From 259fc02afd3906f3fa48ccc2c7e23b9f7ff23e24 Mon Sep 17 00:00:00 2001 From: homelab-runtime-publisher Date: Tue, 8 Sep 2026 07:54:01 +0000 Subject: [PATCH] runtime: publish SIGNALBOT-260908-PACKAGE-SEAL-RCA-043PKG --- ...NALBOT-260908-PACKAGE-SEAL-RCA-043PKG.json | 38 ++++++++++++++++ ...GNALBOT-260908-PACKAGE-SEAL-RCA-043PKG.txt | 45 +++++++++++++++++++ runtime/latest.json | 22 ++++----- runtime/latest.txt | 44 ++++++++---------- 4 files changed, 112 insertions(+), 37 deletions(-) create mode 100644 runtime/history/SIGNALBOT-260908-PACKAGE-SEAL-RCA-043PKG.json create mode 100644 runtime/history/SIGNALBOT-260908-PACKAGE-SEAL-RCA-043PKG.txt diff --git a/runtime/history/SIGNALBOT-260908-PACKAGE-SEAL-RCA-043PKG.json b/runtime/history/SIGNALBOT-260908-PACKAGE-SEAL-RCA-043PKG.json new file mode 100644 index 00000000..1dcc83c0 --- /dev/null +++ b/runtime/history/SIGNALBOT-260908-PACKAGE-SEAL-RCA-043PKG.json @@ -0,0 +1,38 @@ +{ + "schema_version": 1, + "channel": "homelab-runtime", + "command_id": "SIGNALBOT-260908-PACKAGE-SEAL-RCA-043PKG", + "status": "FAIL", + "rc": 3, + "host": "pve01", + "mode": "read-only", + "component": "signalbot-cr0116-package-seal-rca", + "started_at_utc": "2026-09-08T07:53:58Z", + "finished_at_utc": "2026-09-08T07:54:00Z", + "reference_register_checked": true, + "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66", + "error_register_checked": true, + "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0", + "command_sha256": "08ece8490c12004f2f6511bfb5dbcef29ab38d4385dbb224a48ba5d4a3dbfbaf", + "duplicate_failed_command_blocked": false, + "block_reason": null, + "execution_started": true, + "change_declared": false, + "result_contract_valid": true, + "result_contract_status": null, + "result_contract_error": null, + "command_rc": 3, + "changes_made": false, + "rollback_started": false, + "rollback_restored": null, + "mutation_outcome": "NO_MUTATION", + "sanitized": true, + "secrets_included": false, + "private_addresses_included": false, + "raw_evidence_retained_locally": true, + "raw_evidence_sha256": "5a54891c071a17faf298b6f4df768f618290aac210aadeb4e5117d67b35ab713", + "sanitized_output_sha256": "5a54891c071a17faf298b6f4df768f618290aac210aadeb4e5117d67b35ab713", + "output_truncated_in_json": false, + "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", + "output": "ERROR_REGISTER_CHECK=OK\nREFERENCE_CHECK=OK\nAUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED\nSB043K_PRESTATE={\"active_env\":{\"APP_IMAGE\":\"8020-demonov-shadow:e32760c69a4311728db9066ee8bf2bf66b1e5a70\",\"CODE_IDENTITY\":\"e32760c69a4311728db9066ee8bf2bf66b1e5a70\",\"COLLECTION_START_AT\":\"2026-09-07T00:00:00+00:00\",\"EXPERIMENT_ID\":\"ec477ea41ecbd5cfdef5afc259595aab20674a7d933f41a389329ff05098b338\",\"RUNTIME_MANIFEST_ID\":\"58d3b59200bdc0eb8d448612679d667b194263586cb3198dfc08597935053a1a\"},\"services\":[{\"container_id\":\"a546a70c3e8c263d9b590cd78ee206bcda0cfcdb6662327e8415ca0e29ad1501\",\"image\":\"8020-demonov-shadow:e32760c69a4311728db9066ee8bf2bf66b1e5a70\",\"image_id\":\"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736\",\"restart_count\":14,\"running\":true,\"service\":\"collector\",\"started_at\":\"2026-09-08T07:38:09.79483772Z\"},{\"container_id\":\"d8023f4cbf91f9382e39eec0436c9cebc7665535b42b950e95408c03ff9bf30d\",\"image\":\"8020-demonov-shadow:e32760c69a4311728db9066ee8bf2bf66b1e5a70\",\"image_id\":\"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736\",\"restart_count\":0,\"running\":true,\"service\":\"relay\",\"started_at\":\"2026-09-06T18:48:20.603414848Z\"},{\"container_id\":\"1feeca2d9428cd5a277c026bef34534db307657dcdcd63aff98ea66e44f8b9c5\",\"image\":\"8020-demonov-shadow:e32760c69a4311728db9066ee8bf2bf66b1e5