from __future__ import annotations import copy import hashlib import json import os import re import shutil import tempfile from dataclasses import dataclass, asdict from datetime import datetime, timezone from pathlib import Path from typing import Any, Dict, List, Optional, Tuple ENGINE_VERSION = '1.0.11-poc' DECISION_SEMANTICS_VERSION = '1.0.11' METRIC_REGISTRY_VERSION = '1.0.0' SPEC_VERSION = '1.5.1' POLICY_PACK_ID = 'LG-POC-POLICY' POLICY_PACK_VERSION = '1.0.1' def utc_now() -> str: return datetime.now(timezone.utc).isoformat() def sha256_obj(obj: Any) -> str: return hashlib.sha256(canonical_json(obj).encode('utf-8')).hexdigest() def ensure_json_safe(obj: Any) -> None: try: canonical_json(obj) except (TypeError, ValueError, OverflowError) as exc: raise POCError(f'NON_JSON_SAFE_INPUT:{type(exc).__name__}') from exc def _read_json_v106(path: Path) -> Any: return json.loads(path.read_text(encoding='utf-8')) class POCError(Exception): pass @dataclass(frozen=True) class PolicyPack: policy_pack_id: str policy_pack_version: str required_metrics: Tuple[str, ...] metric_policy_requirements: Dict[str, Any] policy_thresholds: Dict[str, Any] hard_blocker_rules: Tuple[Dict[str, Any], ...] risk_elevation_rules: Tuple[Dict[str, Any], ...] conditional_restriction_rules: Tuple[Dict[str, Any], ...] green_path_rule: Dict[str, Any] rollback_rules: Tuple[Dict[str, Any], ...] precedence_rules: Dict[str, Any] allowed_overrides: Dict[str, Any] escalation_requirements: Dict[str, Any] evidence_minimums: Dict[str, Any] tenant_or_environment_tolerances: Dict[str, Any] domain_specific_rules: Dict[str, Any] retention_requirements: Dict[str, Any] rollback_permitted: bool cep_profile: Dict[str, Any] def to_dict(self) -> Dict[str, Any]: return {'policy_pack_id': self.policy_pack_id, 'policy_pack_version': self.policy_pack_version, 'required_metrics': list(self.required_metrics), 'metric_policy_requirements': copy.deepcopy(self.metric_policy_requirements), 'policy_thresholds': copy.deepcopy(self.policy_thresholds), 'hard_blocker_rules': [copy.deepcopy(x) for x in self.hard_blocker_rules], 'risk_elevation_rules': [copy.deepcopy(x) for x in self.risk_elevation_rules], 'conditional_restriction_rules': [copy.deepcopy(x) for x in self.conditional_restriction_rules], 'green_path_rule': copy.deepcopy(self.green_path_rule), 'rollback_rules': [copy.deepcopy(x) for x in self.rollback_rules], 'precedence_rules': copy.deepcopy(self.precedence_rules), 'allowed_overrides': copy.deepcopy(self.allowed_overrides), 'escalation_requirements': copy.deepcopy(self.escalation_requirements), 'evidence_minimums': copy.deepcopy(self.evidence_minimums), 'tenant_or_environment_tolerances': copy.deepcopy(self.tenant_or_environment_tolerances), 'domain_specific_rules': copy.deepcopy(self.domain_specific_rules), 'retention_requirements': copy.deepcopy(self.retention_requirements), 'rollback_permitted': self.rollback_permitted, 'cep_profile': copy.deepcopy(self.cep_profile)} @classmethod def from_dict(cls, d: Dict[str, Any]) -> 'PolicyPack': return cls(policy_pack_id=d['policy_pack_id'], policy_pack_version=d['policy_pack_version'], required_metrics=tuple(d['required_metrics']), metric_policy_requirements=copy.deepcopy(d.get('metric_policy_requirements', {})), policy_thresholds=copy.deepcopy(d['policy_thresholds']), hard_blocker_rules=tuple(copy.deepcopy(d.get('hard_blocker_rules', []))), risk_elevation_rules=tuple(copy.deepcopy(d.get('risk_elevation_rules', []))), conditional_restriction_rules=tuple(copy.deepcopy(d.get('conditional_restriction_rules', []))), green_path_rule=copy.deepcopy(d.get('green_path_rule', {})), rollback_rules=tuple(copy.deepcopy(d.get('rollback_rules', []))), precedence_rules=copy.deepcopy(d.get('precedence_rules', {})), allowed_overrides=copy.deepcopy(d.get('allowed_overrides', {})), escalation_requirements=copy.deepcopy(d.get('escalation_requirements', {})), evidence_minimums=copy.deepcopy(d.get('evidence_minimums', {})), tenant_or_environment_tolerances=copy.deepcopy(d['tenant_or_environment_tolerances']), domain_specific_rules=copy.deepcopy(d['domain_specific_rules']), retention_requirements=copy.deepcopy(d['retention_requirements']), rollback_permitted=bool(d['rollback_permitted']), cep_profile=copy.deepcopy(d['cep_profile'])) @property def policy_pack_hash(self) -> str: return sha256_obj(self.to_dict()) RISK_ORDER = ['LOW', 'MODERATE', 'HIGH', 'CRITICAL'] CORE_ORDER = ['ABSENT', 'LOW', 'MODERATE', 'HIGH'] SHELL_ORDER = ['ABSENT', 'LOW', 'MODERATE', 'HIGH'] DRIFT_ORDER = ['ABSENT', 'POSSIBLE', 'LIKELY', 'STRONG'] ROLLBACK_ORDER = ['ABSENT', 'LOW', 'MODERATE', 'HIGH', 'CRITICAL'] def _metric_rank_rule(rule_id: str, metric: str, order: List[str], threshold_key: str, gate: str, blocking: bool, rank: int) -> Dict[str, Any]: return {'rule_id': rule_id, 'kind': 'metric_rank_gte', 'metric': metric, 'order': order, 'threshold_key': threshold_key, 'gate': gate, 'blocking': blocking, 'rank': rank} DEFAULT_POLICY_PACK = PolicyPack(policy_pack_id=POLICY_PACK_ID, policy_pack_version=POLICY_PACK_VERSION, required_metrics=('risk_level', 'evidence_status', 'authority_status', 'reversibility_status', 'core_instability', 'shell_weakness', 'policy_conflict', 'drift_status', 'rollback_pressure', 'cep_stability'), metric_policy_requirements={'required_status': 'OK'}, policy_thresholds={'risk_restrict_min': 'MODERATE', 'risk_hold_min': 'HIGH', 'core_restrict_min': 'MODERATE', 'core_hold_min': 'HIGH', 'shell_restrict_min': 'MODERATE', 'drift_restrict_min': 'POSSIBLE', 'drift_hold_min': 'STRONG', 'rollback_restrict_min': 'MODERATE', 'rollback_hold_min': 'HIGH', 'rollback_evaluate_min': 'CRITICAL'}, hard_blocker_rules=({'rule_id': 'EVIDENCE-BLOCK', 'kind': 'metric_in', 'metric': 'evidence_status', 'values': ['INSUFFICIENT', 'CONFLICTING'], 'gate': 'HOLD', 'blocking': True, 'rank': 20}, {'rule_id': 'AUTH-EXCEEDED', 'kind': 'metric_in', 'metric': 'authority_status', 'values': ['EXCEEDED'], 'gate': 'HOLD', 'blocking': True, 'rank': 21}, {'rule_id': 'AUTH-UNCLEAR-HIGH', 'kind': 'metric_in_impact', 'metric': 'authority_status', 'values': ['UNCLEAR'], 'impact_values': ['HIGH'], 'gate': 'HOLD', 'blocking': True, 'rank': 22}, {'rule_id': 'REV-HIGH-IMPACT', 'kind': 'metric_in_impact', 'metric': 'reversibility_status', 'values': ['LOW', 'NONE'], 'impact_values': ['HIGH'], 'gate': 'HOLD', 'blocking': True, 'rank': 23}, {'rule_id': 'CORE-HOLD', 'kind': 'metric_rank_gte', 'metric': 'core_instability', 'order': CORE_ORDER, 'threshold_key': 'core_hold_min', 'gate': 'HOLD', 'blocking': True, 'rank': 24}, {'rule_id': 'POLICY-BLOCK', 'kind': 'metric_in', 'metric': 'policy_conflict', 'values': ['UNRESOLVED', 'VIOLATION'], 'gate': 'HOLD', 'blocking': True, 'rank': 25}, {'rule_id': 'DRIFT-HOLD', 'kind': 'metric_rank_gte', 'metric': 'drift_status', 'order': DRIFT_ORDER, 'threshold_key': 'drift_hold_min', 'gate': 'HOLD', 'blocking': True, 'rank': 26}, {'rule_id': 'CEP-HOLD', 'kind': 'metric_in', 'metric': 'cep_stability', 'values': ['BREAKDOWN', 'REQUIRES_REVIEW'], 'gate': 'HOLD', 'blocking': True, 'rank': 27}, {'rule_id': 'HUMAN-REVIEW-BLOCK', 'kind': 'trusted_in', 'field': 'human_review_status', 'values': ['REQUIRED_PENDING', 'COMPLETED_REJECTED'], 'gate': 'HOLD', 'blocking': True, 'rank': 2}, {'rule_id': 'APPROVAL-BLOCK', 'kind': 'trusted_in', 'field': 'approval_status', 'values': ['REQUIRED_MISSING', 'REJECTED'], 'gate': 'HOLD', 'blocking': True, 'rank': 3}), risk_elevation_rules=(_metric_rank_rule('RISK-HOLD', 'risk_level', RISK_ORDER, 'risk_hold_min', 'HOLD', True, 30), _metric_rank_rule('ROLLBACK-HOLD', 'rollback_pressure', ROLLBACK_ORDER, 'rollback_hold_min', 'HOLD', True, 31)), conditional_restriction_rules=(_metric_rank_rule('RISK-RESTRICT', 'risk_level', RISK_ORDER, 'risk_restrict_min', 'RESTRICT', False, 40), {'rule_id': 'EVIDENCE-LIMITED', 'kind': 'metric_in', 'metric': 'evidence_status', 'values': ['LIMITED'], 'gate': 'RESTRICT', 'blocking': False, 'rank': 41}, {'rule_id': 'AUTH-LIMITED', 'kind': 'metric_in', 'metric': 'authority_status', 'values': ['LIMITED'], 'gate': 'RESTRICT', 'blocking': False, 'rank': 42}, {'rule_id': 'AUTH-UNCLEAR-NONHIGH', 'kind': 'metric_in_impact_not', 'metric': 'authority_status', 'values': ['UNCLEAR'], 'impact_values': ['HIGH'], 'gate': 'RESTRICT', 'blocking': False, 'rank': 43}, {'rule_id': 'REV-NONHIGH', 'kind': 'metric_in_impact_not', 'metric': 'reversibility_status', 'values': ['LOW', 'NONE'], 'impact_values': ['HIGH'], 'gate': 'RESTRICT', 'blocking': False, 'rank': 44}, _metric_rank_rule('CORE-RESTRICT', 'core_instability', CORE_ORDER, 'core_restrict_min', 'RESTRICT', False, 45), _metric_rank_rule('SHELL-RESTRICT', 'shell_weakness', SHELL_ORDER, 'shell_restrict_min', 'RESTRICT', False, 46), {'rule_id': 'POLICY-CONDITIONAL', 'kind': 'metric_in', 'metric': 'policy_conflict', 'values': ['CONDITIONAL'], 'gate': 'RESTRICT', 'blocking': False, 'rank': 47}, _metric_rank_rule('DRIFT-RESTRICT', 'drift_status', DRIFT_ORDER, 'drift_restrict_min', 'RESTRICT', False, 48), _metric_rank_rule('ROLLBACK-RESTRICT', 'rollback_pressure', ROLLBACK_ORDER, 'rollback_restrict_min', 'RESTRICT', False, 49), {'rule_id': 'CEP-RESTRICT', 'kind': 'metric_in', 'metric': 'cep_stability', 'values': ['LOCALLY_USEFUL_BUT_UNSTABLE', 'INEFFICIENT'], 'gate': 'RESTRICT', 'blocking': False, 'rank': 50}), green_path_rule={'rule_id': 'GREEN-PATH', 'rule_version': '1.0.0', 'gate': 'SHIP', 'blocking': False, 'rank': 60, 'requires_no_blocking_rules': True, 'requirements': [{'kind': 'all_required_metrics_ok'}, {'kind': 'metric_in', 'metric': 'risk_level', 'values': ['LOW']}, {'kind': 'metric_in', 'metric': 'evidence_status', 'values': ['SUFFICIENT']}, {'kind': 'metric_in', 'metric': 'authority_status', 'values': ['ADEQUATE']}, {'kind': 'metric_in', 'metric': 'reversibility_status', 'values': ['HIGH', 'MEDIUM']}, {'kind': 'metric_in', 'metric': 'core_instability', 'values': ['ABSENT', 'LOW']}, {'kind': 'metric_in', 'metric': 'shell_weakness', 'values': ['ABSENT', 'LOW']}, {'kind': 'metric_in', 'metric': 'policy_conflict', 'values': ['ABSENT']}, {'kind': 'metric_in', 'metric': 'drift_status', 'values': ['ABSENT']}, {'kind': 'metric_in', 'metric': 'rollback_pressure', 'values': ['ABSENT', 'LOW']}, {'kind': 'metric_in', 'metric': 'cep_stability', 'values': ['STABLE']}, {'kind': 'trusted_in', 'field': 'human_review_status', 'values': ['NOT_REQUIRED', 'COMPLETED_APPROVED']}, {'kind': 'trusted_in', 'field': 'approval_status', 'values': ['NOT_REQUIRED', 'APPROVED']}]}, rollback_rules=({'rule_id': 'ROLLBACK-AUTHORIZED', 'kind': 'rollback_contract', 'metric': 'rollback_pressure', 'threshold_key': 'rollback_evaluate_min', 'order': ROLLBACK_ORDER, 'gate': 'ROLLBACK', 'blocking': True, 'rank': 10},), precedence_rules={'terminal_blocking_rule_ids': ['HUMAN-REVIEW-BLOCK', 'APPROVAL-BLOCK'], 'gate_order': ['ROLLBACK', 'HOLD', 'RESTRICT', 'SHIP'], 'fallback_gate': 'HOLD', 'fallback_reason': 'POLICY_COVERAGE_FAILURE'}, allowed_overrides={'SHIP': {'RESTRICT': ['GOVERNANCE_APPROVER'], 'HOLD': ['GOVERNANCE_APPROVER']}, 'RESTRICT': {'SHIP': ['GOVERNANCE_APPROVER'], 'HOLD': ['GOVERNANCE_APPROVER']}, 'HOLD': {}, 'ROLLBACK': {}}, escalation_requirements={'HOLD': ['GOVERNANCE_REVIEW']}, evidence_minimums={'required': True}, tenant_or_environment_tolerances={'default': {'force_cep_review': False}, 'strict': {'force_cep_review': True}}, domain_specific_rules={'general': {'force_cep_review': False}, 'high_stakes': {'force_cep_review': True}}, retention_requirements={'append_only': True}, rollback_permitted=True, cep_profile={'predicates': [{'predicate_id': 'CEP-PRED-01', 'predicate_version': '1.0', 'description': 'Conflicting evidence with moderate/high core instability', 'conditions': [{'kind': 'metric_in', 'metric': 'evidence_status', 'values': ['CONFLICTING']}, {'kind': 'metric_in', 'metric': 'core_instability', 'values': ['MODERATE', 'HIGH']}], 'on_true_result': 'REQUIRES_REVIEW'}, {'predicate_id': 'CEP-PRED-02', 'predicate_version': '1.0', 'description': 'Exceeded authority with high/critical rollback pressure', 'conditions': [{'kind': 'metric_in', 'metric': 'authority_status', 'values': ['EXCEEDED']}, {'kind': 'metric_in', 'metric': 'rollback_pressure', 'values': ['HIGH', 'CRITICAL']}], 'on_true_result': 'REQUIRES_REVIEW'}, {'predicate_id': 'CEP-PRED-03', 'predicate_version': '1.0', 'description': 'Resolved profile forces CEP review', 'conditions': [{'kind': 'profile_flag', 'field': 'force_cep_review', 'value': True}], 'on_true_result': 'REQUIRES_REVIEW'}]}) METRIC_VERSIONS = {'risk_level': ('1.0.0', '1.0.0'), 'evidence_status': ('1.0.0', '1.0.0'), 'authority_status': ('1.0.0', '1.0.0'), 'reversibility_status': ('1.0.0', '1.0.0'), 'core_instability': ('1.0.0', '1.0.0'), 'shell_weakness': ('1.0.0', '1.0.0'), 'policy_conflict': ('1.0.0', '1.0.0'), 'drift_status': ('1.0.0', '1.0.0'), 'rollback_pressure': ('1.0.0', '1.0.0'), 'cep_stability': ('1.0.0', '1.0.0')} TRUSTED_FORBIDDEN_FIELDS = {'rollback_authority_confirmed', 'verified_safer_state_available', 'human_review_status', 'approval_status', 'recovery_state', 'trusted_source_id', 'approval_role', 'override_authorization'} RUN_ID_RE = re.compile('^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$') def _contains_forbidden_trusted_fields(obj: Any) -> bool: if isinstance(obj, dict): for k, v in obj.items(): if k in TRUSTED_FORBIDDEN_FIELDS: return True if _contains_forbidden_trusted_fields(v): return True elif isinstance(obj, list): return any((_contains_forbidden_trusted_fields(v) for v in obj)) return False def validate_run_id(run_id: Any) -> str: if not isinstance(run_id, str) or not RUN_ID_RE.fullmatch(run_id) or run_id in {'.', '..'}: raise POCError('INVALID_RUN_ID') return run_id def safe_run_dir(root: Path, run_id: str) -> Path: validate_run_id(run_id) root_resolved = root.resolve() rd = (root_resolved / run_id).resolve() if rd.parent != root_resolved: raise POCError('RUN_PATH_ESCAPE') return rd def make_metric_result(name: str, status: str, classification: Optional[str], raw_value: Any, explanation: str, input_refs: List[str]) -> Dict[str, Any]: mv, cv = METRIC_VERSIONS[name] return {'metric_name': name, 'metric_version': mv, 'metric_config_version': cv, 'scope': 'POC_SYNTHETIC', 'input_refs': input_refs, 'raw_value': raw_value, 'classification': classification, 'confidence': 1.0 if status == 'OK' else 0.0, 'completeness': 1.0 if status == 'OK' else 0.0, 'status': status, 'explanation': explanation, 'evidence_refs': input_refs, 'computed_at': utc_now()} def metric_envelope(metric_inputs: Dict[str, Any], name: str) -> Dict[str, Any]: if name not in metric_inputs: raise POCError(f'METRIC_INPUT_MISSING:{name}') env = metric_inputs[name] if not isinstance(env, dict) or set(env) != {'determination_state', 'payload', 'input_refs'}: raise POCError(f'METRIC_INPUT_ENVELOPE_INVALID:{name}') if env['determination_state'] not in {'AVAILABLE', 'INSUFFICIENT_FOR_CLASSIFICATION'}: raise POCError(f'METRIC_INPUT_DETERMINATION_INVALID:{name}') return env def _abstained(name: str, env: Dict[str, Any]) -> Dict[str, Any]: return make_metric_result(name, 'ABSTAINED', 'UNKNOWN', env.get('payload'), 'Insufficient basis for responsible classification.', env.get('input_refs', [])) def _failed(name: str, raw: Any, refs: List[str], reason: str) -> Dict[str, Any]: return make_metric_result(name, 'FAILED', None, raw, reason, refs) def compute_m1(env: Dict[str, Any]) -> Dict[str, Any]: name = 'risk_level' if env['determination_state'] == 'INSUFFICIENT_FOR_CLASSIFICATION': return _abstained(name, env) p = env['payload'] if not isinstance(p, dict) or set(p) != {'risk_fixture_score'}: return _failed(name, p, env['input_refs'], 'Malformed risk payload.') v = p['risk_fixture_score'] if not isinstance(v, (int, float)) or isinstance(v, bool) or (not 0 <= v <= 100): return _failed(name, p, env['input_refs'], 'Invalid risk score.') c = 'LOW' if v <= 24 else 'MODERATE' if v <= 49 else 'HIGH' if v <= 74 else 'CRITICAL' return make_metric_result(name, 'OK', c, v, 'Synthetic risk classification.', env['input_refs']) def compute_m2(env: Dict[str, Any]) -> Dict[str, Any]: name = 'evidence_status' if env['determination_state'] == 'INSUFFICIENT_FOR_CLASSIFICATION': return _abstained(name, env) p = env['payload'] req = {'required_evidence_items', 'verified_evidence_items', 'conflicting_evidence_items'} if not isinstance(p, dict) or set(p) != req: return _failed(name, p, env['input_refs'], 'Malformed evidence payload.') vals = [p[k] for k in req] if any((not isinstance(x, int) or isinstance(x, bool) or x < 0 for x in vals)): return _failed(name, p, env['input_refs'], 'Invalid evidence counts.') r, v, c = (p['required_evidence_items'], p['verified_evidence_items'], p['conflicting_evidence_items']) if c > 0: cl = 'CONFLICTING' elif r == 0: cl = 'SUFFICIENT' elif v >= r: cl = 'SUFFICIENT' elif v / r >= 0.5: cl = 'LIMITED' else: cl = 'INSUFFICIENT' return make_metric_result(name, 'OK', cl, p, 'Synthetic evidence classification.', env['input_refs']) def compute_m3(env: Dict[str, Any]) -> Dict[str, Any]: name = 'authority_status' if env['determination_state'] == 'INSUFFICIENT_FOR_CLASSIFICATION': return _abstained(name, env) p = env['payload'] req = {'authority_record_present', 'requested_authority_level', 'granted_authority_level'} if not isinstance(p, dict) or set(p) != req: return _failed(name, p, env['input_refs'], 'Malformed authority payload.') if not isinstance(p['authority_record_present'], bool): return _failed(name, p, env['input_refs'], 'Invalid authority record flag.') rq, gr = (p['requested_authority_level'], p['granted_authority_level']) if any((not isinstance(x, int) or isinstance(x, bool) or x < 0 or (x > 4) for x in (rq, gr))): return _failed(name, p, env['input_refs'], 'Authority level out of domain.') if not p['authority_record_present']: cl = 'UNCLEAR' elif rq <= gr: cl = 'ADEQUATE' elif rq == gr + 1: cl = 'LIMITED' else: cl = 'EXCEEDED' return make_metric_result(name, 'OK', cl, p, 'Synthetic authority classification.', env['input_refs']) def compute_m4(env: Dict[str, Any]) -> Dict[str, Any]: name = 'reversibility_status' if env['determination_state'] == 'INSUFFICIENT_FOR_CLASSIFICATION': return _abstained(name, env) p = env['payload'] req = {'reversible_fraction', 'irreversible_side_effect'} if not isinstance(p, dict) or set(p) != req: return _failed(name, p, env['input_refs'], 'Malformed reversibility payload.') v = p['reversible_fraction'] if not isinstance(v, (int, float)) or isinstance(v, bool) or (not 0 <= v <= 1) or (not isinstance(p['irreversible_side_effect'], bool)): return _failed(name, p, env['input_refs'], 'Invalid reversibility payload.') cl = 'HIGH' if v >= 0.75 else 'MEDIUM' if v >= 0.4 else 'LOW' if v > 0 else 'NONE' if p['irreversible_side_effect'] and cl in {'HIGH', 'MEDIUM'}: cl = 'LOW' return make_metric_result(name, 'OK', cl, p, 'Synthetic reversibility classification.', env['input_refs']) def compute_m5(env: Dict[str, Any]) -> Dict[str, Any]: name = 'core_instability' if env['determination_state'] == 'INSUFFICIENT_FOR_CLASSIFICATION': return _abstained(name, env) p = env['payload'] keys = {'contradiction', 'unsupported_certainty', 'circular_reasoning', 'evidence_free_inference', 'recursive_self_validation'} if not isinstance(p, dict) or set(p) != keys or any((not isinstance(p[k], bool) for k in keys)): return _failed(name, p, env['input_refs'], 'Malformed core-instability payload.') n = sum((bool(p[k]) for k in keys)) cl = 'ABSENT' if n == 0 else 'LOW' if n == 1 else 'MODERATE' if n <= 3 else 'HIGH' return make_metric_result(name, 'OK', cl, p, 'Synthetic Core instability classification.', env['input_refs']) def compute_m6(env: Dict[str, Any]) -> Dict[str, Any]: name = 'shell_weakness' if env['determination_state'] == 'INSUFFICIENT_FOR_CLASSIFICATION': return _abstained(name, env) p = env['payload'] keys = {'scope_control_present', 'uncertainty_disclosure_present', 'evidence_linkage_present', 'policy_mapping_present'} if not isinstance(p, dict) or set(p) != keys or any((not isinstance(p[k], bool) for k in keys)): return _failed(name, p, env['input_refs'], 'Malformed shell payload.') missing = sum((not p[k] for k in keys)) cl = 'ABSENT' if missing == 0 else 'LOW' if missing == 1 else 'MODERATE' if missing == 2 else 'HIGH' return make_metric_result(name, 'OK', cl, p, 'Synthetic Shell weakness classification.', env['input_refs']) def compute_m7(env: Dict[str, Any]) -> Dict[str, Any]: name = 'policy_conflict' if env['determination_state'] == 'INSUFFICIENT_FOR_CLASSIFICATION': return _abstained(name, env) p = env['payload'] keys = {'policy_violation_count', 'unresolved_policy_conflict_count', 'conditional_constraint_count'} if not isinstance(p, dict) or set(p) != keys or any((not isinstance(p[k], int) or isinstance(p[k], bool) or p[k] < 0 for k in keys)): return _failed(name, p, env['input_refs'], 'Malformed policy-conflict payload.') if p['policy_violation_count'] > 0: cl = 'VIOLATION' elif p['unresolved_policy_conflict_count'] > 0: cl = 'UNRESOLVED' elif p['conditional_constraint_count'] > 0: cl = 'CONDITIONAL' else: cl = 'ABSENT' return make_metric_result(name, 'OK', cl, p, 'Synthetic policy-conflict classification.', env['input_refs']) def compute_m8(gc: Dict[str, Any]) -> Dict[str, Any]: name = 'drift_status' bc = gc.get('baseline_comparison') if not isinstance(bc, dict): return _failed(name, bc, ['governance_context.baseline_comparison'], 'Missing baseline comparison.') v = bc.get('gap_score') if not isinstance(v, (int, float)) or isinstance(v, bool) or (not 0 <= v <= 100): return _failed(name, bc, ['governance_context.baseline_comparison'], 'Invalid baseline gap.') cl = 'ABSENT' if v <= 9 else 'POSSIBLE' if v <= 24 else 'LIKELY' if v <= 49 else 'STRONG' return make_metric_result(name, 'OK', cl, v, 'Synthetic drift classification.', ['governance_context.baseline_comparison']) def compute_m9(env: Dict[str, Any]) -> Dict[str, Any]: name = 'rollback_pressure' if env['determination_state'] == 'INSUFFICIENT_FOR_CLASSIFICATION': return _abstained(name, env) p = env['payload'] if not isinstance(p, dict) or set(p) != {'rollback_pressure_fixture'}: return _failed(name, p, env['input_refs'], 'Malformed rollback-pressure payload.') v = p['rollback_pressure_fixture'] if not isinstance(v, (int, float)) or isinstance(v, bool) or (not 0 <= v <= 100): return _failed(name, p, env['input_refs'], 'Invalid rollback-pressure score.') cl = 'ABSENT' if v <= 19 else 'LOW' if v <= 39 else 'MODERATE' if v <= 59 else 'HIGH' if v <= 79 else 'CRITICAL' return make_metric_result(name, 'OK', cl, v, 'Synthetic rollback-pressure classification.', env['input_refs']) def evaluate_cep_predicates(base: Dict[str, Dict[str, Any]], profile: Dict[str, Any]) -> List[Dict[str, Any]]: def eval_condition(cond: Dict[str, Any]) -> bool: kind = cond.get('kind') if kind == 'metric_in': metric = base.get(cond['metric']) return bool(metric and metric.get('status') == 'OK' and (metric.get('classification') in set(cond['values']))) if kind == 'profile_flag': return profile['cep_relevant_policy_flags'].get(cond['field']) == cond.get('value') raise POCError(f'UNKNOWN_CEP_PREDICATE_CONDITION:{kind}') evaluations = [] for predicate in profile.get('cep_review_predicates', []): conditions = predicate.get('conditions', []) triggered = bool(conditions) and all((eval_condition(c) for c in conditions)) evaluations.append({'predicate_id': predicate['predicate_id'], 'predicate_version': predicate.get('predicate_version'), 'triggered': triggered, 'on_true_result': predicate.get('on_true_result', 'REQUIRES_REVIEW')}) return evaluations def compute_m10(env: Dict[str, Any], base: Dict[str, Dict[str, Any]], profile: Dict[str, Any]) -> Tuple[Dict[str, Any], List[Dict[str, Any]]]: name = 'cep_stability' if env['determination_state'] == 'INSUFFICIENT_FOR_CLASSIFICATION': return (_abstained(name, env), []) for m in base.values(): if m['status'] != 'OK': return (_failed(name, {}, ['M1-M9'], 'Base metric unavailable for CEP assessment.'), []) pred_evals = evaluate_cep_predicates(base, profile) triggered_preds = [x for x in pred_evals if x['triggered']] if triggered_preds: result = triggered_preds[0]['on_true_result'] return (make_metric_result(name, 'OK', result, {'predicate_trigger': True, 'predicate_id': triggered_preds[0]['predicate_id']}, 'CEP policy predicate triggered.', ['policy_profile', 'M1-M9']), pred_evals) p = env['payload'] req = {'cep_review_required', 'decision_regime_failure_count', 'structural_inefficiency_flag', 'local_utility_preserved'} if not isinstance(p, dict) or set(p) != req: return (_failed(name, p, env['input_refs'], 'Malformed CEP payload.'), pred_evals) if not isinstance(p['cep_review_required'], bool) or not isinstance(p['structural_inefficiency_flag'], bool) or (not isinstance(p['local_utility_preserved'], bool)): return (_failed(name, p, env['input_refs'], 'Invalid CEP boolean field.'), pred_evals) n = p['decision_regime_failure_count'] if not isinstance(n, int) or isinstance(n, bool) or n < 0: return (_failed(name, p, env['input_refs'], 'Invalid decision-regime failure count.'), pred_evals) if p['cep_review_required']: cl = 'REQUIRES_REVIEW' elif n >= 2: cl = 'BREAKDOWN' elif p['structural_inefficiency_flag']: cl = 'INEFFICIENT' elif n == 1 and p['local_utility_preserved']: cl = 'LOCALLY_USEFUL_BUT_UNSTABLE' elif n == 0: cl = 'STABLE' else: return (_abstained(name, env), pred_evals) return (make_metric_result(name, 'OK', cl, p, 'Synthetic CEP stability classification.', env['input_refs']), pred_evals) def compute_metrics(req: Dict[str, Any], profile: Dict[str, Any]) -> Tuple[Dict[str, Dict[str, Any]], List[Dict[str, Any]]]: mi = req['metric_inputs'] results = {} results['risk_level'] = compute_m1(metric_envelope(mi, 'risk_level')) results['evidence_status'] = compute_m2(metric_envelope(mi, 'evidence_status')) results['authority_status'] = compute_m3(metric_envelope(mi, 'authority_status')) results['reversibility_status'] = compute_m4(metric_envelope(mi, 'reversibility_status')) results['core_instability'] = compute_m5(metric_envelope(mi, 'core_instability')) results['shell_weakness'] = compute_m6(metric_envelope(mi, 'shell_weakness')) results['policy_conflict'] = compute_m7(metric_envelope(mi, 'policy_conflict')) results['drift_status'] = compute_m8(req['governance_context']) results['rollback_pressure'] = compute_m9(metric_envelope(mi, 'rollback_pressure')) cep, preds = compute_m10(metric_envelope(mi, 'cep_stability'), results, profile) results['cep_stability'] = cep sig_by_id = {s.get('signal_id'): s for s in req.get('signals', []) if isinstance(s, dict)} for metric in results.values(): refs = list(metric.get('input_refs') or []) bound = [sig_by_id[r] for r in refs if r in sig_by_id] if bound: metric['confidence'] = min(float(s.get('confidence', 0.0)) for s in bound) metric['completeness'] = min(float(s.get('completeness', 0.0)) for s in bound) return (results, preds) def _metric_class(metrics: Dict[str, Dict[str, Any]], name: str) -> Optional[str]: m = metrics.get(name) if not m or m.get('status') != 'OK': return None return m.get('classification') def _rank_gte(value: Optional[str], threshold: Any, order: List[str]) -> bool: if value is None: return False if threshold not in order: raise POCError(f'POLICY_THRESHOLD_OUT_OF_DOMAIN:{threshold}') if value not in order: raise POCError(f'METRIC_CLASSIFICATION_OUT_OF_DOMAIN:{value}') return order.index(value) >= order.index(threshold) def _eval_policy_spec(spec: Dict[str, Any], metrics: Dict[str, Dict[str, Any]], scenario: Dict[str, Any], trusted: Dict[str, Any], policy: PolicyPack) -> bool: kind = spec['kind'] if kind == 'metric_in': return _metric_class(metrics, spec['metric']) in set(spec['values']) if kind == 'metric_rank_gte': threshold = policy.policy_thresholds[spec['threshold_key']] return _rank_gte(_metric_class(metrics, spec['metric']), threshold, list(spec['order'])) if kind == 'metric_in_impact': return _metric_class(metrics, spec['metric']) in set(spec['values']) and scenario['impact_tier'] in set(spec['impact_values']) if kind == 'metric_in_impact_not': return _metric_class(metrics, spec['metric']) in set(spec['values']) and scenario['impact_tier'] not in set(spec['impact_values']) if kind == 'trusted_in': return trusted[spec['field']] in set(spec['values']) if kind == 'all_required_metrics_ok': return all((name in metrics and metrics[name]['status'] == policy.metric_policy_requirements.get('required_status', 'OK') for name in policy.required_metrics)) if kind == 'rollback_contract': threshold = policy.policy_thresholds[spec['threshold_key']] pressure_ok = _rank_gte(_metric_class(metrics, spec['metric']), threshold, list(spec['order'])) rs = trusted['recovery_state'] return pressure_ok and policy.rollback_permitted and all(rs.values()) and (trusted['human_review_status'] in {'NOT_REQUIRED', 'COMPLETED_APPROVED'}) and (trusted['approval_status'] in {'NOT_REQUIRED', 'APPROVED'}) raise POCError(f'UNKNOWN_POLICY_RULE_KIND:{kind}') def evaluate_policy(metrics: Dict[str, Dict[str, Any]], scenario: Dict[str, Any], trusted: Dict[str, Any], policy: PolicyPack) -> List[Dict[str, Any]]: rules: List[Dict[str, Any]] = [] for name in policy.required_metrics: m = metrics.get(name) if m is None: rules.append(_rule(f'METRIC-MISSING-{name}', True, 'HOLD', True, 'Required metric missing.', [name], 0, 'METRIC_INTEGRITY')) elif m['status'] == 'FAILED': rules.append(_rule(f'METRIC-FAILED-{name}', True, 'HOLD', True, 'Required metric failed.', [name], 0, 'METRIC_INTEGRITY')) elif m['status'] == 'ABSTAINED': rules.append(_rule(f'METRIC-ABSTAIN-{name}', True, 'HOLD', True, 'Required metric abstained.', [name], 0, 'METRIC_INTEGRITY')) for spec in policy.hard_blocker_rules: rules.append(_rule_from_spec(spec, metrics, scenario, trusted, policy, 'HARD_BLOCKER')) for spec in policy.risk_elevation_rules: rules.append(_rule_from_spec(spec, metrics, scenario, trusted, policy, 'RISK_ELEVATION')) for spec in policy.conditional_restriction_rules: rules.append(_rule_from_spec(spec, metrics, scenario, trusted, policy, 'CONDITIONAL_RESTRICTION')) for spec in policy.rollback_rules: rules.append(_rule_from_spec(spec, metrics, scenario, trusted, policy, 'ROLLBACK_RULE')) rules.append(_evaluate_green_path(metrics, scenario, trusted, policy, rules)) return rules def resolve_gate(rules: List[Dict[str, Any]], metrics: Dict[str, Dict[str, Any]], trusted: Dict[str, Any], policy: PolicyPack) -> Tuple[str, str]: triggered = [r for r in rules if r['triggered']] by_id = {r['rule_id']: r for r in triggered} for rid in policy.precedence_rules.get('terminal_blocking_rule_ids', []): if rid in by_id: return ('HOLD', rid) gate_order = policy.precedence_rules.get('gate_order', ['ROLLBACK', 'HOLD', 'RESTRICT', 'SHIP']) for gate in gate_order: matches = [r for r in triggered if r['candidate_gate'] == gate] if matches: matches.sort(key=lambda r: (r['precedence_rank'], r['rule_id'])) if gate == 'SHIP': return ('SHIP', matches[0]['rule_id']) if gate == 'ROLLBACK': return ('ROLLBACK', matches[0]['rule_id']) return (gate, f'{gate}_PRECEDENCE') return (policy.precedence_rules.get('fallback_gate', 'HOLD'), policy.precedence_rules.get('fallback_reason', 'POLICY_COVERAGE_FAILURE')) class _CoreEngineBase: def __init__(self, root: Path, policy: PolicyPack=DEFAULT_POLICY_PACK): self.root = Path(root).resolve() self.root.mkdir(parents=True, exist_ok=True) self.policy = PolicyPack.from_dict(policy.to_dict()) validate_policy_pack(self.policy) self.pending: Dict[str, Dict[str, Any]] = {} self.trusted: Dict[str, Dict[str, Any]] = {} self.override_authorizations: Dict[str, Dict[str, Any]] = {} def _reserve_run_dir(self, run_id: str) -> Path: rd = safe_run_dir(self.root, run_id) if rd.exists(): raise POCError('RUN_ID_ALREADY_EXISTS') rd.mkdir(parents=False, exist_ok=False) return rd def open_run(self, request: Dict[str, Any], run_id: Optional[str]=None) -> str: req_run_id = None if isinstance(request, dict): rm = request.get('run_metadata') if isinstance(rm, dict): req_run_id = rm.get('run_id') chosen = run_id if run_id is not None else req_run_id validate_run_id(chosen) if req_run_id is not None and run_id is not None and (req_run_id != run_id): chosen = validate_run_id(run_id) self._reserve_run_dir(chosen) self.pending[chosen] = {'request': request, 'schema_error': 'RUN_ID_MISMATCH', 'decided': False} return chosen self._reserve_run_dir(chosen) try: validate_request_schema(request, self.policy) self.pending[chosen] = {'request': copy.deepcopy(request), 'decided': False} except Exception as exc: self.pending[chosen] = {'request': request, 'schema_error': str(exc), 'decided': False} return chosen def provide_trusted_control(self, run_id: str, trusted: Dict[str, Any]) -> None: validate_run_id(run_id) if run_id not in self.pending: raise POCError('RUN_NOT_OPEN') validate_trusted_control(trusted) self.trusted[run_id] = copy.deepcopy(trusted) def provide_trusted_override_authorization(self, run_id: str, authorization: Dict[str, Any]) -> None: validate_run_id(run_id) rd = safe_run_dir(self.root, run_id) if not rd.exists(): raise POCError('RUN_NOT_FOUND') validate_trusted_override_authorization(authorization) self.override_authorizations[run_id] = copy.deepcopy(authorization) def decide(self, run_id: str) -> Dict[str, Any]: validate_run_id(run_id) if run_id not in self.pending: raise POCError('RUN_NOT_OPEN') if self.pending[run_id].get('decided'): raise POCError('RUN_ALREADY_DECIDED') req = self.pending[run_id]['request'] rd = safe_run_dir(self.root, run_id) if 'schema_error' in self.pending[run_id]: reason = self.pending[run_id]['schema_error'] decision, sem = self._minimal_fail_closed(run_id, 'SCHEMA_OR_TRUST_BOUNDARY_FAILURE', reason) self._persist_minimal_failed(rd, req, decision, sem) self.pending[run_id]['decided'] = True return decision trusted = self.trusted.get(run_id) if trusted is None: decision, sem = self._minimal_fail_closed(run_id, 'TRUSTED_CONTROL_UNAVAILABLE', 'No TrustedControlEnvelope supplied.') self._persist_minimal_failed(rd, req, decision, sem) self.pending[run_id]['decided'] = True return decision try: validate_trusted_control(trusted) validate_request_schema(req, self.policy) profile = resolve_policy_profile(self.policy, req['scenario'], req['governance_context']) metrics, preds = compute_metrics(req, profile) rules = evaluate_policy(metrics, req['scenario'], trusted, self.policy) gate, rcode = resolve_gate(rules, metrics, trusted, self.policy) sem = semantic_material(metrics, rules, gate, rcode, self.policy, profile) sem_hash = sha256_obj(sem) decision_id = f'DEC-{run_id}' decision = {'decision_id': decision_id, 'run_id': run_id, 'candidate_gates': sem['candidate_gates'], 'final_gate': gate, 'triggered_rules': sem['triggered_rules'], 'blocking_evidence': [r['rule_id'] for r in rules if r['triggered'] and r['blocking']], 'required_actions': sem['required_actions'], 'escalation_requirements': sem['escalation_requirements'], 'summary': f'LoopGuard-AI canonical POC decision: {gate}', 'rationale': rcode, 'rationale_code': rcode, 'policy_pack_id': self.policy.policy_pack_id, 'policy_pack_version': self.policy.policy_pack_version, 'policy_profile_hash': profile['policy_profile_hash'], 'engine_version': ENGINE_VERSION, 'decision_timestamp': utc_now(), 'semantic_decision_hash': sem_hash} self._persist_success(rd, req, trusted, profile, metrics, preds, rules, decision, sem) self.pending[run_id]['decided'] = True return decision except Exception as exc: decision, sem = self._minimal_fail_closed(run_id, 'ENGINE_INTEGRITY_FAILURE', repr(exc)) self._persist_minimal_failed(rd, req, decision, sem, trusted) self.pending[run_id]['decided'] = True return decision def _minimal_fail_closed(self, run_id: str, rcode: str, reason: str) -> Tuple[Dict[str, Any], Dict[str, Any]]: sem = {'metrics': {}, 'triggered_rules': [rcode], 'candidate_gates': ['HOLD'], 'final_gate': 'HOLD', 'required_actions': ['REVIEW'], 'escalation_requirements': list(self.policy.escalation_requirements.get('HOLD', ['GOVERNANCE_REVIEW'])), 'rationale_code': rcode, 'policy_pack_id': self.policy.policy_pack_id, 'policy_pack_version': self.policy.policy_pack_version, 'policy_pack_hash': self.policy.policy_pack_hash, 'policy_profile_hash': None, 'engine_decision_semantics_version': DECISION_SEMANTICS_VERSION} decision = {'decision_id': f'DEC-{run_id}', 'run_id': run_id, 'candidate_gates': ['HOLD'], 'final_gate': 'HOLD', 'triggered_rules': [rcode], 'blocking_evidence': [reason], 'required_actions': ['REVIEW'], 'escalation_requirements': sem['escalation_requirements'], 'summary': 'Fail-closed HOLD.', 'rationale': reason, 'rationale_code': rcode, 'policy_pack_id': self.policy.policy_pack_id, 'policy_pack_version': self.policy.policy_pack_version, 'policy_profile_hash': None, 'engine_version': ENGINE_VERSION, 'decision_timestamp': utc_now(), 'semantic_decision_hash': sha256_obj(sem)} return (decision, sem) def _base_bundle(self, run_id: str, req_safe: Any, trusted_safe: Any, decision: Dict[str, Any], metrics: Dict[str, Any], profile_hash: Optional[str]) -> Dict[str, Any]: bundle = {'bundle_id': f'BUNDLE-{run_id}', 'run_id': run_id, 'input_hash': sha256_obj(req_safe), 'trusted_control_hash': sha256_obj(trusted_safe) if trusted_safe is not None else None, 'metric_registry_version': METRIC_REGISTRY_VERSION, 'metric_versions': {k: v.get('metric_version') for k, v in metrics.items()}, 'metric_config_versions': {k: v.get('metric_config_version') for k, v in metrics.items()}, 'policy_pack_id': self.policy.policy_pack_id, 'policy_pack_version': self.policy.policy_pack_version, 'policy_pack_hash': self.policy.policy_pack_hash, 'policy_profile_hash': profile_hash, 'rule_engine_version': ENGINE_VERSION, 'decision_hash': sha256_obj(decision), 'semantic_decision_hash': decision['semantic_decision_hash'], 'override_refs': [], 'artifact_refs': [], 'audit_refs': ['run.json', 'rule_evaluations.json', 'decision_package.json', 'semantic_material.json'], 'known_limitations': ['Synthetic metric plug-ins are not empirically validated.', 'CEP predicates are POC policy choices, not empirically validated CEP classifiers.', 'Trusted-control separation is interface-level; no cryptographic authentication is claimed.', 'No real-time production enforcement is claimed.']