration"]
+    method=config.get("method")
+    record={"schema_version":SCHEMA,
+        "candidate":{"pr_url":manifest["candidate_pr"],"repository":deepcopy(manifest["head_repository"]),
+            "commit_sha":manifest["head_sha"],"tree_sha":manifest["tree_sha"],
+            "configuration_digest":manifest["configuration_digest"],"source_bundle_digest":manifest["source_bundle_digest"],
+            **deepcopy(config["candidate"]),"files":deepcopy(manifest["files"])},
+        "method":{"declaration_status":"declared" if method else "not_declared","declaration":deepcopy(method),"verified_against_algorithm":False},
+        "model":{"kind":"registered","identity":admission["model_ref"],"declaration":deepcopy(config["model"]),
+            "manifest_digest":admission["manifest_digest"],"artifacts":deepcopy(admission["model_assets"]),
+            "operator_admission":deepcopy(admission),"uses_learned_weights_declared":True,
+            "actual_weight_use_verified":False,"session_ready_proves_model_use":False},
+        "build":deepcopy(config["build"]),"runtime":deepcopy(runtime),"platform":deepcopy(platform),
+        "evaluation":{**deepcopy(manifest["suite"]),"input_order_digest":"sha256:"+hashlib.sha256(canonical_json(requests).encode()).hexdigest(),
+            "input_contract_digest":helper_digest,"reference_labels_visible_to_candidate":False},
+        "baseline":{**deepcopy(manifest["baseline"]),"source_digest":baseline_digest,"model_use_claimed":False},
+        "reproduction":{"level":"operator_artifact_closure_and_runtime_identities_recorded","bitwise_repeatability_verified":False,
+            "model_weights_embedded_in_report":False,"limitations":[
+                "Readiness and artifact availability do not prove submitted code used those weights.",
+                "The trusted probe verifies its reviewed probe program; it is not a proof about every submitted candidate.",
+                "Model files, wheel closure, image and probe receipts require independent retention and verified recovery.",
+                "Host request wall includes tokenization, inference, serialization and IPC; pure tensor inference is not isolated."]}}
+    if "candidate_family" in manifest:
+        record.update(candidate_family=deepcopy(manifest["candidate_family"]),candidate_method=manifest["candidate_method"])
+    return record
+
+
+def validate_model_report_metadata(report):
+    """Check recorded closure bindings; report/capture bytes need trusted storage verification."""
+    admission=validate_model_history_identity(report.get("manifest"),report.get("runtime_identity"))
+    recorded=report.get("reproducibility")
+    _require(type(recorded) is dict and recorded.get("schema_version")==SCHEMA
+        and type(recorded.get("evaluation")) is dict)
+    input_digest=recorded["evaluation"].get("input_order_digest")
+    _require(type(input_digest) is str and re.fullmatch("sha256:[0-9a-f]{64}",input_digest))
+    # The actual input byte/digest check occurs during grading. At comparison,
+    # this verifies every other provenance field without inventing input bytes.
+    expected=model_reproduction_record(report["manifest"],report["runtime_identity"],
+        helper_digest=report.get("helper_digest"),baseline_digest=report.get("baseline_source_digest"),
+        requests=[],platform=recorded.get("platform"))
+    expected["evaluation"]["input_order_digest"]=input_digest
+    _require(recorded==expected)
+    return admission

sphynx/hosted/model_session.py

@@ -0,0 +1,233 @@
+"""Bounded persistent guest transport for a separately admitted CPU model.
+
+This module does not admit an image or model. A trusted operator must verify the
+runtime and artifact closure before constructing it. Readiness is a submitted
+program assertion; recorded model availability is not proof of algorithm use.