a70\",\"image_id\":\"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736\",\"restart_count\":0,\"running\":true,\"service\":\"shadow\",\"started_at\":\"2026-09-06T18:48:20.768190553Z\"},{\"container_id\":\"889be41d2cee9d327811da78388f834ba6eafe4c0eeae456867ed0df76832d01\",\"image\":\"8020-demonov-shadow:e32760c69a4311728db9066ee8bf2bf66b1e5a70\",\"image_id\":\"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736\",\"restart_count\":0,\"running\":true,\"service\":\"worker\",\"started_at\":\"2026-09-06T18:48:20.586788319Z\"}],\"stage_result\":{\"active_env_unchanged\":true,\"build_context\":\"/opt/stacks/8020-demonov-shadow/.deploy/SIGNALBOT-260908-DEPLOY-STAGE-042FIX5\",\"collector_source_sha256\":\"193dd0c7f9890fdb4026c24dbc5add825f1641d92097e881806705ca452812d5\",\"copy_source\":\"/opt/stacks/8020-demonov-shadow/.deploy/SIGNALBOT-260908-DEPLOY-STAGE-042FIX5/demonov_forward_map\",\"decision\":\"DEPLOY_STAGE_READY\",\"dockerfile\":\"/opt/stacks/8020-demonov-shadow/.deploy/SIGNALBOT-260908-DEPLOY-STAGE-042FIX5/Dockerfile\",\"helper_candidates\":{\"demonov_forward_map.live_prospective\":[{\"name\":\"_hash\",\"pure_candidate\":true,\"signature\":\"(value: 'object') -> 'str'\"}],\"demonov_forward_map.runtime_integrity\":[{\"name\":\"canonical_hash\",\"pure_candidate\":true,\"signature\":\"(payload: 'Any') -> 'str'\"},{\"name\":\"verify_experiment_seal_receipt\",\"pure_candidate\":true,\"signature\":\"(*, bundle: 'FinalProspectiveSealBundle', receipt: 'ExperimentSealReceipt', collection_start_at: 'datetime', receipt_verifier: 'Callable[[ExperimentSealReceipt], bool]') -> 'None'\"},{\"name\":\"required_retained_hashes\",\"pure_candidate\":true,\"signature\":\"(*, runtime_registry: 'RuntimeRegistry', model_registry: 'FinalModelRegistry', state_snapshots: 'Sequence[StateSnapshotManifest]' = (), predictor_runtime: 'PredictorRuntimeManifest | None' = None) -> 'Mapping[str, RetainedArtifactKind]'\"}],\"demonov_forward_map.runtime_manifest\":[{\"name\":\"canonical_hash\",\"pure_candidate\":true,\"signature\":\"(payload: 'Any') -> 'str'\"},{\"name\":\"verify_runtime_manifest\",\"pure_candidate\":true,\"signature\":\"(manifest: 'RuntimeDeploymentManifestV1', *, expected_code_identity: 'str', actual_image_id: 'str', actual_package_identity: 'str') -> 'None'\"}]},\"new_image\":\"8020-demonov-shadow:76e1f58baa544a0e208bba317f0150e5b6d74dbd\",\"new_image_id\":\"sha256:341f71a906c91d3fa9c1d50bd89df2a849dfb0b168bb4551efb444bf61c4ab99\",\"policy\":{\"close_timeout\":5,\"open_timeout\":10,\"ping_interval\":20,\"ping_timeout\":60},\"runtime_activated\":false,\"service_identity_unchanged\":true,\"stage_path\":\"/opt/stacks/8020-demonov-shadow/.deploy/SIGNALBOT-260908-DEPLOY-STAGE-042FIX5\",\"websockets_version\":\"15.0.1\"}}\nSB043K_ARTIFACT_CLASS={\"constructors\":[{\"name\":\"RuntimeArtifactManifest\",\"node\":\"ClassDef\",\"path\":\"runtime_integrity.py\",\"source\":\"class RuntimeArtifactManifest:\\n artifact_id: str\\n source_tree_hash: str\\n dependency_lock_hash: str\\n build_recipe_hash: str\\n executable_artifact_hash: str\\n runtime_environment_hash: str\\n\\n def __post_init__(self) -> None:\\n for name in (\\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\"):\\n _hex64(getattr(self, name), name)\\n if self.artifact_id != self.content_hash:\\n raise DemonovError(\\\"runtime artifact id must be content-addressed\\\")\\n\\n @property\\n def content_hash(self) -> str:\\n return canonical_hash({k: getattr(self, k) for k in (\\n \\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\"\\n )})\\n\\n @classmethod\\n def build(cls, **kwargs) -> \\\"RuntimeArtifactManifest\\\":\\n payload = {k: kwargs[k] for k in (\\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\")}\\n