} bundle['integrity_hash'] = sha256_obj(bundle) return bundle def _persist_minimal_failed(self, rd: Path, req: Any, decision: Dict[str, Any], sem: Dict[str, Any], trusted: Any=None) -> None: req_safe = json_safe_snapshot(req) trusted_safe = json_safe_snapshot(trusted) if trusted is not None else None signals = req_safe.get('signals', []) if isinstance(req_safe, dict) else [] metric_inputs = req_safe.get('metric_inputs', {}) if isinstance(req_safe, dict) else {} write_json_new(rd / 'governance_request.json', req_safe) write_json_new(rd / 'signals.json', signals) write_json_new(rd / 'metric_input_envelopes.json', metric_inputs) if trusted_safe is not None: write_json_new(rd / 'trusted_control_envelope.json', trusted_safe) write_json_new(rd / 'policy_pack.json', self.policy.to_dict()) write_json_new(rd / 'rule_evaluations.json', []) write_json_new(rd / 'decision_package.json', decision) write_json_new(rd / 'semantic_material.json', sem) write_json_new(rd / 'overrides.json', []) run = {'run_id': decision['run_id'], 'engine_version': ENGINE_VERSION, 'metric_registry_version': METRIC_REGISTRY_VERSION, 'policy_pack_id': self.policy.policy_pack_id, 'policy_pack_version': self.policy.policy_pack_version, 'policy_pack_hash': self.policy.policy_pack_hash, 'policy_profile_hash': None, 'request_hash': sha256_obj(req_safe), 'trusted_control_hash': sha256_obj(trusted_safe) if trusted_safe is not None else None, 'started_at': utc_now(), 'completed_at': utc_now(), 'run_status': 'FAILED_CLOSED'} write_json_new(rd / 'run.json', run) bundle = self._base_bundle(decision['run_id'], req_safe, trusted_safe, decision, {}, None) write_json_new(rd / 'evidence_bundle.json', bundle) self._write_manifest_snapshot(rd) def _persist_success(self, rd: Path, req: Dict[str, Any], trusted: Dict[str, Any], profile: Dict[str, Any], metrics: Dict[str, Any], preds: List[Dict[str, Any]], rules: List[Dict[str, Any]], decision: Dict[str, Any], sem: Dict[str, Any]) -> None: run = {'run_id': decision['run_id'], 'engine_version': ENGINE_VERSION, 'metric_registry_version': METRIC_REGISTRY_VERSION, 'policy_pack_id': self.policy.policy_pack_id, 'policy_pack_version': self.policy.policy_pack_version, 'policy_pack_hash': self.policy.policy_pack_hash, 'policy_profile_hash': profile['policy_profile_hash'], 'request_hash': sha256_obj(req), 'trusted_control_hash': sha256_obj(trusted), 'started_at': req['run_metadata'].get('started_at', utc_now()), 'completed_at': utc_now(), 'run_status': 'COMPLETED'} write_json_new(rd / 'run.json', run) write_json_new(rd / 'scenario.json', req['scenario']) write_json_new(rd / 'governance_request.json', req) write_json_new(rd / 'governance_context.json', req['governance_context']) write_json_new(rd / 'trusted_control_envelope.json', trusted) write_json_new(rd / 'signals.json', req['signals']) write_json_new(rd / 'metric_input_envelopes.json', req['metric_inputs']) write_json_new(rd / 'metric_results.json', metrics) write_json_new(rd / 'metric_registry.json', METRIC_VERSIONS) write_json_new(rd / 'policy_pack.json', self.policy.to_dict()) write_json_new(rd / 'policy_profile.json', profile) write_json_new(rd / 'cep_predicate_evaluations.json', preds) write_json_new(rd / 'rule_evaluations.json', rules) write_json_new(rd / 'decision_package.json', decision) write_json_new(rd / 'semantic_material.json', sem) write_json_new(rd / 'overrides.json', []) bundle = self._base_bundle(decision['run_id'], req, trusted, decision, metrics, profile['policy_profile_hash']) write_json_new(rd / 'evidence_bundle.json', bundle) self._write_manifest_snapshot(rd) def _manifest_paths(self, rd: Path) -> List[Path]: base = rd / 'manifest.json' extras = sorted(rd.glob('manifest_override_*.json')) return ([base] if base.exists() else []) + extras def _write_manifest_snapshot(self, rd: Path) -> Path: previous = self._manifest_paths(rd) sequence = len(previous) previous_hash = read_json(previous[-1])['manifest_hash'] if previous else None files = sorted((p for p in rd.iterdir() if p.is_file() and (not (p.name == 'manifest.json' or p.name.startswith('manifest_override_'))))) core = {'sequence': sequence, 'previous_manifest_hash': previous_hash, 'files': {p.name: hashlib.sha256(p.read_bytes()).hexdigest() for p in files}} manifest = dict(core) manifest['manifest_hash'] = sha256_obj(core) target = rd / 'manifest.json' if sequence == 0 else rd / f'manifest_override_{sequence:04d}.json' write_json_new(target, manifest) return target def verify_persisted_run(self, run_id: str) -> Dict[str, Any]: validate_run_id(run_id) rd = safe_run_dir(self.root, run_id) errors: List[str] = [] if not rd.exists(): return {'ok': False, 'errors': ['RUN_NOT_FOUND']} manifests = self._manifest_paths(rd) if not manifests: errors.append('MANIFEST_MISSING') previous_hash = None for idx, mp in enumerate(manifests): man = read_json(mp) core = {'sequence': man.get('sequence'), 'previous_manifest_hash': man.get('previous_manifest_hash'), 'files': man.get('files')} if man.get('manifest_hash') != sha256_obj(core): errors.append(f'MANIFEST_HASH_MISMATCH:{mp.name}') if man.get('sequence') != idx: errors.append(f'MANIFEST_SEQUENCE_MISMATCH:{mp.name}') if man.get('previous_manifest_hash') != previous_hash: errors.append(f'MANIFEST_CHAIN_MISMATCH:{mp.name}') previous_hash = man.get('manifest_hash') for fn, h in (man.get('files') or {}).items(): p = rd / fn if not p.exists(): errors.append(f'MISSING:{fn}') elif hashlib.sha256(p.read_bytes()).hexdigest() != h: errors.append(f'HASH_MISMATCH:{fn}') if manifests: latest = read_json(manifests[-1]) current_files = {p.name for p in rd.iterdir() if p.is_file() and (not (p.name == 'manifest.json' or p.name.startswith('manifest_override_')))} if current_files != set(latest.get('files', {})): errors.append('LATEST_MANIFEST_FILESET_MISMATCH') try: run = read_json(rd / 'run.json') req = read_json(rd / 'governance_request.json') decision = read_json(rd / 'decision_package.json') sem_stored = read_json(rd / 'semantic_material.json') pp = PolicyPack.from_dict(read_json(rd / 'policy_pack.json')) validate_policy_pack(pp) if pp.policy_pack_hash != run.get('policy_pack_hash'): errors.append('RUN_POLICY_HASH_MISMATCH') if sha256_obj(req) != run.get('request_hash'): errors.append('REQUEST_HASH_MISMATCH') trusted = read_json(rd / 'trusted_control_envelope.json') if (rd / 'trusted_control_envelope.json').exists() else None expected_trusted_hash = sha256_obj(trusted) if trusted is not None else None if expected_trusted_hash != run.get('trusted_control_hash'): errors.append('TRUSTED_CONTROL_HASH_MISMATCH') if sha256_obj(sem_stored) != decision.get('semantic_decision_hash'): errors.append('SEMANTIC_DECISION_HASH_MISMATCH') if (rd / 'metric_results.json').exists() and (rd / 'policy_profile.json').exists(): metrics = read_json(rd / 'metric_results.json') rules = read_json(rd / 'rule_evaluations.json') profile_stored = read_json(rd / 'policy_profile.json') profile_rebuilt = resolve_policy_profile(pp, req['scenario'], req['governance_context']) if profile_rebuilt['policy_profile_hash'] != profile_stored.get('policy_profile_hash'): errors.append('POLICY_PROFILE_REPRO_MISMATCH') sem_rebuilt = semantic_material(metrics, rules, decision['final_gate'], decision['rationale_code'], pp, profile_stored) if sem_rebuilt != sem_stored: errors.append('SEMANTIC_MATERIAL_RECONSTRUCTION_MISMATCH') if run.get('policy_profile_hash') != profile_stored.get('policy_profile_hash'): errors.append('RUN_POLICY_PROFILE_HASH_MISMATCH') bundle = read_json(rd / 'evidence_bundle.json') b_no_hash = copy.deepcopy(bundle) stored_integrity = b_no_hash.pop('integrity_hash', None) if stored_integrity != sha256_obj(b_no_hash): errors.append('EVIDENCE_BUNDLE_INTEGRITY_MISMATCH') if bundle.get('decision_hash') != sha256_obj(decision): errors.append('EVIDENCE_DECISION_HASH_MISMATCH') if bundle.get('semantic_decision_hash') != decision.get('semantic_decision_hash'): errors.append('EVIDENCE_SEMANTIC_HASH_MISMATCH') if bundle.get('input_hash') != sha256_obj(req): errors.append('EVIDENCE_INPUT_HASH_MISMATCH') if bundle.get('trusted_control_hash') != expected_trusted_hash: errors.append('EVIDENCE_TRUSTED_HASH_MISMATCH') if bundle.get('policy_pack_hash') != pp.policy_pack_hash: errors.append('EVIDENCE_POLICY_HASH_MISMATCH') for ep in sorted(rd.glob('override_evidence_*.json')): ext = read_json(ep) ext_copy = copy.deepcopy(ext) ext_hash = ext_copy.pop('integrity_hash', None) if ext_hash != sha256_obj(ext_copy): errors.append(f'OVERRIDE_EVIDENCE_INTEGRITY_MISMATCH:{ep.name}') except Exception as exc: errors.append(f'VERIFY_EXCEPTION:{type(exc).__name__}:{exc}') return {'ok': not errors, 'errors': errors} def request_override(self, run_id: str, requested_gate: str, justification: str) -> Dict[str, Any]: validate_run_id(run_id) rd = safe_run_dir(self.root, run_id) if not rd.exists() or not (rd / 'decision_package.json').exists(): raise POCError('RUN_NOT_DECIDED') if requested_gate not in {'SHIP', 'RESTRICT', 'HOLD', 'ROLLBACK'}: raise POCError('INVALID_OVERRIDE_GATE') if not isinstance(justification, str) or not justification.strip(): raise POCError('OVERRIDE_JUSTIFICATION_REQUIRED') decision = read_json(rd / 'decision_package.json') original = decision['final_gate'] persisted_policy = PolicyPack.from_dict(read_json(rd / 'policy_pack.json')) auth = self.override_authorizations.get(run_id) actor_id = auth['actor_id'] if auth else 'UNRESOLVED' approval_role = auth['approval_role'] if auth else 'UNRESOLVED' trusted_status = auth['authorization_status'] if auth else 'MISSING' allowed = False rule_reason = 'TRUSTED_OVERRIDE_AUTHORIZATION_MISSING' if auth is not None and trusted_status == 'AUTHORIZED': roles = persisted_policy.allowed_overrides.get(original, {}).get(requested_gate, []) allowed = approval_role in roles rule_reason = 'POLICY_OVERRIDE_MATRIX' if allowed and original == 'RESTRICT' and (requested_gate == 'SHIP'): rules = read_json(rd / 'rule_evaluations.json') if (rd / 'rule_evaluations.json').exists() else [] if any((r['triggered'] and r['blocking'] for r in rules)): allowed = False rule_reason = 'ACTIVE_BLOCKER_PREVENTS_RELAXATION' elif auth is not None and trusted_status != 'AUTHORIZED': rule_reason = 'TRUSTED_OVERRIDE_AUTHORIZATION_REJECTED' existing = sorted(rd.glob('override_[0-9][0-9][0-9][0-9].json')) seq = len(existing) + 1 ov = {'override_id': f'OVR-{run_id}-{seq}', 'decision_id': decision['decision_id'], 'actor_id': actor_id, 'approval_role': approval_role, 'requested_gate': requested_gate, 'original_gate': original, 'override_status': 'ACCEPTED' if allowed else 'REJECTED', 'justification': justification, 'authorizing_policy_rule': rule_reason, 'trusted_authorization_status': trusted_status, 'timestamp': utc_now()} write_json_new(rd / f'override_{seq:04d}.json', ov) base_bundle = read_json(rd / 'evidence_bundle.json') refs = [read_json(p)['override_id'] for p in sorted(rd.glob('override_[0-9][0-9][0-9][0-9].json'))] ext = {'extension_id': f'OVERRIDE-EVIDENCE-{run_id}-{seq}', 'run_id': run_id, 'base_bundle_integrity_hash': base_bundle['integrity_hash'], 'override_refs': refs, 'latest_override_id': ov['override_id']} ext['integrity_hash'] = sha256_obj(ext) write_json_new(rd / f'override_evidence_{seq:04d}.json', ext) self._write_manifest_snapshot(rd) return ov import math from types import MappingProxyType def canonical_json(obj: Any) -> str: """Strict canonical JSON: RFC-compatible finite numbers only.""" return json.dumps(obj, sort_keys=True, separators=(',', ':'), ensure_ascii=False, allow_nan=False) def write_json(path: Path, obj: Any) -> None: ensure_json_safe(obj) path.write_text(json.dumps(obj, indent=2, sort_keys=True, ensure_ascii=False, allow_nan=False), encoding='utf-8') def write_json_new(path: Path, obj: Any) -> None: ensure_json_safe(obj) with path.open('x', encoding='utf-8') as f: json.dump(obj, f, indent=2, sort_keys=True, ensure_ascii=False, allow_nan=False) def json_safe_snapshot(obj: Any) -> Any: if obj is None or isinstance(obj, (str, int, bool)): return obj if isinstance(obj, float): if math.isfinite(obj): return obj return {'__non_finite_float__': repr(obj)} if isinstance(obj, dict): return {str(k): json_safe_snapshot(v) for k, v in obj.items()} if isinstance(obj, (list, tuple)): return [json_safe_snapshot(v) for v in obj] return {'__unsupported_type__': type(obj).__name__, '__repr__': repr(obj)} def validate_timestamp(value: Any, field: str) -> str: if not isinstance(value, str) or not value.strip(): raise POCError(f'TIMESTAMP_INVALID:{field}') text = value.strip() try: parsed = datetime.fromisoformat(text[:-1] + '+00:00' if text.endswith('Z') else text) except ValueError as exc: raise POCError(f'TIMESTAMP_INVALID:{field}') from exc if parsed.tzinfo is None or parsed.utcoffset() is None: raise POCError(f'TIMESTAMP_TIMEZONE_REQUIRED:{field}') return text def _stamp_policy_rule_versions(policy: PolicyPack) -> PolicyPack: d = policy.to_dict() for group in ('hard_blocker_rules', 'risk_elevation_rules', 'conditional_restriction_rules', 'rollback_rules'): for rule in d[group]: rule.setdefault('rule_version', '1.0.0') d['green_path_rule'].setdefault('rule_version', '1.0.0') for predicate in d.get('cep_profile', {}).get('predicates', []): predicate.setdefault('predicate_version', '1.0.0') return PolicyPack.from_dict(d) DEFAULT_POLICY_PACK = _stamp_policy_rule_versions(DEFAULT_POLICY_PACK) DEFAULT_POLICY_PACK_HASH = DEFAULT_POLICY_PACK.policy_pack_hash KNOWN_POLICY_IDENTITIES = {(DEFAULT_POLICY_PACK.policy_pack_id, DEFAULT_POLICY_PACK.policy_pack_version): DEFAULT_POLICY_PACK_HASH} _METRIC_REGISTRY_SNAPSHOT = copy.deepcopy(dict(METRIC_VERSIONS)) METRIC_VERSIONS = MappingProxyType(_METRIC_REGISTRY_SNAPSHOT) METRIC_REGISTRY_HASH = sha256_obj(dict(METRIC_VERSIONS)) KNOWN_METRIC_REGISTRIES = {METRIC_REGISTRY_VERSION: METRIC_REGISTRY_HASH} _METRIC_DOMAINS = {'risk_level': set(RISK_ORDER), 'evidence_status': {'SUFFICIENT', 'LIMITED', 'INSUFFICIENT', 'CONFLICTING'}, 'authority_status': {'ADEQUATE', 'LIMITED', 'UNCLEAR', 'EXCEEDED'}, 'reversibility_status': {'HIGH', 'MEDIUM', 'LOW', 'NONE'}, 'core_instability': set(CORE_ORDER), 'shell_weakness': set(SHELL_ORDER), 'policy_conflict': {'ABSENT', 'CONDITIONAL', 'UNRESOLVED', 'VIOLATION'}, 'drift_status': set(DRIFT_ORDER), 'rollback_pressure': set(ROLLBACK_ORDER), 'cep_stability': {'STABLE', 'LOCALLY_USEFUL_BUT_UNSTABLE', 'INEFFICIENT', 'BREAKDOWN', 'REQUIRES_REVIEW'}} _ALLOWED_GATES = {'SHIP', 'RESTRICT', 'HOLD', 'ROLLBACK'} _ALLOWED_RULE_KINDS = {'metric_in', 'metric_rank_gte', 'metric_in_impact', 'metric_in_impact_not', 'trusted_in', 'rollback_contract'} _ALLOWED_GREEN_KINDS = _ALLOWED_RULE_KINDS | {'all_required_metrics_ok'} _ALLOWED_TRUSTED_FIELDS = {'human_review_status', 'approval_status'} def _validate_rank_threshold(policy: PolicyPack, restrict_key: str, hold_key: str, order: List[str]) -> None: a = policy.policy_thresholds.get(restrict_key) b = policy.policy_thresholds.get(hold_key) if a not in order or b not in order or order.index(a) > order.index(b): raise POCError(f'POLICY_THRESHOLD_ORDER_INVALID:{restrict_key}:{hold_key}') def _deep_validate_condition(spec: Dict[str, Any], policy: PolicyPack, allowed_kinds: set) -> None: if not isinstance(spec, dict) or spec.get('kind') not in allowed_kinds: raise POCError('POLICY_RULE_KIND_INVALID') kind = spec['kind'] if kind in {'metric_in', 'metric_rank_gte', 'metric_in_impact', 'metric_in_impact_not', 'rollback_contract'}: if spec.get('metric') not in METRIC_VERSIONS: raise POCError('POLICY_RULE_METRIC_INVALID') if kind in {'metric_in', 'metric_in_impact', 'metric_in_impact_not'}: if not isinstance(spec.get('values'), list) or not spec['values']: raise POCError('POLICY_RULE_VALUES_INVALID') if kind in {'metric_in_impact', 'metric_in_impact_not'}: vals = spec.get('impact_values') if not isinstance(vals, list) or not vals or (not set(vals) <= {'LOW', 'MEDIUM', 'HIGH'}): raise POCError('POLICY_RULE_IMPACT_INVALID') if kind == 'metric_rank_gte' or kind == 'rollback_contract': key = spec.get('threshold_key') order = spec.get('order') if key not in policy.policy_thresholds or not isinstance(order, list) or (not order): raise POCError('POLICY_RULE_THRESHOLD_INVALID') if policy.policy_thresholds[key] not in order: raise POCError('POLICY_RULE_THRESHOLD_OUT_OF_DOMAIN') if kind == 'trusted_in': if spec.get('field') not in _ALLOWED_TRUSTED_FIELDS or not isinstance(spec.get('values'), list): raise POCError('POLICY_RULE_TRUSTED_INVALID') def validate_policy_pack(policy: PolicyPack) -> None: d = policy.to_dict() ensure_json_safe(d) if not isinstance(policy.policy_pack_id, str) or not policy.policy_pack_id or (not isinstance(policy.policy_pack_version, str)) or (not policy.policy_pack_version): raise POCError('POLICY_IDENTITY_INVALID') if len(set(policy.required_metrics)) != len(policy.required_metrics): raise POCError('POLICY_DUPLICATE_REQUIRED_METRIC') unknown = set(policy.required_metrics) - set(METRIC_VERSIONS) if unknown: raise POCError(f'POLICY_UNKNOWN_REQUIRED_METRICS:{sorted(unknown)}') if policy.metric_policy_requirements.get('required_status', 'OK') != 'OK': raise POCError('POLICY_REQUIRED_STATUS_INVALID') for key in ('risk_restrict_min', 'risk_hold_min', 'core_restrict_min', 'core_hold_min', 'shell_restrict_min', 'drift_restrict_min', 'drift_hold_min', 'rollback_restrict_min', 'rollback_hold_min', 'rollback_evaluate_min'): if key not in policy.policy_thresholds: raise POCError(f'POLICY_THRESHOLD_MISSING:{key}') _validate_rank_threshold(policy, 'risk_restrict_min', 'risk_hold_min', RISK_ORDER) _validate_rank_threshold(policy, 'core_restrict_min', 'core_hold_min', CORE_ORDER) _validate_rank_threshold(policy, 'drift_restrict_min', 'drift_hold_min', DRIFT_ORDER) _validate_rank_threshold(policy, 'rollback_restrict_min', 'rollback_hold_min', ROLLBACK_ORDER) if ROLLBACK_ORDER.index(policy.policy_thresholds['rollback_hold_min']) > ROLLBACK_ORDER.index(policy.policy_thresholds['rollback_evaluate_min']): raise POCError('POLICY_ROLLBACK_THRESHOLD_ORDER_INVALID') if policy.policy_thresholds['shell_restrict_min'] not in SHELL_ORDER: raise POCError('POLICY_SHELL_THRESHOLD_INVALID') rule_ids = set() def validate_group(group: Tuple[Dict[str, Any], ...], expected_gate: str, require_blocking: Optional[bool], allowed_kinds: set) -> None: for rule in group: if not isinstance(rule, dict): raise POCError('POLICY_RULE_NOT_OBJECT') rid = rule.get('rule_id') rv = rule.get('rule_version') if not isinstance(rid, str) or not rid or (not isinstance(rv, str)) or (not rv): raise POCError('POLICY_RULE_ID_VERSION_INVALID') if rid in rule_ids: raise POCError(f'POLICY_DUPLICATE_RULE_ID:{rid}') rule_ids.add(rid) if rule.get('gate') != expected_gate: raise POCError(f"POLICY_RULE_GATE_INVALID:{rid}:{rule.get('gate')}") if require_blocking is not None and bool(rule.get('blocking')) != require_blocking: raise POCError(f'POLICY_RULE_BLOCKING_INVALID:{rid}') if not isinstance(rule.get('rank'), int) or isinstance(rule.get('rank'), bool): raise POCError(f'POLICY_RULE_RANK_INVALID:{rid}') _deep_validate_condition(rule, policy, allowed_kinds) validate_group(policy.hard_blocker_rules, 'HOLD', True, _ALLOWED_RULE_KINDS) validate_group(policy.risk_elevation_rules, 'HOLD', True, _ALLOWED_RULE_KINDS) validate_group(policy.conditional_restriction_rules, 'RESTRICT', False, _ALLOWED_RULE_KINDS) validate_group(policy.rollback_rules, 'ROLLBACK', True, {'rollback_contract'}) gp = policy.green_path_rule if not isinstance(gp, dict) or gp.get('gate') != 'SHIP' or bool(gp.get('blocking', False)): raise POCError('POLICY_GREEN_PATH_INVALID') if not isinstance(gp.get('rule_id'), str) or not isinstance(gp.get('rule_version'), str): raise POCError('POLICY_GREEN_PATH_ID_VERSION_INVALID') if gp['rule_id'] in rule_ids: raise POCError('POLICY_DUPLICATE_RULE_ID:GREEN_PATH') rule_ids.add(gp['rule_id']) if not isinstance(gp.get('requirements'), list): raise POCError('POLICY_GREEN_PATH_REQUIREMENTS_INVALID') for req in gp['requirements']: _deep_validate_condition(req, policy, _ALLOWED_GREEN_KINDS) pr = policy.precedence_rules if not isinstance(pr, dict): raise POCError('POLICY_PRECEDENCE_INVALID') if pr.get('gate_order') != ['ROLLBACK', 'HOLD', 'RESTRICT', 'SHIP']: raise POCError('POLICY_GATE_ORDER_INVALID') if pr.get('fallback_gate') != 'HOLD': raise POCError('POLICY_FALLBACK_GATE_INVALID') terminals = pr.get('terminal_blocking_rule_ids', []) if not isinstance(terminals, list) or not set(terminals) <= rule_ids: raise POCError('POLICY_TERMINAL_RULE_INVALID') if not isinstance(policy.allowed_overrides, dict): raise POCError('POLICY_OVERRIDES_INVALID') for original, transitions in policy.allowed_overrides.items(): if original not in _ALLOWED_GATES or not isinstance(transitions, dict): raise POCError('POLICY_OVERRIDE_MATRIX_INVALID') for target, roles in transitions.items(): if target not in _ALLOWED_GATES or not isinstance(roles, list) or any((not isinstance(r, str) or not r for r in roles)): raise POCError('POLICY_OVERRIDE_MATRIX_INVALID') predicates = policy.cep_profile.get('predicates') if isinstance(policy.cep_profile, dict) else None if not isinstance(predicates, list): raise POCError('POLICY_CEP_PROFILE_INVALID') predicate_ids = set() for pred in predicates: if not isinstance(pred, dict) or not isinstance(pred.get('predicate_id'), str) or (not isinstance(pred.get('predicate_version'), str)): raise POCError('POLICY_CEP_PREDICATE_ID_VERSION_INVALID') if pred['predicate_id'] in predicate_ids: raise POCError('POLICY_CEP_PREDICATE_DUPLICATE') predicate_ids.add(pred['predicate_id']) if pred.get('on_true_result') != 'REQUIRES_REVIEW': raise POCError('POLICY_CEP_RESULT_INVALID') conditions = pred.get('conditions') if not isinstance(conditions, list) or not conditions: raise POCError('POLICY_CEP_CONDITIONS_INVALID') for cond in conditions: if not isinstance(cond, dict) or cond.get('kind') not in {'metric_in', 'profile_flag'}: raise POCError('POLICY_CEP_CONDITION_INVALID') if cond['kind'] == 'metric_in': if cond.get('metric') not in METRIC_VERSIONS or not isinstance(cond.get('values'), list) or (not cond['values']): raise POCError('POLICY_CEP_METRIC_CONDITION_INVALID') elif cond.get('field') != 'force_cep_review' or not isinstance(cond.get('value'), bool): raise POCError('POLICY_CEP_PROFILE_FLAG_INVALID') known = KNOWN_POLICY_IDENTITIES.get((policy.policy_pack_id, policy.policy_pack_version)) if known is not None and policy.policy_pack_hash != known: raise POCError('POLICY_VERSION_CONTENT_MISMATCH') def _validate_signal(sig: Any) -> None: if not isinstance(sig, dict): raise POCError('SIGNAL_NOT_OBJECT') required = {'signal_id', 'signal_type', 'source_type', 'source_ref', 'raw_value', 'normalized_value', 'confidence', 'completeness', 'observed_at'} if set(sig) != required: raise POCError('SIGNAL_SCHEMA_MISMATCH') for k in ('signal_id', 'signal_type', 'source_type', 'source_ref'): if not isinstance(sig[k], str) or not sig[k]: raise POCError(f'SIGNAL_FIELD_TYPE:{k}') validate_timestamp(sig['observed_at'], 'signal.observed_at') for k in ('confidence', 'completeness'): v = sig[k] if not isinstance(v, (int, float)) or isinstance(v, bool) or (not math.isfinite(v)) or (not 0 <= v <= 1): raise POCError(f'SIGNAL_RANGE:{k}') ensure_json_safe(sig['raw_value']) ensure_json_safe(sig['normalized_value']) def validate_request_schema(req: Dict[str, Any], policy: PolicyPack) -> None: if not isinstance(req, dict): raise POCError('REQUEST_NOT_OBJECT') ensure_json_safe(req) required = {'run_metadata', 'scenario', 'signals', 'metric_inputs', 'governance_context', 'policy_pack_ref'} if set(req) != required: missing = required - set(req) extra = set(req) - required if missing: raise POCError(f'REQUEST_MISSING_FIELDS:{sorted(missing)}') raise POCError(f'REQUEST_EXTRA_FIELDS:{sorted(extra)}') if _contains_forbidden_trusted_fields(req): raise POCError('TRUST_BOUNDARY_VIOLATION') rm = req['run_metadata'] if not isinstance(rm, dict) or set(rm) != {'run_id', 'started_at'}: raise POCError('RUN_METADATA_SCHEMA_MISMATCH') validate_run_id(rm['run_id']) validate_timestamp(rm['started_at'], 'run_metadata.started_at') pref = req['policy_pack_ref'] if not isinstance(pref, dict) or set(pref) != {'policy_pack_id', 'policy_pack_version', 'policy_pack_hash'}: raise POCError('POLICY_PACK_REF_SCHEMA_MISMATCH') if (pref['policy_pack_id'], pref['policy_pack_version'], pref['policy_pack_hash']) != (policy.policy_pack_id, policy.policy_pack_version, policy.policy_pack_hash): raise POCError('POLICY_PACK_REF_MISMATCH') sc = req['scenario'] sc_required = {'scenario_id', 'scenario_type', 'system_id', 'system_version', 'operational_context', 'expected_behavior', 'impact_tier', 'domain', 'artifact_refs', 'policy_tags'} if not isinstance(sc, dict) or set(sc) != sc_required: raise POCError('SCENARIO_SCHEMA_MISMATCH') for k in ('scenario_id', 'scenario_type', 'system_id', 'system_version', 'operational_context', 'expected_behavior', 'domain'): if not isinstance(sc[k], str) or not sc[k]: raise POCError(f'SCENARIO_FIELD_TYPE:{k}') if sc['impact_tier'] not in {'LOW', 'MEDIUM', 'HIGH'}: raise POCError('INVALID_IMPACT_TIER') if not isinstance(sc['artifact_refs'], list) or not all((isinstance(x, str) and x for x in sc['artifact_refs'])): raise POCError('ARTIFACT_REFS_INVALID') if len(set(sc['artifact_refs'])) != len(sc['artifact_refs']): raise POCError('ARTIFACT_REFS_DUPLICATE') if not isinstance(sc['policy_tags'], list) or not all((isinstance(x, str) for x in sc['policy_tags'])): raise POCError('POLICY_TAGS_INVALID') signals = req['signals'] if not isinstance(signals, list): raise POCError('SIGNALS_NOT_LIST') for sig in signals: _validate_signal(sig) signal_ids = [s['signal_id'] for s in signals] if len(signal_ids) != len(set(signal_ids)): raise POCError('SIGNAL_ID_DUPLICATE') lineage_refs = set(signal_ids) | set(sc['artifact_refs']) mi = req['metric_inputs'] if not isinstance(mi, dict): raise POCError('METRIC_INPUTS_NOT_OBJECT') expected = set(METRIC_VERSIONS) - {'drift_status'} if set(mi) != expected: raise POCError('METRIC_INPUT_SET_MISMATCH') for name in sorted(mi): env = mi[name] if not isinstance(env, dict) or set(env) != {'determination_state', 'payload', 'input_refs'}: raise POCError(f'METRIC_INPUT_ENVELOPE_INVALID:{name}') if env['determination_state'] not in {'AVAILABLE', 'INSUFFICIENT_FOR_CLASSIFICATION'}: raise POCError(f'METRIC_INPUT_DETERMINATION_INVALID:{name}') refs = env['input_refs'] if not isinstance(refs, list) or not refs or (not all((isinstance(x, str) and x for x in refs))): raise POCError(f'METRIC_INPUT_REFS_INVALID:{name}') unresolved = [x for x in refs if x not in lineage_refs] if unresolved: raise POCError(f'METRIC_INPUT_REF_UNRESOLVED:{name}:{sorted(unresolved)}') ensure_json_safe(env['payload']) gc = req['governance_context'] required_gc = {'environment', 'deployment_risk_tier', 'tenant_or_environment_profile', 'baseline_comparison'} if not isinstance(gc, dict) or set(gc) != required_gc: raise POCError('GOVERNANCE_CONTEXT_SCHEMA_MISMATCH') for k in ('environment', 'deployment_risk_tier', 'tenant_or_environment_profile'): if not isinstance(gc[k], str) or not gc[k]: raise POCError(f'GOVERNANCE_CONTEXT_FIELD_TYPE:{k}') bc = gc['baseline_comparison'] bc_req = {'baseline_id', 'baseline_version', 'comparison_scope', 'gap_score', 'source_ref'} if not isinstance(bc, dict) or set(bc) != bc_req: raise POCError('BASELINE_SCHEMA_MISMATCH') for k in ('baseline_id', 'baseline_version', 'comparison_scope', 'source_ref'): if not isinstance(bc[k], str) or not bc[k]: raise POCError(f'BASELINE_FIELD_TYPE:{k}') gap = bc['gap_score'] if not isinstance(gap, (int, float)) or isinstance(gap, bool) or (not math.isfinite(gap)) or (not 0 <= gap <= 100): raise POCError('INVALID_BASELINE_GAP') validate_metric_derivation(req) def validate_trusted_control(env: Dict[str, Any]) -> None: if not isinstance(env, dict): raise POCError('TRUSTED_CONTROL_NOT_OBJECT') ensure_json_safe(env) required = {'trusted_source_id', 'human_review_status', 'approval_status', 'recovery_state', 'control_timestamp'} if set(env) != required: raise POCError('TRUSTED_CONTROL_SCHEMA_MISMATCH') if not isinstance(env['trusted_source_id'], str) or not env['trusted_source_id']: raise POCError('TRUSTED_CONTROL_IDENTITY_INVALID') validate_timestamp(env['control_timestamp'], 'trusted_control.control_timestamp') if env['human_review_status'] not in {'NOT_REQUIRED', 'REQUIRED_PENDING', 'COMPLETED_APPROVED', 'COMPLETED_REJECTED'}: raise POCError('INVALID_HUMAN_REVIEW_STATUS') if env['approval_status'] not in {'NOT_REQUIRED', 'REQUIRED_MISSING', 'APPROVED', 'REJECTED'}: raise POCError('INVALID_APPROVAL_STATUS') rs = env['recovery_state'] req = {'prior_operational_state_exists', 'current_or_prior_state_invalidated', 'verified_safer_state_available', 'rollback_authority_confirmed'} if not isinstance(rs, dict) or set(rs) != req or any((not isinstance(rs[k], bool) for k in req)): raise POCError('RECOVERY_STATE_INVALID') def validate_trusted_override_authorization(env: Dict[str, Any]) -> None: if not isinstance(env, dict): raise POCError('TRUSTED_OVERRIDE_NOT_OBJECT') ensure_json_safe(env) required = {'trusted_source_id', 'actor_id', 'approval_role', 'authorization_status', 'control_timestamp'} if set(env) != required: raise POCError('TRUSTED_OVERRIDE_SCHEMA_MISMATCH') for k in ('trusted_source_id', 'actor_id', 'approval_role'): if not isinstance(env[k], str) or not env[k]: raise POCError(f'TRUSTED_OVERRIDE_FIELD_TYPE:{k}') validate_timestamp(env['control_timestamp'], 'trusted_override.control_timestamp') if env['authorization_status'] not in {'AUTHORIZED', 'REJECTED'}: raise POCError('TRUSTED_OVERRIDE_STATUS_INVALID') def resolve_policy_profile(policy: PolicyPack, scenario: Dict[str, Any], gc: Dict[str, Any]) -> Dict[str, Any]: domain = scenario['domain'] environment = gc['environment'] tenant = gc['tenant_or_environment_profile'] if domain not in policy.domain_specific_rules: raise POCError('UNKNOWN_POLICY_DOMAIN') if environment not in policy.tenant_or_environment_tolerances: raise POCError('UNKNOWN_POLICY_ENVIRONMENT') if tenant not in policy.tenant_or_environment_tolerances: raise POCError('UNKNOWN_POLICY_TENANT_PROFILE') dr = copy.deepcopy(policy.domain_specific_rules[domain]) er = copy.deepcopy(policy.tenant_or_environment_tolerances[environment]) tr = copy.deepcopy(policy.tenant_or_environment_tolerances[tenant]) force = any((bool(x.get('force_cep_review', False)) for x in (dr, er, tr))) profile = {'source_policy_pack_id': policy.policy_pack_id, 'source_policy_pack_version': policy.policy_pack_version, 'source_policy_pack_hash': policy.policy_pack_hash, 'resolved_domain_profile': dr, 'resolved_environment_profile': er, 'resolved_tenant_or_environment_profile': tr, 'evidence_requirements': copy.deepcopy(policy.evidence_minimums), 'authority_constraints': {'enforced': True}, 'reversibility_constraints': {'enforced': True}, 'review_requirements': {'force_cep_review': force}, 'cep_relevant_policy_flags': {'force_cep_review': force}, 'cep_review_predicates': copy.deepcopy(policy.cep_profile['predicates'])} profile['policy_profile_hash'] = sha256_obj(profile) return profile def _rule(rule_id: str, triggered: bool, gate: Optional[str], blocking: bool, explanation: str, inputs: List[str], rank: int, rule_class: str='POLICY', rule_version: str='1.0.2') -> Dict[str, Any]: return {'rule_id': rule_id, 'rule_version': rule_version, 'rule_class': rule_class, 'triggered': bool(triggered), 'candidate_gate': gate if triggered else None, 'input_refs': inputs, 'blocking': bool(blocking) if triggered else False, 'explanation': explanation, 'precedence_rank': rank, 'evaluated_at': utc_now()} def _rule_from_spec(spec, metrics, scenario, trusted, policy, rule_class): triggered = _eval_policy_spec(spec, metrics, scenario, trusted, policy) inputs = [] if 'metric' in spec: inputs.append(spec['metric']) if spec['kind'].startswith('trusted') or spec['kind'] == 'rollback_contract': inputs.append('trusted_control') if 'impact_values' in spec: inputs.append('scenario.impact_tier') return _rule(spec['rule_id'], triggered, spec.get('gate'), bool(spec.get('blocking', False)), spec.get('explanation', spec['rule_id'].replace('-', ' ').title()), inputs, int(spec.get('rank', 50)), rule_class, spec['rule_version']) def _evaluate_green_path_v106(metrics, scenario, trusted, policy, prior_rules): spec = policy.green_path_rule satisfied = all((_eval_policy_spec(req, metrics, scenario, trusted, policy) for req in spec.get('requirements', []))) if spec.get('requires_no_blocking_rules', False): satisfied = satisfied and (not any((r['triggered'] and r['blocking'] for r in prior_rules))) return _rule(spec['rule_id'], satisfied, spec['gate'], False, 'All PolicyPack Green-Path requirements satisfied.', ['required_metrics', 'trusted_control', 'scenario.impact_tier'], int(spec.get('rank', 60)), 'GREEN_PATH', spec['rule_version']) def semantic_material(metrics, rules, final_gate, rationale_code, policy, profile): triggered = sorted((r['rule_id'] for r in rules if r['triggered'])) versions = sorted([[r['rule_id'], r['rule_version']] for r in rules if r['triggered']]) candidate = sorted({r['candidate_gate'] for r in rules if r['triggered'] and r['candidate_gate']}) mm = {k: {'status': v['status'], 'classification': v['classification'], 'metric_version': v['metric_version'], 'metric_config_version': v['metric_config_version']} for k, v in sorted(metrics.items())} required_actions = ['PROCEED'] escalation = [] if final_gate == 'RESTRICT': required_actions = ['CONSTRAIN'] elif final_gate == 'HOLD': required_actions = ['REVIEW'] escalation = list(policy.escalation_requirements.get('HOLD', ['GOVERNANCE_REVIEW'])) elif final_gate == 'ROLLBACK': required_actions = ['RECOVER'] return {'metrics': mm, 'metric_registry_version': METRIC_REGISTRY_VERSION, 'metric_registry_hash': METRIC_REGISTRY_HASH, 'triggered_rules': triggered, 'triggered_rule_versions': versions, 'candidate_gates': candidate, 'final_gate': final_gate, 'required_actions': required_actions, 'escalation_requirements': escalation, 'rationale_code': rationale_code, 'policy_pack_id': policy.policy_pack_id, 'policy_pack_version': policy.policy_pack_version, 'policy_pack_hash': policy.policy_pack_hash, 'policy_profile_hash': profile['policy_profile_hash'], 'engine_decision_semantics_version': DECISION_SEMANTICS_VERSION} def _policy_rule_shape(rule): keys = ('kind', 'metric', 'values', 'impact_values', 'threshold_key', 'order', 'field', 'gate', 'blocking') return {k: copy.deepcopy(rule[k]) for k in keys if k in rule} def _validate_v15_policy_pack_v106(policy: PolicyPack) -> None: """POC V1.5 conformance profile, distinct from generic PolicyPack syntax validation.""" validate_policy_pack(policy) if set(policy.required_metrics) != set(DEFAULT_POLICY_PACK.required_metrics): raise POCError('V15_REQUIRED_METRICS_MISMATCH') groups = ('hard_blocker_rules', 'risk_elevation_rules', 'conditional_restriction_rules', 'rollback_rules') for g in groups: expected = {r['rule_id']: _policy_rule_shape(r) for r in getattr(DEFAULT_POLICY_PACK, g)} actual = {r['rule_id']: _policy_rule_shape(r) for r in getattr(policy, g)} for rid, shape in expected.items(): if rid not in actual or actual[rid] != shape: raise POCError(f'V15_RULE_COVERAGE_MISMATCH:{g}:{rid}') expected_gp = [_policy_rule_shape(x) for x in DEFAULT_POLICY_PACK.green_path_rule['requirements']] actual_gp = [_policy_rule_shape(x) for x in policy.green_path_rule.get('requirements', [])] if actual_gp != expected_gp or policy.green_path_rule.get('gate') != 'SHIP' or (not policy.green_path_rule.get('requires_no_blocking_rules', False)): raise POCError('V15_GREEN_PATH_MISMATCH') if policy.precedence_rules.get('gate_order') != DEFAULT_POLICY_PACK.precedence_rules.get('gate_order') or policy.precedence_rules.get('fallback_gate') != 'HOLD': raise POCError('V15_PRECEDENCE_MISMATCH') if not policy.rollback_rules: raise POCError('V15_ROLLBACK_RULE_REQUIRED') def _cep_shape(pred): return {k: copy.deepcopy(pred.get(k)) for k in ('predicate_id','predicate_version','conditions','on_true_result')} if [_cep_shape(x) for x in policy.cep_profile.get('predicates', [])] != [_cep_shape(x) for x in DEFAULT_POLICY_PACK.cep_profile.get('predicates', [])]: raise POCError('V15_CEP_PREDICATE_PROFILE_MISMATCH') if policy.allowed_overrides != DEFAULT_POLICY_PACK.allowed_overrides: raise POCError('V15_OVERRIDE_MATRIX_MISMATCH') def bind_fixture_evidence(req: Dict[str, Any]) -> Dict[str, Any]: """Test-fixture helper. Produces deterministic synthetic Signal→MetricInput identity derivations.""" if not isinstance(req, dict) or not isinstance(req.get('metric_inputs'), dict): return req run_id = str((req.get('run_metadata') or {}).get('run_id', 'RUN')) observed_at = (req.get('run_metadata') or {}).get('started_at', utc_now()) signals = [] for name, env in req['metric_inputs'].items(): sid = f'SIG-{run_id}-{name}' env['input_refs'] = [sid] payload = env.get('payload') signals.append({'signal_id': sid, 'signal_type': f'NORMALIZED_METRIC_SOURCE:{name}', 'source_type': 'SYNTHETIC', 'source_ref': f'fixture:{run_id}:{name}', 'raw_value': {'metric_name': name, 'payload': payload}, 'normalized_value': payload, 'confidence': 1.0, 'completeness': 1.0, 'observed_at': observed_at}) req['signals'] = signals return req def metric_normalization_records(req: Dict[str, Any]) -> Dict[str, Any]: by_id = {s['signal_id']: s for s in req.get('signals', []) if isinstance(s, dict) and isinstance(s.get('signal_id'), str)} out = {} for name, env in req.get('metric_inputs', {}).items(): refs = list(env.get('input_refs', [])) src = [] for ref in refs: s = by_id.get(ref) if s is not None: src.append({'signal_id': ref, 'signal_hash': sha256_obj(s)}) out[name] = {'transform_id': 'IDENTITY_NORMALIZED_SIGNAL_V1', 'source_signals': src, 'payload_hash': sha256_obj(env.get('payload')), 'determination_state': env.get('determination_state')} return out def validate_metric_derivation(req: Dict[str, Any]) -> None: by_id = {s['signal_id']: s for s in req.get('signals', []) if isinstance(s, dict) and isinstance(s.get('signal_id'), str)} for name in sorted(req.get('metric_inputs', {})): env = req['metric_inputs'][name] refs = env.get('input_refs', []) if len(refs) != 1 or refs[0] not in by_id: raise POCError(f'METRIC_DERIVATION_SIGNAL_REQUIRED:{name}') sig = by_id[refs[0]] if sig.get('signal_type') != f'NORMALIZED_METRIC_SOURCE:{name}': raise POCError(f'METRIC_DERIVATION_SIGNAL_TYPE:{name}') rv = sig.get('raw_value') if not isinstance(rv, dict) or rv.get('metric_name') != name or rv.get('payload') != env.get('payload') or (sig.get('normalized_value') != env.get('payload')): raise POCError(f'METRIC_DERIVATION_MISMATCH:{name}') def _canonical_metric_trace(metrics: Dict[str, Any]) -> Dict[str, Any]: out = {} for name, m in sorted(metrics.items()): out[name] = {k: copy.deepcopy(v) for k, v in m.items() if k != 'computed_at'} if isinstance(m, dict) else m return out def _canonical_rule_trace(rules: List[Dict[str, Any]]) -> List[Dict[str, Any]]: return [{k: copy.deepcopy(v) for k, v in r.items() if k != 'evaluated_at'} for r in rules] def _parse_run_ts(value: str) -> datetime: text = validate_timestamp(value, 'run.timestamp') return datetime.fromisoformat(text[:-1] + '+00:00' if text.endswith('Z') else text) def validate_persisted_run_entity(run: Dict[str, Any], req: Dict[str, Any], trusted: Optional[Dict[str, Any]], bundle: Dict[str, Any], run_id: str) -> None: required = {'run_id','engine_version','metric_registry_version','metric_registry_hash','policy_pack_id','policy_pack_version','policy_pack_hash','policy_profile_hash','request_hash','trusted_control_hash','started_at','source_started_at','completed_at','run_status'} if not isinstance(run, dict) or set(run) != required: raise POCError('RUN_ENTITY_SCHEMA_MISMATCH') if run['run_id'] != run_id: raise POCError('RUN_ENTITY_ID_MISMATCH') if run['run_status'] not in {'COMPLETED','FAILED_CLOSED'}: raise POCError('RUN_ENTITY_STATUS_INVALID') if run['engine_version'] != ENGINE_VERSION: raise POCError('RUN_ENGINE_VERSION_MISMATCH') if run['metric_registry_version'] != METRIC_REGISTRY_VERSION or run['metric_registry_hash'] != METRIC_REGISTRY_HASH: raise POCError('RUN_METRIC_REGISTRY_IDENTITY_MISMATCH') if run['policy_pack_id'] != bundle.get('policy_pack_id') or run['policy_pack_version'] != bundle.get('policy_pack_version') or run['policy_pack_hash'] != bundle.get('policy_pack_hash'): raise POCError('RUN_POLICY_IDENTITY_MISMATCH') if run['request_hash'] != sha256_obj(req): raise POCError('RUN_REQUEST_HASH_MISMATCH') expected_trusted = sha256_obj(trusted) if trusted is not None else None if run['trusted_control_hash'] != expected_trusted: raise POCError('RUN_TRUSTED_CONTROL_HASH_MISMATCH') src = req.get('run_metadata', {}).get('started_at') if run['source_started_at'] != src: raise POCError('RUN_SOURCE_TIMESTAMP_MISMATCH') if src is not None: validate_timestamp(src, 'run.source_started_at') if _parse_run_ts(run['completed_at']) < _parse_run_ts(run['started_at']): raise POCError('RUN_TIMESTAMP_ORDER_INVALID') def _expected_override_extension(run_id: str, seq: int, bundle: Dict[str, Any], overrides: List[Dict[str, Any]]) -> Dict[str, Any]: latest = overrides[seq-1] ext = {'extension_id': f'OVERRIDE-EVIDENCE-{run_id}-{seq}', 'run_id': run_id, 'base_bundle_integrity_hash': bundle['integrity_hash'], 'override_refs': [x['override_id'] for x in overrides[:seq]], 'latest_override_id': latest['override_id'], 'trusted_authorization_ref': latest.get('trusted_authorization_ref'), 'trusted_authorization_hash': latest.get('trusted_authorization_hash')} ext['integrity_hash'] = sha256_obj(ext) return ext def _semantic_replay_projection_v106(path: Path) -> Dict[str, Any]: def r(name, default=None): q = path / name return read_json(q) if q.exists() else default # decision_id and run_id are deterministic identities and MUST replay exactly. # Only decision_timestamp is intentionally nondeterministic across a fresh replay. return {'semantic_material': r('semantic_material.json', {}), 'policy_profile': r('policy_profile.json'), 'cep_predicates': r('cep_predicate_evaluations.json', []), 'decision': {k: v for k, v in (r('decision_package.json', {}) or {}).items() if k != 'decision_timestamp'}} def _timestamp_dt(value: Any, field: str) -> datetime: text = validate_timestamp(value, field) return datetime.fromisoformat(text[:-1] + '+00:00' if text.endswith('Z') else text) EVIDENCE_BUNDLE_KNOWN_LIMITATIONS = [ 'Synthetic metric plug-ins are not empirically validated.', 'CEP predicates are POC policy choices, not empirically validated CEP classifiers.', 'Trusted-control separation is interface-level; no cryptographic authentication is claimed.', 'No real-time production enforcement is claimed.' ] _OVERRIDE_AUTH_REF_RE = re.compile(r'^trusted_override_authorization_[0-9]{4}\.json$') def _canonical_decision_id(run_id: str) -> str: return f'DEC-{run_id}' def _validate_decision_identity(decision: Dict[str, Any], run_id: str) -> None: if not isinstance(decision, dict): raise POCError('DECISION_PACKAGE_INVALID') if decision.get('run_id') != run_id: raise POCError('DECISION_RUN_ID_MISMATCH') if decision.get('decision_id') != _canonical_decision_id(run_id): raise POCError('DECISION_ID_MISMATCH') def _expected_evidence_bundle_v106( run_id: str, req: Dict[str, Any], trusted: Optional[Dict[str, Any]], decision: Dict[str, Any], metrics: Dict[str, Any], profile_hash: Optional[str], registry: Dict[str, Any], policy: PolicyPack, ) -> Dict[str, Any]: scenario = req.get('scenario', {}) if isinstance(req, dict) else {} signals = req.get('signals', []) if isinstance(req, dict) else [] raw_artifact_refs = scenario.get('artifact_refs', []) if isinstance(scenario, dict) else [] artifact_refs = list(raw_artifact_refs) if isinstance(raw_artifact_refs, list) else [] bundle = { 'bundle_id': f'BUNDLE-{run_id}', 'run_id': run_id, 'input_hash': sha256_obj(req), 'trusted_control_hash': sha256_obj(trusted) if trusted is not None else None, 'metric_registry_version': METRIC_REGISTRY_VERSION, 'metric_registry_hash': sha256_obj(registry), 'metric_versions': {k: v.get('metric_version') for k, v in metrics.items()}, 'metric_config_versions': {k: v.get('metric_config_version') for k, v in metrics.items()}, 'policy_pack_id': policy.policy_pack_id, 'policy_pack_version': policy.policy_pack_version, 'policy_pack_hash': policy.policy_pack_hash, 'policy_profile_hash': profile_hash, 'rule_engine_version': ENGINE_VERSION, 'decision_hash': sha256_obj(decision), 'semantic_decision_hash': decision['semantic_decision_hash'], 'override_refs': [], 'signal_refs': [s.get('signal_id') for s in signals if isinstance(s, dict) and isinstance(s.get('signal_id'), str)], 'artifact_refs': artifact_refs, 'audit_refs': ['run.json', 'rule_evaluations.json', 'decision_package.json', 'semantic_material.json'], 'known_limitations': list(EVIDENCE_BUNDLE_KNOWN_LIMITATIONS), } bundle['integrity_hash'] = sha256_obj(bundle) return bundle def _validate_evidence_bundle_semantics_v106( bundle: Dict[str, Any], run_id: str, req: Dict[str, Any], trusted: Optional[Dict[str, Any]], decision: Dict[str, Any], metrics: Dict[str, Any], profile_hash: Optional[str], registry: Dict[str, Any], policy: PolicyPack, ) -> None: expected = _expected_evidence_bundle(run_id, req, trusted, decision, metrics, profile_hash, registry, policy) if