+"""
+from __future__ import annotations
+import base64
+import json
+import os
+from pathlib import Path
+import queue
+import subprocess
+import threading
+import time
+import uuid
+
+from ..contracts import canonical_json, validate_candidate_request, validate_candidate_response
+from .contracts import HostedError
+from .sandbox import GVisorSandbox, MAX_STREAM
+
+SESSION_POLICY = {"id": "sphynx.gvisor.cpu.model-session.v1", "cpus": 1,
+    "memory_bytes": 2_147_483_648, "pids": 64, "tmpfs_bytes": 67_108_864,
+    "case_timeout_seconds": 30, "build_step_timeout_seconds": 30,
+    "initialization_timeout_seconds": 120, "maximum_requests": 30,
+    "network": "none", "user": "65532:65532", "root_filesystem": "read_only",
+    "fresh_process_per_case": False, "threads": 1}
+TIMING_POLICY = {"id": "trusted-model-session-wall.v1", "unit": "ms",
+    "initialization": "container_start_to_declared_ready_including_imports_and_model_loading",
+    "request": "host_write_to_complete_response_including_tokenization_inference_serialization_and_ipc",
+    "pure_tensor_inference_measured": False, "ready_proves_model_use": False}
+
+
+class ModelSessionSandbox(GVisorSandbox):
+    def __init__(self, image, *, expected_runsc_sha256, model_path, model_manifest_digest, runsc_path="/usr/local/bin/runsc"):
+        super().__init__(image, expected_runsc_sha256=expected_runsc_sha256, runsc_path=runsc_path)
+        from re import fullmatch
+        if not fullmatch("sha256:[0-9a-f]{64}", model_manifest_digest):
+            raise HostedError("invalid_model_identity", "an independently admitted model manifest is required")
+        model_path = Path(model_path)
+        if not model_path.is_dir() or model_path.is_symlink():
+            raise HostedError("invalid_model_identity", "verified read-only model files are required")
+        self.model_path, self.model_manifest_digest = model_path, model_manifest_digest
+
+    def identity(self):
+        return {"image_digest": self.image, "runsc_sha256": self.runsc_hash,
+            "resource_policy": dict(SESSION_POLICY), "timing_policy": dict(TIMING_POLICY),
+            "model_manifest_digest": self.model_manifest_digest}
+
+    def command(self, argv, source, helper, name):
+        command = super().command(argv, source, helper, name)
+        command[command.index("--memory=1g")] = "--memory=2g"
+        command[command.index("--memory-swap=1g")] = "--memory-swap=2g"
+        index = command.index("-i")
+        additions = ["--mount", f"type=bind,source={self.model_path.resolve()},target=/model,readonly"]
+        for value in ("HF_HUB_OFFLINE=1", "TRANSFORMERS_OFFLINE=1", "HF_HUB_DISABLE_TELEMETRY=1", "TOKENIZERS_PARALLELISM=false",
+                      "OMP_NUM_THREADS=1", "MKL_NUM_THREADS=1", "OPENBLAS_NUM_THREADS=1",
+                      "SPHYNX_MODEL_MANIFEST_DIGEST="+self.model_manifest_digest):
+            additions.append("--env="+value)
+        return command[:index]+additions+command[index:]
+
+    def open_session(self, argv, source, helper, *, initialization_timeout=120):
+        self.verify()
+        name = "sphynx-model-"+uuid.uuid4().hex
+        return GuestSession(self.command(argv, source, helper, name), name,
+                            self.model_manifest_digest, initialization_timeout=initialization_timeout)
+
+
+class GuestSession:
+    """One bounded JSON line at a time; timeout kills the guest, not just Docker."""
+    def __init__(self, command, name, manifest_digest, *, launch=subprocess.Popen, remove=None, clock=time.monotonic,
+                 initialization_timeout=120):
+        if type(initialization_timeout) not in (int, float) or not 0 < initialization_timeout <= SESSION_POLICY["initialization_timeout_seconds"]:
+            raise HostedError("invalid_session_timeout", "initialization timeout exceeds the runtime policy")
+        self.command, self.name, self.manifest_digest = command, name, manifest_digest
+        self.launch, self.clock = launch, clock
+        self.remove = remove or (lambda: subprocess.run(["docker", "rm", "-f", name],
+            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=20, check=False))
+        self.process = None
+        self.frames = queue.Queue(maxsize=2)
+        self.stderr = bytearray()
+        self.failed = threading.Event()
+        self.stream_ended = threading.Event()
+        self.closed = False
+        self.requests = 0
+        self.initialization_wall_ms = None
+        self.threads = []
+        self.initialization_timeout = initialization_timeout
+        self._close_lock = threading.Lock()
+
+    def _stdout(self):
+        pending = bytearray()
+        try:
+            read = getattr(self.process.stdout, "read1", self.process.stdout.read)
+            while block := read(8192):
+                pending.extend(block)
+                while b"\n" in pending:
+                    line, _, rest = pending.partition(b"\n")
+                    pending = bytearray(rest)
+                    if len(line) > MAX_STREAM:
+                        raise ValueError("frame limit")
+                    self.frames.put_nowait(bytes(line))
+                if len(pending) > MAX_STREAM:
+                    raise ValueError("frame limit")
+            if pending:
+                raise ValueError("unterminated frame")
+        except (ValueError, queue.Full, OSError):
+            self.failed.set()
+            self.process.kill()
+        finally:
+            self.stream_ended.set()
+            try: self.frames.put_nowait(None)
+            except queue.Full: pass
+
+    def _stderr(self):
+        try:
+            read = getattr(self.process.stderr, "read1", self.process.stderr.read)
+            while block := read(8192):
+                room = MAX_STREAM-len(self.stderr)
+                self.stderr.extend(block[:room])
+                if len(block)>room:
+                    self.failed.set(); self.process.kill(); return
+        except OSError:
+            self.failed.set()
+
+    def _frame(self, timeout):
+        try:
+            frame = self.frames.get(timeout=timeout)
+        except queue.Empty:
+            raise HostedError("candidate_session_timeout", "guest did not produce a bounded frame in time") from None
+        if frame is None or self.failed.is_set():
+            raise HostedError("candidate_session_failed", "guest stream ended or exceeded its bounds")
+        return frame
+
+    def __enter__(self):
+        started = self.clock()
+        with self._close_lock:
+            if self.closed:
+                raise HostedError("candidate_session_closed", "session was cancelled before launch")
+            try:
+                self.process = self.launch(self.command, stdin=subprocess.PIPE, stdout=subprocess.PIPE,
+                    stderr=subprocess.PIPE, env={key:value for key,value in os.environ.items() if key in ("PATH", "LANG")})
+            except OSError:
+                raise HostedError("sandbox_launch_failed", "trusted session could not launch") from None
+            self.threads = [threading.Thread(target=self._stdout, daemon=True), threading.Thread(target=self._stderr, daemon=True)]
+            for thread in self.threads: thread.start()
+        try:
+            try:
+                ready = _session_json(self._frame(self.initialization_timeout))
+            except (ValueError, TypeError, UnicodeError, RecursionError):
+                raise HostedError("invalid_session_ready", "guest readiness is not strict bounded JSON") from None
+            if ready != {"schema_version":"sphynx.rag.rerank.session.ready.v1", "model_manifest_digest":self.manifest_digest}:
+                raise HostedError("invalid_session_ready", "guest readiness differs from the pinned model identity")
+            self.initialization_wall_ms = (self.clock()-started)*1000
+        except BaseException:
+            self.close()
+            raise
+        return self
+
+    def request(self, value, *, timeout=30):
+        if self.closed or self.requests >= SESSION_POLICY["maximum_requests"]:
+            raise HostedError("candidate_session_closed", "session is closed or has reached its request limit")
+        if self.process is None or self.stream_ended.is_set() or self.failed.is_set() or self.process.poll() is not None:
+            self.close()
+            raise HostedError("candidate_session_closed", "guest has ended before another request could be attempted")
+        if type(timeout) not in (int, float) or not 0 < timeout <= SESSION_POLICY["case_timeout_seconds"]:
+            raise HostedError("invalid_session_timeout", "request timeout exceeds the runtime policy")
+        request = validate_candidate_request(value)
+        raw = (request.to_json()+"\n").encode()
+        if len(raw)>MAX_STREAM:
+            raise HostedError("candidate_input_limit", "session input exceeds its bound")
+        self.requests += 1
+        started = self.clock()
+        write_failed = threading.Event()
+        def write():
+            try:
+                self.process.stdin.write(raw); self.process.stdin.flush()
+            except (BrokenPipeError, OSError, ValueError): write_failed.set()
+        writer = threading.Thread(target=write, daemon=True); writer.start()
+        status, stdout = "ok", b""
+        try:
+            stdout = self._frame(timeout)
+            response = _session_json(stdout)
+            validate_candidate_response(response, request)
+            if write_failed.is_set():
+                raise HostedError("candidate_session_failed", "guest could not receive the request")
+        except HostedError as exc:
+            status = "timeout" if exc.code == "candidate_session_timeout" else "process_failed"
+            self.close()
+        except (ValueError, TypeError, KeyError, UnicodeError, RecursionError):
+            # Keep the raw invalid response for separate grading.
+            self.close()
+        ended = self.clock()
+        writer.join(1)
+        return {"status":status, "stdout_base64":base64.b64encode(stdout).decode(),
+            "stderr_base64":base64.b64encode(bytes(self.stderr)).decode(), "exit_code":self.process.poll(),
+            "runner_latency_ms":(ended-started)*1000, "timing_policy":dict(TIMING_POLICY)}
+
+    def stderr_snapshot(self):
+        """Bounded session stderr; the collector archives it once after close."""
+        return bytes(self.stderr)
+
+    def close(self):
+        with self._close_lock:
+            if self.closed: return
+            self.closed = True
+            if self.process is not None:
+                try: self.process.kill()
+                except OSError: pass
+                try: self.process.wait(timeout=5)
+                except (OSError, subprocess.TimeoutExpired): pass
+            try: self.remove()
+            finally:
+                for thread in self.threads: thread.join(1)
+                if self.process is not None:
+                    for stream in (self.process.stdin,self.process.stdout,self.process.stderr):
+                        try: stream.close()
+                        except OSError: pass
+
+    def __exit__(self, *_):
+        self.close()
+
+
+def _session_json(raw):
+    """Reject duplicate keys and non-finite numbers in ready and reply frames."""
