feat: gate commercial external validation release

2026-07-17 14:32:56 +08:00
parent eeb4185bbc
commit 447d89f1da
5 changed files with 375 additions and 0 deletions
@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+"""Verify the commercial public external-validation evidence release."""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+DEFAULT_MANIFEST = ROOT / "references" / "evidence_manifests" / "commercial_external_validation_release.v1.json"
+
+
+def sha256_file(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as handle:
+        for chunk in iter(lambda: handle.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def evaluate_manifest(manifest_path: Path = DEFAULT_MANIFEST) -> dict:
+    manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
+    assets = []
+    for item in manifest["assets"]:
+        path = ROOT / item["path"]
+        observed = sha256_file(path) if path.is_file() else None
+        integrity = "verified" if observed == item["sha256"] else ("missing" if observed is None else "mismatch")
+        assets.append(
+            {
+                "id": item["id"],
+                "path": item["path"],
+                "scope": item["scope"],
+                "expected_sha256": item["sha256"],
+                "observed_sha256": observed,
+                "integrity": integrity,
+            }
+        )
+
+    verified = sum(item["integrity"] == "verified" for item in assets)
+    boundaries = manifest["release_boundaries"]
+    return {
+        "artifact_id": manifest["artifact_id"],
+        "release_scope": manifest["release_scope"],
+        "status": "pass" if verified == len(assets) else "blocked",
+        "assets": assets,
+        "engines": manifest["engines"],
+        "summary": {
+            "assets_total": len(assets),
+            "assets_verified": verified,
+            "external_oracle_closure": boundaries["external_oracle_closure"],
+            "prediction_accuracy_verified": boundaries["prediction_accuracy_verified"],
+            "production_tuning_allowed": boundaries["production_tuning_allowed"],
+        },
+        "boundary": "A passing release validates only versioned public evidence integrity. It does not close external oracles, verify prediction accuracy, or authorize production tuning.",
+    }
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--manifest", type=Path, default=DEFAULT_MANIFEST)
+    parser.add_argument("--format", choices=("text", "json"), default="text")
+    parser.add_argument("--require-match", action="store_true")
+    args = parser.parse_args()
+    report = evaluate_manifest(args.manifest)
+    if args.format == "json":
+        print(json.dumps(report, ensure_ascii=False, indent=2))
+    else:
+        print(f"external validation release: {report['status']}")
+        print(f"assets: {report['summary']['assets_verified']}/{report['summary']['assets_total']} verified")
+        print(f"VedAstro: {report['engines']['VedAstro']['status']}")
+        print(f"production_tuning_allowed: {report['summary']['production_tuning_allowed']}")
+    return 0 if report["status"] == "pass" or not args.require_match else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())