bundle != expected: raise POCError('EVIDENCE_BUNDLE_SEMANTIC_MISMATCH') def _resolve_canonical_override_auth_ref(rd: Path, auth_ref: Any) -> Optional[Path]: if auth_ref is None: return None if not isinstance(auth_ref, str) or not _OVERRIDE_AUTH_REF_RE.fullmatch(auth_ref): raise POCError('OVERRIDE_AUTH_REF_NONCANONICAL') ref_path = Path(auth_ref) if ref_path.is_absolute() or ref_path.name != auth_ref or len(ref_path.parts) != 1: raise POCError('OVERRIDE_AUTH_REF_PATH_INVALID') resolved_root = rd.resolve() resolved = (resolved_root / auth_ref).resolve() if resolved.parent != resolved_root: raise POCError('OVERRIDE_AUTH_REF_OUTSIDE_RUN') return resolved def _latest_manifest_files(rd: Path) -> set: manifests = ([rd / 'manifest.json'] if (rd / 'manifest.json').exists() else []) + sorted(rd.glob('manifest_override_*.json')) if not manifests: return set() latest = read_json(manifests[-1]) return set((latest.get('files') or {}).keys()) def _validate_source_started_before_engine(req: Dict[str, Any], engine_started_at: str) -> None: source = req.get('run_metadata', {}).get('started_at') if isinstance(req, dict) else None if source is None: raise POCError('SOURCE_STARTED_AT_MISSING') if _timestamp_dt(source, 'run_metadata.started_at') > _timestamp_dt(engine_started_at, 'engine.started_at'): raise POCError('SOURCE_STARTED_AT_POSTDATES_ENGINE_START') def _validate_full_persisted_chronology_v106( req: Dict[str, Any], trusted: Optional[Dict[str, Any]], decision: Dict[str, Any], run: Dict[str, Any], metrics: Dict[str, Any], rules: List[Dict[str, Any]], ) -> None: source_dt = _timestamp_dt(run.get('source_started_at'), 'run.source_started_at') started_dt = _timestamp_dt(run.get('started_at'), 'run.started_at') decision_dt = _timestamp_dt(decision.get('decision_timestamp'), 'decision.decision_timestamp') completed_dt = _timestamp_dt(run.get('completed_at'), 'run.completed_at') now_dt = datetime.now(timezone.utc) # Audit-generated chronology is mandatory for every terminal state. if started_dt > decision_dt: raise POCError('RUN_START_POSTDATES_DECISION') if decision_dt > completed_dt: raise POCError('DECISION_TIMESTAMP_POSTDATES_COMPLETION') if completed_dt > now_dt: raise POCError('RUN_COMPLETION_IN_FUTURE') # Source chronology is a success-path invariant. A FAILED_CLOSED Run may exist # precisely because source/control chronology was invalid; deterministic replay # must prove that failure cause rather than treating the evidence package itself # as unverifiable. Syntax is still validated above. if run.get('run_status') == 'COMPLETED': if source_dt > started_dt: raise POCError('SOURCE_STARTED_AT_POSTDATES_ENGINE_START') for sig in req.get('signals', []): observed = _timestamp_dt(sig.get('observed_at'), f"signal.observed_at:{sig.get('signal_id','UNKNOWN')}") if observed > decision_dt: raise POCError(f"SIGNAL_TIMESTAMP_POSTDATES_DECISION:{sig.get('signal_id','UNKNOWN')}") if trusted is not None: control = _timestamp_dt(trusted.get('control_timestamp'), 'trusted_control.control_timestamp') if control > decision_dt: raise POCError('TRUSTED_CONTROL_TIMESTAMP_POSTDATES_DECISION') else: for sig in req.get('signals', []): _timestamp_dt(sig.get('observed_at'), f"signal.observed_at:{sig.get('signal_id','UNKNOWN')}") if trusted is not None: _timestamp_dt(trusted.get('control_timestamp'), 'trusted_control.control_timestamp') for name, metric in metrics.items(): computed = _timestamp_dt(metric.get('computed_at'), f'metric.computed_at:{name}') if computed < started_dt or computed > decision_dt: raise POCError(f'METRIC_TIMESTAMP_OUTSIDE_DECISION_INTERVAL:{name}') for idx, rule in enumerate(rules, 1): evaluated = _timestamp_dt(rule.get('evaluated_at'), f'rule.evaluated_at:{idx}') if evaluated < started_dt or evaluated > decision_dt: raise POCError(f'RULE_TIMESTAMP_OUTSIDE_DECISION_INTERVAL:{idx}') def _override_artifact_sequences(rd: Path, prefix: str) -> List[int]: rx = re.compile(rf'^{re.escape(prefix)}_([0-9]{{4}})\.json$') values = [] for p in rd.iterdir(): if not p.is_file(): continue m = rx.fullmatch(p.name) if m: values.append(int(m.group(1))) return sorted(values) def _validate_override_namespace_closure_v106(rd: Path, run_id: str, decision: Dict[str, Any]) -> None: if (rd / 'overrides.json').exists(): raise POCError('LEGACY_OVERRIDES_COLLECTION_PRESENT') override_seq = _override_artifact_sequences(rd, 'override') request_seq = _override_artifact_sequences(rd, 'override_request') evidence_seq = _override_artifact_sequences(rd, 'override_evidence') expected_seq = list(range(1, len(override_seq) + 1)) if override_seq != expected_seq: raise POCError('OVERRIDE_SEQUENCE_GAP') if request_seq != override_seq: raise POCError('OVERRIDE_REQUEST_NAMESPACE_MISMATCH') if evidence_seq != override_seq: raise POCError('OVERRIDE_EVIDENCE_NAMESPACE_MISMATCH') auth_files = sorted(p.name for p in rd.glob('trusted_override_authorization_[0-9][0-9][0-9][0-9].json')) refs = [] for seq in override_seq: request = read_json(rd / f'override_request_{seq:04d}.json') _validate_override_request_record(request, run_id, decision['decision_id'], seq) ref = request.get('trusted_authorization_ref') if ref is not None: _resolve_canonical_override_auth_ref(rd, ref) refs.append(ref) if len(refs) != len(set(refs)): raise POCError('TRUSTED_OVERRIDE_AUTH_REUSED') if sorted(refs) != auth_files: raise POCError('TRUSTED_OVERRIDE_AUTH_NAMESPACE_MISMATCH') def _validate_override_chronology(rd: Path, run: Dict[str, Any], decision: Dict[str, Any]) -> None: decision_dt = _timestamp_dt(decision.get('decision_timestamp'), 'decision.decision_timestamp') completed_dt = _timestamp_dt(run.get('completed_at'), 'run.completed_at') now_dt = datetime.now(timezone.utc) for seq in _override_artifact_sequences(rd, 'override'): request = read_json(rd / f'override_request_{seq:04d}.json') override = read_json(rd / f'override_{seq:04d}.json') req_dt = _timestamp_dt(request.get('request_timestamp'), f'override_request.request_timestamp:{seq}') ov_dt = _timestamp_dt(override.get('timestamp'), f'override.timestamp:{seq}') if req_dt < decision_dt or req_dt < completed_dt: raise POCError(f'OVERRIDE_REQUEST_PREDATES_DECISION_COMPLETION:{seq}') if req_dt > ov_dt: raise POCError(f'OVERRIDE_REQUEST_POSTDATES_OVERRIDE:{seq}') if ov_dt > now_dt: raise POCError(f'OVERRIDE_TIMESTAMP_IN_FUTURE:{seq}') ref = request.get('trusted_authorization_ref') if ref is not None: ap = _resolve_canonical_override_auth_ref(rd, ref) auth = read_json(ap) auth_dt = _timestamp_dt(auth.get('control_timestamp'), f'trusted_override.control_timestamp:{seq}') if auth_dt < decision_dt or auth_dt < completed_dt: raise POCError(f'OVERRIDE_AUTH_PREDATES_DECISION_COMPLETION:{seq}') if auth_dt > req_dt: raise POCError(f'OVERRIDE_AUTH_POSTDATES_REQUEST:{seq}') def _validate_source_temporal_provenance(req: Dict[str, Any], trusted: Optional[Dict[str, Any]], reference_timestamp: str) -> None: cutoff = _timestamp_dt(reference_timestamp, 'temporal.reference') source_started = _timestamp_dt(req.get('run_metadata', {}).get('started_at'), 'run_metadata.started_at') if source_started > cutoff: raise POCError('SOURCE_STARTED_AT_IN_FUTURE') for sig in req.get('signals', []): observed = _timestamp_dt(sig.get('observed_at'), f"signal.observed_at:{sig.get('signal_id','UNKNOWN')}") if observed > cutoff: raise POCError(f"SIGNAL_TIMESTAMP_POSTDATES_DECISION:{sig.get('signal_id','UNKNOWN')}") if trusted is not None: control = _timestamp_dt(trusted.get('control_timestamp'), 'trusted_control.control_timestamp') if control > cutoff: raise POCError('TRUSTED_CONTROL_TIMESTAMP_POSTDATES_DECISION') def _validate_persisted_completed_chronology(req: Dict[str, Any], trusted: Optional[Dict[str, Any]], decision: Dict[str, Any], run: Dict[str, Any]) -> None: decision_dt = _timestamp_dt(decision.get('decision_timestamp'), 'decision.decision_timestamp') completed_dt = _timestamp_dt(run.get('completed_at'), 'run.completed_at') if decision_dt > completed_dt: raise POCError('DECISION_TIMESTAMP_POSTDATES_COMPLETION') for sig in req.get('signals', []): observed = _timestamp_dt(sig.get('observed_at'), f"signal.observed_at:{sig.get('signal_id','UNKNOWN')}") if observed > decision_dt: raise POCError(f"SIGNAL_TIMESTAMP_POSTDATES_DECISION:{sig.get('signal_id','UNKNOWN')}") if trusted is not None: control = _timestamp_dt(trusted.get('control_timestamp'), 'trusted_control.control_timestamp') if control > decision_dt: raise POCError('TRUSTED_CONTROL_TIMESTAMP_POSTDATES_DECISION') def _snapshot_original_json_error(obj: Any) -> Optional[str]: if isinstance(obj, dict): if set(obj) == {'__non_finite_float__'}: return 'NON_JSON_SAFE_INPUT:ValueError' if set(obj) == {'__unsupported_type__', '__repr__'}: return 'NON_JSON_SAFE_INPUT:TypeError' for value in obj.values(): found = _snapshot_original_json_error(value) if found: return found elif isinstance(obj, list): for value in obj: found = _snapshot_original_json_error(value) if found: return found return None def _override_authorization_material(record: Dict[str, Any]) -> Dict[str, Any]: keys = ('authorization_id', 'run_id', 'decision_id', 'trusted_source_id', 'actor_id', 'approval_role', 'authorization_status', 'control_timestamp') return {k: record[k] for k in keys} def _validate_bound_override_authorization_record(record: Dict[str, Any], run_id: str, decision_id: str, expected_authorization_id: Optional[str]=None) -> Dict[str, Any]: required = {'authorization_id','run_id','decision_id','trusted_source_id','actor_id','approval_role','authorization_status','control_timestamp','authorization_hash'} if not isinstance(record, dict) or set(record) != required: raise POCError('TRUSTED_OVERRIDE_AUTH_RECORD_SCHEMA_MISMATCH') if record['run_id'] != run_id or record['decision_id'] != decision_id: raise POCError('TRUSTED_OVERRIDE_AUTH_BINDING_MISMATCH') if expected_authorization_id is not None and record['authorization_id'] != expected_authorization_id: raise POCError('TRUSTED_OVERRIDE_AUTH_ID_MISMATCH') auth = {k: record[k] for k in ('trusted_source_id', 'actor_id', 'approval_role', 'authorization_status', 'control_timestamp')} validate_trusted_override_authorization(auth) if record.get('authorization_hash') != sha256_obj(_override_authorization_material(record)): raise POCError('TRUSTED_OVERRIDE_AUTH_HASH_MISMATCH') return auth def _validate_override_request_record(record: Dict[str, Any], run_id: str, decision_id: str, seq: int) -> None: required = {'override_request_id','run_id','decision_id','requested_gate','justification','trusted_authorization_ref','request_timestamp'} if not isinstance(record, dict) or set(record) != required: raise POCError('OVERRIDE_REQUEST_SCHEMA_MISMATCH') if record['override_request_id'] != f'OVREQ-{run_id}-{seq}': raise POCError('OVERRIDE_REQUEST_ID_MISMATCH') if record['run_id'] != run_id or record['decision_id'] != decision_id: raise POCError('OVERRIDE_REQUEST_BINDING_MISMATCH') if record['requested_gate'] not in _ALLOWED_GATES: raise POCError('OVERRIDE_REQUEST_GATE_INVALID') if not isinstance(record['justification'], str) or not record['justification'].strip(): raise POCError('OVERRIDE_REQUEST_JUSTIFICATION_INVALID') if record['trusted_authorization_ref'] is not None and not isinstance(record['trusted_authorization_ref'], str): raise POCError('OVERRIDE_REQUEST_AUTH_REF_INVALID') validate_timestamp(record['request_timestamp'], 'override_request.request_timestamp') def _derive_override_record_v106( run_id: str, seq: int, decision: Dict[str, Any], policy: PolicyPack, rules: List[Dict[str, Any]], prior: List[Dict[str, Any]], request_record: Dict[str, Any], auth_record: Optional[Dict[str, Any]], ) -> Dict[str, Any]: original = decision['final_gate'] requested_gate = request_record['requested_gate'] justification = request_record['justification'] auth_ref = request_record.get('trusted_authorization_ref') accepted_prior = [x for x in prior if x.get('override_status') == 'ACCEPTED'] used_refs = {x.get('trusted_authorization_ref') for x in prior if x.get('trusted_authorization_ref')} if auth_record is not None: auth = _validate_bound_override_authorization_record(auth_record, run_id, decision['decision_id']) actor = auth['actor_id'] role = auth['approval_role'] status = auth['authorization_status'] auth_hash = auth_record['authorization_hash'] else: auth = None actor = 'UNRESOLVED' role = 'UNRESOLVED' status = 'MISSING' auth_hash = None allowed = False reason = 'TRUSTED_OVERRIDE_AUTHORIZATION_MISSING' if accepted_prior: reason = 'DECISION_ALREADY_OVERRIDDEN' elif auth_ref in used_refs and auth_ref is not None: reason = 'TRUSTED_OVERRIDE_AUTHORIZATION_CONSUMED' elif auth is not None and status == 'AUTHORIZED': allowed = role in policy.allowed_overrides.get(original, {}).get(requested_gate, []) reason = 'POLICY_OVERRIDE_MATRIX' if allowed and original == 'RESTRICT' and requested_gate == 'SHIP': if any((r.get('triggered') and r.get('blocking')) for r in rules): allowed = False reason = 'ACTIVE_BLOCKER_PREVENTS_RELAXATION' elif auth is not None: reason = 'TRUSTED_OVERRIDE_AUTHORIZATION_REJECTED' return { 'override_id': f'OVR-{run_id}-{seq}', 'decision_id': decision['decision_id'], 'actor_id': actor, 'approval_role': role, 'requested_gate': requested_gate, 'original_gate': original, 'override_status': 'ACCEPTED' if allowed else 'REJECTED', 'justification': justification, 'authorizing_policy_rule': reason, 'trusted_authorization_status': status, 'trusted_authorization_ref': auth_ref, 'trusted_authorization_hash': auth_hash, } def _canonical_override_record(record: Dict[str, Any]) -> Dict[str, Any]: return {k: copy.deepcopy(v) for k, v in record.items() if k != 'timestamp'} def _verify_request_duplicate_artifacts(rd: Path, req: Dict[str, Any], run_status: str) -> List[str]: errors: List[str] = [] mapping = ( ('scenario.json', 'scenario'), ('governance_context.json', 'governance_context'), ('signals.json', 'signals'), ('metric_input_envelopes.json', 'metric_inputs'), ) for filename, key in mapping: p = rd / filename present_in_request = isinstance(req, dict) and key in req if present_in_request: if not p.exists(): errors.append(f'REQUEST_DUPLICATE_ARTIFACT_MISSING:{filename}') else: try: if read_json(p) != req[key]: errors.append(f'REQUEST_DUPLICATE_ARTIFACT_MISMATCH:{filename}') except Exception as exc: errors.append(f'REQUEST_DUPLICATE_ARTIFACT_INVALID:{filename}:{type(exc).__name__}') elif p.exists(): errors.append(f'REQUEST_DUPLICATE_ARTIFACT_ORPHAN:{filename}') elif run_status == 'COMPLETED': errors.append(f'REQUEST_DUPLICATE_ARTIFACT_MISSING:{filename}') return errors class _LoopGuardCanonicalPOCV106(_CoreEngineBase): def __init__(self, root: Path, policy: PolicyPack=DEFAULT_POLICY_PACK): self.root = Path(root).resolve() self.root.mkdir(parents=True, exist_ok=True) p = PolicyPack.from_dict(policy.to_dict()) validate_policy_pack(p) try: validate_v15_policy_pack(p) self._policy_conformance_error = None except POCError as exc: self._policy_conformance_error = str(exc) self._policy_snapshot_json = canonical_json(p.to_dict()) self._policy_hash = p.policy_pack_hash self.policy = PolicyPack.from_dict(json.loads(self._policy_snapshot_json)) self.metric_registry = copy.deepcopy(dict(METRIC_VERSIONS)) self.metric_registry_hash = sha256_obj(self.metric_registry) if KNOWN_METRIC_REGISTRIES.get(METRIC_REGISTRY_VERSION) != self.metric_registry_hash: raise POCError('METRIC_REGISTRY_VERSION_CONTENT_MISMATCH') self.pending = {} self.trusted = {} self.override_authorizations = {} def _bound_policy(self) -> PolicyPack: p = PolicyPack.from_dict(json.loads(self._policy_snapshot_json)) validate_policy_pack(p) if p.policy_pack_hash != self._policy_hash: raise POCError('BOUND_POLICY_HASH_MISMATCH') return p def open_run(self, request: Dict[str, Any], run_id: Optional[str]=None) -> str: self.policy = self._bound_policy() chosen = super().open_run(request, run_id) self.pending[chosen]['engine_started_at'] = utc_now() self.pending[chosen]['bound_policy_hash'] = self._policy_hash self.pending[chosen]['metric_registry_hash'] = self.metric_registry_hash if self._policy_conformance_error: self.pending[chosen]['schema_error'] = 'POLICY_V15_NONCONFORMANT:' + self._policy_conformance_error return chosen def decide(self, run_id: str) -> Dict[str, Any]: validate_run_id(run_id) if run_id not in self.pending: raise POCError('RUN_NOT_OPEN') try: current_hash = self.policy.policy_pack_hash except Exception: current_hash = None if current_hash != self._policy_hash: self.policy = self._bound_policy() self.pending[run_id]['schema_error'] = 'POLICY_PACK_RUNTIME_DRIFT' else: self.policy = self._bound_policy() if sha256_obj(self.metric_registry) != self.metric_registry_hash: self.pending[run_id]['schema_error'] = 'METRIC_REGISTRY_RUNTIME_DRIFT' if self.pending[run_id].get('bound_policy_hash') != self._policy_hash or self.pending[run_id].get('metric_registry_hash') != self.metric_registry_hash: self.pending[run_id]['schema_error'] = 'RUN_CONFIGURATION_BINDING_MISMATCH' if 'schema_error' not in self.pending[run_id]: trusted = self.trusted.get(run_id) if trusted is not None: try: _validate_source_started_before_engine(self.pending[run_id]['request'], self.pending[run_id]['engine_started_at']) _validate_source_temporal_provenance(self.pending[run_id]['request'], trusted, utc_now()) except Exception as exc: self.pending[run_id]['schema_error'] = f'TEMPORAL_PROVENANCE_FAILURE:{exc}' return super().decide(run_id) def provide_trusted_override_authorization(self, run_id: str, authorization: Dict[str, Any]) -> None: validate_run_id(run_id) rd = safe_run_dir(self.root, run_id) decision_path = rd / 'decision_package.json' if not decision_path.exists(): raise POCError('RUN_NOT_DECIDED') validate_trusted_override_authorization(authorization) auth_dt = _timestamp_dt(authorization['control_timestamp'], 'trusted_override.control_timestamp') if auth_dt > datetime.now(timezone.utc): raise POCError('TRUSTED_OVERRIDE_TIMESTAMP_IN_FUTURE') decision = read_json(decision_path) run = read_json(rd / 'run.json') if auth_dt < _timestamp_dt(decision['decision_timestamp'], 'decision.decision_timestamp') or auth_dt < _timestamp_dt(run['completed_at'], 'run.completed_at'): raise POCError('TRUSTED_OVERRIDE_TIMESTAMP_PREDATES_DECISION_COMPLETION') existing = sorted(rd.glob('trusted_override_authorization_[0-9][0-9][0-9][0-9].json')) seq = len(existing) + 1 authorization_id = f'TOA-{run_id}-{seq}' record = { 'authorization_id': authorization_id, 'run_id': run_id, 'decision_id': decision['decision_id'], 'trusted_source_id': authorization['trusted_source_id'], 'actor_id': authorization['actor_id'], 'approval_role': authorization['approval_role'], 'authorization_status': authorization['authorization_status'], 'control_timestamp': authorization['control_timestamp'], } record['authorization_hash'] = sha256_obj(_override_authorization_material(record)) fn = f'trusted_override_authorization_{seq:04d}.json' write_json_new(rd / fn, record) self.override_authorizations[run_id] = {**copy.deepcopy(authorization), 'artifact_ref': fn, 'authorization_hash': record['authorization_hash'], 'authorization_id': authorization_id, 'decision_id': decision['decision_id']} self._write_manifest_snapshot(rd) def _base_bundle(self, run_id, req_safe, trusted_safe, decision, metrics, profile_hash): return _expected_evidence_bundle( run_id, req_safe, trusted_safe, decision, metrics, profile_hash, self.metric_registry, self._bound_policy() ) def _policy_document(self): d = json.loads(self._policy_snapshot_json) d['policy_pack_hash'] = self._policy_hash return d def _persist_minimal_failed(self, rd, req, decision, sem, trusted=None): if trusted is None: trusted = self.trusted.get(decision['run_id']) req_safe = json_safe_snapshot(req) trusted_safe = json_safe_snapshot(trusted) if trusted is not None else None write_json_new(rd / 'governance_request.json', req_safe) if isinstance(req_safe, dict): duplicate_map = ( ('scenario.json', 'scenario'), ('governance_context.json', 'governance_context'), ('signals.json', 'signals'), ('metric_input_envelopes.json', 'metric_inputs'), ) for filename, key in duplicate_map: if key in req_safe: write_json_new(rd / filename, req_safe[key]) if trusted_safe is not None: write_json_new(rd / 'trusted_control_envelope.json', trusted_safe) write_json_new(rd / 'metric_registry.json', self.metric_registry) write_json_new(rd / 'policy_pack.json', self._policy_document()) write_json_new(rd / 'rule_evaluations.json', []) write_json_new(rd / 'decision_package.json', decision) write_json_new(rd / 'semantic_material.json', sem) engine_started = self.pending.get(decision['run_id'], {}).get('engine_started_at', utc_now()) source_started = req_safe.get('run_metadata', {}).get('started_at') if isinstance(req_safe, dict) and isinstance(req_safe.get('run_metadata'), dict) else None run = {'run_id': decision['run_id'], 'engine_version': ENGINE_VERSION, 'metric_registry_version': METRIC_REGISTRY_VERSION, 'metric_registry_hash': self.metric_registry_hash, 'policy_pack_id': self.policy.policy_pack_id, 'policy_pack_version': self.policy.policy_pack_version, 'policy_pack_hash': self._policy_hash, 'policy_profile_hash': None, 'request_hash': sha256_obj(req_safe), 'trusted_control_hash': sha256_obj(trusted_safe) if trusted_safe is not None else None, 'started_at': engine_started, 'source_started_at': source_started, 'completed_at': utc_now(), 'run_status': 'FAILED_CLOSED'} write_json_new(rd / 'run.json', run) bundle = self._base_bundle(decision['run_id'], req_safe, trusted_safe, decision, {}, None) write_json_new(rd / 'normalization_records.json', metric_normalization_records(req_safe)) write_json_new(rd / 'evidence_bundle.json', bundle) self._write_manifest_snapshot(rd) def _persist_success(self, rd, req, trusted, profile, metrics, preds, rules, decision, sem): engine_started = self.pending.get(decision['run_id'], {}).get('engine_started_at', utc_now()) run = {'run_id': decision['run_id'], 'engine_version': ENGINE_VERSION, 'metric_registry_version': METRIC_REGISTRY_VERSION, 'metric_registry_hash': self.metric_registry_hash, 'policy_pack_id': self.policy.policy_pack_id, 'policy_pack_version': self.policy.policy_pack_version, 'policy_pack_hash': self._policy_hash, 'policy_profile_hash': profile['policy_profile_hash'], 'request_hash': sha256_obj(req), 'trusted_control_hash': sha256_obj(trusted), 'started_at': engine_started, 'source_started_at': req['run_metadata']['started_at'], 'completed_at': utc_now(), 'run_status': 'COMPLETED'} for fn, obj in [('run.json', run), ('scenario.json', req['scenario']), ('governance_request.json', req), ('governance_context.json', req['governance_context']), ('trusted_control_envelope.json', trusted), ('signals.json', req['signals']), ('metric_input_envelopes.json', req['metric_inputs']), ('metric_results.json', metrics), ('metric_registry.json', self.metric_registry), ('policy_pack.json', self._policy_document()), ('policy_profile.json', profile), ('cep_predicate_evaluations.json', preds), ('rule_evaluations.json', rules), ('decision_package.json', decision), ('semantic_material.json', sem)]: write_json_new(rd / fn, obj) bundle = self._base_bundle(decision['run_id'], req, trusted, decision, metrics, profile['policy_profile_hash']) write_json_new(rd / 'normalization_records.json', metric_normalization_records(req)) write_json_new(rd / 'evidence_bundle.json', bundle) self._write_manifest_snapshot(rd) def request_override(self, run_id: str, requested_gate: str, justification: str) -> Dict[str, Any]: validate_run_id(run_id) rd = safe_run_dir(self.root, run_id) if not rd.exists() or not (rd / 'decision_package.json').exists(): raise POCError('RUN_NOT_DECIDED') if requested_gate not in _ALLOWED_GATES: raise POCError('INVALID_OVERRIDE_GATE') if not isinstance(justification, str) or not justification.strip(): raise POCError('OVERRIDE_JUSTIFICATION_REQUIRED') decision = read_json(rd / 'decision_package.json') pd = read_json(rd / 'policy_pack.json') pd.pop('policy_pack_hash', None) policy = PolicyPack.from_dict(pd) validate_policy_pack(policy) prior = [read_json(x) for x in sorted(rd.glob('override_[0-9][0-9][0-9][0-9].json'))] auth_files = sorted(rd.glob('trusted_override_authorization_[0-9][0-9][0-9][0-9].json')) auth_path = auth_files[-1] if auth_files else None auth_record = read_json(auth_path) if auth_path else None auth_ref = auth_path.name if auth_path else None if auth_record is not None: expected_auth_id = f"TOA-{run_id}-{int(auth_path.stem.split('_')[-1])}" _validate_bound_override_authorization_record(auth_record, run_id, decision['decision_id'], expected_auth_id) auth_dt = _timestamp_dt(auth_record['control_timestamp'], 'trusted_override.control_timestamp') run = read_json(rd / 'run.json') if auth_dt > datetime.now(timezone.utc): raise POCError('TRUSTED_OVERRIDE_TIMESTAMP_IN_FUTURE') if auth_dt < _timestamp_dt(decision['decision_timestamp'], 'decision.decision_timestamp') or auth_dt < _timestamp_dt(run['completed_at'], 'run.completed_at'): raise POCError('TRUSTED_OVERRIDE_TIMESTAMP_PREDATES_DECISION_COMPLETION') seq = len(prior) + 1 request_record = { 'override_request_id': f'OVREQ-{run_id}-{seq}', 'run_id': run_id, 'decision_id': decision['decision_id'], 'requested_gate': requested_gate, 'justification': justification, 'trusted_authorization_ref': auth_ref, 'request_timestamp': utc_now(), } write_json_new(rd / f'override_request_{seq:04d}.json', request_record) rules = read_json(rd / 'rule_evaluations.json') if (rd / 'rule_evaluations.json').exists() else [] expected = _derive_override_record(run_id, seq, decision, policy, rules, prior, request_record, auth_record) ov = dict(expected) ov['timestamp'] = utc_now() write_json_new(rd / f'override_{seq:04d}.json', ov) bundle = read_json(rd / 'evidence_bundle.json') refs = [x['override_id'] for x in prior] + [ov['override_id']] ext = {'extension_id': f'OVERRIDE-EVIDENCE-{run_id}-{seq}', 'run_id': run_id, 'base_bundle_integrity_hash': bundle['integrity_hash'], 'override_refs': refs, 'latest_override_id': ov['override_id'], 'trusted_authorization_ref': auth_ref, 'trusted_authorization_hash': ov['trusted_authorization_hash']} ext['integrity_hash'] = sha256_obj(ext) write_json_new(rd / f'override_evidence_{seq:04d}.json', ext) self._write_manifest_snapshot(rd) return ov def _verify_static_persisted_run(self, run_id: str) -> Dict[str, Any]: base = super().verify_persisted_run(run_id) errors = list(base.get('errors', [])) rd = safe_run_dir(self.root, run_id) if not rd.exists(): return base try: run = read_json(rd / 'run.json') req = read_json(rd / 'governance_request.json') bundle = read_json(rd / 'evidence_bundle.json') decision = read_json(rd / 'decision_package.json') try: _validate_decision_identity(decision, run_id) except Exception as exc: errors.append(f'DECISION_IDENTITY_INVALID:{type(exc).__name__}:{exc}') errors.extend(_verify_request_duplicate_artifacts(rd, req, run.get('run_status'))) policy_doc = read_json(rd / 'policy_pack.json') persisted_hash = policy_doc.pop('policy_pack_hash', None) pp = PolicyPack.from_dict(policy_doc) validate_policy_pack(pp) if persisted_hash != pp.policy_pack_hash or run.get('policy_pack_hash') != pp.policy_pack_hash or bundle.get('policy_pack_hash') != pp.policy_pack_hash: errors.append('POLICY_CONTENT_BINDING_MISMATCH') pref = req.get('policy_pack_ref', {}) if isinstance(req, dict) else {} if pref.get('policy_pack_hash') != pp.policy_pack_hash: errors.append('REQUEST_POLICY_HASH_MISMATCH') registry = read_json(rd / 'metric_registry.json') registry_hash = sha256_obj(registry) if registry_hash != run.get('metric_registry_hash') or registry_hash != bundle.get('metric_registry_hash'): errors.append('METRIC_REGISTRY_HASH_MISMATCH') if run.get('metric_registry_version') != METRIC_REGISTRY_VERSION or KNOWN_METRIC_REGISTRIES.get(run.get('metric_registry_version')) != registry_hash: errors.append('METRIC_REGISTRY_VERSION_CONTENT_MISMATCH') if (rd / 'metric_results.json').exists(): metrics = read_json(rd / 'metric_results.json') for name, m in metrics.items(): if name in registry: mv, cv = registry[name] if m.get('metric_version') != mv or m.get('metric_config_version') != cv: errors.append(f'METRIC_RESULT_REGISTRY_MISMATCH:{name}') if run.get('run_status') == 'COMPLETED': signals = read_json(rd / 'signals.json') signal_ids = {s['signal_id'] for s in signals if isinstance(s, dict) and 'signal_id' in s} artifacts = set((req.get('scenario') or {}).get('artifact_refs', [])) valid_refs = signal_ids | artifacts envelopes = read_json(rd / 'metric_input_envelopes.json') for name, env in envelopes.items(): for ref in env.get('input_refs', []): if ref not in valid_refs: errors.append(f'EVIDENCE_LINEAGE_UNRESOLVED:{name}:{ref}') if bundle.get('artifact_refs') != list((req.get('scenario') or {}).get('artifact_refs', [])): errors.append('EVIDENCE_ARTIFACT_REFS_MISMATCH') if set(bundle.get('signal_refs', [])) != signal_ids: errors.append('EVIDENCE_SIGNAL_REFS_MISMATCH') trusted = read_json(rd / 'trusted_control_envelope.json') if (rd / 'trusted_control_envelope.json').exists() else None try: _validate_persisted_completed_chronology(req, trusted, decision, run) except Exception as exc: errors.append(f'TEMPORAL_PROVENANCE_INVALID:{type(exc).__name__}:{exc}') if (rd / 'rule_evaluations.json').exists(): rules = read_json(rd / 'rule_evaluations.json') expected_versions = {} for group in (pp.hard_blocker_rules, pp.risk_elevation_rules, pp.conditional_restriction_rules, pp.rollback_rules): for spec in group: expected_versions[spec['rule_id']] = spec['rule_version'] expected_versions[pp.green_path_rule['rule_id']] = pp.green_path_rule['rule_version'] for r in rules: if r['rule_id'] in expected_versions and r.get('rule_version') != expected_versions[r['rule_id']]: errors.append(f"RULE_VERSION_MISMATCH:{r['rule_id']}") else: rules = [] prior: List[Dict[str, Any]] = [] override_paths = sorted(rd.glob('override_[0-9][0-9][0-9][0-9].json')) request_paths = sorted(rd.glob('override_request_[0-9][0-9][0-9][0-9].json')) if len(request_paths) != len(override_paths): errors.append('OVERRIDE_REQUEST_COUNT_MISMATCH') for seq, op in enumerate(override_paths, 1): ov = read_json(op) rp = rd / f'override_request_{seq:04d}.json' if not rp.exists(): errors.append(f'OVERRIDE_REQUEST_MISSING:{seq}') prior.append(ov) continue request_record = read_json(rp) try: _validate_override_request_record(request_record, run_id, decision['decision_id'], seq) except Exception as exc: errors.append(f'OVERRIDE_REQUEST_INVALID:{seq}:{type(exc).__name__}:{exc}') auth_ref = request_record.get('trusted_authorization_ref') auth_record = None if auth_ref is not None: try: ap = _resolve_canonical_override_auth_ref(rd, auth_ref) if auth_ref not in _latest_manifest_files(rd): raise POCError('OVERRIDE_AUTH_REF_NOT_IN_LATEST_MANIFEST') except Exception as exc: errors.append(f'OVERRIDE_AUTH_REF_INVALID:{op.name}:{type(exc).__name__}:{exc}') ap = None if ap is None or not ap.exists(): errors.append(f'OVERRIDE_AUTH_ARTIFACT_MISSING:{op.name}') else: auth_record = read_json(ap) try: auth_seq = int(Path(auth_ref).stem.split('_')[-1]) expected_auth_id = f'TOA-{run_id}-{auth_seq}' _validate_bound_override_authorization_record(auth_record, run_id, decision['decision_id'], expected_auth_id) except Exception as exc: errors.append(f'OVERRIDE_AUTH_INVALID:{op.name}:{type(exc).__name__}:{exc}') try: auth_dt = _timestamp_dt(auth_record.get('control_timestamp'), 'trusted_override.control_timestamp') req_dt = _timestamp_dt(request_record.get('request_timestamp'), 'override_request.request_timestamp') if auth_dt > req_dt: errors.append(f'OVERRIDE_AUTH_POSTDATES_REQUEST:{seq}') except Exception as exc: errors.append(f'OVERRIDE_AUTH_CHRONOLOGY_INVALID:{seq}:{type(exc).__name__}:{exc}') try: expected = _derive_override_record(run_id, seq, decision, pp, rules, prior, request_record, auth_record) if _canonical_override_record(ov) != expected: errors.append(f'OVERRIDE_REPLAY_MISMATCH:{op.name}') except Exception as exc: errors.append(f'OVERRIDE_REPLAY_ERROR:{op.name}:{type(exc).__name__}:{exc}') try: req_dt = _timestamp_dt(request_record.get('request_timestamp'), 'override_request.request_timestamp') ov_dt = _timestamp_dt(ov.get('timestamp'), 'override.timestamp') if req_dt > ov_dt: errors.append(f'OVERRIDE_REQUEST_POSTDATES_OVERRIDE:{seq}') if ov_dt > datetime.now(timezone.utc): errors.append(f'OVERRIDE_TIMESTAMP_IN_FUTURE:{seq}') except Exception as exc: errors.append(f'OVERRIDE_TIMESTAMP_INVALID:{seq}:{type(exc).__name__}:{exc}') prior.append(ov) except Exception as exc: errors.append(f'V105_STATIC_VERIFY_EXCEPTION:{type(exc).__name__}:{exc}') return {'ok': not errors, 'errors': errors} def verify_persisted_run(self, run_id: str) -> Dict[str, Any]: static = self._verify_static_persisted_run(run_id) errors = list(static.get('errors', [])) rd = safe_run_dir(self.root, run_id) if not rd.exists(): return static try: req = read_json(rd / 'governance_request.json') trusted = read_json(rd / 'trusted_control_envelope.json') if (rd / 'trusted_control_envelope.json').exists() else None bundle = read_json(rd / 'evidence_bundle.json') run = read_json(rd / 'run.json') try: validate_persisted_run_entity(run, req, trusted, bundle, run_id) except Exception as exc: errors.append(f'RUN_ENTITY_INVALID:{type(exc).__name__}:{exc}') pd = read_json(rd / 'policy_pack.json') pd.pop('policy_pack_hash', None) pp = PolicyPack.from_dict(pd) validate_policy_pack(pp) try: validate_v15_policy_pack(pp) except Exception as exc: errors.append(f'V15_POLICY_CONFORMANCE_FAILURE:{exc}') decision = read_json(rd / 'decision_package.json') registry = read_json(rd / 'metric_registry.json') metrics_for_bundle = read_json(rd / 'metric_results.json') if (rd / 'metric_results.json').exists() else {} rules_for_time = read_json(rd / 'rule_evaluations.json') if (rd / 'rule_evaluations.json').exists() else [] profile_hash = None if (rd / 'policy_profile.json').exists(): profile_hash = read_json(rd / 'policy_profile.json').get('policy_profile_hash') try: _validate_decision_identity(decision, run_id) except Exception as exc: errors.append(f'DECISION_IDENTITY_INVALID:{type(exc).__name__}:{exc}') try: _validate_evidence_bundle_semantics(bundle, run_id, req, trusted, decision, metrics_for_bundle, profile_hash, registry, pp) except Exception as exc: errors.append(f'EVIDENCE_BUNDLE_SEMANTIC_INVALID:{type(exc).__name__}:{exc}') try: _validate_full_persisted_chronology(req, trusted, decision, run, metrics_for_bundle, rules_for_time) except Exception as exc: errors.append(f'FULL_TEMPORAL_PROVENANCE_INVALID:{type(exc).__name__}:{exc}') try: _validate_override_namespace_closure(rd, run_id, decision) _validate_override_chronology(rd, run, decision) except Exception as exc: errors.append(f'OVERRIDE_NAMESPACE_OR_CHRONOLOGY_INVALID:{type(exc).__name__}:{exc}') with tempfile.TemporaryDirectory(prefix='lg-replay-') as td: replay = LoopGuardCanonicalPOC(Path(td), pp) replay.open_run(copy.deepcopy(req), run_id) snapshot_error = _snapshot_original_json_error(req) if snapshot_error is not None and run.get('run_status') == 'FAILED_CLOSED': replay.pending[run_id]['schema_error'] = snapshot_error if trusted is not None: try: replay.provide_trusted_control(run_id, copy.deepcopy(trusted)) except Exception as exc: replay.pending[run_id]['schema_error'] = f'TRUSTED_CONTROL_REPLAY_FAILURE:{exc}' replay.decide(run_id) rp = Path(td) / run_id replay_run = read_json(rp / 'run.json') if replay_run.get('run_status') != run.get('run_status'): errors.append('RUN_STATUS_REEXECUTION_MISMATCH') if run.get('run_status') == 'COMPLETED' and replay_run.get('run_status') == 'COMPLETED': if _semantic_replay_projection(rd) != _semantic_replay_projection(rp): errors.append('DETERMINISTIC_REEXECUTION_MISMATCH') if (rd / 'metric_results.json').exists() and (rp / 'metric_results.json').exists(): if _canonical_metric_trace(read_json(rd / 'metric_results.json')) != _canonical_metric_trace(read_json(rp / 'metric_results.json')): errors.append('METRIC_RESULT_TRACE_MISMATCH') if (rd / 'rule_evaluations.json').exists() and (rp / 'rule_evaluations.json').exists(): if _canonical_rule_trace(read_json(rd / 'rule_evaluations.json')) != _canonical_rule_trace(read_json(rp / 'rule_evaluations.json')): errors.append('RULE_EVALUATION_TRACE_MISMATCH') elif run.get('run_status') == 'FAILED_CLOSED' and replay_run.get('run_status') == 'FAILED_CLOSED': if _semantic_replay_projection(rd) != _semantic_replay_projection(rp): errors.append('FAILED_CLOSED_TRACE_REEXECUTION_MISMATCH') persisted_rules = read_json(rd / 'rule_evaluations.json') if (rd / 'rule_evaluations.json').exists() else [] replay_rules = read_json(rp / 'rule_evaluations.json') if (rp / 'rule_evaluations.json').exists() else [] if _canonical_rule_trace(persisted_rules) != _canonical_rule_trace(replay_rules): errors.append('FAILED_CLOSED_RULE_TRACE_MISMATCH') else: if _semantic_replay_projection(rd) != _semantic_replay_projection(rp): errors.append('TERMINAL_STATE_TRACE_REEXECUTION_MISMATCH') if run.get('run_status') == 'COMPLETED': try: validate_metric_derivation(req) if read_json(rd / 'normalization_records.json') != metric_normalization_records(req): errors.append('NORMALIZATION_RECORD_MISMATCH') except Exception as exc: errors.append(f'NORMALIZATION_VERIFY_FAILURE:{type(exc).__name__}:{exc}') ovs = [read_json(x) for x in sorted(rd.glob('override_[0-9][0-9][0-9][0-9].json'))] if sum(1 for x in ovs if x.get('override_status') == 'ACCEPTED') > 1: errors.append('MULTIPLE_ACCEPTED_OVERRIDES') refs = [x.get('trusted_authorization_ref') for x in ovs if x.get('trusted_authorization_ref')] if len(refs) != len(set(refs)): errors.append('TRUSTED_OVERRIDE_AUTH_REUSED') for seq in range(1, len(ovs) + 1): ep = rd / f'override_evidence_{seq:04d}.json' if not ep.exists(): errors.append(f'OVERRIDE_EVIDENCE_MISSING:{seq}') continue if read_json(ep) != _expected_override_extension(run_id, seq, bundle, ovs): errors.append(f'OVERRIDE_EVIDENCE_SEMANTIC_MISMATCH:{seq}') except Exception as exc: errors.append(f'V105_VERIFY_EXCEPTION:{type(exc).