return cls(artifact_id=canonical_hash(payload), **kwargs)\",\"source_sha256\":\"8cd1ebf70c003cd4d7b91f18602841426b19c2f54f2d803309c53c22f38cd5c7\"},{\"name\":\"DeploymentAttestation\",\"node\":\"ClassDef\",\"path\":\"runtime_integrity.py\",\"source\":\"class DeploymentAttestation:\\n attestation_id: str\\n subject_kind: DeploymentSubjectKind\\n subject_id: str\\n actor_id: str\\n source_tree_hash: str\\n dependency_lock_hash: str\\n executable_artifact_hash: str\\n runtime_environment_hash: str\\n effective_config_hash: str\\n deployed_at: datetime\\n issued_at: datetime\\n authority_provider_id: str\\n authority_receipt_hash: str\\n feature_extractor_code_hash: str = \\\"\\\"\\n\\n def __post_init__(self) -> None:\\n _aware(self.deployed_at, \\\"deployment deployed_at\\\"); _aware(self.issued_at, \\\"deployment issued_at\\\")\\n if self.issued_at < self.deployed_at:\\n raise DemonovError(\\\"deployment attestation cannot be issued before deployment\\\")\\n if not self.actor_id or not self.authority_provider_id:\\n raise DemonovError(\\\"deployment attestation identity fields are required\\\")\\n for n in (\\\"subject_id\\\",\\\"source_tree_hash\\\",\\\"dependency_lock_hash\\\",\\\"executable_artifact_hash\\\",\\n \\\"runtime_environment_hash\\\",\\\"effective_config_hash\\\",\\\"authority_receipt_hash\\\"):\\n _hex64(getattr(self,n),n)\\n if self.feature_extractor_code_hash: _hex64(self.feature_extractor_code_hash,\\\"feature_extractor_code_hash\\\")\\n if self.attestation_id != self.content_hash:\\n raise DemonovError(\\\"deployment attestation id must be content-addressed\\\")\\n\\n @property\\n def content_hash(self) -> str:\\n payload={\\\"subject_kind\\\":self.subject_kind,\\\"subject_id\\\":self.subject_id,\\\"actor_id\\\":self.actor_id,\\n \\\"source_tree_hash\\\":self.source_tree_hash,\\\"dependency_lock_hash\\\":self.dependency_lock_hash,\\n \\\"executable_artifact_hash\\\":self.executable_artifact_hash,\\\"runtime_environment_hash\\\":self.runtime_environment_hash,\\n \\\"effective_config_hash\\\":self.effective_config_hash,\\\"deployed_at\\\":self.deployed_at,\\\"issued_at\\\":self.issued_at,\\n \\\"authority_provider_id\\\":self.authority_provider_id,\\\"authority_receipt_hash\\\":self.authority_receipt_hash}\\n if self.feature_extractor_code_hash: payload[\\\"feature_extractor_code_hash\\\"]=self.feature_extractor_code_hash\\n return canonical_hash(payload)\\n\\n @classmethod\\n def build(cls, **kwargs) -> \\\"DeploymentAttestation\\\":\\n payload={k:kwargs[k] for k in (\\\"subject_kind\\\",\\\"subject_id\\\",\\\"actor_id\\\",\\\"source_tree_hash\\\",\\\"dependency_lock_hash\\\",\\n \\\"executable_artifact_hash\\\",\\\"runtime_environment_hash\\\",\\\"effective_config_hash\\\",\\\"deployed_at\\\",\\\"issued_at\\\",\\n \\\"authority_provider_id\\\",\\\"authority_receipt_hash\\\")}\\n if kwargs.get(\\\"feature_extractor_code_hash\\\"): payload[\\\"feature_extractor_code_hash\\\"]=kwargs[\\\"feature_extractor_code_hash\\\"]\\n return cls(attestation_id=canonical_hash(payload),**kwargs)\",\"source_sha256\":\"1b0ca84bb035dfb7ff441ce73bbe8ee5f140a07b4a821f5a9f55770b585ffac7\"},{\"name\":\"verify_final_deployment_attestations\",\"node\":\"FunctionDef\",\"path\":\"runtime_integrity.py\",\"source\":\"def verify_final_deployment_attestations(*, runtime_registry: RuntimeRegistry, producer_id: str,\\n predictor_runtime: \\\"PredictorRuntimeManifest\\\",\\n attestations: Sequence[DeploymentAttestation],\\n policy: DeploymentAttestationPolicy,\\n collection_start_at: datetime,\\n receipt_verifier: Callable[[DeploymentAttestation], bool]) -> None:\\n _aware(collection_start_at,\\\"collection_start_at\\\")\\n relevant_epochs=[e for e in runtime_registry.epochs if e.producer_id==producer_id and e.contains(collection_start_at)]\\n if len(relevant_epochs)!