+    def unique(pairs):
+        value = {}
+        for key, item in pairs:
+            if key in value: raise ValueError("duplicate frame field")
+            value[key] = item
+        return value
+    return json.loads(raw, object_pairs_hook=unique,
+                      parse_constant=lambda _: (_ for _ in ()).throw(ValueError("non-finite frame value")))

sphynx/hosted/public_suite.py

@@ -0,0 +1,74 @@
+"""Installed public reranking contract; admission metadata is not a dataset."""
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+
+from ..benchmarks import BenchmarkRegistry, BenchmarkRelease, LabelSetRelease
+from ..evals import (ArtifactBinding, ArtifactReference, EvaluationContractError,
+                     EvaluationDefinition, require_legacy_rerank, resolve_eval)
+from .contracts import HostedError
+from ..public_eval import (
+    EVALUATION_ID, BENCHMARK_REF, LABEL_REF, MANIFEST_DIGEST, BENCHMARK_DIGEST,
+    LABEL_DIGEST, GRADER_RELEASE, METRIC_RELEASE, INPUT_DIGEST,
+    public_definition, public_artifacts,
+)
+
+
+
+def public_release_metadata():
+    """Read a reviewed content-free catalog, never corpus or reference bytes."""
+    path = Path(__file__).resolve().parents[1] / "data/public-benchmark-release.v1.json"
+    value = json.loads(path.read_bytes())
+    if (value.get("schema_version") != "sphynx.hosted.public-admission.v1"
+            or value.get("manifest_digest") != MANIFEST_DIGEST):
+        raise HostedError("public_admission_identity_mismatch", "installed benchmark metadata differs")
+    benchmark = BenchmarkRelease.from_dict(value["benchmark_release"])
+    labels = LabelSetRelease.from_dict(value["label_release"])
+    registry = BenchmarkRegistry((labels,), (benchmark,))
+    if (benchmark.ref != BENCHMARK_REF or benchmark.digest != BENCHMARK_DIGEST
+            or labels.ref != LABEL_REF or labels.digest != LABEL_DIGEST
+            or benchmark.evaluation_id != EVALUATION_ID or benchmark.input.digest != INPUT_DIGEST
+            or not registry.resolve(BENCHMARK_REF, {"split": "development"}).eligible):
+        raise HostedError("public_admission_identity_mismatch", "installed release is not eligible")
+    return value
+
+
+
+
+
+
+
+
+def require_hosted_rerank(evaluation_id, parameters=None):
+    if evaluation_id == "rag.rerank.v1":
+        return require_legacy_rerank(evaluation_id, parameters)
+    if evaluation_id != EVALUATION_ID:
+        raise EvaluationContractError("evaluation does not have an admitted hosted adapter")
+    public_release_metadata()
+    return resolve_eval(evaluation_id, parameters)
+
+
+def verify_public_inputs(raw, manifest):
+    """Worker verifies label-free inputs without fetching reference assets."""
+    from ..contracts import validate_candidate_request
+    from .benchmark_intake import read_json
+    if (type(raw) is not bytes or "sha256:" + hashlib.sha256(raw).hexdigest() != INPUT_DIGEST
+            or manifest.get("benchmark_manifest_digest") != MANIFEST_DIGEST
+            or manifest.get("benchmark_release", {}).get("digest") != BENCHMARK_DIGEST
+            or manifest.get("label_set_release", {}).get("digest") != LABEL_DIGEST):
+        raise HostedError("public_input_identity_mismatch", "public inputs differ from the admitted release")
+    inputs = read_json(raw)
+    if (inputs.get("schema_version") != "sphynx.hosted.public-rerank.inputs.v1"
+            or inputs.get("benchmark_ref") != BENCHMARK_REF or len(inputs.get("requests", [])) != 15):
+        raise HostedError("public_input_identity_mismatch", "public input membership differs")
+    metadata = public_release_metadata()
+    expected = metadata["benchmark_release"]["cases"]
+    requests = inputs["requests"]
+    if [r.get("case_id") for r in requests] != [case["case_id"] for case in expected]:
+        raise HostedError("public_input_identity_mismatch", "public case order differs")
+    for request in requests:
+        if request != validate_candidate_request(request).to_dict():
+            raise HostedError("public_input_identity_mismatch", "candidate input contract differs")
+    return requests