__name__}:{exc}') return {'ok': not errors, 'errors': errors} def _base_request_v101(run_id: str='RUN-BASE') -> Dict[str, Any]: def env(payload): return {'determination_state': 'AVAILABLE', 'payload': payload, 'input_refs': [f'fixture:{run_id}']} return {'run_metadata': {'run_id': run_id, 'started_at': utc_now()}, 'scenario': {'scenario_id': f'SC-{run_id}', 'scenario_type': 'POC_TEST', 'system_id': 'SYS-1', 'system_version': '1.0', 'operational_context': 'synthetic test', 'expected_behavior': 'deterministic', 'impact_tier': 'LOW', 'domain': 'general', 'artifact_refs': [], 'policy_tags': ['poc']}, 'signals': [{'signal_id': f'SIG-{run_id}-1', 'signal_type': 'POC_FIXTURE', 'source_type': 'SYNTHETIC', 'source_ref': f'fixture:{run_id}', 'raw_value': {'present': True}, 'normalized_value': 1.0, 'confidence': 1.0, 'completeness': 1.0, 'observed_at': utc_now()}], 'metric_inputs': {'risk_level': env({'risk_fixture_score': 10}), 'evidence_status': env({'required_evidence_items': 2, 'verified_evidence_items': 2, 'conflicting_evidence_items': 0}), 'authority_status': env({'authority_record_present': True, 'requested_authority_level': 2, 'granted_authority_level': 2}), 'reversibility_status': env({'reversible_fraction': 0.9, 'irreversible_side_effect': False}), 'core_instability': env({'contradiction': False, 'unsupported_certainty': False, 'circular_reasoning': False, 'evidence_free_inference': False, 'recursive_self_validation': False}), 'shell_weakness': env({'scope_control_present': True, 'uncertainty_disclosure_present': True, 'evidence_linkage_present': True, 'policy_mapping_present': True}), 'policy_conflict': env({'policy_violation_count': 0, 'unresolved_policy_conflict_count': 0, 'conditional_constraint_count': 0}), 'rollback_pressure': env({'rollback_pressure_fixture': 10}), 'cep_stability': env({'cep_review_required': False, 'decision_regime_failure_count': 0, 'structural_inefficiency_flag': False, 'local_utility_preserved': True})}, 'governance_context': {'environment': 'default', 'deployment_risk_tier': 'LOW', 'tenant_or_environment_profile': 'default', 'baseline_comparison': {'baseline_id': 'B1', 'baseline_version': '1', 'comparison_scope': 'poc', 'gap_score': 0, 'source_ref': 'fixture'}}, 'policy_pack_ref': {'policy_pack_id': POLICY_PACK_ID, 'policy_pack_version': POLICY_PACK_VERSION}} def base_trusted() -> Dict[str, Any]: return {'trusted_source_id': 'TRUSTED-POC', 'human_review_status': 'NOT_REQUIRED', 'approval_status': 'NOT_REQUIRED', 'recovery_state': {'prior_operational_state_exists': False, 'current_or_prior_state_invalidated': False, 'verified_safer_state_available': False, 'rollback_authority_confirmed': False}, 'control_timestamp': utc_now()} def base_trusted_override(actor_id: str='actor', role: str='GOVERNANCE_APPROVER', status: str='AUTHORIZED') -> Dict[str, Any]: return {'trusted_source_id': 'TRUSTED-OVERRIDE-POC', 'actor_id': actor_id, 'approval_role': role, 'authorization_status': status, 'control_timestamp': utc_now()} def base_request(run_id: str='RUN-BASE') -> Dict[str, Any]: req = _base_request_v101(run_id) req['policy_pack_ref'] = {'policy_pack_id': DEFAULT_POLICY_PACK.policy_pack_id, 'policy_pack_version': DEFAULT_POLICY_PACK.policy_pack_version, 'policy_pack_hash': DEFAULT_POLICY_PACK.policy_pack_hash} return bind_fixture_evidence(req) def _set(req, path, value): obj = req for p in path[:-1]: obj = obj[p] obj[path[-1]] = value def run_scenario(engine: LoopGuardCanonicalPOC, sid: str, mut_req=None, mut_trusted=None, expected_gate=None, postcheck=None): req = base_request(sid) tr = base_trusted() if mut_req: mut_req(req) if mut_trusted: mut_trusted(tr) bind_fixture_evidence(req) engine.open_run(req, sid) try: engine.provide_trusted_control(sid, tr) except Exception: pass dec = engine.decide(sid) ok = True details = [] if expected_gate is not None and dec['final_gate'] != expected_gate: ok = False details.append(f"expected {expected_gate}, got {dec['final_gate']}") if postcheck is not None: p_ok, p_msg = postcheck(engine, sid, req, tr, dec) if not p_ok: ok = False details.append(p_msg) return {'id': sid, 'ok': ok, 'decision': dec, 'details': details} def scenario_suite(root: Path) -> List[Dict[str, Any]]: engine = LoopGuardCanonicalPOC(root) cases = [] cases.append(run_scenario(engine, 'CPOC-01', expected_gate='SHIP')) cases.append(run_scenario(engine, 'CPOC-02', lambda r: _set(r, ['metric_inputs', 'risk_level', 'payload', 'risk_fixture_score'], 30), expected_gate='RESTRICT')) cases.append(run_scenario(engine, 'CPOC-03', lambda r: _set(r, ['metric_inputs', 'risk_level', 'payload', 'risk_fixture_score'], 60), expected_gate='HOLD')) cases.append(run_scenario(engine, 'CPOC-04', lambda r: _set(r, ['metric_inputs', 'evidence_status', 'payload'], {'required_evidence_items': 4, 'verified_evidence_items': 2, 'conflicting_evidence_items': 0}), expected_gate='RESTRICT')) cases.append(run_scenario(engine, 'CPOC-05', lambda r: _set(r, ['metric_inputs', 'evidence_status', 'payload'], {'required_evidence_items': 0, 'verified_evidence_items': 0, 'conflicting_evidence_items': 0}), expected_gate='HOLD')) cases.append(run_scenario(engine, 'CPOC-06', lambda r: _set(r, ['metric_inputs', 'evidence_status', 'payload', 'conflicting_evidence_items'], 1), expected_gate='HOLD')) cases.append(run_scenario(engine, 'CPOC-07', lambda r: _set(r, ['metric_inputs', 'evidence_status', 'determination_state'], 'INSUFFICIENT_FOR_CLASSIFICATION'), expected_gate='HOLD', postcheck=lambda e, s, r, t, d: (read_json(Path(e.root) / s / 'metric_results.json')['evidence_status']['status'] == 'ABSTAINED', 'Evidence metric did not abstain'))) cases.append(run_scenario(engine, 'CPOC-08', lambda r: _set(r, ['metric_inputs', 'evidence_status', 'payload'], {'bad': 1}), expected_gate='HOLD', postcheck=lambda e, s, r, t, d: (read_json(Path(e.root) / s / 'metric_results.json')['evidence_status']['status'] == 'FAILED', 'Evidence metric did not fail'))) cases.append(run_scenario(engine, 'CPOC-09', lambda r: _set(r, ['metric_inputs', 'authority_status', 'payload'], {'authority_record_present': True, 'requested_authority_level': 3, 'granted_authority_level': 2}), expected_gate='RESTRICT')) cases.append(run_scenario(engine, 'CPOC-10', lambda r: _set(r, ['metric_inputs', 'authority_status', 'payload'], {'authority_record_present': True, 'requested_authority_level': 4, 'granted_authority_level': 2}), expected_gate='HOLD')) cases.append(run_scenario(engine, 'CPOC-11', lambda r: _set(r, ['metric_inputs', 'reversibility_status', 'payload'], {'reversible_fraction': 0.2, 'irreversible_side_effect': False}), expected_gate='RESTRICT')) cases.append(run_scenario(engine, 'CPOC-12', lambda r: _set(r, ['metric_inputs', 'reversibility_status', 'payload'], {'reversible_fraction': 0.9, 'irreversible_side_effect': True}), expected_gate='RESTRICT', postcheck=lambda e, s, r, t, d: (read_json(Path(e.root) / s / 'metric_results.json')['reversibility_status']['classification'] == 'LOW', 'Reversibility was not capped'))) def m13(r): _set(r, ['scenario', 'impact_tier'], 'HIGH') _set(r, ['metric_inputs', 'reversibility_status', 'payload'], {'reversible_fraction': 0.0, 'irreversible_side_effect': True}) cases.append(run_scenario(engine, 'CPOC-13', m13, expected_gate='HOLD')) cases.append(run_scenario(engine, 'CPOC-14', lambda r: _set(r, ['metric_inputs', 'core_instability', 'payload'], {'contradiction': True, 'unsupported_certainty': True, 'circular_reasoning': False, 'evidence_free_inference': False, 'recursive_self_validation': False}), expected_gate='RESTRICT')) cases.append(run_scenario(engine, 'CPOC-15', lambda r: _set(r, ['metric_inputs', 'core_instability', 'payload'], {'contradiction': True, 'unsupported_certainty': True, 'circular_reasoning': True, 'evidence_free_inference': True, 'recursive_self_validation': False}), expected_gate='HOLD')) cases.append(run_scenario(engine, 'CPOC-16', lambda r: _set(r, ['metric_inputs', 'shell_weakness', 'payload'], {'scope_control_present': False, 'uncertainty_disclosure_present': False, 'evidence_linkage_present': False, 'policy_mapping_present': True}), expected_gate='RESTRICT')) cases.append(run_scenario(engine, 'CPOC-17', lambda r: _set(r, ['metric_inputs', 'policy_conflict', 'payload', 'policy_violation_count'], 1), expected_gate='HOLD')) cases.append(run_scenario(engine, 'CPOC-18', lambda r: _set(r, ['governance_context', 'baseline_comparison', 'gap_score'], 70), expected_gate='HOLD')) cases.append(run_scenario(engine, 'CPOC-19', lambda r: _set(r, ['metric_inputs', 'cep_stability', 'payload'], {'cep_review_required': False, 'decision_regime_failure_count': 1, 'structural_inefficiency_flag': False, 'local_utility_preserved': True}), expected_gate='RESTRICT')) cases.append(run_scenario(engine, 'CPOC-20', lambda r: _set(r, ['metric_inputs', 'cep_stability', 'payload', 'decision_regime_failure_count'], 2), expected_gate='HOLD')) def c21(r): _set(r, ['metric_inputs', 'evidence_status', 'payload', 'conflicting_evidence_items'], 1) _set(r, ['metric_inputs', 'core_instability', 'payload'], {'contradiction': True, 'unsupported_certainty': True, 'circular_reasoning': False, 'evidence_free_inference': False, 'recursive_self_validation': False}) cases.append(run_scenario(engine, 'CPOC-21', c21, expected_gate='HOLD', postcheck=lambda e, s, r, t, d: (read_json(Path(e.root) / s / 'metric_results.json')['cep_stability']['classification'] == 'REQUIRES_REVIEW', 'CEP-PRED-01 did not affect M10'))) cases.append(run_scenario(engine, 'CPOC-22', lambda r: _set(r, ['scenario', 'domain'], 'high_stakes'), expected_gate='HOLD', postcheck=lambda e, s, r, t, d: (read_json(Path(e.root) / s / 'metric_results.json')['cep_stability']['classification'] == 'REQUIRES_REVIEW', 'CEP-PRED-03 did not affect M10'))) def post23(e, s, r, t, d): req2 = base_request('CPOC-23B') req2['scenario']['domain'] = 'high_stakes' e.open_run(req2, 'CPOC-23B') e.provide_trusted_control('CPOC-23B', base_trusted()) e.decide('CPOC-23B') h1 = read_json(Path(e.root) / s / 'policy_profile.json')['policy_profile_hash'] h2 = read_json(Path(e.root) / 'CPOC-23B' / 'policy_profile.json')['policy_profile_hash'] return (h1 != h2, 'Policy profile hash did not differ by domain') cases.append(run_scenario(engine, 'CPOC-23', expected_gate='SHIP', postcheck=post23)) def post24(e, s, r, t, d): req2 = base_request('CPOC-24B') e.open_run(req2, 'CPOC-24B') e.provide_trusted_control('CPOC-24B', base_trusted()) e.decide('CPOC-24B') h1 = read_json(Path(e.root) / s / 'policy_profile.json')['policy_profile_hash'] h2 = read_json(Path(e.root) / 'CPOC-24B' / 'policy_profile.json')['policy_profile_hash'] return (h1 == h2, 'Policy profile hash not reproducible') cases.append(run_scenario(engine, 'CPOC-24', expected_gate='SHIP', postcheck=post24)) def post25(e, s, r, t, d): p = Path(e.root) / s / 'policy_profile.json' prof = read_json(p) prof['resolved_domain_profile']['tampered'] = True write_json(p, prof) res = e.verify_persisted_run(s) return (not res['ok'], 'Tampered profile not detected') cases.append(run_scenario(engine, 'CPOC-25', expected_gate='SHIP', postcheck=post25)) cases.append(run_scenario(engine, 'CPOC-26', lambda r: _set(r, ['metric_inputs', 'rollback_pressure', 'payload', 'rollback_pressure_fixture'], 90), expected_gate='HOLD')) def t27(t): t['recovery_state'] = {k: True for k in t['recovery_state']} cases.append(run_scenario(engine, 'CPOC-27', lambda r: _set(r, ['metric_inputs', 'rollback_pressure', 'payload', 'rollback_pressure_fixture'], 90), t27, expected_gate='ROLLBACK')) def t28(t): t27(t) t['human_review_status'] = 'REQUIRED_PENDING' cases.append(run_scenario(engine, 'CPOC-28', lambda r: _set(r, ['metric_inputs', 'rollback_pressure', 'payload', 'rollback_pressure_fixture'], 90), t28, expected_gate='HOLD')) def t29(t): t27(t) t['approval_status'] = 'REQUIRED_MISSING' cases.append(run_scenario(engine, 'CPOC-29', lambda r: _set(r, ['metric_inputs', 'rollback_pressure', 'payload', 'rollback_pressure_fixture'], 90), t29, expected_gate='HOLD')) cases.append(run_scenario(engine, 'CPOC-30', lambda r: r['governance_context'].update({'rollback_authority_confirmed': True}), expected_gate='HOLD')) req = base_request('CPOC-31') engine.open_run(req, 'CPOC-31') dec = engine.decide('CPOC-31') cases.append({'id': 'CPOC-31', 'ok': dec['final_gate'] == 'HOLD', 'decision': dec, 'details': [] if dec['final_gate'] == 'HOLD' else ['missing trusted did not HOLD']}) def c32(r): _set(r, ['metric_inputs', 'risk_level', 'payload', 'risk_fixture_score'], 30) _set(r, ['metric_inputs', 'evidence_status', 'payload', 'conflicting_evidence_items'], 1) cases.append(run_scenario(engine, 'CPOC-32', c32, expected_gate='HOLD')) def c33(r): _set(r, ['metric_inputs', 'rollback_pressure', 'payload', 'rollback_pressure_fixture'], 90) _set(r, ['metric_inputs', 'core_instability', 'payload'], {'contradiction': True, 'unsupported_certainty': True, 'circular_reasoning': True, 'evidence_free_inference': True, 'recursive_self_validation': False}) def post33(e, s, r, t, d): rules = read_json(Path(e.root) / s / 'rule_evaluations.json') gates = {x['candidate_gate'] for x in rules if x['triggered'] and x['candidate_gate']} return ('HOLD' in gates and 'ROLLBACK' in gates and (d['final_gate'] == 'ROLLBACK'), 'CPOC-33 did not create genuine concurrent HOLD + ROLLBACK candidates') cases.append(run_scenario(engine, 'CPOC-33', c33, t27, expected_gate='ROLLBACK', postcheck=post33)) def post34(e, s, r, t, d): req2 = copy.deepcopy(r) req2['run_metadata']['run_id'] = 'CPOC-34B' req2['scenario']['scenario_id'] = 'SC-CPOC-34B' e.open_run(req2, 'CPOC-34B') e.provide_trusted_control('CPOC-34B', copy.deepcopy(t)) d2 = e.decide('CPOC-34B') return (d['semantic_decision_hash'] == d2['semantic_decision_hash'], 'Semantic replay hash mismatch') cases.append(run_scenario(engine, 'CPOC-34', expected_gate='SHIP', postcheck=post34)) def post35(e, s, r, t, d): e.provide_trusted_override_authorization(s, base_trusted_override()) ov = e.request_override(s, 'HOLD', 'conservative override') return (ov['override_status'] == 'ACCEPTED', 'Allowed override rejected') cases.append(run_scenario(engine, 'CPOC-35', expected_gate='SHIP', postcheck=post35)) def post36(e, s, r, t, d): e.provide_trusted_override_authorization(s, base_trusted_override()) ov = e.request_override(s, 'SHIP', 'attempt') return (ov['override_status'] == 'REJECTED', 'Forbidden override accepted') cases.append(run_scenario(engine, 'CPOC-36', lambda r: _set(r, ['metric_inputs', 'risk_level', 'payload', 'risk_fixture_score'], 60), expected_gate='HOLD', postcheck=post36)) cases.append(run_scenario(engine, 'CPOC-37', expected_gate='SHIP', postcheck=lambda e, s, r, t, d: (e.verify_persisted_run(s)['ok'], 'Persistence verification failed'))) def post38(e, s, r, t, d): pp = copy.deepcopy(DEFAULT_POLICY_PACK.to_dict()) pp['policy_pack_version'] = '1.0.2' alt = PolicyPack.from_dict(pp) e2 = LoopGuardCanonicalPOC(Path(e.root) / 'alt-policy', alt) req2 = base_request('CPOC-38B') req2['policy_pack_ref'] = {'policy_pack_id': alt.policy_pack_id, 'policy_pack_version': alt.policy_pack_version, 'policy_pack_hash': alt.policy_pack_hash} e2.open_run(req2, 'CPOC-38B') e2.provide_trusted_control('CPOC-38B', base_trusted()) d2 = e2.decide('CPOC-38B') return (d['semantic_decision_hash'] != d2['semantic_decision_hash'], 'Policy version not reflected in semantic provenance') cases.append(run_scenario(engine, 'CPOC-38', expected_gate='SHIP', postcheck=post38)) def post39(e, s, r, t, d): sem = semantic_material(read_json(Path(e.root) / s / 'metric_results.json'), read_json(Path(e.root) / s / 'rule_evaluations.json'), d['final_gate'], d['rationale_code'], e.policy, read_json(Path(e.root) / s / 'policy_profile.json')) sem2 = copy.deepcopy(sem) sem2['metrics']['risk_level']['metric_config_version'] = '1.0.1' return (sha256_obj(sem) != sha256_obj(sem2), 'Metric config version not hash-bearing') cases.append(run_scenario(engine, 'CPOC-39', expected_gate='SHIP', postcheck=post39)) cases.append(run_scenario(engine, 'CPOC-40', lambda r: r.update({'baseline_comparison': {'gap_score': 0}}), expected_gate='HOLD')) cases.append(run_scenario(engine, 'CPOC-41', lambda r: r['governance_context'].update({'domain': 'general'}), expected_gate='HOLD')) cases.append(run_scenario(engine, 'CPOC-42', lambda r: r['governance_context'].update({'impact_tier': 'LOW'}), expected_gate='HOLD')) pp43 = copy.deepcopy(DEFAULT_POLICY_PACK.to_dict()) pp43['policy_pack_version'] = '1.0.0-defensive' pp43['required_metrics'] = [] pp43['hard_blocker_rules'] = [] pp43['risk_elevation_rules'] = [] pp43['conditional_restriction_rules'] = [] pp43['rollback_rules'] = [] pp43['precedence_rules']['terminal_blocking_rule_ids'] = [] pp43['green_path_rule'] = {'rule_id': 'GREEN-PATH', 'rule_version': '1.0.0', 'gate': 'SHIP', 'blocking': False, 'rank': 60, 'requires_no_blocking_rules': True, 'requirements': [{'kind': 'metric_in', 'metric': 'risk_level', 'values': ['NON_MATCHING_TEST_VALUE']}]} p43 = PolicyPack.from_dict(pp43) e43 = LoopGuardCanonicalPOC(root / 'defensive-policy', p43) req43 = base_request('CPOC-43') req43['policy_pack_ref'] = {'policy_pack_id': p43.policy_pack_id, 'policy_pack_version': p43.policy_pack_version, 'policy_pack_hash': p43.policy_pack_hash} e43.open_run(req43, 'CPOC-43') e43.provide_trusted_control('CPOC-43', base_trusted()) dec43 = e43.decide('CPOC-43') ok43 = dec43['final_gate'] == 'HOLD' and any('POLICY_V15_NONCONFORMANT' in str(x) for x in dec43.get('blocking_evidence', [])) cases.append({'id': 'CPOC-43', 'ok': ok43, 'decision': dec43, 'details': [] if ok43 else ['End-to-end defensive fallback failed']}) return cases def invariant_suite(root: Path) -> List[Dict[str, Any]]: checks = [] def add(name, cond, detail=''): checks.append({'invariant': name, 'ok': bool(cond), 'detail': detail if not cond else ''}) engine = LoopGuardCanonicalPOC(root / 'inv') sc = scenario_suite(root / 'inv' / 'scenarios') by = {x['id']: x for x in sc} add('INV-01', all((by[x]['decision']['final_gate'] != 'SHIP' for x in ['CPOC-03', 'CPOC-06', 'CPOC-10', 'CPOC-13', 'CPOC-15', 'CPOC-17', 'CPOC-18', 'CPOC-20']))) add('INV-02', by['CPOC-15']['decision']['final_gate'] == 'HOLD') add('INV-03', by['CPOC-07']['decision']['final_gate'] == 'HOLD') add('INV-04', by['CPOC-10']['decision']['final_gate'] == 'HOLD') add('INV-05', by['CPOC-26']['decision']['final_gate'] == 'HOLD' and by['CPOC-27']['decision']['final_gate'] == 'ROLLBACK') add('INV-06', by['CPOC-30']['decision']['final_gate'] == 'HOLD') add('INV-07', by['CPOC-28']['decision']['final_gate'] == 'HOLD') add('INV-08', by['CPOC-29']['decision']['final_gate'] == 'HOLD') rd = root / 'inv' / 'scenarios' / 'CPOC-35' d_before = read_json(rd / 'decision_package.json') add('INV-09', d_before['final_gate'] == 'SHIP' and read_json(rd / 'override_0001.json')['override_status'] == 'ACCEPTED') add('INV-10', by['CPOC-34']['ok']) add('INV-11', by['CPOC-08']['decision']['final_gate'] == 'HOLD') add('INV-12', by['CPOC-07']['decision']['final_gate'] == 'HOLD') add('INV-13', by['CPOC-07']['ok']) add('INV-14', by['CPOC-43']['ok']) add('INV-15', by['CPOC-38']['ok']) add('INV-16', by['CPOC-23']['ok'] and by['CPOC-24']['ok']) add('INV-17', by['CPOC-39']['ok']) add('INV-18', all((x['decision']['final_gate'] in {'SHIP', 'RESTRICT', 'HOLD', 'ROLLBACK'} for x in sc))) add('INV-19', by['CPOC-18']['decision']['final_gate'] == 'HOLD') add('INV-20', by['CPOC-26']['decision']['final_gate'] == 'HOLD') add('INV-21', by['CPOC-40']['decision']['final_gate'] == 'HOLD') add('INV-22', by['CPOC-42']['decision']['final_gate'] == 'HOLD') add('INV-23', by['CPOC-41']['decision']['final_gate'] == 'HOLD') add('INV-24', by['CPOC-37']['ok']) add('INV-25', by['CPOC-30']['decision']['final_gate'] == 'HOLD') add('INV-26', by['CPOC-24']['ok']) add('INV-27', by['CPOC-21']['ok'] and by['CPOC-22']['ok']) add('INV-28', by['CPOC-23']['ok']) add('INV-29', by['CPOC-34']['ok']) mr_a = make_metric_result('risk_level', 'ABSTAINED', 'UNKNOWN', None, 'x', []) mr_f = make_metric_result('risk_level', 'FAILED', None, None, 'x', []) add('INV-30', mr_a['status'] != mr_f['status'] and mr_a['classification'] == 'UNKNOWN' and (mr_f['classification'] is None)) return checks def audit_regression_suite(root: Path) -> List[Dict[str, Any]]: checks: List[Dict[str, Any]] = [] def add(test_id: str, cond: bool, detail: str='') -> None: checks.append({'test': test_id, 'ok': bool(cond), 'detail': '' if cond else detail}) pp = copy.deepcopy(DEFAULT_POLICY_PACK.to_dict()) pp['policy_pack_version'] = 'audit-threshold' pp['policy_thresholds']['risk_hold_min'] = 'CRITICAL' p = PolicyPack.from_dict(pp) e = LoopGuardCanonicalPOC(root / 'ar01', p) req = base_request('AR-01') req['policy_pack_ref'] = {'policy_pack_id': p.policy_pack_id, 'policy_pack_version': p.policy_pack_version, 'policy_pack_hash': p.policy_pack_hash} _set(req, ['metric_inputs', 'risk_level', 'payload', 'risk_fixture_score'], 60) e.open_run(req, 'AR-01') e.provide_trusted_control('AR-01', base_trusted()) d = e.decide('AR-01') add('AR-01-POLICY-THRESHOLD-OPERATIVE', d['final_gate'] == 'RESTRICT', f"expected RESTRICT, got {d['final_gate']}") pp = copy.deepcopy(DEFAULT_POLICY_PACK.to_dict()) pp['policy_pack_version'] = 'audit-rule-list' pp['hard_blocker_rules'] = [r for r in pp['hard_blocker_rules'] if r['rule_id'] != 'CORE-HOLD'] pp['policy_thresholds']['core_restrict_min'] = 'MODERATE' p = PolicyPack.from_dict(pp) e = LoopGuardCanonicalPOC(root / 'ar02', p) req = base_request('AR-02') req['policy_pack_ref'] = {'policy_pack_id': p.policy_pack_id, 'policy_pack_version': p.policy_pack_version, 'policy_pack_hash': p.policy_pack_hash} _set(req, ['metric_inputs', 'core_instability', 'payload'], {'contradiction': True, 'unsupported_certainty': True, 'circular_reasoning': True, 'evidence_free_inference': True, 'recursive_self_validation': False}) e.open_run(req, 'AR-02') e.provide_trusted_control('AR-02', base_trusted()) d = e.decide('AR-02') add('AR-02-V15-CONFORMANCE-PREVENTS-RULE-REMOVAL', d['final_gate'] == 'HOLD', f"expected HOLD, got {d['final_gate']}") pp = copy.deepcopy(DEFAULT_POLICY_PACK.to_dict()) pp['policy_pack_version'] = 'audit-required' pp['required_metrics'] = ['risk_level'] pp['hard_blocker_rules'] = [] pp['risk_elevation_rules'] = [] pp['conditional_restriction_rules'] = [] pp['rollback_rules'] = [] pp['precedence_rules']['terminal_blocking_rule_ids'] = [] pp['green_path_rule'] = {'rule_id': 'GREEN-PATH', 'rule_version': '1.0.0', 'gate': 'SHIP', 'blocking': False, 'rank': 60, 'requires_no_blocking_rules': True, 'requirements': [{'kind': 'all_required_metrics_ok'}, {'kind': 'metric_in', 'metric': 'risk_level', 'values': ['LOW']}, {'kind': 'trusted_in', 'field': 'human_review_status', 'values': ['NOT_REQUIRED', 'COMPLETED_APPROVED']}, {'kind': 'trusted_in', 'field': 'approval_status', 'values': ['NOT_REQUIRED', 'APPROVED']}]} p = PolicyPack.from_dict(pp) e = LoopGuardCanonicalPOC(root / 'ar03', p) req = base_request('AR-03') req['policy_pack_ref'] = {'policy_pack_id': p.policy_pack_id, 'policy_pack_version': p.policy_pack_version, 'policy_pack_hash': p.policy_pack_hash} _set(req, ['metric_inputs', 'evidence_status', 'determination_state'], 'INSUFFICIENT_FOR_CLASSIFICATION') e.open_run(req, 'AR-03') e.provide_trusted_control('AR-03', base_trusted()) d = e.decide('AR-03') add('AR-03-V15-CONFORMANCE-PREVENTS-METRIC-REMOVAL', d['final_gate'] == 'HOLD', f"expected HOLD, got {d['final_gate']}") e = LoopGuardCanonicalPOC(root / 'ar04') req = base_request('AR-04') req['policy_pack_ref'] = {'policy_pack_id': 'OTHER', 'policy_pack_version': '999', 'policy_pack_hash': '0000000000000000000000000000000000000000000000000000000000000000'} e.open_run(req, 'AR-04') e.provide_trusted_control('AR-04', base_trusted()) d = e.decide('AR-04') add('AR-04-POLICY-REF-BINDING', d['final_gate'] == 'HOLD' and 'SCHEMA_OR_TRUST_BOUNDARY_FAILURE' in d['triggered_rules']) for tid, path, value in [('AR-05', ['scenario', 'domain'], 'unknown-domain'), ('AR-06', ['governance_context', 'environment'], 'unknown-environment'), ('AR-07', ['governance_context', 'tenant_or_environment_profile'], 'unknown-profile')]: e = LoopGuardCanonicalPOC(root / tid.lower()) req = base_request(tid) _set(req, path, value) e.open_run(req, tid) e.provide_trusted_control(tid, base_trusted()) d = e.decide(tid) add(f'{tid}-UNKNOWN-SELECTOR-FAIL-CLOSED', d['final_gate'] == 'HOLD', f"got {d['final_gate']}") e = LoopGuardCanonicalPOC(root / 'ar08') req = base_request('AR-08') e.open_run(req, 'AR-08') e.provide_trusted_control('AR-08', base_trusted()) e.decide('AR-08') before = (root / 'ar08' / 'AR-08' / 'governance_request.json').read_bytes() duplicate_rejected = False try: e.open_run(base_request('AR-08'), 'AR-08') except POCError as exc: duplicate_rejected = 'RUN_ID_ALREADY_EXISTS' in str(exc) after = (root / 'ar08' / 'AR-08' / 'governance_request.json').read_bytes() add('AR-08-APPEND-ONLY-RUN-ID', duplicate_rejected and before == after) e = LoopGuardCanonicalPOC(root / 'ar09a') req = base_request('AR-09A') e.open_run(req, 'AR-09A') e.provide_trusted_control('AR-09A', base_trusted()) e.decide('AR-09A') ov = e.request_override('AR-09A', 'HOLD', 'no trusted auth') missing_auth_rejected = ov['override_status'] == 'REJECTED' # V1.0.10 refinement: test policy-bound rejection on a conformant completed Run. # A nonconformant override matrix now fails closed and FAILED_CLOSED transitions are terminal. e2 = LoopGuardCanonicalPOC(root / 'ar09b') req2 = base_request('AR-09B') e2.open_run(req2, 'AR-09B') e2.provide_trusted_control('AR-09B', base_trusted()) e2.decide('AR-09B') e2.provide_trusted_override_authorization('AR-09B', base_trusted_override(role='REVIEWER')) ov2 = e2.request_override('AR-09B', 'HOLD', 'role should be disallowed by canonical policy') add('AR-09-TRUSTED-POLICY-BOUND-OVERRIDE', missing_auth_rejected and ov2['override_status'] == 'REJECTED') e = LoopGuardCanonicalPOC(root / 'ar10') escaped = (root / 'ESCAPE-LG-AUDIT').resolve() if escaped.exists(): shutil.rmtree(escaped) rejected = False try: req = base_request('SAFE') req['run_metadata']['run_id'] = '../ESCAPE-LG-AUDIT' e.open_run(req, '../ESCAPE-LG-AUDIT') except POCError: rejected = True add('AR-10-RUN-ID-PATH-SAFETY', rejected and (not escaped.exists())) e = LoopGuardCanonicalPOC(root / 'ar11') req = base_request('AR-11') req['scenario']['artifact_refs'] = {'not-json-safe'} e.open_run(req, 'AR-11') e.provide_trusted_control('AR-11', base_trusted()) d = e.decide('AR-11') vr = e.verify_persisted_run('AR-11') add('AR-11-NON-JSON-FAIL-CLOSED', d['final_gate'] == 'HOLD' and vr['ok'], repr(vr)) e = LoopGuardCanonicalPOC(root / 'ar12') req = base_request('AR-12') req['signals'].append({'signal_id': 'SIG-AR12-2', 'signal_type': 'SECONDARY', 'source_type': 'SYNTHETIC', 'source_ref': 'fixture:AR-12', 'raw_value': {'x': 1}, 'normalized_value': 0.5, 'confidence': 0.9, 'completeness': 1.0, 'observed_at': utc_now()}) e.open_run(req, 'AR-12') e.provide_trusted_control('AR-12', base_trusted()) d = e.decide('AR-12') persisted = read_json(root / 'ar12' / 'AR-12' / 'signals.json') add('AR-12-SIGNAL-INGESTION', d['final_gate'] == 'SHIP' and any(x.get('signal_id') == 'SIG-AR12-2' for x in persisted)) for tid, field in [('AR-13', 'integrity_hash'), ('AR-14', 'semantic_decision_hash')]: e = LoopGuardCanonicalPOC(root / tid.lower()) req = base_request(tid) e.open_run(req, tid) e.provide_trusted_control(tid, base_trusted()) e.decide(tid) rd = root / tid.lower() / tid if field == 'integrity_hash': obj = read_json(rd / 'evidence_bundle.json') obj[field] = 'BOGUS' write_json(rd / 'evidence_bundle.json', obj) else: obj = read_json(rd / 'decision_package.json') obj[field] = 'BOGUS' write_json(rd / 'decision_package.json', obj) man = read_json(rd / 'manifest.json') files = sorted((p for p in rd.iterdir() if p.is_file() and p.name != 'manifest.json')) man_core = {'sequence': 0, 'previous_manifest_hash': None, 'files': {p.name: hashlib.sha256(p.read_bytes()).hexdigest() for p in files}} man = dict(man_core) man['manifest_hash'] = sha256_obj(man_core) write_json(rd / 'manifest.json', man) vr = e.verify_persisted_run(tid) add(f'{tid}-INTERNAL-HASH-VERIFICATION', not vr['ok'], repr(vr)) e = LoopGuardCanonicalPOC(root / 'ar15') req = base_request('AR-15') e.open_run(req, 'AR-15') e.provide_trusted_control('AR-15', base_trusted()) e.decide('AR-15') rd = root / 'ar15' / 'AR-15' man = read_json(rd / 'manifest.json') man['manifest_hash'] = 'BOGUS' write_json(rd / 'manifest.json', man) add('AR-15-MANIFEST-HASH-VERIFICATION', not e.verify_persisted_run('AR-15')['ok']) e = LoopGuardCanonicalPOC(root / 'ar16') req = base_request('AR-16') e.open_run(req, 'AR-16') e.provide_trusted_control('AR-16', base_trusted()) d = e.decide('AR-16') rules = read_json(root / 'ar16' / 'AR-16' / 'rule_evaluations.json') add('AR-16-GREEN-PATH-TRACE', d['final_gate'] == 'SHIP' and any((r['rule_id'] == 'GREEN-PATH' and r['triggered'] and (r['candidate_gate'] == 'SHIP') for r in rules))) e = LoopGuardCanonicalPOC(root / 'ar17') req = base_request('AR-17') req['policy_pack_ref'] = {'policy_pack_id': 'WRONG', 'policy_pack_version': 'WRONG', 'policy_pack_hash': '0000000000000000000000000000000000000000000000000000000000000000'} e.open_run(req, 'AR-17') e.provide_trusted_control('AR-17', base_trusted()) e.decide('AR-17') auth_blocked = req_blocked = False try: e.provide_trusted_override_authorization('AR-17', base_trusted_override()) except POCError as exc: auth_blocked = 'FAILED_CLOSED_OVERRIDE_TRANSITION_FORBIDDEN' in str(exc) try: e.request_override('AR-17', 'SHIP', 'must remain terminally prohibited') except POCError as exc: req_blocked = 'FAILED_CLOSED_OVERRIDE_TRANSITION_FORBIDDEN' in str(exc) add('AR-17-FAIL-CLOSED-OVERRIDE-AUDIT', auth_blocked and req_blocked and not (root / 'ar17' / 'AR-17' / 'override_0001.json').exists()) pp = copy.deepcopy(DEFAULT_POLICY_PACK.to_dict()) pp['policy_pack_version'] = 'audit-cep-predicate' pp['cep_profile']['predicates'] = [{'predicate_id': 'CUSTOM-CEP-PRED', 'predicate_version': '1.0', 'description': 'Low risk forces review for regression proof', 'conditions': [{'kind': 'metric_in', 'metric': 'risk_level', 'values': ['LOW']}], 'on_true_result': 'REQUIRES_REVIEW'}] p = PolicyPack.from_dict(pp) e = LoopGuardCanonicalPOC(root / 'ar18', p) req = base_request('AR-18') req['policy_pack_ref'] = {'policy_pack_id': p.policy_pack_id, 'policy_pack_version': p.policy_pack_version, 'policy_pack_hash': p.policy_pack_hash} e.open_run(req, 'AR-18') e.provide_trusted_control('AR-18', base_trusted()) d = e.decide('AR-18') add('AR-18-CEP-PREDICATE-POLICY-DRIVEN', d['final_gate'] == 'HOLD' and any('POLICY_V15_NONCONFORMANT' in str(x) for x in d.get('blocking_evidence', []))) return checks def configuration_integrity_regression_suite(root: Path) -> List[Dict[str, Any]]: checks = [] def add(t, cond, detail=''): checks.append({'test': t, 'ok': bool(cond), 'detail': '' if cond else detail}) bad = copy.deepcopy(DEFAULT_POLICY_PACK.to_dict()) bad['policy_thresholds']['risk_hold_min'] = 'CRITICAL' rejected = False try: LoopGuardCanonicalPOC(root / 'cr01', PolicyPack.from_dict(bad)) except POCError as exc: rejected = 'POLICY_VERSION_CONTENT_MISMATCH' in str(exc) add('CR-01-POLICY-ID-VERSION-CONTENT-BINDING', rejected) bad = copy.deepcopy(DEFAULT_POLICY_PACK.to_dict()) bad['policy_pack_version'] = 'cr-hardblock' bad['hard_blocker_rules'][0]['gate'] = 'SHIP' rejected = False try: LoopGuardCanonicalPOC(root / 'cr02', PolicyPack.from_dict(bad)) except POCError as exc: rejected = 'POLICY_RULE_GATE_INVALID' in str(exc) add('CR-02-HARD-BLOCKER-CANNOT-SHIP', rejected) e = LoopGuardCanonicalPOC(root / 'cr03') req = base_request('CR-03') e.open_run(req, 'CR-03') e.policy.policy_thresholds['risk_hold_min'] = 'CRITICAL' e.provide_trusted_control('CR-03', base_trusted()) d = e.decide('CR-03') add('CR-03-RUNTIME-POLICY-MUTATION-FAIL-CLOSED', d['final_gate'] == 'HOLD' and 'SCHEMA_OR_TRUST_BOUNDARY_FAILURE' in d['triggered_rules']) immutable = False try: METRIC_VERSIONS['risk_level'] = ('9.9.9', '9.9.9') except TypeError: immutable = True e = LoopGuardCanonicalPOC(root / 'cr04') req = base_request('CR-04') e.open_run(req, 'CR-04') e.provide_trusted_control('CR-04', base_trusted()) e.decide('CR-04') run = read_json(root / 'cr04' / 'CR-04' / 'run.json') add('CR-04-METRIC-REGISTRY-FREEZE-HASH', immutable and run.get('metric_registry_hash') == METRIC_REGISTRY_HASH and e.verify_persisted_run('CR-04')['ok']) e = LoopGuardCanonicalPOC(root / 'cr05') req = base_request('CR-05') req['metric_inputs']['risk_level']['input_refs'] = ['SIG-DOES-NOT-EXIST'] e.open_run(req, 'CR-05') e.provide_trusted_control('CR-05', base_trusted()) d = e.decide('CR-05') add('CR-05-METRIC-REF-REFERENTIAL-INTEGRITY', d['final_gate'] == 'HOLD') e = LoopGuardCanonicalPOC(root / 'cr06') req = base_request('CR-06') req['scenario']['artifact_refs'] = ['artifact:AR-CR06'] e.open_run(req, 'CR-06') e.provide_trusted_control('CR-06', base_trusted()) d = e.decide('CR-06') b = read_json(root / 'cr06' / 'CR-06' / 'evidence_bundle.json') add('CR-06-ARTIFACT-LINEAGE-IN-BUNDLE', d['final_gate'] == 'SHIP' and b['artifact_refs'] == ['artifact:AR-CR06'] and e.verify_persisted_run('CR-06')['ok']) e = LoopGuardCanonicalPOC(root / 'cr07') req = base_request('CR-07') e.open_run(req, 'CR-07') e.provide_trusted_control('CR-07', base_trusted()) e.decide('CR-07') e.provide_trusted_override_authorization('CR-07', base_trusted_override()) ov = e.request_override('CR-07', 'HOLD', 'audit') auths = list((root / 'cr07' / 'CR-07').glob('trusted_override_authorization_*.json')) add('CR-07-TRUSTED-OVERRIDE-AUTH-PERSISTED', ov['override_status'] == 'ACCEPTED' and len(auths) == 1 and e.verify_persisted_run('CR-07')['ok']) rd = root / 'cr07' / 'CR-07' ap = sorted(rd.glob('trusted_override_authorization_*.json'))[0] ar = read_json(ap) ar['approval_role'] = 'REVIEWER' write_json(ap, ar) latest = e._manifest_paths(rd)[-1] e._write_manifest_snapshot(rd) add('CR-08-OVERRIDE-AUTH-TAMPER-DETECTED', not e.verify_persisted_run('CR-07')['ok']) e = LoopGuardCanonicalPOC(root / 'cr09') req = base_request('CR-09') req['signals'][0]['normalized_value'] = float('nan') e.open_run(req, 'CR-09') e.provide_trusted_control('CR-09', base_trusted()) d = e.decide('CR-09') text = (root / 'cr09' / 'CR-09' / 'governance_request.json').read_text() add('CR-09-STRICT-JSON-NONFINITE-REJECTED', d['final_gate'] == 'HOLD' and 'NaN' not in text and e.verify_persisted_run('CR-09')['ok']) e = LoopGuardCanonicalPOC(root / 'cr10') req = base_request('CR-10') req['run_metadata']['started_at'] = 'not-a-timestamp' e.open_run(req, 'CR-10') e.provide_trusted_control('CR-10', base_trusted()) d = e.decide('CR-10') add('CR-10-TIMESTAMP-VALIDATION', d['final_gate'] == 'HOLD') e = LoopGuardCanonicalPOC(root / 'cr11') req = base_request('CR-11') source = '2026-01-01T00:00:00+00:00' req['run_metadata']['started_at'] = source e.open_run(req, 'CR-11') e.provide_trusted_control('CR-11', base_trusted()) e.decide('CR-11') run = read_json(root / 'cr11' / 'CR-11' / 'run.json') add('CR-11-ENGINE-AUDIT-TIME-SEPARATED', run['source_started_at'] == source and run['started_at'] != source) pp = copy.deepcopy(DEFAULT_POLICY_PACK.to_dict()) pp['policy_pack_version'] = 'cr-rule-version' pp['hard_blocker_rules'][0]['rule_version'] = '7.3.1' p = PolicyPack.from_dict(pp) e = LoopGuardCanonicalPOC(root / 'cr12', p) req = base_request('CR-12') req['policy_pack_ref'] = {'policy_pack_id': p.policy_pack_id, 'policy_pack_version': p.policy_pack_version, 'policy_pack_hash': p.policy_pack_hash} req['metric_inputs']['evidence_status']['payload']['conflicting_evidence_items'] = 1 e.open_run(req, 'CR-12') e.provide_trusted_control('CR-12', base_trusted()) e.decide('CR-12') rules = read_json(root / 'cr12' / 'CR-12' / 'rule_evaluations.json') er = [r for r in rules if r['rule_id'] == 'EVIDENCE-BLOCK'][0] add('CR-12-RULE-VERSION-PROVENANCE', er['rule_version'] == '7.3.1' and e.verify_persisted_run('CR-12')['ok']) e = LoopGuardCanonicalPOC(root / 'cr13') req = base_request('CR-13') req['policy_pack_ref']['policy_pack_hash'] = '0' * 64 e.open_run(req, 'CR-13') e.provide_trusted_control('CR-13', base_trusted()) d = e.decide('CR-13') add('CR-13-REQUEST-POLICY-HASH-BINDING', d['final_gate'] == 'HOLD') return checks def v103_replay_evidence_regression_suite(root: Path) -> List[Dict[str,Any]]: if root.exists(): shutil.rmtree(root) root.mkdir(parents=True) out=[] def add(name, ok, detail=''): out.append({'test':name,'ok':bool(ok),'detail':'' if ok else detail}) # V103-01: forged, self-consistent derived SHIP artifacts must not validate against a HOLD source request. e=LoopGuardCanonicalPOC(root/'replay') hold_req=base_request('V103-01-H'); _set(hold_req,['metric_inputs','risk_level','payload','risk_fixture_score'],90); bind_fixture_evidence(hold_req) e.open_run(hold_req,'V103-01-H'); e.provide_trusted_control('V103-01-H',base_trusted()); dh=e.decide('V103-01-H') green_req=base_request('V103-01-G'); e.open_run(green_req,'V103-01-G'); e.provide_trusted_control('V103-01-G',base_trusted()); dg=e.decide('V103-01-G') rh=root/'replay'/'V103-01-H'; rg=root/'replay'/'V103-01-G' for fn in ('metric_results.json','policy_profile.json','cep_predicate_evaluations.json','rule_evaluations.json','semantic_material.json'): write_json(rh/fn,read_json(rg/fn)) dec=read_json(rg/'decision_package.json'); dec['run_id']='V103-01-H'; dec['decision_id']='DEC-V103-01-H'; dec['semantic_decision_hash']=sha256_obj(read_json(rh/'semantic_material.json')); write_json(rh/'decision_package.json',dec) bundle=read_json(rh/'evidence_bundle.json'); bundle['decision_hash']=sha256_obj(dec); bundle['semantic_decision_hash']=dec['semantic_decision_hash']; tmp=copy.deepcopy(bundle); tmp.pop('integrity_hash',None); bundle['integrity_hash']=sha256_obj(tmp); write_json(rh/'evidence_bundle.json',bundle) # attacker rewrites the root manifest to match the forged files, simulating a self-consistent evidence set files=sorted(x for x in rh.iterdir() if x.is_file() and x.name!='manifest.json' and not x.name.startswith('manifest_override_')) core={'sequence':0,'previous_manifest_hash':None,'files':{x.name:hashlib.sha256(x.read_bytes()).hexdigest() for x in files}}; man=dict(core); man['manifest_hash']=sha256_obj(core); write_json(rh/'manifest.json',man) vr=e.verify_persisted_run('V103-01-H') add('V103-01-DETERMINISTIC-REEXECUTION-DETECTS-FORGED-DERIVATION', dh['final_gate']=='HOLD' and dg['final_gate']=='SHIP' and (not vr['ok']) and 'DETERMINISTIC_REEXECUTION_MISMATCH' in vr['errors'], repr(vr)) # V103-02: vacuous policy is rejected fail-closed by the V1.5 conformance profile. pp=copy.deepcopy(DEFAULT_POLICY_PACK.to_dict()); pp['policy_pack_version']='v103-vacuous'; pp['required_metrics']=[]; pp['hard_blocker_rules']=[]; pp['risk_elevation_rules']=[]; pp['conditional_restriction_rules']=[]; pp['rollback_rules']=[]; pp['precedence_rules']['terminal_blocking_rule_ids']=[]; pp['green_path_rule']={'rule_id':'GREEN-PATH','rule_version':'1.0.0','gate':'SHIP','blocking':False,'rank':60,'requires_no_blocking_rules':True,'requirements':[]} vac=PolicyPack.from_dict(pp); e2=LoopGuardCanonicalPOC(root/'vacuous',vac); req=base_request('V103-02'); req['policy_pack_ref']={'policy_pack_id':vac.policy_pack_id,'policy_pack_version':vac.policy_pack_version,'policy_pack_hash':vac.policy_pack_hash}; _set(req,['metric_inputs','risk_level','payload','risk_fixture_score'],100); _set(req,['metric_inputs','core_instability','payload'],{'contradiction':True,'unsupported_certainty':True,'circular_reasoning':True,'evidence_free_inference':True,'recursive_self_validation':True}); _set(req,['metric_inputs','policy_conflict','payload','policy_violation_count'],1); bind_fixture_evidence(req); e2.open_run(req,'V103-02'); e2.provide_trusted_control('V103-02',base_trusted()); d=e2.decide('V103-02') add('V103-02-V15-CONFORMANCE-REJECTS-VACUOUS-POLICY', d['final_gate']=='HOLD' and any('POLICY_V15_NONCONFORMANT' in str(x) for x in d.get('blocking_evidence',[])), repr(d)) # V103-03: signal/payload inconsistency must fail closed. e3=LoopGuardCanonicalPOC(root/'lineage'); req=base_request('V103-03'); risk_sig=next(x for x in req['signals'] if x['signal_type']=='NORMALIZED_METRIC_SOURCE:risk_level'); risk_sig['raw_value']['payload']={'risk_fixture_score':100}; risk_sig['normalized_value']={'risk_fixture_score':100}; e3.open_run(req,'V103-03'); e3.provide_trusted_control('V103-03',base_trusted()); d=e3.decide('V103-03') add('V103-03-SIGNAL-METRIC-DERIVATION-MISMATCH-FAILS-CLOSED', d['final_gate']=='HOLD', repr(d)) # V103-04: only one accepted override is permitted for an immutable DecisionPackage. # V1.0.9 rejects new authorization issuance after acceptance; a second override # request using the already-consumed authorization remains a valid rejected audit event. e4=LoopGuardCanonicalPOC(root/'override'); req=base_request('V103-04'); e4.open_run(req,'V103-04'); e4.provide_trusted_control('V103-04',base_trusted()); e4.decide('V103-04'); e4.provide_trusted_override_authorization('V103-04',base_trusted_override()); o1=e4.request_override('V103-04','RESTRICT','first'); o2=e4.request_override('V103-04','HOLD','second') add('V103-04-CONFLICTING-ACCEPTED-OVERRIDES-PROHIBITED', o1['override_status']=='ACCEPTED' and o2['override_status']=='REJECTED' and o2['authorizing_policy_rule']=='DECISION_ALREADY_OVERRIDDEN' and e4.verify_persisted_run('V103-04')['ok'], repr((o1,o2,e4.verify_persisted_run('V103-04')))) # V103-05: canonical source has no shadowed top-level function/class definitions. import ast as _ast tree=_ast.parse(Path(__file__).read_text(encoding='utf-8')); names={}; dups=[] for node in tree.body: if isinstance(node,(_ast.FunctionDef,_ast.AsyncFunctionDef,_ast.ClassDef)): if node.name in names: dups.append(node.name) names[node.name]=node.lineno add('V103-05-CANONICAL-SOURCE-NO-SHADOWED-TOPLEVEL-DEFINITIONS', not dups, repr(dups)) return out def v104_verification_integrity_regression_suite(root: Path) -> List[Dict[str,Any]]: if root.exists(): shutil.rmtree(root) root.mkdir(parents=True) out=[] def add(name, ok, detail=''): out.append({'test':name,'ok':bool(ok),'detail':'' if ok else detail}) e=LoopGuardCanonicalPOC(root/'status'); req=base_request('V104-01'); _set(req,['metric_inputs','risk_level','payload','risk_fixture_score'],90); bind_fixture_evidence(req); e.open_run(req,'V104-01'); e.provide_trusted_control('V104-01',base_trusted()); e.decide('V104-01'); rd=root/'status'/'V104-01'; run=read_json(rd/'run.json'); run['run_status']='FAILED_CLOSED'; write_json(rd/'run.json',run); e._write_manifest_snapshot(rd); vr=e.verify_persisted_run('V104-01'); add('V104-01-RUN-STATUS-CANNOT-BYPASS-REPLAY', (not vr['ok']) and ('RUN_STATUS_REEXECUTION_MISMATCH' in vr['errors']), repr(vr)) pp=copy.deepcopy(DEFAULT_POLICY_PACK.to_dict()); pp['policy_pack_version']='v104-no-cep'; pp['cep_profile']['predicates']=[]; p=PolicyPack.from_dict(pp); e2=LoopGuardCanonicalPOC(root/'cep',p); r=base_request('V104-02'); r['policy_pack_ref']={'policy_pack_id':p.policy_pack_id,'policy_pack_version':p.policy_pack_version,'policy_pack_hash':p.policy_pack_hash}; e2.open_run(r,'V104-02'); e2.provide_trusted_control('V104-02',base_trusted()); d=e2.decide('V104-02'); add('V104-02-V15-REQUIRES-CANONICAL-CEP-PREDICATES', d['final_gate']=='HOLD' and any('POLICY_V15_NONCONFORMANT' in str(x) for x in d.get('blocking_evidence',[])), repr(d)) pp=copy.deepcopy(DEFAULT_POLICY_PACK.to_dict()); pp['policy_pack_version']='v104-bad-override'; pp['allowed_overrides']['HOLD']={'SHIP':['GOVERNANCE_APPROVER']}; p=PolicyPack.from_dict(pp); e3=LoopGuardCanonicalPOC(root/'ovmatrix',p); r=base_request('V104-03'); r['policy_pack_ref']={'policy_pack_id':p.policy_pack_id,'policy_pack_version':p.policy_pack_version,'policy_pack_hash':p.policy_pack_hash}; e3.open_run(r,'V104-03'); e3.provide_trusted_control('V104-03',base_trusted()); d=e3.decide('V104-03'); add('V104-03-V15-LOCKS-OVERRIDE-MATRIX', d['final_gate']=='HOLD' and any('POLICY_V15_NONCONFORMANT' in str(x) for x in d.get('blocking_evidence',[])), repr(d)) e4=LoopGuardCanonicalPOC(root/'trace'); r=base_request('V104-04'); e4.open_run(r,'V104-04'); e4.provide_trusted_control('V104-04',base_trusted()); e4.decide('V104-04'); rd=root/'trace'/'V104-04'; mm=read_json(rd/'metric_results.json'); mm['risk_level']['explanation']='FORGED'; mm['risk_level']['confidence']=0.123; write_json(rd/'metric_results.json',mm); e4._write_manifest_snapshot(rd); vr=e4.verify_persisted_run('V104-04'); add('V104-04-FULL-METRIC-TRACE-REPLAYED', (not vr['ok']) and 'METRIC_RESULT_TRACE_MISMATCH' in vr['errors'], repr(vr)) e5=LoopGuardCanonicalPOC(root/'quality'); r=base_request('V104-05'); [s.update({'confidence':0.0,'completeness':0.0}) for s in r['signals']]; e5.open_run(r,'V104-05'); e5.provide_trusted_control('V104-05',base_trusted()); e5.decide('V104-05'); mm=read_json(root/'quality'/'V104-05'/'metric_results.json'); bound=[m for m in mm.values() if any(str(ref).startswith('SIG-') for ref in (m.get('input_refs') or []))]; add('V104-05-SIGNAL-QUALITY-NOT-UPGRADED', all(m['confidence']==0.0 and m['completeness']==0.0 for m in bound), repr(bound)) e6=LoopGuardCanonicalPOC(root/'ovext'); r=base_request('V104-06'); e6.open_run(r,'V104-06'); e6.provide_trusted_control('V104-06',base_trusted()); e6.decide('V104-06'); e6.provide_trusted_override_authorization('V104-06',base_trusted_override()); e6.request_override('V104-06','HOLD','audit'); rd=root/'ovext'/'V104-06'; ep=rd/'override_evidence_0001.json'; ext=read_json(ep); ext['latest_override_id']='FORGED'; tmp=copy.deepcopy(ext); tmp.pop('integrity_hash',None); ext['integrity_hash']=sha256_obj(tmp); write_json(ep,ext); e6._write_manifest_snapshot(rd); vr=e6.verify_persisted_run('V104-06'); add('V104-06-OVERRIDE-EVIDENCE-SEMANTIC-RECONSTRUCTION', (not vr['ok']) and 'OVERRIDE_EVIDENCE_SEMANTIC_MISMATCH:1' in vr['errors'], repr(vr)) e7=LoopGuardCanonicalPOC(root/'runentity'); r=base_request('V104-07'); e7.open_run(r,'V104-07'); e7.provide_trusted_control('V104-07',base_trusted()); e7.decide('V104-07'); rd=root/'runentity'/'V104-07'; run=read_json(rd/'run.json'); run['started_at']='not-a-timestamp'; write_json(rd/'run.json',run); e7._write_manifest_snapshot(rd); vr=e7.verify_persisted_run('V104-07'); add('V104-07-RUN-ENTITY-SCHEMA-AND-TIMESTAMPS-VERIFIED', (not vr['ok']) and any(x.startswith('RUN_ENTITY_INVALID:') for x in vr['errors']), repr(vr)) return out def v105_audit_provenance_regression_suite(root: Path) -> List[Dict[str, Any]]: if root.exists(): shutil.rmtree(root) root.mkdir(parents=True) out: List[Dict[str, Any]] = [] def add(name, ok, detail=''): out.append({'test': name, 'ok': bool(ok), 'detail': '' if ok else detail}) def rewrite_manifest(engine: LoopGuardCanonicalPOC, rd: Path) -> None: for p in list(rd.glob('manifest.json')) + list(rd.glob('manifest_override_*.json')): p.unlink() engine._write_manifest_snapshot(rd) # V105-01: a rejected override cannot be forged into ACCEPTED. e = LoopGuardCanonicalPOC(root / 'override-status') req = base_request('V105-01') e.open_run(req, 'V105-01') e.provide_trusted_control('V105-01', base_trusted()) e.decide('V105-01') e.provide_trusted_override_authorization('V105-01', base_trusted_override(role='REVIEWER')) ov = e.request_override('V105-01', 'HOLD', 'unauthorized role must remain rejected') rd = root / 'override-status' / 'V105-01' forged = read_json(rd / 'override_0001.json') forged['override_status'] = 'ACCEPTED' write_json(rd / 'override_0001.json', forged) rewrite_manifest(e, rd) vr = e.verify_persisted_run('V105-01') add('V105-01-OVERRIDE-STATUS-REPLAY-VERIFIED', ov['override_status'] == 'REJECTED' and (not vr['ok']) and any('OVERRIDE_REPLAY_MISMATCH' in x for x in vr['errors']), repr(vr)) # V105-02: accepted override attribution must match the bound authorization. e = LoopGuardCanonicalPOC(root / 'override-attribution') req = base_request('V105-02') e.open_run(req, 'V105-02') e.provide_trusted_control('V105-02', base_trusted()) e.decide('V105-02') e.provide_trusted_override_authorization('V105-02', base_trusted_override(actor_id='actor-original')) e.request_override('V105-02', 'HOLD', 'authorized') rd = root / 'override-attribution' / 'V105-02' forged = read_json(rd / 'override_0001.json') forged['actor_id'] = 'actor-forged' forged['approval_role'] = 'REVIEWER' forged['trusted_authorization_status'] = 'REJECTED' forged['authorizing_policy_rule'] = 'FORGED' write_json(rd / 'override_0001.json', forged) rewrite_manifest(e, rd) vr = e.verify_persisted_run('V105-02') add('V105-02-OVERRIDE-ATTRIBUTION-REPLAY-VERIFIED', (not vr['ok']) and any('OVERRIDE_REPLAY_MISMATCH' in x for x in vr['errors']), repr(vr)) # V105-03: authorization from RUN-A cannot authorize RUN-B. e = LoopGuardCanonicalPOC(root / 'cross-run') for rid in ('V105-03-A', 'V105-03-B'): req = base_request(rid) e.open_run(req, rid) e.provide_trusted_control(rid, base_trusted()) e.decide(rid) e.provide_trusted_override_authorization('V105-03-A', base_trusted_override(actor_id='actor-a')) src_auth = root / 'cross-run' / 'V105-03-A' / 'trusted_override_authorization_0001.json' dst_auth = root / 'cross-run' / 'V105-03-B' / 'trusted_override_authorization_0001.json' shutil.copyfile(src_auth, dst_auth) rejected = False try: e.request_override('V105-03-B', 'HOLD', 'must reject cross-run authorization') except POCError as exc: rejected = 'TRUSTED_OVERRIDE_AUTH_BINDING_MISMATCH' in str(exc) add('V105-03-OVERRIDE-AUTHORIZATION-RUN-BOUND', rejected) # V105-04: failed-closed root cause is replay-verified, not only Gate/status. e = LoopGuardCanonicalPOC(root / 'failed-cause') req = base_request('V105-04') e.open_run(req, 'V105-04') d = e.decide('V105-04') # no trusted control -> TRUSTED_CONTROL_UNAVAILABLE rd = root / 'failed-cause' / 'V105-04' sem = read_json(rd / 'semantic_material.json') sem['triggered_rules'] = ['ENGINE_INTEGRITY_FAILURE'] sem['rationale_code'] = 'ENGINE_INTEGRITY_FAILURE' write_json(rd / 'semantic_material.json', sem) dec = read_json(rd / 'decision_package.json') dec['triggered_rules'] = ['ENGINE_INTEGRITY_FAILURE'] dec['blocking_evidence'] = ['forged cause'] dec['rationale'] = 'forged cause' dec['rationale_code'] = 'ENGINE_INTEGRITY_FAILURE' dec['semantic_decision_hash'] = sha256_obj(sem) write_json(rd / 'decision_package.json', dec) bundle = read_json(rd / 'evidence_bundle.json') bundle['decision_hash'] = sha256_obj(dec) bundle['semantic_decision_hash'] = dec['semantic_decision_hash'] tmp = copy.deepcopy(bundle) tmp.pop('integrity_hash', None) bundle['integrity_hash'] = sha256_obj(tmp) write_json(rd / 'evidence_bundle.json', bundle) rewrite_manifest(e, rd) vr = e.verify_persisted_run('V105-04') add('V105-04-FAILED-CLOSED-CAUSE-REPLAY-VERIFIED', d['rationale_code'] == 'TRUSTED_CONTROL_UNAVAILABLE' and (not vr['ok']) and 'FAILED_CLOSED_TRACE_REEXECUTION_MISMATCH' in vr['errors'], repr(vr)) # V105-05..08: duplicated audit views must remain exactly bound to the request. for idx, filename, mutator in ( (5, 'signals.json', lambda obj: obj[0].update({'confidence': 0.123})), (6, 'scenario.json', lambda obj: obj.update({'impact_tier': 'HIGH'})), (7, 'governance_context.json', lambda obj: obj.update({'deployment_risk_tier': 'HIGH'})), (8, 'metric_input_envelopes.json', lambda obj: obj['risk_level']['payload'].update({'risk_fixture_score': 99})), ): rid = f'V105-0{idx}' e = LoopGuardCanonicalPOC(root / f'duplicate-{idx}') req = base_request(rid) e.open_run(req, rid) e.provide_trusted_control(rid, base_trusted()) e.decide(rid) rd = root / f'duplicate-{idx}' / rid obj = read_json(rd / filename) mutator(obj) write_json(rd / filename, obj) rewrite_manifest(e, rd) vr = e.verify_persisted_run(rid) add(f'V105-0{idx}-REQUEST-DUPLICATE-{filename.upper()}-BOUND', (not vr['ok']) and f'REQUEST_DUPLICATE_ARTIFACT_MISMATCH:{filename}' in vr['errors'], repr(vr)) # V105-09: future Signal timestamps fail closed and the failed-closed replay remains verifiable. e = LoopGuardCanonicalPOC(root / 'future-signal') req = base_request('V105-09') for sig in req['signals']: sig['observed_at'] = '2099-01-01T00:00:00+00:00' e.open_run(req, 'V105-09') e.provide_trusted_control('V105-09', base_trusted()) d = e.decide('V105-09') vr = e.verify_persisted_run('V105-09') add('V105-09-FUTURE-SIGNAL-FAILS-CLOSED-AND-REPLAYS', d['final_gate'] == 'HOLD' and d['rationale_code'] == 'SCHEMA_OR_TRUST_BOUNDARY_FAILURE' and vr['ok'], repr((d, vr))) # V105-10: future trusted-control timestamp cannot yield a completed decision. e = LoopGuardCanonicalPOC(root / 'future-control') req = base_request('V105-10') trusted = base_trusted() trusted['control_timestamp'] = '2099-01-01T00:00:00+00:00' e.open_run(req, 'V105-10') e.provide_trusted_control('V105-10', trusted) d = e.decide('V105-10') vr = e.verify_persisted_run('V105-10') add('V105-10-FUTURE-TRUSTED-CONTROL-FAILS-CLOSED-AND-REPLAYS', d['final_gate'] == 'HOLD' and vr['ok'], repr((d, vr))) # V105-11: future trusted override authorization is rejected at ingestion. e = LoopGuardCanonicalPOC(root / 'future-override-auth') req = base_request('V105-11') e.open_run(req, 'V105-11') e.provide_trusted_control('V105-11', base_trusted()) e.decide('V105-11') auth = base_trusted_override() auth['control_timestamp'] = '2099-01-01T00:00:00+00:00' rejected = False try: e.provide_trusted_override_authorization('V105-11', auth) except POCError as exc: rejected = 'TRUSTED_OVERRIDE_TIMESTAMP_IN_FUTURE' in str(exc) add('V105-11-FUTURE-OVERRIDE-AUTHORIZATION-REJECTED', rejected) return out def v106_identity_bundle_namespace_temporal_regression_suite(root: Path) -> List[Dict[str,Any]]: if root.exists(): shutil.rmtree(root) root.mkdir(parents=True) out=[] def add(name, ok, detail=''): out.append({'test':name,'ok':bool(ok),'detail':'' if ok else detail}) def rewrite_manifest(engine, rd): for mp in engine._manifest_paths(rd): mp.unlink() engine._write_manifest_snapshot(rd) def run_green(subdir, rid): e=LoopGuardCanonicalPOC(root/subdir); req=base_request(rid); e.open_run(req,rid); e.provide_trusted_control(rid,base_trusted()); d=e.decide(rid); return e,d,root/subdir/rid # V106-01 decision_id is deterministic and bound to Run. e,d,rd=run_green('decision-id','V106-01') dec=read_json(rd/'decision_package.json'); dec['decision_id']='DEC-FORGED'; write_json(rd/'decision_package.json',dec) b=read_json(rd/'evidence_bundle.json'); b['decision_hash']=sha256_obj(dec); tmp=copy.deepcopy(b); tmp.pop('integrity_hash',None); b['integrity_hash']=sha256_obj(tmp); write_json(rd/'evidence_bundle.json',b); rewrite_manifest(e,rd) vr=e.verify_persisted_run('V106-01'); add('V106-01-DECISION-ID-BOUND', (not vr['ok']) and any('DECISION_IDENTITY_INVALID' in x or 'DETERMINISTIC_REEXECUTION_MISMATCH' in x for x in vr['errors']), repr(vr)) # V106-02 decision.run_id is deterministic and bound to Run. e,d,rd=run_green('decision-run','V106-02') dec=read_json(rd/'decision_package.json'); dec['run_id']='V106-02-FORGED'; write_json(rd/'decision_package.json',dec) b=read_json(rd/'evidence_bundle.json'); b['decision_hash']=sha256_obj(dec); tmp=copy.deepcopy(b); tmp.pop('integrity_hash',None); b['integrity_hash']=sha256_obj(tmp); write_json(rd/'evidence_bundle.json',b); rewrite_manifest(e,rd) vr=e.verify_persisted_run('V106-02'); add('V106-02-DECISION-RUN-ID-BOUND', (not vr['ok']) and any('DECISION_IDENTITY_INVALID' in x or 'DETERMINISTIC_REEXECUTION_MISMATCH' in x for x in vr['errors']), repr(vr)) # V106-03 EvidenceBundle metadata is reconstructed, not merely hash checked. e,d,rd=run_green('bundle','V106-03') b=read_json(rd/'evidence_bundle.json'); b['bundle_id']='BUNDLE-FORGED'; b['metric_registry_version']='9.9.9'; b['rule_engine_version']='forged'; b['audit_refs']=['fake.json']; b['known_limitations']=['none']; tmp=copy.deepcopy(b); tmp.pop('integrity_hash',None); b['integrity_hash']=sha256_obj(tmp); write_json(rd/'evidence_bundle.json',b); rewrite_manifest(e,rd) vr=e.verify_persisted_run('V106-03'); add('V106-03-EVIDENCE-BUNDLE-SEMANTIC-RECONSTRUCTION', (not vr['ok']) and any('EVIDENCE_BUNDLE_SEMANTIC_INVALID' in x for x in vr['errors']), repr(vr)) # V106-04 accepted override has no contradictory legacy collection artifact. e,d,rd=run_green('override-collection','V106-04'); e.provide_trusted_override_authorization('V106-04',base_trusted_override()); ov=e.request_override('V106-04','HOLD','authorized') vr=e.verify_persisted_run('V106-04'); add('V106-04-NO-LEGACY-OVERRIDES-COLLECTION', ov['override_status']=='ACCEPTED' and not (rd/'overrides.json').exists() and vr['ok'], repr(vr)) # V106-05 arbitrary non-sequential authorization artifacts remain rejected. # A sequential API-issued authorization is a valid pending lifecycle state as of V1.0.9. e,d,rd=run_green('orphan-auth','V106-05') forged = {'authorization_id':'TOA-V106-05-9999','run_id':'V106-05','decision_id':d['decision_id'],'trusted_source_id':'TRUSTED-OVERRIDE-POC','actor_id':'actor','approval_role':'GOVERNANCE_APPROVER','authorization_status':'AUTHORIZED','control_timestamp':utc_now()} forged['authorization_hash']=sha256_obj(_override_authorization_material(forged)); write_json_new(rd/'trusted_override_authorization_9999.json',forged); e._write_manifest_snapshot(rd) vr=e.verify_persisted_run('V106-05'); add('V106-05-NONSEQUENTIAL-AUTHORIZATION-REJECTED', (not vr['ok']) and any('OVERRIDE_NAMESPACE_OR_CHRONOLOGY_INVALID' in x for x in vr['errors']), repr(vr)) # V106-06 orphan evidence extension is rejected. e,d,rd=run_green('orphan-evidence','V106-06') b=read_json(rd/'evidence_bundle.json'); ext={'extension_id':'OVERRIDE-EVIDENCE-V106-06-1','run_id':'V106-06','base_bundle_integrity_hash':b['integrity_hash'],'override_refs':[],'latest_override_id':'OVR-NONE','trusted_authorization_ref':None,'trusted_authorization_hash':None}; ext['integrity_hash']=sha256_obj(ext); write_json_new(rd/'override_evidence_0001.json',ext); e._write_manifest_snapshot(rd) vr=e.verify_persisted_run('V106-06'); add('V106-06-ORPHAN-OVERRIDE-EVIDENCE-REJECTED', (not vr['ok']) and any('OVERRIDE_NAMESPACE_OR_CHRONOLOGY_INVALID' in x for x in vr['errors']), repr(vr)) # V106-07 malformed/future derived timestamps fail verification. e,d,rd=run_green('derived-time','V106-07') metrics=read_json(rd/'metric_results.json'); metrics['risk_level']['computed_at']='not-a-timestamp'; write_json(rd/'metric_results.json',metrics); rewrite_manifest(e,rd) vr=e.verify_persisted_run('V106-07'); add('V106-07-DERIVED-TIMESTAMP-VALIDATED', (not vr['ok']) and any('FULL_TEMPORAL_PROVENANCE_INVALID' in x for x in vr['errors']), repr(vr)) # V106-08 future source_started_at fails closed and remains replay-verifiable. e=LoopGuardCanonicalPOC(root/'future-source-start'); req=base_request('V106-08'); req['run_metadata']['started_at']='2099-01-01T00:00:00+00:00'; e.open_run(req,'V106-08'); e.provide_trusted_control('V106-08',base_trusted()); d=e.decide('V106-08'); vr=e.verify_persisted_run('V106-08') add('V106-08-FUTURE-SOURCE-START-FAILS-CLOSED', d['final_gate']=='HOLD' and d['rationale_code']=='SCHEMA_OR_TRUST_BOUNDARY_FAILURE' and vr['ok'], repr((d,vr))) # V106-09 run.started_at may not postdate decision. e,d,rd=run_green('run-time-order','V106-09') run=read_json(rd/'run.json'); dec=read_json(rd/'decision_package.json'); run['started_at']=run['completed_at']; write_json(rd/'run.json',run); rewrite_manifest(e,rd) vr=e.verify_persisted_run('V106-09'); add('V106-09-RUN-START-BEFORE-DECISION', (not vr['ok']) and any('FULL_TEMPORAL_PROVENANCE_INVALID' in x for x in vr['errors']), repr(vr)) # V106-10 terminal Run cannot be coherently shifted into the future. e,d,rd=run_green('future-run','V106-10') future_start='2099-01-01T00:00:00+00:00'; future_dec='2099-01-01T00:00:01+00:00'; future_end='2099-01-01T00:00:02+00:00' run=read_json(rd/'run.json'); run['source_started_at']='2098-12-31T23:59:59+00:00'; run['started_at']=future_start; run['completed_at']=future_end; write_json(rd/'run.json',run) req=read_json(rd/'governance_request.json'); req['run_metadata']['started_at']=run['source_started_at']; write_json(rd/'governance_request.json',req); write_json(rd/'scenario.json',req['scenario']); write_json(rd/'governance_context.json',req['governance_context']); write_json(rd/'signals.json',req['signals']); write_json(rd/'metric_input_envelopes.json',req['metric_inputs']); run['request_hash']=sha256_obj(req); write_json(rd/'run.json',run) dec=read_json(rd/'decision_package.json'); dec['decision_timestamp']=future_dec; write_json(rd/'decision_package.json',dec) b=read_json(rd/'evidence_bundle.json'); b['input_hash']=sha256_obj(req); b['decision_hash']=sha256_obj(dec); tmp=copy.deepcopy(b); tmp.pop('integrity_hash',None); b['integrity_hash']=sha256_obj(tmp); write_json(rd/'evidence_bundle.json',b); rewrite_manifest(e,rd) vr=e.verify_persisted_run('V106-10'); add('V106-10-FUTURE-TERMINAL-RUN-REJECTED', (not vr['ok']) and any('FULL_TEMPORAL_PROVENANCE_INVALID' in x for x in vr['errors']), repr(vr)) # V106-11 override request must postdate decision/completion. e,d,rd=run_green('override-time','V106-11'); e.provide_trusted_override_authorization('V106-11',base_trusted_override()); e.request_override('V106-11','HOLD','authorized') r=read_json(rd/'override_request_0001.json'); r['request_timestamp']='2021-01-01T00:00:00+00:00'; write_json(rd/'override_request_0001.json',r); e._write_manifest_snapshot(rd) vr=e.verify_persisted_run('V106-11'); add('V106-11-OVERRIDE-REQUEST-POSTDATES-DECISION', (not vr['ok']) and any('OVERRIDE_NAMESPACE_OR_CHRONOLOGY_INVALID' in x or 'OVERRIDE_AUTH_POSTDATES_REQUEST' in x for x in vr['errors']), repr(vr)) # V106-12 absolute/external authorization references are rejected before file access. e,d,rd=run_green('auth-path','V106-12'); e.provide_trusted_override_authorization('V106-12',base_trusted_override()); e.request_override('V106-12','HOLD','authorized') request=read_json(rd/'override_request_0001.json'); request['trusted_authorization_ref']='/tmp/evil.json'; write_json(rd/'override_request_0001.json',request); e._write_manifest_snapshot(rd) vr=e.verify_persisted_run('V106-12'); add('V106-12-AUTHORIZATION-PATH-CONTAINED', (not vr['ok']) and any('OVERRIDE_AUTH_REF_INVALID' in x or 'OVERRIDE_NAMESPACE_OR_CHRONOLOGY_INVALID' in x for x in vr['errors']), repr(vr)) # V106-13 a normal accepted override remains fully verifiable under stricter closure/chronology. e,d,rd=run_green('override-valid','V106-13'); e.provide_trusted_override_authorization('V106-13',base_trusted_override()); ov=e.request_override('V106-13','HOLD','valid control flow'); vr=e.verify_persisted_run('V106-13') add('V106-13-VALID-OVERRIDE-REMAINS-VERIFIABLE', ov['override_status']=='ACCEPTED' and vr['ok'], repr(vr)) return out def _run_full_verification_v106(output_root: Path) -> Dict[str, Any]: if output_root.exists(): shutil.rmtree(output_root) output_root.mkdir(parents=True) scenarios = scenario_suite(output_root / 'runs') invariants = invariant_suite(output_root / 'invariants') regressions = audit_regression_suite(output_root / 'audit_regressions') config_regressions = configuration_integrity_regression_suite(output_root / 'configuration_integrity_regressions') v103_regressions = v103_replay_evidence_regression_suite(output_root / 'v103_regressions') v104_regressions = v104_verification_integrity_regression_suite(output_root / 'v104_regressions') v105_regressions = v105_audit_provenance_regression_suite(output_root / 'v105_regressions') v106_regressions = v106_identity_bundle_namespace_temporal_regression_suite(output_root / 'v106_regressions') summary = { 'spec_version': SPEC_VERSION, 'engine_version': ENGINE_VERSION, 'scenario_total': len(scenarios), 'scenario_passed': sum(x['ok'] for x in scenarios), 'scenario_failed': sum(not x['ok'] for x in scenarios), 'invariant_total': len(invariants), 'invariant_passed': sum(x['ok'] for x in invariants), 'invariant_failed': sum(not x['ok'] for x in invariants), 'audit_regression_total': len(regressions), 'audit_regression_passed': sum(x['ok'] for x in regressions), 'audit_regression_failed': sum(not x['ok'] for x in regressions), 'configuration_integrity_total': len(config_regressions), 'configuration_integrity_passed': sum(x['ok'] for x in config_regressions), 'configuration_integrity_failed': sum(not x['ok'] for x in config_regressions), 'v103_regression_total': len(v103_regressions), 'v103_regression_passed': sum(x['ok'] for x in v103_regressions), 'v103_regression_failed': sum(not x['ok'] for x in v103_regressions), 'v103_regressions': v103_regressions, 'v104_regression_total': len(v104_regressions), 'v104_regression_passed': sum(x['ok'] for x in v104_regressions), 'v104_regression_failed': sum(not x['ok'] for x in v104_regressions), 'v104_regressions': v104_regressions, 'v105_regression_total': len(v105_regressions), 'v105_regression_passed': sum(x['ok'] for x in v105_regressions), 'v105_regression_failed': sum(not x['ok'] for x in v105_regressions), 'v105_regressions': v105_regressions, 'v106_regression_total': len(v106_regressions), 'v106_regression_passed': sum(x['ok'] for x in v106_regressions), 'v106_regression_failed': sum(not x['ok'] for x in v106_regressions), 'v106_regressions': v106_regressions, 'scenarios': [{'id': x['id'], 'ok': x['ok'], 'gate': x['decision']['final_gate'], 'details': x['details']} for x in scenarios], 'invariants': invariants, 'audit_regressions': regressions, 'configuration_integrity_regressions': config_regressions, } write_json(output_root / 'verification_report.json', summary) return summary # ============================================================================ # Canonical POC V1.0.7 — V1.5.1 Rev B implementation layer # ============================================================================ EVIDENCE_QUALITY_ARTIFACT = 'evidence_quality_evaluation.json' EVIDENCE_QUALITY_VIOLATION_ORDER = ( 'MISSING_REQUIRED_METRIC', 'METRIC_STATUS_NOT_OK', 'INVALID_CONFIDENCE', 'INVALID_COMPLETENESS', 'INSUFFICIENT_REQUIRED_EVIDENCE', 'BELOW_MIN_CONFIDENCE', 'BELOW_MIN_COMPLETENESS', ) EVIDENCE_MINIMUM_FIELDS = { 'required', 'minimum_required_evidence_items', 'minimum_metric_confidence', 'minimum_metric_completeness', 'applies_to', 'ship_eligibility', } POLICY_PACK_CANONICAL_FIELDS = set(PolicyPack.__dataclass_fields__) def _strict_object_pairs(pairs): obj = {} for key, value in pairs: if key in obj: raise POCError(f'DUPLICATE_JSON_KEY:{key}') obj[key] = value return obj def _reject_json_constant(value: str): raise POCError(f'NON_STANDARD_JSON_CONSTANT:{value}') def read_json(path: Path) -> Any: """Ambiguity-safe persisted JSON reader. Rejects duplicate object keys and non-standard NaN/Infinity constants so a verification PASS has one parser-independent JSON interpretation. """ text = Path(path).read_text(encoding='utf-8') try: return json.loads( text, object_pairs_hook=_strict_object_pairs, parse_constant=_reject_json_constant, ) except POCError: raise except (json.JSONDecodeError, TypeError, ValueError) as exc: raise POCError(f'STRICT_JSON_PARSE_FAILURE:{Path(path).name}:{type(exc).__name__}') from exc def _finite_real_01(value: Any) -> bool: return isinstance(value, (int, float)) and not isinstance(value, bool) and math.isfinite(float(value)) and 0.0 <= float(value) <= 1.0 def _validate_evidence_minimums_v151(minima: Any, *, lock_default: bool=False) -> None: if not isinstance(minima, dict) or set(minima) != EVIDENCE_MINIMUM_FIELDS: raise POCError('V151_EVIDENCE_MINIMUMS_SCHEMA_MISMATCH') if not isinstance(minima['required'], bool): raise POCError('V151_EVIDENCE_REQUIRED_TYPE_INVALID') mri = minima['minimum_required_evidence_items'] if not isinstance(mri, int) or isinstance(mri, bool) or (minima['required'] and mri < 1) or (not minima['required'] and mri < 0): raise POCError('V151_MINIMUM_REQUIRED_EVIDENCE_ITEMS_INVALID') if not _finite_real_01(minima['minimum_metric_confidence']): raise POCError('V151_MINIMUM_METRIC_CONFIDENCE_INVALID') if not _finite_real_01(minima['minimum_metric_completeness']): raise POCError('V151_MINIMUM_METRIC_COMPLETENESS_INVALID') if minima['applies_to'] != 'required_metrics': raise POCError('V151_EVIDENCE_APPLIES_TO_INVALID') if minima['ship_eligibility'] != 'ALL_REQUIRED_METRICS_MUST_MEET_MINIMUMS': raise POCError('V151_EVIDENCE_SHIP_ELIGIBILITY_INVALID') if lock_default and minima != DEFAULT_POLICY_PACK.evidence_minimums: raise POCError('V151_DEFAULT_EVIDENCE_MINIMUMS_MISMATCH') def _validate_persisted_policy_document_v107(doc: Any) -> None: if not isinstance(doc, dict): raise POCError('PERSISTED_POLICY_DOCUMENT_NOT_OBJECT') expected = POLICY_PACK_CANONICAL_FIELDS | {'policy_pack_hash'} if set(doc) != expected: extra = sorted(set(doc) - expected) missing = sorted(expected - set(doc)) raise POCError(f'PERSISTED_POLICY_DOCUMENT_SCHEMA_MISMATCH:extra={extra}:missing={missing}') declared_hash = doc.get('policy_pack_hash') raw = {k: copy.deepcopy(v) for k, v in doc.items() if k != 'policy_pack_hash'} policy = PolicyPack.from_dict(raw) validate_policy_pack(policy) if declared_hash != policy.policy_pack_hash: raise POCError('PERSISTED_POLICY_DOCUMENT_HASH_MISMATCH') def _quality_violation(code: str, metric: Optional[str]=None, detail: Optional[str]=None) -> Dict[str, Any]: out = {'code': code} if metric is not None: out['metric'] = metric if detail is not None: out['detail'] = detail return out def _quality_violation_sort_key(v: Dict[str, Any], required_metrics: Tuple[str, ...]): try: cidx = EVIDENCE_QUALITY_VIOLATION_ORDER.index(v['code']) except ValueError: cidx = len(EVIDENCE_QUALITY_VIOLATION_ORDER) metric = v.get('metric') try: midx = required_metrics.index(metric) if metric is not None else len(required_metrics) except ValueError: midx = len(required_metrics) return (cidx, midx, metric or '', v.get('detail') or '') def build_evidence_quality_evaluation( run_id: str, decision_id: str, metrics: Dict[str, Any], policy: PolicyPack, ) -> Dict[str, Any]: """Build the deterministic V1.5.1 Rev B EvidenceQualityEvaluation.""" _validate_evidence_minimums_v151(policy.evidence_minimums) required_metrics = tuple(policy.required_metrics) minima = copy.deepcopy(policy.evidence_minimums) metric_quality: Dict[str, Any] = {} violations: List[Dict[str, Any]] = [] structural_non_evaluable = False min_conf = float(minima['minimum_metric_confidence']) min_comp = float(minima['minimum_metric_completeness']) for name in required_metrics: metric = metrics.get(name) if isinstance(metrics, dict) else None entry = {'status': None, 'confidence': None, 'completeness': None} if not isinstance(metric, dict): violations.append(_quality_violation('MISSING_REQUIRED_METRIC', name)) structural_non_evaluable = True metric_quality[name] = entry continue entry['status'] = metric.get('status') if metric.get('status') != 'OK': violations.append(_quality_violation('METRIC_STATUS_NOT_OK', name, str(metric.get('status')))) structural_non_evaluable = True conf = metric.get('confidence') comp = metric.get('completeness') if _finite_real_01(conf): entry['confidence'] = float(conf) if float(conf) < min_conf: violations.append(_quality_violation('BELOW_MIN_CONFIDENCE', name)) else: violations.append(_quality_violation('INVALID_CONFIDENCE', name)) structural_non_evaluable = True if _finite_real_01(comp): entry['completeness'] = float(comp) if float(comp) < min_comp: violations.append(_quality_violation('BELOW_MIN_COMPLETENESS', name)) else: violations.append(_quality_violation('INVALID_COMPLETENESS', name)) structural_non_evaluable = True metric_quality[name] = entry evidence_counts = { 'required_evidence_items': None, 'verified_evidence_items': None, 'conflicting_evidence_items': None, } evidence_metric = metrics.get('evidence_status') if isinstance(metrics, dict) else None raw = evidence_metric.get('raw_value') if isinstance(evidence_metric, dict) else None counts_valid = isinstance(raw, dict) and set(raw) == set(evidence_counts) if counts_valid: vals = [raw[k] for k in evidence_counts] counts_valid = all(isinstance(x, int) and not isinstance(x, bool) and x >= 0 for x in vals) if counts_valid: evidence_counts = {k: int(raw[k]) for k in evidence_counts} if minima['required']: if ( evidence_counts['required_evidence_items'] < int(minima['minimum_required_evidence_items']) or evidence_counts['verified_evidence_items'] < evidence_counts['required_evidence_items'] ): violations.append(_quality_violation('INSUFFICIENT_REQUIRED_EVIDENCE', 'evidence_status')) else: # Missing/malformed evidence counts are already non-evaluable if the evidence # metric itself is missing/non-OK; ensure an explicit deterministic violation. if minima['required']: if not any(v['code'] in {'MISSING_REQUIRED_METRIC', 'METRIC_STATUS_NOT_OK'} and v.get('metric') == 'evidence_status' for v in violations): violations.append(_quality_violation('INSUFFICIENT_REQUIRED_EVIDENCE', 'evidence_status', 'COUNTS_UNAVAILABLE')) structural_non_evaluable = True violations.sort(key=lambda v: _quality_violation_sort_key(v, required_metrics)) status = 'NOT_EVALUABLE' if structural_non_evaluable else 'EVALUATED' ship_eligible = status == 'EVALUATED' and not violations reason_code = 'QUALITY_ELIGIBLE' if ship_eligible else (violations[0]['code'] if violations else 'NOT_EVALUABLE') explanation = ( 'All required metrics and evidence counts satisfy the locked V1.5.1 evidence-quality contract.' if ship_eligible else f'Evidence-quality SHIP eligibility failed: {reason_code}.' ) return { 'evaluation_id': f'EQE-{run_id}', 'run_id': run_id, 'decision_id': decision_id, 'status': status, 'policy_pack_id': policy.policy_pack_id, 'policy_pack_version': policy.policy_pack_version, 'policy_pack_hash': policy.policy_pack_hash, 'required_metrics': list(required_metrics), 'configured_minimums': minima, 'metric_quality': metric_quality, 'evidence_counts': evidence_counts, 'violations': violations, 'ship_eligible': bool(ship_eligible), 'reason_code': reason_code, 'deterministic_explanation': explanation, } def _evidence_quality_ship_eligible(metrics: Dict[str, Any], policy: PolicyPack) -> bool: eqe = build_evidence_quality_evaluation('ELIGIBILITY', 'DEC-ELIGIBILITY', metrics, policy) return eqe['status'] == 'EVALUATED' and eqe['ship_eligible'] is True def _evaluate_green_path(metrics, scenario, trusted, policy, prior_rules): spec = policy.green_path_rule satisfied = all((_eval_policy_spec(req, metrics, scenario, trusted, policy) for req in spec.get('requirements', []))) satisfied = satisfied and _evidence_quality_ship_eligible(metrics, policy) if spec.get('requires_no_blocking_rules', False): satisfied = satisfied and (not any((r['triggered'] and r['blocking'] for r in prior_rules))) return _rule( spec['rule_id'], satisfied, spec['gate'], False, 'All PolicyPack Green-Path requirements and V1.5.1 evidence-quality requirements satisfied.', ['required_metrics', 'evidence_quality', 'trusted_control', 'scenario.impact_tier'], int(spec.get('rank', 60)), 'GREEN_PATH', spec['rule_version'] ) def validate_v15_policy_pack(policy: PolicyPack) -> None: """Locked Canonical POC V1.5.1 Rev B conformance profile.""" _validate_v15_policy_pack_v106(policy) _validate_evidence_minimums_v151(policy.evidence_minimums, lock_default=True) def _semantic_replay_projection(path: Path) -> Dict[str, Any]: def r(name, default=None): q = path / name return read_json(q) if q.exists() else default return { 'semantic_material': r('semantic_material.json', {}), 'policy_profile': r('policy_profile.json'), 'cep_predicates': r('cep_predicate_evaluations.json', []), 'evidence_quality_evaluation': r(EVIDENCE_QUALITY_ARTIFACT), 'decision': {k: v for k, v in (r('decision_package.json', {}) or {}).items() if k != 'decision_timestamp'}, } def _expected_evidence_bundle( run_id: str, req: Dict[str, Any], trusted: Optional[Dict[str, Any]], decision: Dict[str, Any], metrics: Dict[str, Any], profile_hash: Optional[str], registry: Dict[str, Any], policy: PolicyPack, ) -> Dict[str, Any]: scenario = req.get('scenario', {}) if isinstance(req, dict) else {} signals = req.get('signals', []) if isinstance(req, dict) else [] raw_artifact_refs = scenario.get('artifact_refs', []) if isinstance(scenario, dict) else [] artifact_refs = list(raw_artifact_refs) if isinstance(raw_artifact_refs, list) else [] eqe = build_evidence_quality_evaluation(run_id, decision['decision_id'], metrics, policy) eqe_hash = sha256_obj(eqe) bundle = { 'bundle_id': f'BUNDLE-{run_id}', 'run_id': run_id, 'input_hash': sha256_obj(req), 'trusted_control_hash': sha256_obj(trusted) if trusted is not None else None, 'metric_registry_version': METRIC_REGISTRY_VERSION, 'metric_registry_hash': sha256_obj(registry), 'metric_versions': {k: v.get('metric_version') for k, v in metrics.items()}, 'metric_config_versions': {k: v.get('metric_config_version') for k, v in metrics.items()}, 'policy_pack_id': policy.policy_pack_id, 'policy_pack_version': policy.policy_pack_version, 'policy_pack_hash': policy.policy_pack_hash, 'policy_profile_hash': profile_hash, 'rule_engine_version': ENGINE_VERSION, 'decision_hash': sha256_obj(decision), 'semantic_decision_hash': decision['semantic_decision_hash'], 'evidence_quality_evaluation_ref': EVIDENCE_QUALITY_ARTIFACT, 'evidence_quality_evaluation_hash': eqe_hash, 'override_refs': [], 'signal_refs': [s.get('signal_id') for s in signals if isinstance(s, dict) and isinstance(s.get('signal_id'), str)], 'artifact_refs': artifact_refs, 'audit_refs': ['run.json', 'rule_evaluations.json', 'decision_package.json', 'semantic_material.json', EVIDENCE_QUALITY_ARTIFACT], 'known_limitations': list(EVIDENCE_BUNDLE_KNOWN_LIMITATIONS), } bundle['integrity_hash'] = sha256_obj(bundle) return bundle def _validate_evidence_quality_artifact_v107(rd: Path, run_id: str, decision: Dict[str, Any], metrics: Dict[str, Any], policy: PolicyPack, bundle: Dict[str, Any]) -> None: p = rd / EVIDENCE_QUALITY_ARTIFACT if not p.exists(): raise POCError('EVIDENCE_QUALITY_ARTIFACT_MISSING') stored = read_json(p) expected = build_evidence_quality_evaluation(run_id, decision['decision_id'], metrics, policy) if stored != expected: raise POCError('EVIDENCE_QUALITY_ARTIFACT_SEMANTIC_MISMATCH') h = sha256_obj(expected) if decision.get('evidence_quality_evaluation_ref') != EVIDENCE_QUALITY_ARTIFACT: raise POCError('DECISION_EVIDENCE_QUALITY_REF_MISMATCH') if decision.get('evidence_quality_evaluation_hash') != h: raise POCError('DECISION_EVIDENCE_QUALITY_HASH_MISMATCH') if decision.get('evidence_quality_status') != expected['status']: raise POCError('DECISION_EVIDENCE_QUALITY_STATUS_MISMATCH') if decision.get('evidence_quality_ship_eligible') is not expected['ship_eligible']: raise POCError('DECISION_EVIDENCE_QUALITY_ELIGIBILITY_MISMATCH') if bundle.get('evidence_quality_evaluation_ref') != EVIDENCE_QUALITY_ARTIFACT or bundle.get('evidence_quality_evaluation_hash') != h: raise POCError('BUNDLE_EVIDENCE_QUALITY_BINDING_MISMATCH') def _validate_evidence_bundle_semantics( bundle: Dict[str, Any], run_id: str, req: Dict[str, Any], trusted: Optional[Dict[str, Any]], decision: Dict[str, Any], metrics: Dict[str, Any], profile_hash: Optional[str], registry: Dict[str, Any], policy: PolicyPack, ) -> None: expected = _expected_evidence_bundle(run_id, req, trusted, decision, metrics, profile_hash, registry, policy) if bundle != expected: raise POCError('EVIDENCE_BUNDLE_SEMANTIC_MISMATCH') def _validate_full_persisted_chronology( req: Dict[str, Any], trusted: Optional[Dict[str, Any]], decision: Dict[str, Any], run: Dict[str, Any], metrics: Dict[str, Any], rules: List[Dict[str, Any]], ) -> None: # First apply all V1.0.6 interval and source/control checks. _validate_full_persisted_chronology_v106(req, trusted, decision, run, metrics, rules) if run.get('run_status') != 'COMPLETED': return signal_times = {} for sig in req.get('signals', []): if isinstance(sig, dict) and isinstance(sig.get('signal_id'), str): signal_times[sig['signal_id']] = _timestamp_dt(sig.get('observed_at'), f"signal.observed_at:{sig['signal_id']}") metric_times = {} for name, metric in metrics.items(): mdt = _timestamp_dt(metric.get('computed_at'), f'metric.computed_at:{name}') metric_times[name] = mdt for ref in metric.get('input_refs') or []: if ref in signal_times and signal_times[ref] > mdt: raise POCError(f'SIGNAL_POSTDATES_BOUND_METRIC:{ref}:{name}') trusted_dt = None if trusted is not None: trusted_dt = _timestamp_dt(trusted.get('control_timestamp'), 'trusted_control.control_timestamp') for idx, rule in enumerate(rules, 1): rdt = _timestamp_dt(rule.get('evaluated_at'), f'rule.evaluated_at:{idx}') refs = set(rule.get('input_refs') or []) required_metric_names = set() if 'required_metrics' in refs: required_metric_names |= set(metrics) required_metric_names |= refs & set(metrics) for name in sorted(required_metric_names): if metric_times[name] > rdt: raise POCError(f'RULE_PREDATES_REQUIRED_METRIC:{idx}:{name}') if 'trusted_control' in refs and trusted_dt is not None and trusted_dt > rdt: raise POCError(f'RULE_PREDATES_TRUSTED_CONTROL:{idx}') def _validate_override_namespace_closure(rd: Path, run_id: str, decision: Dict[str, Any]) -> None: if (rd / 'overrides.json').exists(): raise POCError('LEGACY_OVERRIDES_COLLECTION_PRESENT') override_seq = _override_artifact_sequences(rd, 'override') request_seq = _override_artifact_sequences(rd, 'override_request') evidence_seq = _override_artifact_sequences(rd, 'override_evidence') expected_seq = list(range(1, len(override_seq) + 1)) if override_seq != expected_seq: raise POCError('OVERRIDE_SEQUENCE_GAP') if request_seq != override_seq: raise POCError('OVERRIDE_REQUEST_NAMESPACE_MISMATCH') if evidence_seq != override_seq: raise POCError('OVERRIDE_EVIDENCE_NAMESPACE_MISMATCH') auth_seq = _override_artifact_sequences(rd, 'trusted_override_authorization') if auth_seq != list(range(1, len(auth_seq) + 1)): raise POCError('TRUSTED_OVERRIDE_AUTH_SEQUENCE_GAP') auth_files = [f'trusted_override_authorization_{n:04d}.json' for n in auth_seq] refs: List[str] = [] for seq in override_seq: request = read_json(rd / f'override_request_{seq:04d}.json') _validate_override_request_record(request, run_id, decision['decision_id'], seq) ref = request.get('trusted_authorization_ref') if ref is not None: _resolve_canonical_override_auth_ref(rd, ref) refs.append(ref) # Lifecycle rule: the latest issued authorization must be referenced. Earlier # unreferenced authorizations are valid only because a later authorization # superseded them. This preserves an auditable issue/supersede lifecycle while # still rejecting a genuinely orphaned final authorization. if auth_files: if not refs or auth_files[-1] not in refs: raise POCError('TRUSTED_OVERRIDE_AUTH_ORPHAN_LATEST') for i, fn in enumerate(auth_files[:-1]): if fn not in refs and i + 1 >= len(auth_files): raise POCError('TRUSTED_OVERRIDE_AUTH_ORPHAN') for ref in refs: if ref not in auth_files: raise POCError('TRUSTED_OVERRIDE_AUTH_NAMESPACE_MISMATCH') def _derive_override_record( run_id: str, seq: int, decision: Dict[str, Any], policy: PolicyPack, rules: List[Dict[str, Any]], prior: List[Dict[str, Any]], request_record: Dict[str, Any], auth_record: Optional[Dict[str, Any]], ) -> Dict[str, Any]: original = decision['final_gate'] requested_gate = request_record['requested_gate'] justification = request_record['justification'] auth_ref = request_record.get('trusted_authorization_ref') accepted_prior = [x for x in prior if x.get('override_status') == 'ACCEPTED'] used_refs = {x.get('trusted_authorization_ref') for x in prior if x.get('trusted_authorization_ref')} if auth_record is not None: auth = _validate_bound_override_authorization_record(auth_record, run_id, decision['decision_id']) actor = auth['actor_id']; role = auth['approval_role']; status = auth['authorization_status']; auth_hash = auth_record['authorization_hash'] else: auth = None; actor = 'UNRESOLVED'; role = 'UNRESOLVED'; status = 'MISSING'; auth_hash = None allowed = False reason = 'TRUSTED_OVERRIDE_AUTHORIZATION_MISSING' if accepted_prior: reason = 'DECISION_ALREADY_OVERRIDDEN' elif auth_ref in used_refs and auth_ref is not None: reason = 'TRUSTED_OVERRIDE_AUTHORIZATION_CONSUMED' elif requested_gate == 'SHIP' and decision.get('evidence_quality_ship_eligible') is not True: reason = 'EVIDENCE_QUALITY_PREVENTS_SHIP_OVERRIDE' elif auth is not None and status == 'AUTHORIZED': allowed = role in policy.allowed_overrides.get(original, {}).get(requested_gate, []) reason = 'POLICY_OVERRIDE_MATRIX' if allowed and original == 'RESTRICT' and requested_gate == 'SHIP': if any((r.get('triggered') and r.get('blocking')) for r in rules): allowed = False reason = 'ACTIVE_BLOCKER_PREVENTS_RELAXATION' elif auth is not None: reason = 'TRUSTED_OVERRIDE_AUTHORIZATION_REJECTED' return { 'override_id': f'OVR-{run_id}-{seq}', 'decision_id': decision['decision_id'], 'actor_id': actor, 'approval_role': role, 'requested_gate': requested_gate, 'original_gate': original, 'override_status': 'ACCEPTED' if allowed else 'REJECTED', 'justification': justification, 'authorizing_policy_rule': reason, 'trusted_authorization_status': status, 'trusted_authorization_ref': auth_ref, 'trusted_authorization_hash': auth_hash, } def _override_reuse_is_valid_v107(rd: Path) -> bool: try: overrides = [read_json(p) for p in sorted(rd.glob('override_[0-9][0-9][0-9][0-9].json'))] seen = set() accepted_seen = False for ov in overrides: ref = ov.get('trusted_authorization_ref') reason = ov.get('authorizing_policy_rule') if ref in seen and ref is not None: if ov.get('override_status') != 'REJECTED' or reason not in {'DECISION_ALREADY_OVERRIDDEN', 'TRUSTED_OVERRIDE_AUTHORIZATION_CONSUMED'}: return False if ov.get('override_status') == 'ACCEPTED': if accepted_seen: return False accepted_seen = True if ref is not None: seen.add(ref) return True except Exception: return False # Upgrade the locked default PolicyPack after all historical V1.0.6 definitions # have loaded. The version number is already 1.0.1 at module scope. _v107_policy = DEFAULT_POLICY_PACK.to_dict() _v107_policy['policy_pack_version'] = POLICY_PACK_VERSION _v107_policy['evidence_minimums'] = { 'required': True, 'minimum_required_evidence_items': 1, 'minimum_metric_confidence': 1.0, 'minimum_metric_completeness': 1.0, 'applies_to': 'required_metrics', 'ship_eligibility': 'ALL_REQUIRED_METRICS_MUST_MEET_MINIMUMS', } DEFAULT_POLICY_PACK = PolicyPack.from_dict(_v107_policy) DEFAULT_POLICY_PACK_HASH = DEFAULT_POLICY_PACK.policy_pack_hash KNOWN_POLICY_IDENTITIES = {(DEFAULT_POLICY_PACK.policy_pack_id, DEFAULT_POLICY_PACK.policy_pack_version): DEFAULT_POLICY_PACK_HASH} validate_policy_pack(DEFAULT_POLICY_PACK) validate_v15_policy_pack(DEFAULT_POLICY_PACK) class LoopGuardCanonicalPOC(_LoopGuardCanonicalPOCV106): """Canonical V1.0.7 implementation of locked Specification V1.5.1 Rev B.""" def __init__(self, root: Path, policy: Optional[PolicyPack]=None): super().__init__(root, DEFAULT_POLICY_PACK if policy is None else policy) def _attach_quality_to_decision(self, run_id: str, metrics: Dict[str, Any], decision: Dict[str, Any]) -> Dict[str, Any]: eqe = build_evidence_quality_evaluation(run_id, decision['decision_id'], metrics, self._bound_policy()) h = sha256_obj(eqe) decision['evidence_quality_evaluation_ref'] = EVIDENCE_QUALITY_ARTIFACT decision['evidence_quality_evaluation_hash'] = h decision['evidence_quality_status'] = eqe['status'] decision['evidence_quality_ship_eligible'] = eqe['ship_eligible'] return eqe def _persist_minimal_failed(self, rd, req, decision, sem, trusted=None): if trusted is None: trusted = self.trusted.get(decision['run_id']) req_safe = json_safe_snapshot(req) trusted_safe = json_safe_snapshot(trusted) if trusted is not None else None eqe = self._attach_quality_to_decision(decision['run_id'], {}, decision) write_json_new(rd / 'governance_request.json', req_safe) if isinstance(req_safe, dict): for filename, key in ( ('scenario.json', 'scenario'), ('governance_context.json', 'governance_context'), ('signals.json', 'signals'), ('metric_input_envelopes.json', 'metric_inputs'), ): if key in req_safe: write_json_new(rd / filename, req_safe[key]) if trusted_safe is not None: write_json_new(rd / 'trusted_control_envelope.json', trusted_safe) write_json_new(rd / 'metric_registry.json', self.metric_registry) write_json_new(rd / 'policy_pack.json', self._policy_document()) write_json_new(rd / 'rule_evaluations.json', []) write_json_new(rd / EVIDENCE_QUALITY_ARTIFACT, eqe) write_json_new(rd / 'decision_package.json', decision) write_json_new(rd / 'semantic_material.json', sem) engine_started = self.pending.get(decision['run_id'], {}).get('engine_started_at', utc_now()) source_started = req_safe.get('run_metadata', {}).get('started_at') if isinstance(req_safe, dict) and isinstance(req_safe.get('run_metadata'), dict) else None run = { 'run_id': decision['run_id'], 'engine_version': ENGINE_VERSION, 'metric_registry_version': METRIC_REGISTRY_VERSION, 'metric_registry_hash': self.metric_registry_hash, 'policy_pack_id': self.policy.policy_pack_id, 'policy_pack_version': self.policy.policy_pack_version, 'policy_pack_hash': self._policy_hash, 'policy_profile_hash': None, 'request_hash': sha256_obj(req_safe), 'trusted_control_hash': sha256_obj(trusted_safe) if trusted_safe is not None else None, 'started_at': engine_started, 'source_started_at': source_started, 'completed_at': utc_now(), 'run_status': 'FAILED_CLOSED', } write_json_new(rd / 'run.json', run) bundle = self._base_bundle(decision['run_id'], req_safe, trusted_safe, decision, {}, None) write_json_new(rd / 'normalization_records.json', metric_normalization_records(req_safe)) write_json_new(rd / 'evidence_bundle.json', bundle) self._write_manifest_snapshot(rd) def _persist_success(self, rd, req, trusted, profile, metrics, preds, rules, decision, sem): eqe = self._attach_quality_to_decision(decision['run_id'], metrics, decision) engine_started = self.pending.get(decision['run_id'], {}).get('engine_started_at', utc_now()) run = { 'run_id': decision['run_id'], 'engine_version': ENGINE_VERSION, 'metric_registry_version': METRIC_REGISTRY_VERSION, 'metric_registry_hash': self.metric_registry_hash, 'policy_pack_id': self.policy.policy_pack_id, 'policy_pack_version': self.policy.policy_pack_version, 'policy_pack_hash': self._policy_hash, 'policy_profile_hash': profile['policy_profile_hash'], 'request_hash': sha256_obj(req), 'trusted_control_hash': sha256_obj(trusted), 'started_at': engine_started, 'source_started_at': req['run_metadata']['started_at'], 'completed_at': utc_now(), 'run_status': 'COMPLETED', } artifacts = [ ('run.json', run), ('scenario.json', req['scenario']), ('governance_request.json', req), ('governance_context.json', req['governance_context']), ('trusted_control_envelope.json', trusted), ('signals.json', req['signals']), ('metric_input_envelopes.json', req['metric_inputs']), ('metric_results.json', metrics), ('metric_registry.json', self.metric_registry), ('policy_pack.json', self._policy_document()), ('policy_profile.json', profile), ('cep_predicate_evaluations.json', preds), ('rule_evaluations.json', rules), (EVIDENCE_QUALITY_ARTIFACT, eqe), ('decision_package.json', decision), ('semantic_material.json', sem), ] for fn, obj in artifacts: write_json_new(rd / fn, obj) bundle = self._base_bundle(decision['run_id'], req, trusted, decision, metrics, profile['policy_profile_hash']) write_json_new(rd / 'normalization_records.json', metric_normalization_records(req)) write_json_new(rd / 'evidence_bundle.json', bundle) self._write_manifest_snapshot(rd) def request_override(self, run_id: str, requested_gate: str, justification: str) -> Dict[str, Any]: rd = safe_run_dir(self.root, run_id) if (rd / 'policy_pack.json').exists(): _validate_persisted_policy_document_v107(read_json(rd / 'policy_pack.json')) return super().request_override(run_id, requested_gate, justification) def _verify_static_persisted_run(self, run_id: str) -> Dict[str, Any]: base = super()._verify_static_persisted_run(run_id) errors = list(base.get('errors', [])) rd = safe_run_dir(self.root, run_id) if not rd.exists(): return base try: policy_doc = read_json(rd / 'policy_pack.json') try: _validate_persisted_policy_document_v107(policy_doc) except Exception as exc: errors.append(f'PERSISTED_POLICY_SCHEMA_INVALID:{type(exc).__name__}:{exc}') raw = copy.deepcopy(policy_doc); raw.pop('policy_pack_hash', None) pp = PolicyPack.from_dict(raw) decision = read_json(rd / 'decision_package.json') metrics = read_json(rd / 'metric_results.json') if (rd / 'metric_results.json').exists() else {} bundle = read_json(rd / 'evidence_bundle.json') try: _validate_evidence_quality_artifact_v107(rd, run_id, decision, metrics, pp, bundle) except Exception as exc: errors.append(f'EVIDENCE_QUALITY_VERIFY_FAILURE:{type(exc).__name__}:{exc}') except Exception as exc: errors.append(f'V107_STATIC_VERIFY_EXCEPTION:{type(exc).__name__}:{exc}') return {'ok': not errors, 'errors': errors} def verify_persisted_run(self, run_id: str) -> Dict[str, Any]: result = super().verify_persisted_run(run_id) errors = list(result.get('errors', [])) rd = safe_run_dir(self.root, run_id) # V1.0.7 lifecycle semantics permit authorization reuse only for auditable # rejected transitions such as DECISION_ALREADY_OVERRIDDEN/CONSUMED. if 'TRUSTED_OVERRIDE_AUTH_REUSED' in errors and _override_reuse_is_valid_v107(rd): errors = [e for e in errors if e != 'TRUSTED_OVERRIDE_AUTH_REUSED'] if rd.exists(): try: policy_doc = read_json(rd / 'policy_pack.json') _validate_persisted_policy_document_v107(policy_doc) raw = copy.deepcopy(policy_doc); raw.pop('policy_pack_hash', None) pp = PolicyPack.from_dict(raw) decision = read_json(rd / 'decision_package.json') metrics = read_json(rd / 'metric_results.json') if (rd / 'metric_results.json').exists() else {} bundle = read_json(rd / 'evidence_bundle.json') _validate_evidence_quality_artifact_v107(rd, run_id, decision, metrics, pp, bundle) except Exception as exc: marker = f'V107_QUALITY_OR_POLICY_VERIFY_FAILURE:{type(exc).__name__}:{exc}' if marker not in errors: errors.append(marker) return {'ok': not errors, 'errors': errors} # ============================================================================ # V1.0.8 implementation remediation layer # Specification target remains locked Canonical POC Specification V1.5.1 Rev B. # ============================================================================ _POLICY_PACK_ALLOWED_FROM_DICT_FIELDS_V108 = POLICY_PACK_CANONICAL_FIELDS | {'policy_pack_hash'} _POLICY_THRESHOLD_FIELDS_V108 = { 'risk_restrict_min', 'risk_hold_min', 'core_restrict_min', 'core_hold_min', 'shell_restrict_min', 'drift_restrict_min', 'drift_hold_min', 'rollback_restrict_min', 'rollback_hold_min', 'rollback_evaluate_min', } _POLICY_PRECEDENCE_FIELDS_V108 = { 'terminal_blocking_rule_ids', 'gate_order', 'fallback_gate', 'fallback_reason' } _GREEN_PATH_FIELDS_V108 = { 'rule_id', 'rule_version', 'gate', 'blocking', 'rank', 'requires_no_blocking_rules', 'requirements' } _RULE_BASE_FIELDS_V108 = {'rule_id', 'rule_version', 'kind', 'gate', 'blocking', 'rank'} _CONDITION_KEYS_V108 = { 'all_required_metrics_ok': {'kind'}, 'metric_in': {'kind', 'metric', 'values'}, 'metric_rank_gte': {'kind', 'metric', 'order', 'threshold_key'}, 'metric_in_impact': {'kind', 'metric', 'values', 'impact_values'}, 'metric_in_impact_not': {'kind', 'metric', 'values', 'impact_values'}, 'trusted_in': {'kind', 'field', 'values'}, 'rollback_contract': {'kind', 'metric', 'order', 'threshold_key'}, } _RULE_KEYS_BY_KIND_V108 = { kind: (_RULE_BASE_FIELDS_V108 | (fields - {'kind'})) for kind, fields in _CONDITION_KEYS_V108.items() if kind != 'all_required_metrics_ok' } _CEP_CONDITION_KEYS_V108 = { 'metric_in': {'kind', 'metric', 'values'}, 'profile_flag': {'kind', 'field', 'value'}, } _CEP_PREDICATE_FIELDS_V108 = { 'predicate_id', 'predicate_version', 'description', 'conditions', 'on_true_result' } def _policy_pack_from_dict_v108(cls, d: Dict[str, Any]) -> 'PolicyPack': if not isinstance(d, dict): raise POCError('POLICY_DOCUMENT_NOT_OBJECT') extra = set(d) - _POLICY_PACK_ALLOWED_FROM_DICT_FIELDS_V108 missing = POLICY_PACK_CANONICAL_FIELDS - set(d) if extra or missing: raise POCError(f'POLICY_TOP_LEVEL_SCHEMA_MISMATCH:extra={sorted(extra)}:missing={sorted(missing)}') if not isinstance(d['rollback_permitted'], bool): raise POCError('POLICY_ROLLBACK_PERMITTED_TYPE_INVALID') return cls( policy_pack_id=d['policy_pack_id'], policy_pack_version=d['policy_pack_version'], required_metrics=tuple(copy.deepcopy(d['required_metrics'])), metric_policy_requirements=copy.deepcopy(d['metric_policy_requirements']), policy_thresholds=copy.deepcopy(d['policy_thresholds']), hard_blocker_rules=tuple(copy.deepcopy(d['hard_blocker_rules'])), risk_elevation_rules=tuple(copy.deepcopy(d['risk_elevation_rules'])), conditional_restriction_rules=tuple(copy.deepcopy(d['conditional_restriction_rules'])), green_path_rule=copy.deepcopy(d['green_path_rule']), rollback_rules=tuple(copy.deepcopy(d['rollback_rules'])), precedence_rules=copy.deepcopy(d['precedence_rules']), allowed_overrides=copy.deepcopy(d['allowed_overrides']), escalation_requirements=copy.deepcopy(d['escalation_requirements']), evidence_minimums=copy.deepcopy(d['evidence_minimums']), tenant_or_environment_tolerances=copy.deepcopy(d['tenant_or_environment_tolerances']), domain_specific_rules=copy.deepcopy(d['domain_specific_rules']), retention_requirements=copy.deepcopy(d['retention_requirements']), rollback_permitted=d['rollback_permitted'], cep_profile=copy.deepcopy(d['cep_profile']), ) PolicyPack.from_dict = classmethod(_policy_pack_from_dict_v108) def _require_exact_keys_v108(obj: Any, expected: set, code: str, optional: Optional[set]=None) -> None: if not isinstance(obj, dict): raise POCError(f'{code}:NOT_OBJECT') optional = optional or set() actual = set(obj) missing = expected - actual extra = actual - expected - optional if missing or extra: raise POCError(f'{code}:SCHEMA_MISMATCH:extra={sorted(extra)}:missing={sorted(missing)}') def _validate_condition_schema_v108(spec: Any, code: str, *, allow_rule_metadata: bool=False) -> None: if not isinstance(spec, dict): raise POCError(f'{code}:NOT_OBJECT') kind = spec.get('kind') if kind not in _CONDITION_KEYS_V108: raise POCError(f'{code}:UNKNOWN_KIND:{kind}') if allow_rule_metadata: expected = _RULE_KEYS_BY_KIND_V108.get(kind) if expected is None: raise POCError(f'{code}:RULE_KIND_INVALID:{kind}') _require_exact_keys_v108(spec, expected, code, optional={'explanation'}) if not isinstance(spec.get('rule_id'), str) or not spec['rule_id']: raise POCError(f'{code}:RULE_ID_INVALID') if not isinstance(spec.get('rule_version'), str) or not spec['rule_version']: raise POCError(f'{code}:RULE_VERSION_INVALID') if not isinstance(spec.get('gate'), str) or spec['gate'] not in _ALLOWED_GATES: raise POCError(f'{code}:GATE_INVALID') if not isinstance(spec.get('blocking'), bool): raise POCError(f'{code}:BLOCKING_TYPE_INVALID') if not isinstance(spec.get('rank'), int) or isinstance(spec.get('rank'), bool): raise POCError(f'{code}:RANK_TYPE_INVALID') if 'explanation' in spec and (not isinstance(spec['explanation'], str) or not spec['explanation']): raise POCError(f'{code}:EXPLANATION_INVALID') else: _require_exact_keys_v108(spec, _CONDITION_KEYS_V108[kind], code) if 'metric' in spec and (not isinstance(spec['metric'], str) or not spec['metric']): raise POCError(f'{code}:METRIC_TYPE_INVALID') if 'values' in spec: vals = spec['values'] if not isinstance(vals, list) or not vals or any(not isinstance(x, str) or not x for x in vals): raise POCError(f'{code}:VALUES_INVALID') if 'impact_values' in spec: vals = spec['impact_values'] if not isinstance(vals, list) or not vals or any(not isinstance(x, str) or not x for x in vals): raise POCError(f'{code}:IMPACT_VALUES_INVALID') if 'order' in spec: vals = spec['order'] if not isinstance(vals, list) or not vals or any(not isinstance(x, str) or not x for x in vals): raise POCError(f'{code}:ORDER_INVALID') if 'threshold_key' in spec and (not isinstance(spec['threshold_key'], str) or not spec['threshold_key']): raise POCError(f'{code}:THRESHOLD_KEY_INVALID') if 'field' in spec and (not isinstance(spec['field'], str) or not spec['field']): raise POCError(f'{code}:FIELD_INVALID') def _validate_policy_pack_recursive_schema_v108(policy: PolicyPack) -> None: d = policy.to_dict() _require_exact_keys_v108(d, POLICY_PACK_CANONICAL_FIELDS, 'POLICY_CANONICAL') if not isinstance(d['required_metrics'], list) or any(not isinstance(x, str) or not x for x in d['required_metrics']): raise POCError('POLICY_REQUIRED_METRICS_SCHEMA_INVALID') _require_exact_keys_v108(d['metric_policy_requirements'], {'required_status'}, 'POLICY_METRIC_REQUIREMENTS') if d['metric_policy_requirements']['required_status'] != 'OK': raise POCError('POLICY_REQUIRED_STATUS_INVALID') _require_exact_keys_v108(d['policy_thresholds'], _POLICY_THRESHOLD_FIELDS_V108, 'POLICY_THRESHOLDS') for key, value in d['policy_thresholds'].items(): if not isinstance(value, str) or not value: raise POCError(f'POLICY_THRESHOLD_TYPE_INVALID:{key}') for group_name in ('hard_blocker_rules', 'risk_elevation_rules', 'conditional_restriction_rules', 'rollback_rules'): group = d[group_name] if not isinstance(group, list): raise POCError(f'POLICY_RULE_GROUP_NOT_LIST:{group_name}') for idx, rule in enumerate(group): _validate_condition_schema_v108(rule, f'POLICY_RULE_SCHEMA:{group_name}:{idx}', allow_rule_metadata=True) gp = d['green_path_rule'] _require_exact_keys_v108(gp, _GREEN_PATH_FIELDS_V108, 'POLICY_GREEN_PATH', optional={'explanation'}) if not isinstance(gp['blocking'], bool): raise POCError('POLICY_GREEN_PATH_BLOCKING_TYPE_INVALID') if not isinstance(gp['requires_no_blocking_rules'], bool): raise POCError('POLICY_GREEN_PATH_REQUIRES_BLOCKING_TYPE_INVALID') if not isinstance(gp['rank'], int) or isinstance(gp['rank'], bool): raise POCError('POLICY_GREEN_PATH_RANK_TYPE_INVALID') if not isinstance(gp['requirements'], list): raise POCError('POLICY_GREEN_PATH_REQUIREMENTS_NOT_LIST') for idx, req in enumerate(gp['requirements']): _validate_condition_schema_v108(req, f'POLICY_GREEN_REQUIREMENT:{idx}', allow_rule_metadata=False) if 'explanation' in gp and (not isinstance(gp['explanation'], str) or not gp['explanation']): raise POCError('POLICY_GREEN_PATH_EXPLANATION_INVALID') _require_exact_keys_v108(d['precedence_rules'], _POLICY_PRECEDENCE_FIELDS_V108, 'POLICY_PRECEDENCE') if not isinstance(d['precedence_rules']['terminal_blocking_rule_ids'], list) or any(not isinstance(x, str) or not x for x in d['precedence_rules']['terminal_blocking_rule_ids']): raise POCError('POLICY_PRECEDENCE_TERMINALS_INVALID') if not isinstance(d['precedence_rules']['gate_order'], list) or any(x not in _ALLOWED_GATES for x in d['precedence_rules']['gate_order']): raise POCError('POLICY_PRECEDENCE_GATE_ORDER_SCHEMA_INVALID') for key in ('fallback_gate', 'fallback_reason'): if not isinstance(d['precedence_rules'][key], str) or not d['precedence_rules'][key]: raise POCError(f'POLICY_PRECEDENCE_FIELD_INVALID:{key}') overrides = d['allowed_overrides'] if not isinstance(overrides, dict) or any(k not in _ALLOWED_GATES for k in overrides): raise POCError('POLICY_OVERRIDE_SCHEMA_INVALID') for original, transitions in overrides.items(): if not isinstance(transitions, dict) or any(k not in _ALLOWED_GATES for k in transitions): raise POCError(f'POLICY_OVERRIDE_TRANSITION_SCHEMA_INVALID:{original}') for target, roles in transitions.items(): if not isinstance(roles, list) or any(not isinstance(role, str) or not role for role in roles): raise POCError(f'POLICY_OVERRIDE_ROLES_SCHEMA_INVALID:{original}:{target}') escalation = d['escalation_requirements'] if not isinstance(escalation, dict) or any(k not in _ALLOWED_GATES for k in escalation): raise POCError('POLICY_ESCALATION_SCHEMA_INVALID') for gate, actions in escalation.items(): if not isinstance(actions, list) or any(not isinstance(a, str) or not a for a in actions): raise POCError(f'POLICY_ESCALATION_ACTIONS_INVALID:{gate}') _validate_evidence_minimums_v151(d['evidence_minimums'], lock_default=False) for field in ('tenant_or_environment_tolerances', 'domain_specific_rules'): profiles = d[field] if not isinstance(profiles, dict): raise POCError(f'POLICY_PROFILE_MAP_INVALID:{field}') for name, profile in profiles.items(): if not isinstance(name, str) or not name: raise POCError(f'POLICY_PROFILE_NAME_INVALID:{field}') _require_exact_keys_v108(profile, {'force_cep_review'}, f'POLICY_PROFILE_SCHEMA:{field}:{name}') if not isinstance(profile['force_cep_review'], bool): raise POCError(f'POLICY_PROFILE_FORCE_CEP_TYPE_INVALID:{field}:{name}') _require_exact_keys_v108(d['retention_requirements'], {'append_only'}, 'POLICY_RETENTION') if not isinstance(d['retention_requirements']['append_only'], bool): raise POCError('POLICY_RETENTION_APPEND_ONLY_TYPE_INVALID') if not isinstance(d['rollback_permitted'], bool): raise POCError('POLICY_ROLLBACK_PERMITTED_TYPE_INVALID') cep = d['cep_profile'] _require_exact_keys_v108(cep, {'predicates'}, 'POLICY_CEP_PROFILE') if not isinstance(cep['predicates'], list): raise POCError('POLICY_CEP_PREDICATES_NOT_LIST') for pidx, pred in enumerate(cep['predicates']): _require_exact_keys_v108(pred, _CEP_PREDICATE_FIELDS_V108, f'POLICY_CEP_PREDICATE:{pidx}') for key in ('predicate_id', 'predicate_version', 'description', 'on_true_result'): if not isinstance(pred[key], str) or not pred[key]: raise POCError(f'POLICY_CEP_PREDICATE_FIELD_INVALID:{pidx}:{key}') if not isinstance(pred['conditions'], list) or not pred['conditions']: raise POCError(f'POLICY_CEP_CONDITIONS_INVALID:{pidx}') for cidx, cond in enumerate(pred['conditions']): if not isinstance(cond, dict) or cond.get('kind') not in _CEP_CONDITION_KEYS_V108: raise POCError(f'POLICY_CEP_CONDITION_KIND_INVALID:{pidx}:{cidx}') _require_exact_keys_v108(cond, _CEP_CONDITION_KEYS_V108[cond['kind']], f'POLICY_CEP_CONDITION:{pidx}:{cidx}') if cond['kind'] == 'metric_in': if not isinstance(cond['metric'], str) or not cond['metric']: raise POCError(f'POLICY_CEP_CONDITION_METRIC_INVALID:{pidx}:{cidx}') if not isinstance(cond['values'], list) or not cond['values'] or any(not isinstance(x, str) or not x for x in cond['values']): raise POCError(f'POLICY_CEP_CONDITION_VALUES_INVALID:{pidx}:{cidx}') else: if not isinstance(cond['field'], str) or not cond['field'] or not isinstance(cond['value'], bool): raise POCError(f'POLICY_CEP_PROFILE_FLAG_SCHEMA_INVALID:{pidx}:{cidx}') _validate_policy_pack_v107 = validate_policy_pack def validate_policy_pack_v108(policy: PolicyPack) -> None: _validate_policy_pack_v107(policy) _validate_policy_pack_recursive_schema_v108(policy) validate_policy_pack = validate_policy_pack_v108 def validate_v15_policy_pack_v108(policy: PolicyPack) -> None: """Canonical V1.5.1 conformance: profile structure is locked, minima values are versioned PolicyPack material.""" _validate_v15_policy_pack_v106(policy) _validate_evidence_minimums_v151(policy.evidence_minimums, lock_default=False) validate_v15_policy_pack = validate_v15_policy_pack_v108 def _validate_persisted_policy_document_v108(doc: Any) -> PolicyPack: if not isinstance(doc, dict): raise POCError('PERSISTED_POLICY_DOCUMENT_NOT_OBJECT') expected = POLICY_PACK_CANONICAL_FIELDS | {'policy_pack_hash'} if set(doc) != expected: extra = sorted(set(doc) - expected) missing = sorted(expected - set(doc)) raise POCError(f'PERSISTED_POLICY_DOCUMENT_SCHEMA_MISMATCH:extra={extra}:missing={missing}') declared_hash = doc['policy_pack_hash'] raw = {k: copy.deepcopy(v) for k, v in doc.items() if k != 'policy_pack_hash'} policy = PolicyPack.from_dict(raw) validate_policy_pack(policy) if raw != policy.to_dict(): raise POCError('PERSISTED_POLICY_CANONICAL_SEMANTIC_PROJECTION_MISMATCH') if declared_hash != policy.policy_pack_hash or declared_hash != sha256_obj(raw): raise POCError('PERSISTED_POLICY_DOCUMENT_HASH_MISMATCH') return policy def resolve_gate_v108( rules: List[Dict[str, Any]], metrics: Dict[str, Dict[str, Any]], trusted: Dict[str, Any], policy: PolicyPack, ) -> Tuple[str, str]: triggered = [r for r in rules if r['triggered']] by_id = {r['rule_id']: r for r in triggered} for rid in policy.precedence_rules.get('terminal_blocking_rule_ids', []): if rid in by_id: return ('HOLD', rid) gate_order = policy.precedence_rules.get('gate_order', ['ROLLBACK', 'HOLD', 'RESTRICT', 'SHIP']) for gate in gate_order: matches = [r for r in triggered if r['candidate_gate'] == gate] if matches: matches.sort(key=lambda r: (r['precedence_rank'], r['rule_id'])) if gate == 'SHIP': return ('SHIP', matches[0]['rule_id']) if gate == 'ROLLBACK': return ('ROLLBACK', matches[0]['rule_id']) return (gate, f'{gate}_PRECEDENCE') # V1.5.1 quality failure is a Green-Path eligibility failure, not a # precedence class. It is used only after all higher-priority rule classes # and explicit restrictions have failed to resolve a gate. try: eqe = build_evidence_quality_evaluation('GATE', 'DEC-GATE', metrics, policy) if eqe.get('ship_eligible') is not True: return ('HOLD', 'EVIDENCE_QUALITY_HOLD') except Exception: return ('HOLD', 'EVIDENCE_QUALITY_HOLD') return ( policy.precedence_rules.get('fallback_gate', 'HOLD'), policy.precedence_rules.get('fallback_reason', 'POLICY_COVERAGE_FAILURE'), ) resolve_gate = resolve_gate_v108 def _safe_metric_normalization_records_v108(req: Any) -> Dict[str, Any]: if not isinstance(req, dict): return {} signals = req.get('signals') metric_inputs = req.get('metric_inputs') if not isinstance(signals, list) or not isinstance(metric_inputs, dict): return {} if any(not isinstance(env, dict) for env in metric_inputs.values()): return {} try: return metric_normalization_records(req) except Exception: return {} _RUN_BASE_ARTIFACTS_V108 = { 'run.json', 'governance_request.json', 'metric_registry.json', 'policy_pack.json', 'rule_evaluations.json', EVIDENCE_QUALITY_ARTIFACT, 'decision_package.json', 'semantic_material.json', 'normalization_records.json', 'evidence_bundle.json', 'trusted_control_envelope.json', 'scenario.json', 'governance_context.json', 'signals.json', 'metric_input_envelopes.json', } _RUN_COMPLETED_ONLY_ARTIFACTS_V108 = { 'metric_results.json', 'policy_profile.json', 'cep_predicate_evaluations.json', } _MANIFEST_NAME_RE_V108 = re.compile(r'^manifest(?:_override_\d{4})?\.json$') _OVERRIDE_ARTIFACT_RE_V108 = re.compile( r'^(?:trusted_override_authorization|override_request|override|override_evidence)_\d{4}\.json$' ) def _validate_run_artifact_namespace_v108(rd: Path, run_status: str) -> None: if not rd.exists() or not rd.is_dir(): raise POCError('RUN_DIRECTORY_MISSING') allowed = set(_RUN_BASE_ARTIFACTS_V108) if run_status == 'COMPLETED': allowed |= _RUN_COMPLETED_ONLY_ARTIFACTS_V108 for p in rd.iterdir(): if p.is_dir(): raise POCError(f'RUN_ARTIFACT_SUBDIRECTORY_FORBIDDEN:{p.name}') name = p.name if name in allowed or _MANIFEST_NAME_RE_V108.fullmatch(name) or _OVERRIDE_ARTIFACT_RE_V108.fullmatch(name): continue raise POCError(f'UNKNOWN_RUN_ARTIFACT:{name}') if run_status == 'FAILED_CLOSED': forbidden = sorted(name for name in _RUN_COMPLETED_ONLY_ARTIFACTS_V108 if (rd / name).exists()) if forbidden: raise POCError(f'FAILED_CLOSED_SUCCESS_ARTIFACT_PRESENT:{forbidden}') def _verify_manifest_chain_v108(rd: Path) -> List[str]: errors: List[str] = [] manifests = sorted( [p for p in rd.iterdir() if p.is_file() and _MANIFEST_NAME_RE_V108.fullmatch(p.name)], key=lambda p: (0 if p.name == 'manifest.json' else int(p.stem.split('_')[-1])), ) if not manifests: return ['MANIFEST_MISSING'] previous_hash = None last = None for idx, mp in enumerate(manifests): try: man = read_json(mp) if not isinstance(man, dict) or set(man) != {'sequence', 'previous_manifest_hash', 'files', 'manifest_hash'}: errors.append(f'MANIFEST_SCHEMA_MISMATCH:{mp.name}') continue if man['sequence'] != idx: errors.append(f'MANIFEST_SEQUENCE_MISMATCH:{mp.name}') if man['previous_manifest_hash'] != previous_hash: errors.append(f'MANIFEST_CHAIN_MISMATCH:{mp.name}') if not isinstance(man['files'], dict) or any(not isinstance(fn, str) or not isinstance(h, str) for fn, h in man['files'].items()): errors.append(f'MANIFEST_FILES_SCHEMA_MISMATCH:{mp.name}') core = { 'sequence': man['sequence'], 'previous_manifest_hash': man['previous_manifest_hash'], 'files': man['files'], } if man['manifest_hash'] != sha256_obj(core): errors.append(f'MANIFEST_HASH_MISMATCH:{mp.name}') for fn, expected_hash in (man['files'] if isinstance(man['files'], dict) else {}).items(): fp = rd / fn if not fp.exists() or not fp.is_file(): errors.append(f'MANIFEST_FILE_MISSING:{mp.name}:{fn}') elif hashlib.sha256(fp.read_bytes()).hexdigest() != expected_hash: errors.append(f'MANIFEST_FILE_HASH_MISMATCH:{mp.name}:{fn}') previous_hash = man.get('manifest_hash') last = man except Exception as exc: errors.append(f'MANIFEST_VERIFY_EXCEPTION:{mp.name}:{type(exc).__name__}:{exc}') if isinstance(last, dict) and isinstance(last.get('files'), dict): current_files = { p.name for p in rd.iterdir() if p.is_file() and not _MANIFEST_NAME_RE_V108.fullmatch(p.name) } if set(last['files']) != current_files: errors.append( f'LATEST_MANIFEST_FILESET_MISMATCH:manifest={sorted(last["files"])}:current={sorted(current_files)}' ) return errors def _source_started_value_v108(req: Any) -> Any: if isinstance(req, dict) and isinstance(req.get('run_metadata'), dict): return req['run_metadata'].get('started_at') return None def _validate_failed_run_entity_v108( run: Any, req: Any, trusted: Any, bundle: Any, run_id: str ) -> None: required = { 'run_id','engine_version','metric_registry_version','metric_registry_hash', 'policy_pack_id','policy_pack_version','policy_pack_hash','policy_profile_hash', 'request_hash','trusted_control_hash','started_at','source_started_at', 'completed_at','run_status' } if not isinstance(run, dict) or set(run) != required: raise POCError('RUN_ENTITY_SCHEMA_MISMATCH') if run['run_id'] != run_id or run['run_status'] != 'FAILED_CLOSED': raise POCError('FAILED_RUN_ID_OR_STATUS_MISMATCH') if run['engine_version'] != ENGINE_VERSION: raise POCError('RUN_ENGINE_VERSION_MISMATCH') if run['metric_registry_version'] != METRIC_REGISTRY_VERSION: raise POCError('RUN_METRIC_REGISTRY_VERSION_MISMATCH') if run['request_hash'] != sha256_obj(req): raise POCError('RUN_REQUEST_HASH_MISMATCH') expected_trusted_hash = sha256_obj(trusted) if trusted is not None else None if run['trusted_control_hash'] != expected_trusted_hash: raise POCError('RUN_TRUSTED_CONTROL_HASH_MISMATCH') if run['source_started_at'] != _source_started_value_v108(req): raise POCError('RUN_SOURCE_TIMESTAMP_SNAPSHOT_MISMATCH') if not isinstance(bundle, dict): raise POCError('EVIDENCE_BUNDLE_NOT_OBJECT') for key in ('policy_pack_id','policy_pack_version','policy_pack_hash'): if run[key] != bundle.get(key): raise POCError(f'RUN_POLICY_IDENTITY_MISMATCH:{key}') started = _timestamp_dt(run['started_at'], 'run.started_at') completed = _timestamp_dt(run['completed_at'], 'run.completed_at') if completed < started: raise POCError('RUN_TIMESTAMP_ORDER_INVALID') if completed > datetime.now(timezone.utc): raise POCError('RUN_COMPLETION_IN_FUTURE') def _verify_failed_closed_run_v108(engine: Any, run_id: str) -> Dict[str, Any]: errors: List[str] = [] try: validate_run_id(run_id) rd = safe_run_dir(engine.root, run_id) except Exception as exc: return {'ok': False, 'errors': [f'RUN_ID_OR_PATH_INVALID:{type(exc).__name__}:{exc}']} if not rd.exists(): return {'ok': False, 'errors': ['RUN_NOT_FOUND']} errors.extend(_verify_manifest_chain_v108(rd)) try: run = read_json(rd / 'run.json') except Exception as exc: return {'ok': False, 'errors': errors + [f'RUN_READ_FAILURE:{type(exc).__name__}:{exc}']} try: _validate_run_artifact_namespace_v108(rd, run.get('run_status')) except Exception as exc: errors.append(f'RUN_ARTIFACT_NAMESPACE_INVALID:{type(exc).__name__}:{exc}') try: req = read_json(rd / 'governance_request.json') trusted = read_json(rd / 'trusted_control_envelope.json') if (rd / 'trusted_control_envelope.json').exists() else None policy_doc = read_json(rd / 'policy_pack.json') policy = _validate_persisted_policy_document_v108(policy_doc) registry = read_json(rd / 'metric_registry.json') decision = read_json(rd / 'decision_package.json') sem = read_json(rd / 'semantic_material.json') rules = read_json(rd / 'rule_evaluations.json') eqe = read_json(rd / EVIDENCE_QUALITY_ARTIFACT) bundle = read_json(rd / 'evidence_bundle.json') normalization = read_json(rd / 'normalization_records.json') # Replay terminal status before deeper FAILED_CLOSED shape assumptions so a # forged run_status cannot suppress the deterministic re-execution finding. try: with tempfile.TemporaryDirectory(prefix='lg-v108-status-replay-') as td_status: replay_status = LoopGuardCanonicalPOC(Path(td_status), policy) replay_status.open_run(copy.deepcopy(req), run_id) snapshot_error = _snapshot_original_json_error(req) if snapshot_error is not None: replay_status.pending[run_id]['schema_error'] = snapshot_error if trusted is not None: try: replay_status.provide_trusted_control(run_id, copy.deepcopy(trusted)) except Exception as exc: replay_status.pending[run_id]['schema_error'] = f'TRUSTED_CONTROL_REPLAY_FAILURE:{exc}' replay_status.decide(run_id) replay_status_run = read_json(Path(td_status) / run_id / 'run.json') if replay_status_run.get('run_status') != run.get('run_status'): errors.append('RUN_STATUS_REEXECUTION_MISMATCH') except Exception as exc: errors.append(f'RUN_STATUS_REEXECUTION_ERROR:{type(exc).__name__}:{exc}') _validate_failed_run_entity_v108(run, req, trusted, bundle, run_id) if sha256_obj(registry) != run['metric_registry_hash'] or sha256_obj(registry) != METRIC_REGISTRY_HASH: raise POCError('FAILED_RUN_METRIC_REGISTRY_MISMATCH') _validate_decision_identity(decision, run_id) if decision.get('final_gate') != 'HOLD': raise POCError('FAILED_CLOSED_GATE_NOT_HOLD') if decision.get('engine_version') != ENGINE_VERSION: raise POCError('FAILED_CLOSED_DECISION_ENGINE_VERSION_MISMATCH') if not isinstance(rules, list) or rules: raise POCError('FAILED_CLOSED_RULE_TRACE_NOT_EMPTY') if decision.get('semantic_decision_hash') != sha256_obj(sem): raise POCError('FAILED_CLOSED_SEMANTIC_HASH_MISMATCH') expected_eqe = build_evidence_quality_evaluation(run_id, decision['decision_id'], {}, policy) if eqe != expected_eqe: raise POCError('FAILED_CLOSED_EVIDENCE_QUALITY_MISMATCH') _validate_evidence_quality_artifact_v107(rd, run_id, decision, {}, policy, bundle) expected_bundle = _expected_evidence_bundle( run_id, req, trusted, decision, {}, None, registry, policy ) if bundle != expected_bundle: raise POCError('FAILED_CLOSED_EVIDENCE_BUNDLE_MISMATCH') if normalization != _safe_metric_normalization_records_v108(req): raise POCError('FAILED_CLOSED_NORMALIZATION_RECORD_MISMATCH') errors.extend(_verify_request_duplicate_artifacts(rd, req, 'FAILED_CLOSED')) decision_dt = _timestamp_dt(decision.get('decision_timestamp'), 'decision.decision_timestamp') started_dt = _timestamp_dt(run.get('started_at'), 'run.started_at') completed_dt = _timestamp_dt(run.get('completed_at'), 'run.completed_at') if started_dt > decision_dt: errors.append('RUN_START_POSTDATES_DECISION') if decision_dt > completed_dt: errors.append('DECISION_TIMESTAMP_POSTDATES_COMPLETION') if completed_dt > datetime.now(timezone.utc): errors.append('RUN_COMPLETION_IN_FUTURE') # Deterministic failed-closed replay against the exact preserved malformed source shape. with tempfile.TemporaryDirectory(prefix='lg-v108-failed-replay-') as td: replay = LoopGuardCanonicalPOC(Path(td), policy) replay.open_run(copy.deepcopy(req), run_id) snapshot_error = _snapshot_original_json_error(req) if snapshot_error is not None: replay.pending[run_id]['schema_error'] = snapshot_error if trusted is not None: try: replay.provide_trusted_control(run_id, copy.deepcopy(trusted)) except Exception as exc: replay.pending[run_id]['schema_error'] = f'TRUSTED_CONTROL_REPLAY_FAILURE:{exc}' replay_decision = replay.decide(run_id) replay_dir = Path(td) / run_id replay_run = read_json(replay_dir / 'run.json') if replay_run.get('run_status') != 'FAILED_CLOSED': errors.append('RUN_STATUS_REEXECUTION_MISMATCH') if _semantic_replay_projection(rd) != _semantic_replay_projection(replay_dir): errors.append('FAILED_CLOSED_TRACE_REEXECUTION_MISMATCH') if replay_decision.get('rationale_code') != decision.get('rationale_code'): errors.append('FAILED_CLOSED_RATIONALE_REEXECUTION_MISMATCH') except Exception as exc: errors.append(f'V108_FAILED_CLOSED_VERIFY_EXCEPTION:{type(exc).__name__}:{exc}') return {'ok': not errors, 'errors': errors} _LoopGuardCanonicalPOCV107 = LoopGuardCanonicalPOC class _LoopGuardCanonicalPOCV108(_LoopGuardCanonicalPOCV107): """V1.0.8 implementation remediation; locked specification remains V1.5.1 Rev B.""" def _persist_minimal_failed(self, rd, req, decision, sem, trusted=None): if trusted is None: trusted = self.trusted.get(decision['run_id']) req_safe = json_safe_snapshot(req) trusted_safe = json_safe_snapshot(trusted) if trusted is not None else None eqe = self._attach_quality_to_decision(decision['run_id'], {}, decision) write_json_new(rd / 'governance_request.json', req_safe) if isinstance(req_safe, dict): for filename, key in ( ('scenario.json', 'scenario'), ('governance_context.json', 'governance_context'), ('signals.json', 'signals'), ('metric_input_envelopes.json', 'metric_inputs'), ): if key in req_safe: write_json_new(rd / filename, req_safe[key]) if trusted_safe is not None: write_json_new(rd / 'trusted_control_envelope.json', trusted_safe) write_json_new(rd / 'metric_registry.json', self.metric_registry) write_json_new(rd / 'policy_pack.json', self._policy_document()) write_json_new(rd / 'rule_evaluations.json', []) write_json_new(rd / EVIDENCE_QUALITY_ARTIFACT, eqe) write_json_new(rd / 'decision_package.json', decision) write_json_new(rd / 'semantic_material.json', sem) engine_started = self.pending.get(decision['run_id'], {}).get('engine_started_at', utc_now()) source_started = _source_started_value_v108(req_safe) run = { 'run_id': decision['run_id'], 'engine_version': ENGINE_VERSION, 'metric_registry_version': METRIC_REGISTRY_VERSION, 'metric_registry_hash': self.metric_registry_hash, 'policy_pack_id': self.policy.policy_pack_id, 'policy_pack_version': self.policy.policy_pack_version, 'policy_pack_hash': self._policy_hash, 'policy_profile_hash': None, 'request_hash': sha256_obj(req_safe), 'trusted_control_hash': sha256_obj(trusted_safe) if trusted_safe is not None else None, 'started_at': engine_started, 'source_started_at': source_started, 'completed_at': utc_now(), 'run_status': 'FAILED_CLOSED', } write_json_new(rd / 'run.json', run) bundle = self._base_bundle(decision['run_id'], req_safe, trusted_safe, decision, {}, None) write_json_new(rd / 'normalization_records.json', _safe_metric_normalization_records_v108(req_safe)) write_json_new(rd / 'evidence_bundle.json', bundle) self._write_manifest_snapshot(rd) def request_override(self, run_id: str, requested_gate: str, justification: str) -> Dict[str, Any]: rd = safe_run_dir(self.root, run_id) if rd.exists() and (rd / 'run.json').exists(): run = read_json(rd / 'run.json') _validate_run_artifact_namespace_v108(rd, run.get('run_status')) if (rd / 'policy_pack.json').exists(): _validate_persisted_policy_document_v108(read_json(rd / 'policy_pack.json')) return super().request_override(run_id, requested_gate, justification) def verify_persisted_run(self, run_id: str) -> Dict[str, Any]: validate_run_id(run_id) rd = safe_run_dir(self.root, run_id) if not rd.exists(): return {'ok': False, 'errors': ['RUN_NOT_FOUND']} try: run = read_json(rd / 'run.json') except Exception as exc: return {'ok': False, 'errors': [f'RUN_READ_FAILURE:{type(exc).__name__}:{exc}']} if run.get('run_status') == 'FAILED_CLOSED': return _verify_failed_closed_run_v108(self, run_id) result = super().verify_persisted_run(run_id) errors = list(result.get('errors', [])) try: _validate_run_artifact_namespace_v108(rd, run.get('run_status')) except Exception as exc: errors.append(f'RUN_ARTIFACT_NAMESPACE_INVALID:{type(exc).__name__}:{exc}') try: policy = _validate_persisted_policy_document_v108(read_json(rd / 'policy_pack.json')) validate_v15_policy_pack(policy) except Exception as exc: errors.append(f'V108_POLICY_VERIFY_FAILURE:{type(exc).__name__}:{exc}') return {'ok': not errors, 'errors': errors} LoopGuardCanonicalPOC = _LoopGuardCanonicalPOCV108 def v107_evidence_quality_and_integrity_regression_suite(root: Path) -> List[Dict[str, Any]]: if root.exists(): shutil.rmtree(root) root.mkdir(parents=True) out=[] def add(name, ok, detail=''): out.append({'test':name,'ok':bool(ok),'detail':'' if ok else detail}) def run(req, rid, trusted=None, sub=None): e=LoopGuardCanonicalPOC(root/(sub or rid)); e.open_run(req,rid); e.provide_trusted_control(rid, trusted or base_trusted()); d=e.decide(rid); return e,d,root/(sub or rid)/rid def rewrite_manifest(e, rd): for mp in e._manifest_paths(rd): mp.unlink() e._write_manifest_snapshot(rd) # EQ-S01 — zero quality cannot SHIP. r=base_request('V107-01'); [s.update({'confidence':0.0,'completeness':0.0}) for s in r['signals']] e,d,rd=run(r,'V107-01'); eq=read_json(rd/EVIDENCE_QUALITY_ARTIFACT) add('V107-01-ZERO-QUALITY-HOLD', d['final_gate']=='HOLD' and not eq['ship_eligible'] and e.verify_persisted_run('V107-01')['ok'], repr((d,eq))) # EQ-S02 — one metric below confidence minimum. r=base_request('V107-02'); sid=r['metric_inputs']['risk_level']['input_refs'][0] next(s for s in r['signals'] if s['signal_id']==sid)['confidence']=0.5 e,d,rd=run(r,'V107-02'); eq=read_json(rd/EVIDENCE_QUALITY_ARTIFACT) add('V107-02-ONE-CONFIDENCE-DEFICIT-NO-SHIP', d['final_gate']=='HOLD' and any(v['code']=='BELOW_MIN_CONFIDENCE' and v.get('metric')=='risk_level' for v in eq['violations']), repr((d,eq))) # EQ-S03 — one metric below completeness minimum. r=base_request('V107-03'); sid=r['metric_inputs']['authority_status']['input_refs'][0] next(s for s in r['signals'] if s['signal_id']==sid)['completeness']=0.5 e,d,rd=run(r,'V107-03'); eq=read_json(rd/EVIDENCE_QUALITY_ARTIFACT) add('V107-03-ONE-COMPLETENESS-DEFICIT-NO-SHIP', d['final_gate']=='HOLD' and any(v['code']=='BELOW_MIN_COMPLETENESS' and v.get('metric')=='authority_status' for v in eq['violations']), repr((d,eq))) # EQ-S04 — zero required evidence cannot satisfy required evidence policy. r=base_request('V107-04'); env=r['metric_inputs']['evidence_status']; env['payload']={'required_evidence_items':0,'verified_evidence_items':0,'conflicting_evidence_items':0}; bind_fixture_evidence(r) e,d,rd=run(r,'V107-04'); eq=read_json(rd/EVIDENCE_QUALITY_ARTIFACT) add('V107-04-ZERO-REQUIRED-EVIDENCE-HOLD', d['final_gate']=='HOLD' and any(v['code']=='INSUFFICIENT_REQUIRED_EVIDENCE' for v in eq['violations']), repr((d,eq))) # EQ-S05 — existing conditional restriction remains RESTRICT. r=base_request('V107-05'); r['metric_inputs']['evidence_status']['payload']={'required_evidence_items':2,'verified_evidence_items':1,'conflicting_evidence_items':0}; bind_fixture_evidence(r) e,d,rd=run(r,'V107-05') add('V107-05-LIMITED-EVIDENCE-RESTRICT', d['final_gate']=='RESTRICT', repr(d)) # EQ-S06 — full quality clean path still SHIPs. e,d,rd=run(base_request('V107-06'),'V107-06'); eq=read_json(rd/EVIDENCE_QUALITY_ARTIFACT) add('V107-06-FULL-QUALITY-SHIP', d['final_gate']=='SHIP' and eq['ship_eligible'] and e.verify_persisted_run('V107-06')['ok'], repr((d,eq))) # EQ-S07 — no cross-metric compensation. r=base_request('V107-07'); sid=r['metric_inputs']['rollback_pressure']['input_refs'][0]; next(s for s in r['signals'] if s['signal_id']==sid)['confidence']=0.99 e,d,rd=run(r,'V107-07'); add('V107-07-NONCOMPENSATION', d['final_gate']!='SHIP', repr(d)) # EQ-S08 — deterministic replay includes quality artifact. e,d,rd=run(base_request('V107-08'),'V107-08'); add('V107-08-QUALITY-REPLAY', e.verify_persisted_run('V107-08')['ok'], repr(e.verify_persisted_run('V107-08'))) # EQ-S09 — hard blocker remains controlling. r=base_request('V107-09'); r['metric_inputs']['authority_status']['payload']['requested_authority_level']=3; r['metric_inputs']['authority_status']['payload']['granted_authority_level']=1; bind_fixture_evidence(r); [s.update({'confidence':0.0}) for s in r['signals']] e,d,rd=run(r,'V107-09'); add('V107-09-HARD-BLOCKER-PRECEDENCE', d['final_gate']=='HOLD' and ('AUTH-EXCEEDED' in d['triggered_rules']), repr(d)) # EQ-S10 — valid rollback remains controlling under subminimum quality. r=base_request('V107-10'); r['metric_inputs']['rollback_pressure']['payload']['rollback_pressure_fixture']=100; bind_fixture_evidence(r); [s.update({'confidence':0.0}) for s in r['signals']] t=base_trusted(); t['recovery_state']={k:True for k in t['recovery_state']} e,d,rd=run(r,'V107-10',t); add('V107-10-ROLLBACK-PRECEDENCE', d['final_gate']=='ROLLBACK', repr(d)) # EQ-S11 — quality-ineligible RESTRICT cannot be overridden to SHIP. r=base_request('V107-11'); r['metric_inputs']['risk_level']['payload']['risk_fixture_score']=30; bind_fixture_evidence(r); sid=r['metric_inputs']['risk_level']['input_refs'][0]; next(s for s in r['signals'] if s['signal_id']==sid)['confidence']=0.5 e,d,rd=run(r,'V107-11'); e.provide_trusted_override_authorization('V107-11',base_trusted_override()); ov=e.request_override('V107-11','SHIP','quality cannot be bypassed') add('V107-11-OVERRIDE-CANNOT-BYPASS-QUALITY', d['final_gate']=='RESTRICT' and ov['override_status']=='REJECTED' and ov['authorizing_policy_rule']=='EVIDENCE_QUALITY_PREVENTS_SHIP_OVERRIDE' and e.verify_persisted_run('V107-11')['ok'], repr((d,ov,e.verify_persisted_run('V107-11')))) # Audit finding: repeated override attempt remains valid audit history. e,d,rd=run(base_request('V107-12'),'V107-12'); e.provide_trusted_override_authorization('V107-12',base_trusted_override()); o1=e.request_override('V107-12','HOLD','first'); o2=e.request_override('V107-12','RESTRICT','second') vr=e.verify_persisted_run('V107-12'); add('V107-12-REJECTED-REUSE-AUDIT-VERIFIABLE', o1['override_status']=='ACCEPTED' and o2['override_status']=='REJECTED' and vr['ok'], repr((o1,o2,vr))) # Audit finding: superseded authorization is a valid lifecycle event. e,d,rd=run(base_request('V107-13'),'V107-13'); e.provide_trusted_override_authorization('V107-13',base_trusted_override('approver-1')); e.provide_trusted_override_authorization('V107-13',base_trusted_override('approver-2')); ov=e.request_override('V107-13','HOLD','latest') vr=e.verify_persisted_run('V107-13'); add('V107-13-SUPERSEDED-AUTHORIZATION-VERIFIABLE', ov['override_status']=='ACCEPTED' and ov['actor_id']=='approver-2' and vr['ok'], repr((ov,vr))) # Strict JSON duplicate key rejection. e,d,rd=run(base_request('V107-14'),'V107-14'); p=rd/'decision_package.json'; text=p.read_text(encoding='utf-8'); pos=text.find('{')+1; p.write_text(text[:pos]+'\n "final_gate": "ROLLBACK",'+text[pos:],encoding='utf-8'); rewrite_manifest(e,rd) vr=e.verify_persisted_run('V107-14'); add('V107-14-DUPLICATE-JSON-KEY-REJECTED', (not vr['ok']) and any('DUPLICATE_JSON_KEY' in x for x in vr['errors']), repr(vr)) # Strict JSON nonstandard constant rejection. e,d,rd=run(base_request('V107-15'),'V107-15'); p=rd/'decision_package.json'; text=p.read_text(encoding='utf-8').replace('"candidate_gates": [', '"nonstandard": NaN,\n "candidate_gates": [',1); p.write_text(text,encoding='utf-8'); rewrite_manifest(e,rd) vr=e.verify_persisted_run('V107-15'); add('V107-15-NONSTANDARD-JSON-CONSTANT-REJECTED', (not vr['ok']) and any('NON_STANDARD_JSON_CONSTANT' in x for x in vr['errors']), repr(vr)) # Causal chronology: source Signal must not postdate its bound MetricResult. e,d,rd=run(base_request('V107-16'),'V107-16'); req=read_json(rd/'governance_request.json'); metrics=read_json(rd/'metric_results.json'); mdt=_timestamp_dt(metrics['risk_level']['computed_at'],'m'); ddt=_timestamp_dt(d['decision_timestamp'],'d'); later=(mdt+(ddt-mdt)*0.5).isoformat(); sid=req['metric_inputs']['risk_level']['input_refs'][0] for sig in req['signals']: if sig['signal_id']==sid: sig['observed_at']=later write_json(rd/'governance_request.json',req); write_json(rd/'signals.json',req['signals']); runj=read_json(rd/'run.json'); runj['request_hash']=sha256_obj(req); write_json(rd/'run.json',runj); write_json(rd/'normalization_records.json',metric_normalization_records(req)); b=read_json(rd/'evidence_bundle.json'); b['input_hash']=sha256_obj(req); tmp=copy.deepcopy(b); tmp.pop('integrity_hash',None); b['integrity_hash']=sha256_obj(tmp); write_json(rd/'evidence_bundle.json',b); rewrite_manifest(e,rd) vr=e.verify_persisted_run('V107-16'); add('V107-16-SIGNAL-BEFORE-METRIC-ENFORCED', (not vr['ok']) and any('SIGNAL_POSTDATES_BOUND_METRIC' in x for x in vr['errors']), repr(vr)) # Causal chronology: rule cannot predate the metrics it evaluates. e,d,rd=run(base_request('V107-17'),'V107-17'); runj=read_json(rd/'run.json'); metrics=read_json(rd/'metric_results.json'); rules=read_json(rd/'rule_evaluations.json'); start=_timestamp_dt(runj['started_at'],'s'); earliest=min(_timestamp_dt(x['computed_at'],'m') for x in metrics.values()); t=(start+(earliest-start)*0.25).isoformat(); [r.__setitem__('evaluated_at',t) for r in rules]; write_json(rd/'rule_evaluations.json',rules); rewrite_manifest(e,rd) vr=e.verify_persisted_run('V107-17'); add('V107-17-METRIC-BEFORE-RULE-ENFORCED', (not vr['ok']) and any('RULE_PREDATES_REQUIRED_METRIC' in x for x in vr['errors']), repr(vr)) # Closed persisted PolicyPack schema rejects semantic shadow fields. e,d,rd=run(base_request('V107-18'),'V107-18'); pp=read_json(rd/'policy_pack.json'); pp['certification_status']='CERTIFIED'; pp['allow_ship_without_evidence']=True; write_json(rd/'policy_pack.json',pp); rewrite_manifest(e,rd) vr=e.verify_persisted_run('V107-18'); add('V107-18-POLICY-SHADOW-FIELDS-REJECTED', (not vr['ok']) and any('PERSISTED_POLICY' in x or 'POLICY_SCHEMA' in x for x in vr['errors']), repr(vr)) # Quality artifact forgery is detected. e,d,rd=run(base_request('V107-19'),'V107-19'); eq=read_json(rd/EVIDENCE_QUALITY_ARTIFACT); eq['ship_eligible']=False; eq['reason_code']='FORGED'; write_json(rd/EVIDENCE_QUALITY_ARTIFACT,eq); rewrite_manifest(e,rd) vr=e.verify_persisted_run('V107-19'); add('V107-19-FORGED-QUALITY-ARTIFACT-DETECTED', (not vr['ok']) and any('EVIDENCE_QUALITY' in x for x in vr['errors']), repr(vr)) # Pre-metric fail-closed persists NOT_EVALUABLE quality artifact. r=base_request('V107-20'); r['policy_pack_ref']['policy_pack_id']='WRONG'; e=LoopGuardCanonicalPOC(root/'V107-20'); e.open_run(r,'V107-20'); e.provide_trusted_control('V107-20',base_trusted()); d=e.decide('V107-20'); rd=root/'V107-20'/'V107-20'; eq=read_json(rd/EVIDENCE_QUALITY_ARTIFACT); vr=e.verify_persisted_run('V107-20') add('V107-20-PREMETRIC-FAILCLOSED-HAS-NOT-EVALUABLE-QUALITY', d['final_gate']=='HOLD' and eq['status']=='NOT_EVALUABLE' and not eq['ship_eligible'] and vr['ok'], repr((d,eq,vr))) return out def v108_failclosed_policy_namespace_regression_suite(root: Path) -> List[Dict[str, Any]]: if root.exists(): shutil.rmtree(root) root.mkdir(parents=True) out: List[Dict[str, Any]] = [] def add(name: str, ok: bool, detail: Any='') -> None: out.append({'test': name, 'ok': bool(ok), 'detail': '' if ok else repr(detail)}) def malformed_case(test_id: str, mutator) -> None: e = LoopGuardCanonicalPOC(root / test_id) req = base_request(test_id) mutator(req) e.open_run(req, test_id) try: e.provide_trusted_control(test_id, base_trusted()) except Exception: pass try: d = e.decide(test_id) vr = e.verify_persisted_run(test_id) add(test_id, d['final_gate'] == 'HOLD' and vr['ok'], (d, vr)) except Exception as exc: add(test_id, False, exc) malformed_case('V108-01-METRIC-INPUTS-LIST', lambda r: r.__setitem__('metric_inputs', [])) malformed_case('V108-02-RUN-METADATA-LIST', lambda r: r.__setitem__('run_metadata', [])) malformed_case('V108-03-POLICY-REF-LIST', lambda r: r.__setitem__('policy_pack_ref', [])) malformed_case('V108-04-SIGNALS-OBJECT', lambda r: r.__setitem__('signals', {})) malformed_case('V108-05-GOVERNANCE-CONTEXT-SCALAR', lambda r: r.__setitem__('governance_context', 'bad')) malformed_case('V108-06-METRIC-ENVELOPE-SCALAR', lambda r: r['metric_inputs'].__setitem__('risk_level', 'bad')) malformed_case('V108-07-SCENARIO-NULL', lambda r: r.__setitem__('scenario', None)) # Whole request scalar/list with explicit Run ID. e = LoopGuardCanonicalPOC(root / 'V108-08') e.open_run([], 'V108-08') d = e.decide('V108-08') vr = e.verify_persisted_run('V108-08') add('V108-08-WHOLE-REQUEST-LIST', d['final_gate'] == 'HOLD' and vr['ok'], (d, vr)) # Coercive boolean semantics are prohibited. bad = copy.deepcopy(DEFAULT_POLICY_PACK.to_dict()) bad['policy_pack_version'] = 'v108-bool-string' bad['rollback_permitted'] = 'false' rejected = False try: PolicyPack.from_dict(bad) except POCError as exc: rejected = 'POLICY_ROLLBACK_PERMITTED_TYPE_INVALID' in str(exc) add('V108-09-ROLLBACK-BOOLEAN-STRING-REJECTED', rejected) # Nested semantic shadow fields are rejected. for test_id, mutate in ( ('V108-10-NESTED-GREEN-SHADOW', lambda d: d['green_path_rule'].__setitem__('certification_status', 'CERTIFIED')), ('V108-11-NESTED-BLOCKER-SHADOW', lambda d: d['hard_blocker_rules'][0].__setitem__('allow_ship_without_evidence', True)), ('V108-12-NESTED-CEP-SHADOW', lambda d: d['cep_profile']['predicates'][0].__setitem__('certification_status', 'CERTIFIED')), ('V108-13-NESTED-PRECEDENCE-SHADOW', lambda d: d['precedence_rules'].__setitem__('safety_certified', True)), ): pd = copy.deepcopy(DEFAULT_POLICY_PACK.to_dict()) pd['policy_pack_version'] = test_id.lower() mutate(pd) ok = False try: pol = PolicyPack.from_dict(pd) validate_policy_pack(pol) except POCError: ok = True add(test_id, ok) # Alternate versioned minima are V1.5.1-conformant. pd = copy.deepcopy(DEFAULT_POLICY_PACK.to_dict()) pd['policy_pack_version'] = '1.0.2-alt-minima' pd['evidence_minimums']['minimum_metric_confidence'] = 0.9 pd['evidence_minimums']['minimum_metric_completeness'] = 0.9 alt = PolicyPack.from_dict(pd) alt_ok = True try: validate_policy_pack(alt) validate_v15_policy_pack(alt) except Exception: alt_ok = False add('V108-14-ALTERNATE-MINIMA-CONFORMANT', alt_ok) # Alternate minima are actually enforced and replay-verifiable. e = LoopGuardCanonicalPOC(root / 'V108-15', alt) req = base_request('V108-15') req['policy_pack_ref'] = { 'policy_pack_id': alt.policy_pack_id, 'policy_pack_version': alt.policy_pack_version, 'policy_pack_hash': alt.policy_pack_hash, } for s in req['signals']: s['confidence'] = 0.95 s['completeness'] = 0.95 e.open_run(req, 'V108-15') e.provide_trusted_control('V108-15', base_trusted()) d = e.decide('V108-15') vr = e.verify_persisted_run('V108-15') add('V108-15-ALTERNATE-MINIMA-SHIP-AND-REPLAY', d['final_gate'] == 'SHIP' and vr['ok'], (d, vr)) e = LoopGuardCanonicalPOC(root / 'V108-16', alt) req = base_request('V108-16') req['policy_pack_ref'] = { 'policy_pack_id': alt.policy_pack_id, 'policy_pack_version': alt.policy_pack_version, 'policy_pack_hash': alt.policy_pack_hash, } for s in req['signals']: s['confidence'] = 0.85 s['completeness'] = 0.95 e.open_run(req, 'V108-16') e.provide_trusted_control('V108-16', base_trusted()) d = e.decide('V108-16') vr = e.verify_persisted_run('V108-16') add('V108-16-ALTERNATE-MINIMA-ENFORCED', d['final_gate'] == 'HOLD' and d['rationale_code'] == 'EVIDENCE_QUALITY_HOLD' and vr['ok'], (d, vr)) # Same default identity with changed minima remains content-bound and is rejected. pd = copy.deepcopy(DEFAULT_POLICY_PACK.to_dict()) pd['evidence_minimums']['minimum_metric_confidence'] = 0.9 same_identity_rejected = False try: pol = PolicyPack.from_dict(pd) validate_policy_pack(pol) except POCError as exc: same_identity_rejected = 'POLICY_VERSION_CONTENT_MISMATCH' in str(exc) add('V108-17-DEFAULT-IDENTITY-CONTENT-LOCKED', same_identity_rejected) # Quality-only HOLD rationale fidelity. e = LoopGuardCanonicalPOC(root / 'V108-18') req = base_request('V108-18') for s in req['signals']: s['confidence'] = 0.0 s['completeness'] = 0.0 e.open_run(req, 'V108-18') e.provide_trusted_control('V108-18', base_trusted()) d = e.decide('V108-18') eqe = read_json(root / 'V108-18' / 'V108-18' / EVIDENCE_QUALITY_ARTIFACT) vr = e.verify_persisted_run('V108-18') add( 'V108-18-EVIDENCE-QUALITY-HOLD-RATIONALE', d['final_gate'] == 'HOLD' and d['rationale_code'] == 'EVIDENCE_QUALITY_HOLD' and eqe['ship_eligible'] is False and vr['ok'], (d, eqe, vr) ) # Unknown semantic sidecars and subdirectories are rejected. for test_id, make_unknown in ( ('V108-19-UNKNOWN-SIDECAR-REJECTED', 'file'), ('V108-20-UNKNOWN-SUBDIRECTORY-REJECTED', 'dir'), ): e = LoopGuardCanonicalPOC(root / test_id) req = base_request(test_id) e.open_run(req, test_id) e.provide_trusted_control(test_id, base_trusted()) e.decide(test_id) rd = root / test_id / test_id if make_unknown == 'file': (rd / 'certification.json').write_text('{"certification_status":"CERTIFIED"}', encoding='utf-8') else: (rd / 'extensions').mkdir() for mp in e._manifest_paths(rd): mp.unlink() e._write_manifest_snapshot(rd) vr = e.verify_persisted_run(test_id) add(test_id, (not vr['ok']) and any('RUN_ARTIFACT_NAMESPACE_INVALID' in x for x in vr['errors']), vr) # Unmodified completed and failed-closed canonical namespaces remain valid. e = LoopGuardCanonicalPOC(root / 'V108-21') req = base_request('V108-21') e.open_run(req, 'V108-21') e.provide_trusted_control('V108-21', base_trusted()) e.decide('V108-21') add('V108-21-COMPLETED-NAMESPACE-VALID', e.verify_persisted_run('V108-21')['ok'], e.verify_persisted_run('V108-21')) e = LoopGuardCanonicalPOC(root / 'V108-22') req = base_request('V108-22') req['metric_inputs'] = None e.open_run(req, 'V108-22') e.decide('V108-22') add('V108-22-FAILED-CLOSED-NAMESPACE-VALID', e.verify_persisted_run('V108-22')['ok'], e.verify_persisted_run('V108-22')) # Persisted rollback string mutation is rejected even after a fresh manifest. e = LoopGuardCanonicalPOC(root / 'V108-23') req = base_request('V108-23') e.open_run(req, 'V108-23') e.provide_trusted_control('V108-23', base_trusted()) e.decide('V108-23') rd = root / 'V108-23' / 'V108-23' pp = read_json(rd / 'policy_pack.json') pp['rollback_permitted'] = 'false' write_json(rd / 'policy_pack.json', pp) for mp in e._manifest_paths(rd): mp.unlink() e._write_manifest_snapshot(rd) vr = e.verify_persisted_run('V108-23') add('V108-23-PERSISTED-BOOLEAN-COERCION-REJECTED', (not vr['ok']) and any('POLICY' in x for x in vr['errors']), vr) # Manifested unknown semantic file cannot become canonical by re-manifesting. e = LoopGuardCanonicalPOC(root / 'V108-24') req = base_request('V108-24') e.open_run(req, 'V108-24') e.provide_trusted_control('V108-24', base_trusted()) e.decide('V108-24') rd = root / 'V108-24' / 'V108-24' (rd / 'safety_claim.json').write_text('{"safety":"PROVEN"}', encoding='utf-8') for mp in e._manifest_paths(rd): mp.unlink() e._write_manifest_snapshot(rd) vr = e.verify_persisted_run('V108-24') add('V108-24-REMANIFESTED-SIDECAR-STILL-NONCANONICAL', (not vr['ok']) and any(('UNKNOWN_RUN_ARTIFACT' in x or 'RUN_ARTIFACT_NAMESPACE_INVALID' in x) for x in vr['errors']), vr) return out def run_full_verification(output_root: Path) -> Dict[str, Any]: if output_root.exists(): shutil.rmtree(output_root) output_root.mkdir(parents=True) scenarios=scenario_suite(output_root/'runs') invariants=invariant_suite(output_root/'invariants') regressions=audit_regression_suite(output_root/'audit_regressions') config_regressions=configuration_integrity_regression_suite(output_root/'configuration_integrity_regressions') v103=v103_replay_evidence_regression_suite(output_root/'v103_regressions') v104=v104_verification_integrity_regression_suite(output_root/'v104_regressions') v105=v105_audit_provenance_regression_suite(output_root/'v105_regressions') v106=v106_identity_bundle_namespace_temporal_regression_suite(output_root/'v106_regressions') v107=v107_evidence_quality_and_integrity_regression_suite(output_root/'v107_regressions') v108=v108_failclosed_policy_namespace_regression_suite(output_root/'v108_regressions') summary={ 'spec_version':SPEC_VERSION,'engine_version':ENGINE_VERSION, 'scenario_total':len(scenarios),'scenario_passed':sum(x['ok'] for x in scenarios),'scenario_failed':sum(not x['ok'] for x in scenarios), 'invariant_total':len(invariants),'invariant_passed':sum(x['ok'] for x in invariants),'invariant_failed':sum(not x['ok'] for x in invariants), 'audit_regression_total':len(regressions),'audit_regression_passed':sum(x['ok'] for x in regressions),'audit_regression_failed':sum(not x['ok'] for x in regressions), 'configuration_integrity_total':len(config_regressions),'configuration_integrity_passed':sum(x['ok'] for x in config_regressions),'configuration_integrity_failed':sum(not x['ok'] for x in config_regressions), 'v103_regression_total':len(v103),'v103_regression_passed':sum(x['ok'] for x in v103),'v103_regression_failed':sum(not x['ok'] for x in v103),'v103_regressions':v103, 'v104_regression_total':len(v104),'v104_regression_passed':sum(x['ok'] for x in v104),'v104_regression_failed':sum(not x['ok'] for x in v104),'v104_regressions':v104, 'v105_regression_total':len(v105),'v105_regression_passed':sum(x['ok'] for x in v105),'v105_regression_failed':sum(not x['ok'] for x in v105),'v105_regressions':v105, 'v106_regression_total':len(v106),'v106_regression_passed':sum(x['ok'] for x in v106),'v106_regression_failed':sum(not x['ok'] for x in v106),'v106_regressions':v106, 'v107_regression_total':len(v107),'v107_regression_passed':sum(x['ok'] for x in v107),'v107_regression_failed':sum(not x['ok'] for x in v107),'v107_regressions':v107, 'v108_regression_total':len(v108),'v108_regression_passed':sum(x['ok'] for x in v108),'v108_regression_failed':sum(not x['ok'] for x in v108),'v108_regressions':v108, 'scenarios':[{'id':x['id'],'ok':x['ok'],'gate':x['decision']['final_gate'],'details':x['details']} for x in scenarios], 'invariants':invariants,'audit_regressions':regressions,'configuration_integrity_regressions':config_regressions, } write_json(output_root/'verification_report.json',summary) return summary # --------------------------------------------------------------------------- # V1.0.9 remediation layer # Closes V108-HF-01..04 without reopening Specification V1.5.1 Rev B. # --------------------------------------------------------------------------- import stat as _stat _EXPECTED_EVIDENCE_BUNDLE_V108 = _expected_evidence_bundle def _expected_evidence_bundle_v109( run_id: str, req: Any, trusted: Optional[Dict[str, Any]], decision: Dict[str, Any], metrics: Dict[str, Any], profile_hash: Optional[str], registry: Dict[str, Any], policy: PolicyPack, ) -> Dict[str, Any]: """V1.0.9: reconstruct a bundle over arbitrary preserved JSON request shapes.""" scenario = req.get('scenario', {}) if isinstance(req, dict) else {} raw_signals = req.get('signals', []) if isinstance(req, dict) else [] signals = raw_signals if isinstance(raw_signals, list) else [] raw_artifact_refs = scenario.get('artifact_refs', []) if isinstance(scenario, dict) else [] artifact_refs = list(raw_artifact_refs) if isinstance(raw_artifact_refs, list) else [] eqe = build_evidence_quality_evaluation(run_id, decision['decision_id'], metrics, policy) eqe_hash = sha256_obj(eqe) bundle = { 'bundle_id': f'BUNDLE-{run_id}', 'run_id': run_id, 'input_hash': sha256_obj(req), 'trusted_control_hash': sha256_obj(trusted) if trusted is not None else None, 'metric_registry_version': METRIC_REGISTRY_VERSION, 'metric_registry_hash': sha256_obj(registry), 'metric_versions': {k: v.get('metric_version') for k, v in metrics.items()}, 'metric_config_versions': {k: v.get('metric_config_version') for k, v in metrics.items()}, 'policy_pack_id': policy.policy_pack_id, 'policy_pack_version': policy.policy_pack_version, 'policy_pack_hash': policy.policy_pack_hash, 'policy_profile_hash': profile_hash, 'rule_engine_version': ENGINE_VERSION, 'decision_hash': sha256_obj(decision), 'semantic_decision_hash': decision['semantic_decision_hash'], 'evidence_quality_evaluation_ref': EVIDENCE_QUALITY_ARTIFACT, 'evidence_quality_evaluation_hash': eqe_hash, 'override_refs': [], 'signal_refs': [ s.get('signal_id') for s in signals if isinstance(s, dict) and isinstance(s.get('signal_id'), str) ], 'artifact_refs': artifact_refs, 'audit_refs': [ 'run.json', 'rule_evaluations.json', 'decision_package.json', 'semantic_material.json', EVIDENCE_QUALITY_ARTIFACT, ], 'known_limitations': list(EVIDENCE_BUNDLE_KNOWN_LIMITATIONS), } bundle['integrity_hash'] = sha256_obj(bundle) return bundle _expected_evidence_bundle = _expected_evidence_bundle_v109 _VALIDATE_V15_POLICY_PACK_V108 = validate_v15_policy_pack def _validate_v15_policy_pack_v109(policy: PolicyPack) -> None: """V1.0.9: V1.5.1 conformance also locks canonical precedence membership.""" _VALIDATE_V15_POLICY_PACK_V108(policy) if policy.precedence_rules != DEFAULT_POLICY_PACK.precedence_rules: raise POCError('V151_PRECEDENCE_PROFILE_MISMATCH') validate_v15_policy_pack = _validate_v15_policy_pack_v109 def _validate_override_namespace_closure_v109(rd: Path, run_id: str, decision: Dict[str, Any]) -> None: """V1.0.9 authorization lifecycle: ISSUED pending is valid; post-accept issuance is not.""" if (rd / 'overrides.json').exists(): raise POCError('LEGACY_OVERRIDES_COLLECTION_PRESENT') override_seq = _override_artifact_sequences(rd, 'override') request_seq = _override_artifact_sequences(rd, 'override_request') evidence_seq = _override_artifact_sequences(rd, 'override_evidence') expected_seq = list(range(1, len(override_seq) + 1)) if override_seq != expected_seq: raise POCError('OVERRIDE_SEQUENCE_GAP') if request_seq != override_seq: raise POCError('OVERRIDE_REQUEST_NAMESPACE_MISMATCH') if evidence_seq != override_seq: raise POCError('OVERRIDE_EVIDENCE_NAMESPACE_MISMATCH') auth_seq = _override_artifact_sequences(rd, 'trusted_override_authorization') if auth_seq != list(range(1, len(auth_seq) + 1)): raise POCError('TRUSTED_OVERRIDE_AUTH_SEQUENCE_GAP') auth_files = [f'trusted_override_authorization_{n:04d}.json' for n in auth_seq] # Every issued authorization is a valid bound audit event, even if the latest # one is still pending and has not yet been referenced by an OverrideRequest. for seq, fn in zip(auth_seq, auth_files): rec = read_json(rd / fn) _validate_bound_override_authorization_record( rec, run_id, decision['decision_id'], f'TOA-{run_id}-{seq}' ) refs: List[str] = [] accepted_auth_indices: List[int] = [] for seq in override_seq: request = read_json(rd / f'override_request_{seq:04d}.json') _validate_override_request_record(request, run_id, decision['decision_id'], seq) ref = request.get('trusted_authorization_ref') if ref is not None: _resolve_canonical_override_auth_ref(rd, ref) if ref not in auth_files: raise POCError('TRUSTED_OVERRIDE_AUTH_NAMESPACE_MISMATCH') refs.append(ref) ov = read_json(rd / f'override_{seq:04d}.json') if ov.get('override_status') == 'ACCEPTED' and ref is not None: accepted_auth_indices.append(int(Path(ref).stem.split('_')[-1])) # Once an override has been accepted, the public API is terminal with respect # to new authorization issuance. Reject persisted states that contain later auths. if accepted_auth_indices and auth_seq: accepted_cutoff = max(accepted_auth_indices) if max(auth_seq) > accepted_cutoff: raise POCError('TRUSTED_OVERRIDE_AUTH_ISSUED_AFTER_ACCEPTED_OVERRIDE') _validate_override_namespace_closure = _validate_override_namespace_closure_v109 _RUN_CANONICAL_ARTIFACTS_V109 = ( set(_RUN_BASE_ARTIFACTS_V108) | set(_RUN_COMPLETED_ONLY_ARTIFACTS_V108) ) def _is_canonical_manifest_artifact_name_v109(name: str) -> bool: if not isinstance(name, str) or not name or name in {'.', '..'}: return False if '/' in name or '\\' in name or Path(name).name != name: return False return name in _RUN_CANONICAL_ARTIFACTS_V109 or bool(_OVERRIDE_ARTIFACT_RE_V108.fullmatch(name)) def _require_regular_contained_file_v109(rd: Path, p: Path, label: str) -> None: try: st = p.lstat() except FileNotFoundError: raise POCError(f'{label}_MISSING:{p.name}') if _stat.S_ISLNK(st.st_mode): raise POCError(f'{label}_SYMLINK_FORBIDDEN:{p.name}') if not _stat.S_ISREG(st.st_mode): raise POCError(f'{label}_NONREGULAR_FORBIDDEN:{p.name}') if getattr(st, 'st_nlink', 1) != 1: raise POCError(f'{label}_HARDLINK_FORBIDDEN:{p.name}') try: resolved = p.resolve(strict=True) except Exception as exc: raise POCError(f'{label}_RESOLVE_FAILURE:{p.name}:{type(exc).__name__}') if resolved.parent != rd.resolve(strict=True): raise POCError(f'{label}_PATH_NOT_CONTAINED:{p.name}') def _manifest_sort_key_v109(p: Path) -> Tuple[int, int]: if p.name == 'manifest.json': return (0, 0) m = re.fullmatch(r'manifest_override_(\d{4})\.json', p.name) return (1, int(m.group(1)) if m else 10**9) def _validate_run_filesystem_containment_v109(rd: Path) -> None: if rd.is_symlink(): raise POCError('RUN_DIRECTORY_SYMLINK_FORBIDDEN') if not rd.exists() or not rd.is_dir(): raise POCError('RUN_DIRECTORY_MISSING') entries = list(rd.iterdir()) for p in entries: if p.is_symlink(): raise POCError(f'RUN_ARTIFACT_SYMLINK_FORBIDDEN:{p.name}') st = p.lstat() if _stat.S_ISDIR(st.st_mode): # Namespace validator emits the canonical directory error later. continue if not _stat.S_ISREG(st.st_mode): raise POCError(f'RUN_ARTIFACT_NONREGULAR_FORBIDDEN:{p.name}') if getattr(st, 'st_nlink', 1) != 1: raise POCError(f'RUN_ARTIFACT_HARDLINK_FORBIDDEN:{p.name}') if p.resolve(strict=True).parent != rd.resolve(strict=True): raise POCError(f'RUN_ARTIFACT_PATH_NOT_CONTAINED:{p.name}') manifests = sorted( [p for p in entries if _MANIFEST_NAME_RE_V108.fullmatch(p.name)], key=_manifest_sort_key_v109, ) for mp in manifests: _require_regular_contained_file_v109(rd, mp, 'MANIFEST') man = read_json(mp) if not isinstance(man, dict): raise POCError(f'MANIFEST_NOT_OBJECT:{mp.name}') files = man.get('files') if not isinstance(files, dict): raise POCError(f'MANIFEST_FILES_NOT_OBJECT:{mp.name}') for fn in files: if not _is_canonical_manifest_artifact_name_v109(fn): raise POCError(f'MANIFEST_FILE_KEY_NONCANONICAL:{mp.name}:{fn}') _require_regular_contained_file_v109(rd, rd / fn, 'MANIFEST_ARTIFACT') _LoopGuardCanonicalPOCV108_FINAL = LoopGuardCanonicalPOC class _LoopGuardCanonicalPOCV109(_LoopGuardCanonicalPOCV108_FINAL): """V1.0.9 implementation remediation; Specification V1.5.1 Rev B remains locked.""" def _manifest_paths(self, rd: Path) -> List[Path]: if not rd.exists(): return [] return sorted( [p for p in rd.iterdir() if _MANIFEST_NAME_RE_V108.fullmatch(p.name)], key=_manifest_sort_key_v109, ) def _write_manifest_snapshot(self, rd: Path) -> Path: if rd.is_symlink() or not rd.exists() or not rd.is_dir(): raise POCError('RUN_DIRECTORY_INVALID_FOR_MANIFEST') previous = self._manifest_paths(rd) for mp in previous: _require_regular_contained_file_v109(rd, mp, 'MANIFEST') sequence = len(previous) previous_hash = read_json(previous[-1])['manifest_hash'] if previous else None files: List[Path] = [] for p in rd.iterdir(): if _MANIFEST_NAME_RE_V108.fullmatch(p.name): continue if p.is_symlink(): raise POCError(f'MANIFEST_GENERATION_SYMLINK_FORBIDDEN:{p.name}') st = p.lstat() if _stat.S_ISREG(st.st_mode): if getattr(st, 'st_nlink', 1) != 1: raise POCError(f'MANIFEST_GENERATION_HARDLINK_FORBIDDEN:{p.name}') if p.resolve(strict=True).parent != rd.resolve(strict=True): raise POCError(f'MANIFEST_GENERATION_PATH_NOT_CONTAINED:{p.name}') files.append(p) # Directories/nonregular objects are not followed or manifested; the # namespace verifier will reject them if verification is requested. core = { 'sequence': sequence, 'previous_manifest_hash': previous_hash, 'files': {p.name: hashlib.sha256(p.read_bytes()).hexdigest() for p in sorted(files)}, } manifest = dict(core) manifest['manifest_hash'] = sha256_obj(core) target = rd / 'manifest.json' if sequence == 0 else rd / f'manifest_override_{sequence:04d}.json' write_json_new(target, manifest) return target def provide_trusted_override_authorization(self, run_id: str, authorization: Dict[str, Any]) -> None: validate_run_id(run_id) rd = safe_run_dir(self.root, run_id) if rd.exists(): _validate_run_filesystem_containment_v109(rd) # Accepted override is terminal for further authorization issuance. for p in sorted(rd.glob('override_[0-9][0-9][0-9][0-9].json')): ov = read_json(p) if ov.get('override_status') == 'ACCEPTED': raise POCError('DECISION_ALREADY_OVERRIDDEN') return super().provide_trusted_override_authorization(run_id, authorization) def request_override(self, run_id: str, requested_gate: str, justification: str) -> Dict[str, Any]: rd = safe_run_dir(self.root, run_id) if rd.exists(): _validate_run_filesystem_containment_v109(rd) return super().request_override(run_id, requested_gate, justification) def verify_persisted_run(self, run_id: str) -> Dict[str, Any]: validate_run_id(run_id) rd = safe_run_dir(self.root, run_id) if not rd.exists(): return {'ok': False, 'errors': ['RUN_NOT_FOUND']} try: _validate_run_filesystem_containment_v109(rd) except Exception as exc: # Do not follow/read externalized artifacts after containment failure. return { 'ok': False, 'errors': [f'RUN_ARTIFACT_NAMESPACE_INVALID:{type(exc).__name__}:{exc}'], } return super().verify_persisted_run(run_id) LoopGuardCanonicalPOC = _LoopGuardCanonicalPOCV109 def v109_totality_containment_lifecycle_conformance_regression_suite(root: Path) -> List[Dict[str, Any]]: if root.exists(): shutil.rmtree(root) root.mkdir(parents=True) out: List[Dict[str, Any]] = [] def add(name: str, ok: bool, detail: Any='') -> None: out.append({'test': name, 'ok': bool(ok), 'detail': '' if ok else repr(detail)}) def failed_shape(test_id: str, value: Any) -> None: e = LoopGuardCanonicalPOC(root / test_id) req = base_request(test_id) req['signals'] = value e.open_run(req, test_id) try: e.provide_trusted_control(test_id, base_trusted()) except Exception: pass try: d = e.decide(test_id) vr = e.verify_persisted_run(test_id) add(test_id, d['final_gate'] == 'HOLD' and vr['ok'], (d, vr)) except Exception as exc: add(test_id, False, exc) failed_shape('V109-01-SIGNALS-NULL', None) failed_shape('V109-02-SIGNALS-FALSE', False) failed_shape('V109-03-SIGNALS-ZERO', 0) failed_shape('V109-04-SIGNALS-EMPTY', []) failed_shape('V109-05-SIGNALS-STRING', 'bad') failed_shape('V109-06-SIGNALS-OBJECT', {'bad': True}) # Exact failed-closed rationale is stable across canonical JSON replay. e = LoopGuardCanonicalPOC(root / 'V109-07') req = base_request('V109-07'); req['signals'] = [] e.open_run(req, 'V109-07'); d = e.decide('V109-07') rd = root / 'V109-07' / 'V109-07'; persisted = read_json(rd / 'decision_package.json') add('V109-07-FAILCLOSED-RATIONALE-DETERMINISTIC', d['rationale'] == persisted['rationale'] and e.verify_persisted_run('V109-07')['ok'], (d, persisted)) # Manifest generation refuses a symlink rather than hashing the target. e = LoopGuardCanonicalPOC(root / 'V109-08'); req = base_request('V109-08'); e.open_run(req, 'V109-08'); e.provide_trusted_control('V109-08', base_trusted()); e.decide('V109-08') rd = root / 'V109-08' / 'V109-08'; external = root / 'V109-08' / 'external_policy.json'; shutil.copy2(rd / 'policy_pack.json', external); (rd / 'policy_pack.json').unlink(); os.symlink(external, rd / 'policy_pack.json') rejected = False try: e._write_manifest_snapshot(rd) except POCError as exc: rejected = 'SYMLINK' in str(exc) add('V109-08-MANIFEST-GENERATOR-REFUSES-SYMLINK', rejected) # Completed-run verifier rejects externalized canonical artifact. e = LoopGuardCanonicalPOC(root / 'V109-09'); req = base_request('V109-09'); e.open_run(req, 'V109-09'); e.provide_trusted_control('V109-09', base_trusted()); e.decide('V109-09') rd = root / 'V109-09' / 'V109-09'; external = root / 'V109-09' / 'external_decision.json'; shutil.copy2(rd / 'decision_package.json', external); (rd / 'decision_package.json').unlink(); os.symlink(external, rd / 'decision_package.json') vr = e.verify_persisted_run('V109-09'); add('V109-09-CANONICAL-ARTIFACT-SYMLINK-REJECTED', (not vr['ok']) and any('SYMLINK' in x for x in vr['errors']), vr) # Primary manifest cannot be externalized. e = LoopGuardCanonicalPOC(root / 'V109-10'); req = base_request('V109-10'); e.open_run(req, 'V109-10'); e.provide_trusted_control('V109-10', base_trusted()); e.decide('V109-10') rd = root / 'V109-10' / 'V109-10'; external = root / 'V109-10' / 'external_manifest.json'; shutil.copy2(rd / 'manifest.json', external); (rd / 'manifest.json').unlink(); os.symlink(external, rd / 'manifest.json') vr = e.verify_persisted_run('V109-10'); add('V109-10-MANIFEST-SYMLINK-REJECTED', (not vr['ok']) and any('SYMLINK' in x for x in vr['errors']), vr) # Historical traversal key is rejected before following it. e = LoopGuardCanonicalPOC(root / 'V109-11'); req = base_request('V109-11'); e.open_run(req, 'V109-11'); e.provide_trusted_control('V109-11', base_trusted()); e.decide('V109-11') rd = root / 'V109-11' / 'V109-11'; man = read_json(rd / 'manifest.json'); ext = root / 'V109-11' / 'outside.json'; write_json(ext, {'x': 1}); man['files']['../outside.json'] = hashlib.sha256(ext.read_bytes()).hexdigest(); core={'sequence':man['sequence'],'previous_manifest_hash':man['previous_manifest_hash'],'files':man['files']}; man['manifest_hash']=sha256_obj(core); write_json(rd/'manifest.json', man) vr=e.verify_persisted_run('V109-11'); add('V109-11-HISTORICAL-MANIFEST-TRAVERSAL-REJECTED', (not vr['ok']) and any('NONCANONICAL' in x for x in vr['errors']), vr) # Pending issued authorization is a valid auditable state. e = LoopGuardCanonicalPOC(root / 'V109-12'); req = base_request('V109-12'); e.open_run(req,'V109-12'); e.provide_trusted_control('V109-12',base_trusted()); e.decide('V109-12'); e.provide_trusted_override_authorization('V109-12',base_trusted_override()) vr=e.verify_persisted_run('V109-12'); add('V109-12-PENDING-AUTHORIZATION-VERIFIABLE', vr['ok'], vr) # Post-accepted authorization issuance is rejected before persistence. e = LoopGuardCanonicalPOC(root / 'V109-13'); req = base_request('V109-13'); e.open_run(req,'V109-13'); e.provide_trusted_control('V109-13',base_trusted()); e.decide('V109-13'); e.provide_trusted_override_authorization('V109-13',base_trusted_override()); ov=e.request_override('V109-13','HOLD','authorized') rd=root/'V109-13'/'V109-13'; before=len(list(rd.glob('trusted_override_authorization_*.json'))); rejected=False try: e.provide_trusted_override_authorization('V109-13',base_trusted_override('second')) except POCError as exc: rejected='DECISION_ALREADY_OVERRIDDEN' in str(exc) after=len(list(rd.glob('trusted_override_authorization_*.json'))); vr=e.verify_persisted_run('V109-13') add('V109-13-POST-ACCEPT-AUTH-REJECTED-BEFORE-PERSISTENCE', ov['override_status']=='ACCEPTED' and rejected and before==after and vr['ok'], (ov,vr,before,after)) # V1.5.1 conformance locks terminal-blocking membership. for tid, terminal in ( ('V109-14-TERMINALIZE-RISK-RESTRICT-REJECTED', ['RISK-RESTRICT']), ('V109-15-TERMINALIZE-GREEN-PATH-REJECTED', ['GREEN-PATH']), ): pd=copy.deepcopy(DEFAULT_POLICY_PACK.to_dict()); pd['policy_pack_version']=tid.lower(); pd['precedence_rules']['terminal_blocking_rule_ids']=terminal; pol=PolicyPack.from_dict(pd); generic=True; conform=False try: validate_policy_pack(pol) except Exception: generic=False try: validate_v15_policy_pack(pol); conform=True except POCError: conform=False add(tid, generic and not conform, (generic,conform)) # Default and alternate-minima conformant policies remain accepted. ok_default=True try: validate_v15_policy_pack(DEFAULT_POLICY_PACK) except Exception: ok_default=False add('V109-16-DEFAULT-PRECEDENCE-CONFORMANCE-PASS', ok_default) pd=copy.deepcopy(DEFAULT_POLICY_PACK.to_dict()); pd['policy_pack_version']='v109-alt-minima'; pd['evidence_minimums']['minimum_metric_confidence']=0.9; pd['evidence_minimums']['minimum_metric_completeness']=0.9; alt=PolicyPack.from_dict(pd); ok_alt=True try: validate_policy_pack(alt); validate_v15_policy_pack(alt) except Exception: ok_alt=False add('V109-17-ALT-MINIMA-PRESERVE-PRECEDENCE-CONFORMANCE', ok_alt) return out def run_full_verification_v109(output_root: Path) -> Dict[str, Any]: if output_root.exists(): shutil.rmtree(output_root) output_root.mkdir(parents=True) scenarios=scenario_suite(output_root/'runs') invariants=invariant_suite(output_root/'invariants') regressions=audit_regression_suite(output_root/'audit_regressions') config_regressions=configuration_integrity_regression_suite(output_root/'configuration_integrity_regressions') v103=v103_replay_evidence_regression_suite(output_root/'v103_regressions') v104=v104_verification_integrity_regression_suite(output_root/'v104_regressions') v105=v105_audit_provenance_regression_suite(output_root/'v105_regressions') v106=v106_identity_bundle_namespace_temporal_regression_suite(output_root/'v106_regressions') v107=v107_evidence_quality_and_integrity_regression_suite(output_root/'v107_regressions') v108=v108_failclosed_policy_namespace_regression_suite(output_root/'v108_regressions') v109=v109_totality_containment_lifecycle_conformance_regression_suite(output_root/'v109_regressions') summary={ 'spec_version':SPEC_VERSION,'engine_version':ENGINE_VERSION, 'scenario_total':len(scenarios),'scenario_passed':sum(x['ok'] for x in scenarios),'scenario_failed':sum(not x['ok'] for x in scenarios), 'invariant_total':len(invariants),'invariant_passed':sum(x['ok'] for x in invariants),'invariant_failed':sum(not x['ok'] for x in invariants), 'audit_regression_total':len(regressions),'audit_regression_passed':sum(x['ok'] for x in regressions),'audit_regression_failed':sum(not x['ok'] for x in regressions), 'configuration_integrity_total':len(config_regressions),'configuration_integrity_passed':sum(x['ok'] for x in config_regressions),'configuration_integrity_failed':sum(not x['ok'] for x in config_regressions), 'v103_regression_total':len(v103),'v103_regression_passed':sum(x['ok'] for x in v103),'v103_regression_failed':sum(not x['ok'] for x in v103),'v103_regressions':v103, 'v104_regression_total':len(v104),'v104_regression_passed':sum(x['ok'] for x in v104),'v104_regression_failed':sum(not x['ok'] for x in v104),'v104_regressions':v104, 'v105_regression_total':len(v105),'v105_regression_passed':sum(x['ok'] for x in v105),'v105_regression_failed':sum(not x['ok'] for x in v105),'v105_regressions':v105, 'v106_regression_total':len(v106),'v106_regression_passed':sum(x['ok'] for x in v106),'v106_regression_failed':sum(not x['ok'] for x in v106),'v106_regressions':v106, 'v107_regression_total':len(v107),'v107_regression_passed':sum(x['ok'] for x in v107),'v107_regression_failed':sum(not x['ok'] for x in v107),'v107_regressions':v107, 'v108_regression_total':len(v108),'v108_regression_passed':sum(x['ok'] for x in v108),'v108_regression_failed':sum(not x['ok'] for x in v108),'v108_regressions':v108, 'v109_regression_total':len(v109),'v109_regression_passed':sum(x['ok'] for x in v109),'v109_regression_failed':sum(not x['ok'] for x in v109),'v109_regressions':v109, 'scenarios':[{'id':x['id'],'ok':x['ok'],'gate':x['decision']['final_gate'],'details':x['details']} for x in scenarios], 'invariants':invariants,'audit_regressions':regressions,'configuration_integrity_regressions':config_regressions, } write_json(output_root/'verification_report.json',summary) return summary run_full_verification = run_full_verification_v109 # --------------------------------------------------------------------------- # V1.0.10 remediation layer # Closes V109-HF-01..04 without reopening Specification V1.5.1 Rev B. # --------------------------------------------------------------------------- _LoopGuardCanonicalPOCV109_FINAL = LoopGuardCanonicalPOC _VERIFY_FAILED_CLOSED_V108 = _verify_failed_closed_run_v108 _VERIFY_MANIFEST_CHAIN_V108 = _verify_manifest_chain_v108 _VALIDATE_OVERRIDE_CHRONOLOGY_V106 = _validate_override_chronology _VALIDATE_RUN_NAMESPACE_V108 = _validate_run_artifact_namespace_v108 def _sha256_hex_v110(value: Any) -> bool: return isinstance(value, str) and bool(re.fullmatch(r'[0-9a-f]{64}', value)) def _manifest_paths_v110(rd: Path) -> List[Path]: if not rd.exists() or not rd.is_dir(): return [] base = rd / 'manifest.json' overrides: List[Tuple[int, Path]] = [] for p in rd.iterdir(): if not p.is_file() and not p.is_symlink(): continue m = re.fullmatch(r'manifest_override_(\d{4})\.json', p.name) if m: overrides.append((int(m.group(1)), p)) overrides.sort(key=lambda x: x[0]) return ([base] if base.exists() or base.is_symlink() else []) + [p for _, p in overrides] def _verify_manifest_chain_v110(rd: Path, check_latest_fileset: bool=True) -> List[str]: """Canonical manifest identity: filename, integer sequence, hash-chain and file-set are exact.""" errors: List[str] = [] base = rd / 'manifest.json' override_entries: List[Tuple[int, Path]] = [] for p in rd.iterdir(): if not (p.is_file() or p.is_symlink()): continue m = re.fullmatch(r'manifest_override_(\d{4})\.json', p.name) if m: override_entries.append((int(m.group(1)), p)) override_entries.sort(key=lambda x: x[0]) if not (base.exists() or base.is_symlink()): errors.append('MANIFEST_BASE_MISSING') if any(seq == 0 for seq, _ in override_entries): errors.append('MANIFEST_OVERRIDE_SEQUENCE_ZERO_FORBIDDEN') suffixes = [seq for seq, _ in override_entries] expected_suffixes = list(range(1, len(override_entries) + 1)) if suffixes != expected_suffixes: errors.append(f'MANIFEST_OVERRIDE_FILENAME_SEQUENCE_GAP:{suffixes}') ordered: List[Tuple[int, Path]] = [] if base.exists() or base.is_symlink(): ordered.append((0, base)) ordered.extend(override_entries) if not ordered: return errors or ['MANIFEST_MISSING'] previous_hash: Optional[str] = None last: Optional[Dict[str, Any]] = None for expected_seq, mp in ordered: try: _require_regular_contained_file_v109(rd, mp, 'MANIFEST') man = read_json(mp) if not isinstance(man, dict) or set(man) != {'sequence', 'previous_manifest_hash', 'files', 'manifest_hash'}: errors.append(f'MANIFEST_SCHEMA_MISMATCH:{mp.name}') continue seq_value = man.get('sequence') if type(seq_value) is not int: errors.append(f'MANIFEST_SEQUENCE_TYPE_INVALID:{mp.name}') elif seq_value != expected_seq: errors.append(f'MANIFEST_SEQUENCE_MISMATCH:{mp.name}:{seq_value}:{expected_seq}') if expected_seq == 0: if mp.name != 'manifest.json': errors.append(f'MANIFEST_BASE_FILENAME_INVALID:{mp.name}') if man.get('previous_manifest_hash') is not None: errors.append(f'MANIFEST_BASE_PREVIOUS_HASH_NOT_NULL:{mp.name}') else: suffix = int(mp.stem.split('_')[-1]) if suffix != expected_seq: errors.append(f'MANIFEST_FILENAME_SEQUENCE_MISMATCH:{mp.name}:{expected_seq}') ph = man.get('previous_manifest_hash') if not _sha256_hex_v110(ph): errors.append(f'MANIFEST_PREVIOUS_HASH_TYPE_INVALID:{mp.name}') elif ph != previous_hash: errors.append(f'MANIFEST_CHAIN_MISMATCH:{mp.name}') files = man.get('files') if not isinstance(files, dict): errors.append(f'MANIFEST_FILES_SCHEMA_MISMATCH:{mp.name}') files = {} else: for fn, expected_hash in files.items(): if not isinstance(fn, str) or not _is_canonical_manifest_artifact_name_v109(fn): errors.append(f'MANIFEST_FILE_KEY_NONCANONICAL:{mp.name}:{fn}') continue if not _sha256_hex_v110(expected_hash): errors.append(f'MANIFEST_FILE_HASH_TYPE_INVALID:{mp.name}:{fn}') continue fp = rd / fn try: _require_regular_contained_file_v109(rd, fp, 'MANIFEST_ARTIFACT') actual = hashlib.sha256(fp.read_bytes()).hexdigest() if actual != expected_hash: errors.append(f'MANIFEST_FILE_HASH_MISMATCH:{mp.name}:{fn}') except Exception as exc: errors.append(f'MANIFEST_FILE_INVALID:{mp.name}:{fn}:{type(exc).__name__}:{exc}') core = { 'sequence': man.get('sequence'), 'previous_manifest_hash': man.get('previous_manifest_hash'), 'files': man.get('files'), } mh = man.get('manifest_hash') if not _sha256_hex_v110(mh): errors.append(f'MANIFEST_HASH_TYPE_INVALID:{mp.name}') elif mh != sha256_obj(core): errors.append(f'MANIFEST_HASH_MISMATCH:{mp.name}') previous_hash = mh if isinstance(mh, str) else None last = man except Exception as exc: errors.append(f'MANIFEST_VERIFY_EXCEPTION:{mp.name}:{type(exc).__name__}:{exc}') if check_latest_fileset and isinstance(last, dict) and isinstance(last.get('files'), dict): current_files = { p.name for p in rd.iterdir() if p.is_file() and not _MANIFEST_NAME_RE_V108.fullmatch(p.name) } if set(last['files']) != current_files: errors.append( f'LATEST_MANIFEST_FILESET_MISMATCH:manifest={sorted(last["files"])}:current={sorted(current_files)}' ) return errors def _validate_run_artifact_namespace_v110(rd: Path, run_status: str) -> None: _VALIDATE_RUN_NAMESPACE_V108(rd, run_status) if run_status == 'FAILED_CLOSED': override_names = sorted( p.name for p in rd.iterdir() if p.is_file() and _OVERRIDE_ARTIFACT_RE_V108.fullmatch(p.name) ) if override_names: raise POCError(f'FAILED_CLOSED_OVERRIDE_ARTIFACT_FORBIDDEN:{override_names}') def _validate_all_override_authorization_chronology_v110( rd: Path, run: Dict[str, Any], decision: Dict[str, Any] ) -> None: """Every authorization event, consumed or pending, is causally bound to the terminal decision.""" decision_dt = _timestamp_dt(decision.get('decision_timestamp'), 'decision.decision_timestamp') completed_dt = _timestamp_dt(run.get('completed_at'), 'run.completed_at') now_dt = datetime.now(timezone.utc) for seq in _override_artifact_sequences(rd, 'trusted_override_authorization'): fn = f'trusted_override_authorization_{seq:04d}.json' rec = read_json(rd / fn) _validate_bound_override_authorization_record( rec, run['run_id'], decision['decision_id'], f'TOA-{run["run_id"]}-{seq}' ) auth_dt = _timestamp_dt(rec.get('control_timestamp'), f'trusted_override.control_timestamp:{seq}') if auth_dt < decision_dt or auth_dt < completed_dt: raise POCError(f'OVERRIDE_AUTH_PREDATES_DECISION_COMPLETION:{seq}') if auth_dt > now_dt: raise POCError(f'OVERRIDE_AUTH_TIMESTAMP_IN_FUTURE:{seq}') def _verify_failed_closed_run_v110(engine: Any, run_id: str) -> Dict[str, Any]: errors: List[str] = [] try: validate_run_id(run_id) rd = safe_run_dir(engine.root, run_id) except Exception as exc: return {'ok': False, 'errors': [f'RUN_ID_OR_PATH_INVALID:{type(exc).__name__}:{exc}']} if not rd.exists(): return {'ok': False, 'errors': ['RUN_NOT_FOUND']} try: _validate_run_filesystem_containment_v109(rd) except Exception as exc: return {'ok': False, 'errors': [f'RUN_ARTIFACT_NAMESPACE_INVALID:{type(exc).__name__}:{exc}']} errors.extend(_verify_manifest_chain_v110(rd)) try: run = read_json(rd / 'run.json') _validate_run_artifact_namespace_v110(rd, run.get('run_status')) except Exception as exc: errors.append(f'RUN_ARTIFACT_NAMESPACE_INVALID:{type(exc).__name__}:{exc}') try: policy_doc = read_json(rd / 'policy_pack.json') policy = _validate_persisted_policy_document_v108(policy_doc) validate_v15_policy_pack(policy) except Exception as exc: errors.append(f'V151_POLICY_CONFORMANCE_FAILURE:{type(exc).__name__}:{exc}') # Retain the complete pre-existing deterministic failed-closed replay checks. base = _VERIFY_FAILED_CLOSED_V108(engine, run_id) for err in base.get('errors', []): if err not in errors: errors.append(err) return {'ok': not errors, 'errors': errors} class _LoopGuardCanonicalPOCV110(_LoopGuardCanonicalPOCV109_FINAL): """V1.0.10 verifier/evidence-lifecycle remediation; Specification V1.5.1 Rev B remains locked.""" def _write_manifest_snapshot(self, rd: Path) -> Path: # Snapshot generation remains append-only and mechanically hashes current local files; # semantic/canonical validation is the verifier's responsibility. return super()._write_manifest_snapshot(rd) def provide_trusted_override_authorization(self, run_id: str, authorization: Dict[str, Any]) -> None: validate_run_id(run_id) rd = safe_run_dir(self.root, run_id) if rd.exists() and (rd / 'run.json').exists(): run = read_json(rd / 'run.json') if run.get('run_status') == 'FAILED_CLOSED': raise POCError('FAILED_CLOSED_OVERRIDE_TRANSITION_FORBIDDEN') return super().provide_trusted_override_authorization(run_id, authorization) def request_override(self, run_id: str, requested_gate: str, justification: str) -> Dict[str, Any]: validate_run_id(run_id) rd = safe_run_dir(self.root, run_id) if rd.exists() and (rd / 'run.json').exists(): run = read_json(rd / 'run.json') if run.get('run_status') == 'FAILED_CLOSED': raise POCError('FAILED_CLOSED_OVERRIDE_TRANSITION_FORBIDDEN') return super().request_override(run_id, requested_gate, justification) def verify_persisted_run(self, run_id: str) -> Dict[str, Any]: validate_run_id(run_id) rd = safe_run_dir(self.root, run_id) if not rd.exists(): return {'ok': False, 'errors': ['RUN_NOT_FOUND']} try: _validate_run_filesystem_containment_v109(rd) except Exception as exc: return {'ok': False, 'errors': [f'RUN_ARTIFACT_NAMESPACE_INVALID:{type(exc).__name__}:{exc}']} try: run = read_json(rd / 'run.json') except Exception as exc: return {'ok': False, 'errors': [f'RUN_READ_FAILURE:{type(exc).__name__}:{exc}']} if run.get('run_status') == 'FAILED_CLOSED': return _verify_failed_closed_run_v110(self, run_id) result = super().verify_persisted_run(run_id) errors = list(result.get('errors', [])) for err in _verify_manifest_chain_v110(rd): if err not in errors: errors.append(err) try: _validate_run_artifact_namespace_v110(rd, run.get('run_status')) except Exception as exc: errors.append(f'RUN_ARTIFACT_NAMESPACE_INVALID:{type(exc).__name__}:{exc}') try: decision = read_json(rd / 'decision_package.json') _validate_all_override_authorization_chronology_v110(rd, run, decision) except Exception as exc: errors.append(f'OVERRIDE_AUTHORIZATION_CHRONOLOGY_INVALID:{type(exc).__name__}:{exc}') return {'ok': not errors, 'errors': errors} LoopGuardCanonicalPOC = _LoopGuardCanonicalPOCV110 def _rewrite_single_manifest_raw_v110(rd: Path) -> None: """Test helper: rebuild one canonical base manifest without invoking engine guardrails.""" for p in list(rd.iterdir()): if _MANIFEST_NAME_RE_V108.fullmatch(p.name): p.unlink() files = { p.name: hashlib.sha256(p.read_bytes()).hexdigest() for p in sorted(rd.iterdir()) if p.is_file() and not _MANIFEST_NAME_RE_V108.fullmatch(p.name) } core = {'sequence': 0, 'previous_manifest_hash': None, 'files': files} man = dict(core); man['manifest_hash'] = sha256_obj(core) write_json_new(rd / 'manifest.json', man) def v110_failedclosed_manifest_authorization_parity_regression_suite(root: Path) -> List[Dict[str, Any]]: if root.exists(): shutil.rmtree(root) root.mkdir(parents=True) out: List[Dict[str, Any]] = [] def add(name: str, ok: bool, detail: Any='') -> None: out.append({'test': name, 'ok': bool(ok), 'detail': '' if ok else repr(detail)}) def failed_run(test_id: str, policy: Optional[PolicyPack]=None): e = LoopGuardCanonicalPOC(root / test_id, policy or DEFAULT_POLICY_PACK) req = base_request(test_id) active = policy or DEFAULT_POLICY_PACK req['policy_pack_ref'] = { 'policy_pack_id': active.policy_pack_id, 'policy_pack_version': active.policy_pack_version, 'policy_pack_hash': active.policy_pack_hash, } req['metric_inputs'] = None e.open_run(req, test_id) d = e.decide(test_id) return e, d, root / test_id / test_id # P01: invalid override JSON is forbidden in FAILED_CLOSED namespace. e,d,rd = failed_run('V110-01') (rd/'override_0001.json').write_text('{bad json', encoding='utf-8') _rewrite_single_manifest_raw_v110(rd) vr=e.verify_persisted_run('V110-01') add('V110-01-FAILED-CLOSED-INVALID-OVERRIDE-REJECTED', (not vr['ok']) and any('FAILED_CLOSED_OVERRIDE_ARTIFACT_FORBIDDEN' in x for x in vr['errors']), vr) # P02: forged accepted SHIP override is forbidden for FAILED_CLOSED. e,d,rd = failed_run('V110-02') write_json_new(rd/'override_0001.json', { 'override_id':'OVR-V110-02-1','decision_id':d['decision_id'],'actor_id':'forged','approval_role':'GOVERNANCE_APPROVER', 'requested_gate':'SHIP','original_gate':'HOLD','override_status':'ACCEPTED','justification':'forged', 'authorizing_policy_rule':'FORGED','trusted_authorization_status':'AUTHORIZED','trusted_authorization_ref':None, 'trusted_authorization_hash':None,'timestamp':utc_now(), }) _rewrite_single_manifest_raw_v110(rd) vr=e.verify_persisted_run('V110-02') add('V110-02-FAILED-CLOSED-ACCEPTED-SHIP-OVERRIDE-REJECTED', (not vr['ok']) and any('FAILED_CLOSED_OVERRIDE_ARTIFACT_FORBIDDEN' in x for x in vr['errors']), vr) # P03: malformed authorization artifact is forbidden in FAILED_CLOSED. e,d,rd = failed_run('V110-03') (rd/'trusted_override_authorization_0001.json').write_text('{"authorization_id":', encoding='utf-8') _rewrite_single_manifest_raw_v110(rd) vr=e.verify_persisted_run('V110-03') add('V110-03-FAILED-CLOSED-AUTH-ARTIFACT-REJECTED', (not vr['ok']) and any('FAILED_CLOSED_OVERRIDE_ARTIFACT_FORBIDDEN' in x for x in vr['errors']), vr) # P04-P06: generic-valid but V1.5.1-nonconformant policies fail verification even on FAILED_CLOSED. policy_mutators = ( ('V110-04-FAILED-CLOSED-PRECEDENCE-CONFORMANCE', lambda pd: pd['precedence_rules'].__setitem__('terminal_blocking_rule_ids', ['RISK-RESTRICT'])), ('V110-05-FAILED-CLOSED-OVERRIDE-MATRIX-CONFORMANCE', lambda pd: pd['allowed_overrides']['HOLD'].__setitem__('SHIP', ['GOVERNANCE_APPROVER'])), ('V110-06-FAILED-CLOSED-GREEN-PATH-CONFORMANCE', lambda pd: pd['green_path_rule'].__setitem__('requires_no_blocking_rules', False)), ) for tid, mutate in policy_mutators: pd=copy.deepcopy(DEFAULT_POLICY_PACK.to_dict()); pd['policy_pack_version']=tid.lower(); mutate(pd); pol=PolicyPack.from_dict(pd) generic=True; conform=False try: validate_policy_pack(pol) except Exception: generic=False try: validate_v15_policy_pack(pol); conform=True except Exception: conform=False e,d,rd=failed_run(tid, pol); vr=e.verify_persisted_run(tid) add(tid, generic and (not conform) and (not vr['ok']) and any('V151_POLICY_CONFORMANCE_FAILURE' in x for x in vr['errors']), (generic,conform,vr)) def completed_pending(tid: str): e=LoopGuardCanonicalPOC(root/tid); req=base_request(tid); e.open_run(req,tid); e.provide_trusted_control(tid,base_trusted()); d=e.decide(tid); e.provide_trusted_override_authorization(tid,base_trusted_override()); return e,d,root/tid/tid # P07: pending authorization cannot predate decision/completion. e,d,rd=completed_pending('V110-07'); ap=rd/'trusted_override_authorization_0001.json'; auth=read_json(ap); auth['control_timestamp']='2020-01-01T00:00:00+00:00'; auth['authorization_hash']=sha256_obj(_override_authorization_material(auth)); write_json(ap,auth); _rewrite_single_manifest_raw_v110(rd); vr=e.verify_persisted_run('V110-07') add('V110-07-PENDING-AUTH-PREDECISION-REJECTED', (not vr['ok']) and any('OVERRIDE_AUTHORIZATION_CHRONOLOGY_INVALID' in x for x in vr['errors']), vr) # P08: pending authorization cannot be future-dated. e,d,rd=completed_pending('V110-08'); ap=rd/'trusted_override_authorization_0001.json'; auth=read_json(ap); auth['control_timestamp']='2099-01-01T00:00:00+00:00'; auth['authorization_hash']=sha256_obj(_override_authorization_material(auth)); write_json(ap,auth); _rewrite_single_manifest_raw_v110(rd); vr=e.verify_persisted_run('V110-08') add('V110-08-PENDING-AUTH-FUTURE-REJECTED', (not vr['ok']) and any('OVERRIDE_AUTHORIZATION_CHRONOLOGY_INVALID' in x for x in vr['errors']), vr) def completed_with_override_manifest(tid: str): e=LoopGuardCanonicalPOC(root/tid); req=base_request(tid); e.open_run(req,tid); e.provide_trusted_control(tid,base_trusted()); e.decide(tid); e.provide_trusted_override_authorization(tid,base_trusted_override()); return e,root/tid/tid # P09: filename suffix must equal exact internal sequence. e,rd=completed_with_override_manifest('V110-09'); src=rd/'manifest_override_0001.json'; dst=rd/'manifest_override_0002.json'; src.rename(dst); vr=e.verify_persisted_run('V110-09') add('V110-09-MANIFEST-FILENAME-SEQUENCE-BINDING', (not vr['ok']) and any('MANIFEST_OVERRIDE_FILENAME_SEQUENCE_GAP' in x or 'MANIFEST_SEQUENCE_MISMATCH' in x for x in vr['errors']), vr) # P10: base manifest must be named manifest.json. e=LoopGuardCanonicalPOC(root/'V110-10'); req=base_request('V110-10'); e.open_run(req,'V110-10'); e.provide_trusted_control('V110-10',base_trusted()); e.decide('V110-10'); rd=root/'V110-10'/'V110-10'; (rd/'manifest.json').rename(rd/'manifest_override_0000.json'); vr=e.verify_persisted_run('V110-10') add('V110-10-MANIFEST-BASE-NAME-REQUIRED', (not vr['ok']) and any('MANIFEST_BASE_MISSING' in x or 'MANIFEST_OVERRIDE_SEQUENCE_ZERO_FORBIDDEN' in x for x in vr['errors']), vr) # P11: sequence=false is not integer zero. e=LoopGuardCanonicalPOC(root/'V110-11'); req=base_request('V110-11'); e.open_run(req,'V110-11'); e.provide_trusted_control('V110-11',base_trusted()); e.decide('V110-11'); rd=root/'V110-11'/'V110-11'; mp=rd/'manifest.json'; man=read_json(mp); man['sequence']=False; core={'sequence':man['sequence'],'previous_manifest_hash':man['previous_manifest_hash'],'files':man['files']}; man['manifest_hash']=sha256_obj(core); write_json(mp,man); vr=e.verify_persisted_run('V110-11') add('V110-11-MANIFEST-SEQUENCE-BOOL-FALSE-REJECTED', (not vr['ok']) and any('MANIFEST_SEQUENCE_TYPE_INVALID' in x for x in vr['errors']), vr) # P12: sequence=true is not integer one. e,rd=completed_with_override_manifest('V110-12'); mp=rd/'manifest_override_0001.json'; man=read_json(mp); man['sequence']=True; core={'sequence':man['sequence'],'previous_manifest_hash':man['previous_manifest_hash'],'files':man['files']}; man['manifest_hash']=sha256_obj(core); write_json(mp,man); vr=e.verify_persisted_run('V110-12') add('V110-12-MANIFEST-SEQUENCE-BOOL-TRUE-REJECTED', (not vr['ok']) and any('MANIFEST_SEQUENCE_TYPE_INVALID' in x for x in vr['errors']), vr) return out def run_full_verification_v110(output_root: Path) -> Dict[str, Any]: if output_root.exists(): shutil.rmtree(output_root) output_root.mkdir(parents=True) scenarios=scenario_suite(output_root/'runs') invariants=invariant_suite(output_root/'invariants') regressions=audit_regression_suite(output_root/'audit_regressions') config_regressions=configuration_integrity_regression_suite(output_root/'configuration_integrity_regressions') v103=v103_replay_evidence_regression_suite(output_root/'v103_regressions') v104=v104_verification_integrity_regression_suite(output_root/'v104_regressions') v105=v105_audit_provenance_regression_suite(output_root/'v105_regressions') v106=v106_identity_bundle_namespace_temporal_regression_suite(output_root/'v106_regressions') v107=v107_evidence_quality_and_integrity_regression_suite(output_root/'v107_regressions') v108=v108_failclosed_policy_namespace_regression_suite(output_root/'v108_regressions') v109=v109_totality_containment_lifecycle_conformance_regression_suite(output_root/'v109_regressions') v110=v110_failedclosed_manifest_authorization_parity_regression_suite(output_root/'v110_regressions') summary={ 'spec_version':SPEC_VERSION,'engine_version':ENGINE_VERSION, 'scenario_total':len(scenarios),'scenario_passed':sum(x['ok'] for x in scenarios),'scenario_failed':sum(not x['ok'] for x in scenarios), 'invariant_total':len(invariants),'invariant_passed':sum(x['ok'] for x in invariants),'invariant_failed':sum(not x['ok'] for x in invariants), 'audit_regression_total':len(regressions),'audit_regression_passed':sum(x['ok'] for x in regressions),'audit_regression_failed':sum(not x['ok'] for x in regressions), 'configuration_integrity_total':len(config_regressions),'configuration_integrity_passed':sum(x['ok'] for x in config_regressions),'configuration_integrity_failed':sum(not x['ok'] for x in config_regressions), 'v103_regression_total':len(v103),'v103_regression_passed':sum(x['ok'] for x in v103),'v103_regression_failed':sum(not x['ok'] for x in v103),'v103_regressions':v103, 'v104_regression_total':len(v104),'v104_regression_passed':sum(x['ok'] for x in v104),'v104_regression_failed':sum(not x['ok'] for x in v104),'v104_regressions':v104, 'v105_regression_total':len(v105),'v105_regression_passed':sum(x['ok'] for x in v105),'v105_regression_failed':sum(not x['ok'] for x in v105),'v105_regressions':v105, 'v106_regression_total':len(v106),'v106_regression_passed':sum(x['ok'] for x in v106),'v106_regression_failed':sum(not x['ok'] for x in v106),'v106_regressions':v106, 'v107_regression_total':len(v107),'v107_regression_passed':sum(x['ok'] for x in v107),'v107_regression_failed':sum(not x['ok'] for x in v107),'v107_regressions':v107, 'v108_regression_total':len(v108),'v108_regression_passed':sum(x['ok'] for x in v108),'v108_regression_failed':sum(not x['ok'] for x in v108),'v108_regressions':v108, 'v109_regression_total':len(v109),'v109_regression_passed':sum(x['ok'] for x in v109),'v109_regression_failed':sum(not x['ok'] for x in v109),'v109_regressions':v109, 'v110_regression_total':len(v110),'v110_regression_passed':sum(x['ok'] for x in v110),'v110_regression_failed':sum(not x['ok'] for x in v110),'v110_regressions':v110, 'scenarios':[{'id':x['id'],'ok':x['ok'],'gate':x['decision']['final_gate'],'details':x['details']} for x in scenarios], 'invariants':invariants,'audit_regressions':regressions,'configuration_integrity_regressions':config_regressions, } write_json(output_root/'verification_report.json',summary) return summary run_full_verification = run_full_verification_v110 # --------------------------------------------------------------------------- # V1.0.11 remediation layer # Closes V110-HF-01..04 without reopening Specification V1.5.1 Rev B. # --------------------------------------------------------------------------- _LoopGuardCanonicalPOCV110_FINAL = LoopGuardCanonicalPOC _RUN_FULL_VERIFICATION_V110 = run_full_verification _AUTH_FILE_RE_V111 = re.compile(r'^trusted_override_authorization_(\d{4})\.json$') _REQUEST_FILE_RE_V111 = re.compile(r'^override_request_(\d{4})\.json$') _OVERRIDE_FILE_RE_V111 = re.compile(r'^override_(\d{4})\.json$') _OVERRIDE_EVIDENCE_FILE_RE_V111 = re.compile(r'^override_evidence_(\d{4})\.json$') def _is_post_decision_event_artifact_v111(name: str) -> bool: return bool( _AUTH_FILE_RE_V111.fullmatch(name) or _REQUEST_FILE_RE_V111.fullmatch(name) or _OVERRIDE_FILE_RE_V111.fullmatch(name) or _OVERRIDE_EVIDENCE_FILE_RE_V111.fullmatch(name) ) def _ordered_manifest_records_v111(rd: Path) -> List[Tuple[int, Path, Dict[str, Any]]]: paths = _manifest_paths_v110(rd) out: List[Tuple[int, Path, Dict[str, Any]]] = [] for idx, mp in enumerate(paths): man = read_json(mp) if not isinstance(man, dict): raise POCError(f'MANIFEST_EVENT_RECORD_NOT_OBJECT:{mp.name}') files = man.get('files') if not isinstance(files, dict): raise POCError(f'MANIFEST_EVENT_FILES_NOT_OBJECT:{mp.name}') out.append((idx, mp, man)) return out def _derive_manifest_event_history_v111(rd: Path) -> List[Dict[str, Any]]: """Bind every post-decision manifest snapshot to exactly one append-only lifecycle event.""" records = _ordered_manifest_records_v111(rd) if not records: raise POCError('MANIFEST_EVENT_HISTORY_MISSING') if records[0][1].name != 'manifest.json': raise POCError('MANIFEST_EVENT_BASE_NAME_INVALID') base_files = records[0][2]['files'] base_events = sorted(name for name in base_files if _is_post_decision_event_artifact_v111(name)) if base_events: raise POCError(f'MANIFEST_BASE_CONTAINS_POST_DECISION_EVENT:{base_events}') events: List[Dict[str, Any]] = [] prev_files = dict(base_files) expected_auth_seq = 1 expected_override_seq = 1 for manifest_seq, mp, man in records[1:]: cur_files = dict(man['files']) removed = sorted(set(prev_files) - set(cur_files)) changed = sorted( name for name in set(prev_files) & set(cur_files) if prev_files[name] != cur_files[name] ) added = sorted(set(cur_files) - set(prev_files)) if removed: raise POCError(f'MANIFEST_EVENT_REMOVAL_FORBIDDEN:{mp.name}:{removed}') if changed: raise POCError(f'MANIFEST_EVENT_REWRITE_FORBIDDEN:{mp.name}:{changed}') if not added: raise POCError(f'MANIFEST_EVENT_DELTA_EMPTY:{mp.name}') expected_auth = f'trusted_override_authorization_{expected_auth_seq:04d}.json' expected_override_set = { f'override_request_{expected_override_seq:04d}.json', f'override_{expected_override_seq:04d}.json', f'override_evidence_{expected_override_seq:04d}.json', } added_set = set(added) if added_set == {expected_auth}: events.append({ 'manifest_sequence': manifest_seq, 'event_type': 'TRUSTED_OVERRIDE_AUTHORIZATION', 'event_sequence': expected_auth_seq, 'event_refs': [expected_auth], }) expected_auth_seq += 1 elif added_set == expected_override_set: events.append({ 'manifest_sequence': manifest_seq, 'event_type': 'OVERRIDE_TRANSACTION', 'event_sequence': expected_override_seq, 'event_refs': sorted(expected_override_set), }) expected_override_seq += 1 else: raise POCError(f'MANIFEST_EVENT_DELTA_INVALID:{mp.name}:{added}') prev_files = cur_files auth_seq = _override_artifact_sequences(rd, 'trusted_override_authorization') override_seq = _override_artifact_sequences(rd, 'override') expected_manifest_count = 1 + len(auth_seq) + len(override_seq) if len(records) != expected_manifest_count: raise POCError( f'MANIFEST_EVENT_CARDINALITY_MISMATCH:manifests={len(records)}:' f'auth={len(auth_seq)}:override={len(override_seq)}:expected={expected_manifest_count}' ) if auth_seq != list(range(1, expected_auth_seq)): raise POCError(f'MANIFEST_AUTH_EVENT_SEQUENCE_MISMATCH:{auth_seq}') if override_seq != list(range(1, expected_override_seq)): raise POCError(f'MANIFEST_OVERRIDE_EVENT_SEQUENCE_MISMATCH:{override_seq}') return events def _validate_global_event_chronology_v111( rd: Path, run: Dict[str, Any], decision: Dict[str, Any] ) -> List[Dict[str, Any]]: events = _derive_manifest_event_history_v111(rd) decision_dt = _timestamp_dt(decision.get('decision_timestamp'), 'decision.decision_timestamp') completed_dt = _timestamp_dt(run.get('completed_at'), 'run.completed_at') prev_end = max(decision_dt, completed_dt) now_dt = datetime.now(timezone.utc) for ev in events: seq = ev['event_sequence'] if ev['event_type'] == 'TRUSTED_OVERRIDE_AUTHORIZATION': fn = f'trusted_override_authorization_{seq:04d}.json' rec = read_json(rd / fn) _validate_bound_override_authorization_record( rec, run['run_id'], decision['decision_id'], f'TOA-{run["run_id"]}-{seq}' ) event_dt = _timestamp_dt(rec.get('control_timestamp'), f'trusted_override.control_timestamp:{seq}') if event_dt < prev_end: raise POCError(f'GLOBAL_EVENT_CHRONOLOGY_REGRESSION:AUTH:{seq}') if event_dt > now_dt: raise POCError(f'GLOBAL_EVENT_TIMESTAMP_IN_FUTURE:AUTH:{seq}') prev_end = event_dt ev['event_start'] = event_dt.isoformat() ev['event_end'] = event_dt.isoformat() else: request = read_json(rd / f'override_request_{seq:04d}.json') override = read_json(rd / f'override_{seq:04d}.json') req_dt = _timestamp_dt(request.get('request_timestamp'), f'override_request.request_timestamp:{seq}') ov_dt = _timestamp_dt(override.get('timestamp'), f'override.timestamp:{seq}') if req_dt < prev_end: raise POCError(f'GLOBAL_EVENT_CHRONOLOGY_REGRESSION:OVERRIDE_REQUEST:{seq}') if ov_dt < req_dt: raise POCError(f'GLOBAL_EVENT_LOCAL_CHRONOLOGY_INVALID:OVERRIDE:{seq}') if ov_dt > now_dt: raise POCError(f'GLOBAL_EVENT_TIMESTAMP_IN_FUTURE:OVERRIDE:{seq}') prev_end = ov_dt ev['event_start'] = req_dt.isoformat() ev['event_end'] = ov_dt.isoformat() return events def _latest_lifecycle_timestamp_v111(rd: Path) -> datetime: run = read_json(rd / 'run.json') decision = read_json(rd / 'decision_package.json') events = _validate_global_event_chronology_v111(rd, run, decision) if events: return _timestamp_dt(events[-1]['event_end'], 'lifecycle.latest_event_end') return max( _timestamp_dt(run.get('completed_at'), 'run.completed_at'), _timestamp_dt(decision.get('decision_timestamp'), 'decision.decision_timestamp'), ) def _authorization_manifest_provenance_v111(rd: Path, auth_ref: str) -> bool: if not isinstance(auth_ref, str) or not _AUTH_FILE_RE_V111.fullmatch(auth_ref): return False try: events = _derive_manifest_event_history_v111(rd) except Exception: return False return any( ev['event_type'] == 'TRUSTED_OVERRIDE_AUTHORIZATION' and auth_ref in ev['event_refs'] for ev in events ) def _require_mutation_preflight_v111(engine: Any, run_id: str) -> Dict[str, Any]: vr = engine.verify_persisted_run(run_id) if not vr.get('ok'): errors = vr.get('errors') or [] summary = '|'.join(str(x) for x in errors[:12]) raise POCError(f'RUN_MUTATION_PREFLIGHT_FAILED:{summary}') return vr class _LoopGuardCanonicalPOCV111(_LoopGuardCanonicalPOCV110_FINAL): """V1.0.11 lifecycle-provenance remediation; Specification V1.5.1 Rev B remains locked.""" def provide_trusted_override_authorization(self, run_id: str, authorization: Dict[str, Any]) -> None: validate_run_id(run_id) rd = safe_run_dir(self.root, run_id) if not rd.exists() or not (rd / 'run.json').exists(): raise POCError('RUN_NOT_FOUND') run = read_json(rd / 'run.json') if run.get('run_status') == 'FAILED_CLOSED': raise POCError('FAILED_CLOSED_OVERRIDE_TRANSITION_FORBIDDEN') # State mutation is permitted only from a verifier-PASS persisted state. _require_mutation_preflight_v111(self, run_id) validate_trusted_override_authorization(authorization) incoming_dt = _timestamp_dt(authorization.get('control_timestamp'), 'trusted_override.control_timestamp') latest_dt = _latest_lifecycle_timestamp_v111(rd) if incoming_dt < latest_dt: raise POCError('TRUSTED_OVERRIDE_TIMESTAMP_PRECEDES_LATEST_LIFECYCLE_EVENT') return super().provide_trusted_override_authorization(run_id, authorization) def request_override(self, run_id: str, requested_gate: str, justification: str) -> Dict[str, Any]: validate_run_id(run_id) rd = safe_run_dir(self.root, run_id) if not rd.exists() or not (rd / 'run.json').exists(): raise POCError('RUN_NOT_FOUND') run = read_json(rd / 'run.json') if run.get('run_status') == 'FAILED_CLOSED': raise POCError('FAILED_CLOSED_OVERRIDE_TRANSITION_FORBIDDEN') # Prevent laundering of unmanifested or otherwise verifier-failed state. _require_mutation_preflight_v111(self, run_id) auth_files = sorted(rd.glob('trusted_override_authorization_[0-9][0-9][0-9][0-9].json')) if auth_files: latest_auth = auth_files[-1].name if not _authorization_manifest_provenance_v111(rd, latest_auth): raise POCError(f'TRUSTED_OVERRIDE_AUTH_PROVENANCE_UNBOUND:{latest_auth}') return super().request_override(run_id, requested_gate, justification) def verify_persisted_run(self, run_id: str) -> Dict[str, Any]: validate_run_id(run_id) rd = safe_run_dir(self.root, run_id) if not rd.exists(): return {'ok': False, 'errors': ['RUN_NOT_FOUND']} result = super().verify_persisted_run(run_id) errors = list(result.get('errors', [])) try: run = read_json(rd / 'run.json') decision = read_json(rd / 'decision_package.json') _validate_global_event_chronology_v111(rd, run, decision) except Exception as exc: errors.append(f'MANIFEST_EVENT_HISTORY_OR_CHRONOLOGY_INVALID:{type(exc).__name__}:{exc}') return {'ok': not errors, 'errors': errors} LoopGuardCanonicalPOC = _LoopGuardCanonicalPOCV111 def _raw_rebuild_base_manifest_v111(rd: Path) -> None: for p in list(rd.iterdir()): if _MANIFEST_NAME_RE_V108.fullmatch(p.name): p.unlink() files = { p.name: hashlib.sha256(p.read_bytes()).hexdigest() for p in sorted(rd.iterdir()) if p.is_file() and not _MANIFEST_NAME_RE_V108.fullmatch(p.name) } core = {'sequence': 0, 'previous_manifest_hash': None, 'files': files} man = dict(core); man['manifest_hash'] = sha256_obj(core) write_json_new(rd / 'manifest.json', man) def _raw_append_manifest_v111(rd: Path) -> Path: manifests = _manifest_paths_v110(rd) sequence = len(manifests) previous_hash = read_json(manifests[-1])['manifest_hash'] if manifests else None files = { p.name: hashlib.sha256(p.read_bytes()).hexdigest() for p in sorted(rd.iterdir()) if p.is_file() and not _MANIFEST_NAME_RE_V108.fullmatch(p.name) } core = {'sequence': sequence, 'previous_manifest_hash': previous_hash, 'files': files} man = dict(core); man['manifest_hash'] = sha256_obj(core) target = rd / ('manifest.json' if sequence == 0 else f'manifest_override_{sequence:04d}.json') write_json_new(target, man) return target def v111_provenance_preflight_manifest_chronology_regression_suite(root: Path) -> List[Dict[str, Any]]: if root.exists(): shutil.rmtree(root) root.mkdir(parents=True) out: List[Dict[str, Any]] = [] def add(name: str, ok: bool, detail: Any='') -> None: out.append({'test': name, 'ok': bool(ok), 'detail': '' if ok else repr(detail)}) def completed(test_id: str, *, restrict: bool=False): e=LoopGuardCanonicalPOC(root/test_id); req=base_request(test_id) if restrict: req['metric_inputs']['risk_level']['payload']['risk_fixture_score']=30 bind_fixture_evidence(req) e.open_run(req,test_id); e.provide_trusted_control(test_id,base_trusted()); d=e.decide(test_id) return e,d,root/test_id/test_id def manual_auth(rd: Path, run_id: str, decision_id: str, seq: int, *, actor='manual', status='AUTHORIZED', timestamp=None): rec={ 'authorization_id':f'TOA-{run_id}-{seq}','run_id':run_id,'decision_id':decision_id, 'trusted_source_id':'TRUSTED-OVERRIDE-POC','actor_id':actor,'approval_role':'GOVERNANCE_APPROVER', 'authorization_status':status,'control_timestamp':timestamp or utc_now(), } rec['authorization_hash']=sha256_obj(_override_authorization_material(rec)) write_json_new(rd/f'trusted_override_authorization_{seq:04d}.json',rec) return rec # P01: unmanifested manual authorization cannot be laundered into accepted SHIP. e,d,rd=completed('V111-01',restrict=True); manual_auth(rd,'V111-01',d['decision_id'],1,actor='manual-forged') pre=e.verify_persisted_run('V111-01'); blocked=False try: e.request_override('V111-01','SHIP','manual injection') except POCError as exc: blocked='RUN_MUTATION_PREFLIGHT_FAILED' in str(exc) add('V111-01-UNMANIFESTED-AUTH-CANNOT-BE-LAUNDERED', (not pre['ok']) and blocked and not (rd/'override_0001.json').exists(), (pre,blocked)) # P02: injected latest sequence cannot supersede legitimate API auth. e,d,rd=completed('V111-02',restrict=True); rejected=base_trusted_override('legit-rejected'); rejected['authorization_status']='REJECTED'; e.provide_trusted_override_authorization('V111-02',rejected); manual_auth(rd,'V111-02',d['decision_id'],2,actor='manual-latest') blocked=False try: e.request_override('V111-02','SHIP','manual latest') except POCError as exc: blocked='RUN_MUTATION_PREFLIGHT_FAILED' in str(exc) add('V111-02-INJECTED-LATEST-AUTH-CANNOT-SUPERSEDE', blocked and not (rd/'override_0001.json').exists()) # P03: manual authorization cannot be canonicalized even for conservative HOLD. e,d,rd=completed('V111-03'); manual_auth(rd,'V111-03',d['decision_id'],1,actor='manual-hold') blocked=False try: e.request_override('V111-03','HOLD','manual conservative') except POCError as exc: blocked='RUN_MUTATION_PREFLIGHT_FAILED' in str(exc) add('V111-03-MANUAL-AUTH-CANNOT-BE-CANONICALIZED', blocked and not (rd/'override_0001.json').exists()) # P04: authorization issuance is blocked on a verifier-failed manifest state. e,d,rd=completed('V111-04'); man=read_json(rd/'manifest.json'); man['manifest_hash']='0'*64; write_json(rd/'manifest.json',man) blocked=False; before=len(list(rd.glob('trusted_override_authorization_*.json'))) try: e.provide_trusted_override_authorization('V111-04',base_trusted_override()) except POCError as exc: blocked='RUN_MUTATION_PREFLIGHT_FAILED' in str(exc) after=len(list(rd.glob('trusted_override_authorization_*.json'))) add('V111-04-AUTH-ISSUANCE-REQUIRES-PREFLIGHT-PASS', blocked and before==after==0) # P05: request_override cannot act on tampered nonconformant PolicyPack. e,d,rd=completed('V111-05'); e.provide_trusted_override_authorization('V111-05',base_trusted_override()) pp=read_json(rd/'policy_pack.json'); pp['allowed_overrides']['SHIP']={'SHIP':['GOVERNANCE_APPROVER']}; raw=copy.deepcopy(pp); raw.pop('policy_pack_hash',None); pp['policy_pack_hash']=sha256_obj(raw); write_json(rd/'policy_pack.json',pp); _raw_append_manifest_v111(rd) blocked=False try: e.request_override('V111-05','SHIP','tampered policy') except POCError as exc: blocked='RUN_MUTATION_PREFLIGHT_FAILED' in str(exc) add('V111-05-OVERRIDE-REQUIRES-POLICY-PREFLIGHT-PASS', blocked and not (rd/'override_0001.json').exists()) # P06: tampered DecisionPackage/rule trace cannot be consumed by mutation API. e,d,rd=completed('V111-06',restrict=True); e.provide_trusted_override_authorization('V111-06',base_trusted_override()) dec=read_json(rd/'decision_package.json'); dec['rationale_code']='FORGED'; write_json(rd/'decision_package.json',dec); rules=read_json(rd/'rule_evaluations.json'); rules[0]['triggered']=not rules[0]['triggered']; write_json(rd/'rule_evaluations.json',rules); _raw_append_manifest_v111(rd) blocked=False try: e.request_override('V111-06','SHIP','tampered trace') except POCError as exc: blocked='RUN_MUTATION_PREFLIGHT_FAILED' in str(exc) add('V111-06-OVERRIDE-REQUIRES-TRACE-PREFLIGHT-PASS', blocked and not (rd/'override_0001.json').exists()) # P07: two auth events require base + two event snapshots; collapsing history fails. e,d,rd=completed('V111-07'); e.provide_trusted_override_authorization('V111-07',base_trusted_override('a1')); e.provide_trusted_override_authorization('V111-07',base_trusted_override('a2')); _raw_rebuild_base_manifest_v111(rd); vr=e.verify_persisted_run('V111-07') add('V111-07-MANIFEST-HISTORY-COLLAPSE-AUTH-REJECTED', (not vr['ok']) and any('MANIFEST_EVENT' in x for x in vr['errors']), vr) # P08: no-op snapshot is not a valid lifecycle event. e,d,rd=completed('V111-08'); _raw_append_manifest_v111(rd); vr=e.verify_persisted_run('V111-08') add('V111-08-NOOP-MANIFEST-SNAPSHOT-REJECTED', (not vr['ok']) and any('MANIFEST_EVENT_DELTA_EMPTY' in x for x in vr['errors']), vr) # P09: auth+override lifecycle cannot be collapsed into one snapshot. e,d,rd=completed('V111-09'); e.provide_trusted_override_authorization('V111-09',base_trusted_override()); e.request_override('V111-09','HOLD','valid'); _raw_rebuild_base_manifest_v111(rd); vr=e.verify_persisted_run('V111-09') add('V111-09-MANIFEST-HISTORY-COLLAPSE-OVERRIDE-REJECTED', (not vr['ok']) and any('MANIFEST_EVENT' in x for x in vr['errors']), vr) # P10: authorization sequence must be globally monotonic in time. e,d,rd=completed('V111-10'); e.provide_trusted_override_authorization('V111-10',base_trusted_override('a1')); a1=read_json(rd/'trusted_override_authorization_0001.json'); later=_timestamp_dt(a1['control_timestamp'],'a1') a2=base_trusted_override('a2'); a2['control_timestamp']=(later.replace(microsecond=max(0,later.microsecond-1000))).isoformat() if later.microsecond>=1000 else a1['control_timestamp'] blocked=False try: e.provide_trusted_override_authorization('V111-10',a2) except POCError as exc: blocked='TRUSTED_OVERRIDE_TIMESTAMP_PRECEDES_LATEST_LIFECYCLE_EVENT' in str(exc) add('V111-10-AUTH-SEQUENCE-TIME-MONOTONIC', blocked and not (rd/'trusted_override_authorization_0002.json').exists()) # P11: complete override sequence 2 cannot be timestamped before sequence 1, # even when each local interval remains after completion and its original manifest is rehashed. e,d,rd=completed('V111-11'); e.request_override('V111-11','HOLD','missing auth first'); e.request_override('V111-11','HOLD','missing auth second') run=read_json(rd/'run.json'); r1=read_json(rd/'override_request_0001.json'); o1=read_json(rd/'override_0001.json'); r2=read_json(rd/'override_request_0002.json'); o2=read_json(rd/'override_0002.json') completed_dt=_timestamp_dt(run['completed_at'],'run.completed_at'); r1_dt=_timestamp_dt(r1['request_timestamp'],'r1.request_timestamp') gap=r1_dt-completed_dt if gap.total_seconds() <= 0.000006: raise POCError('V111_TEST_CLOCK_GAP_TOO_SMALL') r2_dt=completed_dt + gap/3; o2_dt=completed_dt + (gap*2)/3 r2['request_timestamp']=r2_dt.isoformat(); o2['timestamp']=o2_dt.isoformat(); write_json(rd/'override_request_0002.json',r2); write_json(rd/'override_0002.json',o2) mp=rd/'manifest_override_0002.json'; man=read_json(mp); man['files']['override_request_0002.json']=hashlib.sha256((rd/'override_request_0002.json').read_bytes()).hexdigest(); man['files']['override_0002.json']=hashlib.sha256((rd/'override_0002.json').read_bytes()).hexdigest(); core={'sequence':man['sequence'],'previous_manifest_hash':man['previous_manifest_hash'],'files':man['files']}; man['manifest_hash']=sha256_obj(core); write_json(mp,man) vr=e.verify_persisted_run('V111-11') add('V111-11-OVERRIDE-SEQUENCE-TIME-MONOTONIC', (not vr['ok']) and any('GLOBAL_EVENT_CHRONOLOGY_REGRESSION' in x for x in vr['errors']), vr) # P12: latest authorization by sequence cannot carry an earlier timestamp and then be consumed. e,d,rd=completed('V111-12'); e.provide_trusted_override_authorization('V111-12',base_trusted_override('a1')); a1=read_json(rd/'trusted_override_authorization_0001.json'); a2=base_trusted_override('latest-seq'); t1=_timestamp_dt(a1['control_timestamp'],'a1'); a2['control_timestamp']=(t1.replace(microsecond=max(0,t1.microsecond-1000))).isoformat() if t1.microsecond>=1000 else a1['control_timestamp'] rejected=False try: e.provide_trusted_override_authorization('V111-12',a2) except POCError as exc: rejected='TRUSTED_OVERRIDE_TIMESTAMP_PRECEDES_LATEST_LIFECYCLE_EVENT' in str(exc) add('V111-12-EARLIER-LATEST-AUTH-CANNOT-BE-CONSUMED', rejected and not (rd/'trusted_override_authorization_0002.json').exists()) return out def run_full_verification_v111(output_root: Path) -> Dict[str, Any]: if output_root.exists(): shutil.rmtree(output_root) output_root.mkdir(parents=True) scenarios=scenario_suite(output_root/'runs') invariants=invariant_suite(output_root/'invariants') regressions=audit_regression_suite(output_root/'audit_regressions') config_regressions=configuration_integrity_regression_suite(output_root/'configuration_integrity_regressions') v103=v103_replay_evidence_regression_suite(output_root/'v103_regressions') v104=v104_verification_integrity_regression_suite(output_root/'v104_regressions') v105=v105_audit_provenance_regression_suite(output_root/'v105_regressions') v106=v106_identity_bundle_namespace_temporal_regression_suite(output_root/'v106_regressions') v107=v107_evidence_quality_and_integrity_regression_suite(output_root/'v107_regressions') v108=v108_failclosed_policy_namespace_regression_suite(output_root/'v108_regressions') v109=v109_totality_containment_lifecycle_conformance_regression_suite(output_root/'v109_regressions') v110=v110_failedclosed_manifest_authorization_parity_regression_suite(output_root/'v110_regressions') v111=v111_provenance_preflight_manifest_chronology_regression_suite(output_root/'v111_regressions') summary={ 'spec_version':SPEC_VERSION,'engine_version':ENGINE_VERSION, 'scenario_total':len(scenarios),'scenario_passed':sum(x['ok'] for x in scenarios),'scenario_failed':sum(not x['ok'] for x in scenarios), 'invariant_total':len(invariants),'invariant_passed':sum(x['ok'] for x in invariants),'invariant_failed':sum(not x['ok'] for x in invariants), 'audit_regression_total':len(regressions),'audit_regression_passed':sum(x['ok'] for x in regressions),'audit_regression_failed':sum(not x['ok'] for x in regressions), 'configuration_integrity_total':len(config_regressions),'configuration_integrity_passed':sum(x['ok'] for x in config_regressions),'configuration_integrity_failed':sum(not x['ok'] for x in config_regressions), 'v103_regression_total':len(v103),'v103_regression_passed':sum(x['ok'] for x in v103),'v103_regression_failed':sum(not x['ok'] for x in v103),'v103_regressions':v103, 'v104_regression_total':len(v104),'v104_regression_passed':sum(x['ok'] for x in v104),'v104_regression_failed':sum(not x['ok'] for x in v104),'v104_regressions':v104, 'v105_regression_total':len(v105),'v105_regression_passed':sum(x['ok'] for x in v105),'v105_regression_failed':sum(not x['ok'] for x in v105),'v105_regressions':v105, 'v106_regression_total':len(v106),'v106_regression_passed':sum(x['ok'] for x in v106),'v106_regression_failed':sum(not x['ok'] for x in v106),'v106_regressions':v106, 'v107_regression_total':len(v107),'v107_regression_passed':sum(x['ok'] for x in v107),'v107_regression_failed':sum(not x['ok'] for x in v107),'v107_regressions':v107, 'v108_regression_total':len(v108),'v108_regression_passed':sum(x['ok'] for x in v108),'v108_regression_failed':sum(not x['ok'] for x in v108),'v108_regressions':v108, 'v109_regression_total':len(v109),'v109_regression_passed':sum(x['ok'] for x in v109),'v109_regression_failed':sum(not x['ok'] for x in v109),'v109_regressions':v109, 'v110_regression_total':len(v110),'v110_regression_passed':sum(x['ok'] for x in v110),'v110_regression_failed':sum(not x['ok'] for x in v110),'v110_regressions':v110, 'v111_regression_total':len(v111),'v111_regression_passed':sum(x['ok'] for x in v111),'v111_regression_failed':sum(not x['ok'] for x in v111),'v111_regressions':v111, 'scenarios':[{'id':x['id'],'ok':x['ok'],'gate':x['decision']['final_gate'],'details':x['details']} for x in scenarios], 'invariants':invariants,'audit_regressions':regressions,'configuration_integrity_regressions':config_regressions, } write_json(output_root/'verification_report.json',summary) return summary run_full_verification = run_full_verification_v111