=1:\\n raise DemonovError(\\\"collection start must resolve to exactly one producer runtime epoch for deployment proof\\\")\\n epoch=relevant_epochs[0]\\n artifact=next((a for a in runtime_registry.artifacts if a.artifact_id==epoch.artifact_id),None)\\n if artifact is None: raise DemonovError(\\\"producer deployment proof references missing runtime artifact\\\")\\n expected={\\n (DeploymentSubjectKind.PRODUCER_RUNTIME_EPOCH,epoch.epoch_id):(\\n producer_id,artifact.source_tree_hash,artifact.dependency_lock_hash,artifact.executable_artifact_hash,\\n artifact.runtime_environment_hash,epoch.config_id,\\\"\\\",epoch.started_at),\\n (DeploymentSubjectKind.PREDICTOR_RUNTIME,predictor_runtime.predictor_runtime_id):(\\n predictor_runtime.consumer_id,predictor_runtime.source_tree_hash,predictor_runtime.dependency_lock_hash,\\n predictor_runtime.executable_artifact_hash,predictor_runtime.runtime_environment_hash,predictor_runtime.effective_config_hash,\\n predictor_runtime.feature_extractor_code_hash,predictor_runtime.started_at),\\n }\\n amap={(a.subject_kind,a.subject_id):a for a in attestations}\\n if len(amap)!=len(attestations): raise DemonovError(\\\"duplicate deployment attestation subject\\\")\\n if set(amap)!=set(expected): raise DemonovError(\\\"deployment attestation set differs from exact producer/predictor subjects\\\")\\n for key,(actor,src,dep,exe,env,cfg,feature,start) in expected.items():\\n a=amap[key]\\n if a.authority_provider_id!=policy.authority_provider_id or not receipt_verifier(a):\\n raise DemonovError(\\\"deployment attestation authority verification failed\\\")\\n if (a.actor_id,a.source_tree_hash,a.dependency_lock_hash,a.executable_artifact_hash,a.runtime_environment_hash,a.effective_config_hash)!=(actor,src,dep,exe,env,cfg):\\n raise DemonovError(\\\"deployment attestation artifact/config identity mismatch\\\")\\n if key[0] is DeploymentSubjectKind.PREDICTOR_RUNTIME and a.feature_extractor_code_hash!=feature:\\n raise DemonovError(\\\"predictor deployment attestation feature extractor mismatch\\\")\\n if key[0] is DeploymentSubjectKind.PRODUCER_RUNTIME_EPOCH and a.feature_extractor_code_hash:\\n raise DemonovError(\\\"producer deployment attestation must not invent challenger feature extractor\\\")\\n if abs((a.deployed_at-start).total_seconds()) > policy.max_start_skew_seconds:\\n raise DemonovError(\\\"deployment attestation outside frozen runtime-start skew\\\")\\n if policy.require_precollection_attestation and a.issued_at >= collection_start_at:\\n raise DemonovError(\\\"deployment attestation must be externally issued strictly before collection start\\\")\",\"source_sha256\":\"9fc5b8d032d6a7b31f6b4e21d15142fe20b1fde4fe30a06fb758ad264bdeac9d\"},{\"name\":\"PredictorRuntimeManifest\",\"node\":\"ClassDef\",\"path\":\"runtime_integrity.py\",\"source\":\"class PredictorRuntimeManifest:\\n predictor_runtime_id: str\\n consumer_id: str\\n source_tree_hash: str\\n dependency_lock_hash: str\\n runtime_environment_hash: str\\n executable_artifact_hash: str\\n effective_config_hash: str\\n final_model_registry_id: str\\n feature_extractor_code_hash: str\\n started_at: datetime\\n ended_at: datetime | None\\n deployment_receipt_hash: str\\n\\n def __post_init__(self) -> None:\\n _aware(self.started_at, \\\"predictor runtime started_at\\\")\\n if self.ended_at is not None:\\n _aware(self.ended_at, \\\"predictor runtime ended_at\\\")\\n if self.ended_at <= self.started_at: raise DemonovError(\\\"predictor runtime ended_at must follow started_at\\\")\\n if not self.consumer_id or not self.final_model_registry_id:\\n raise DemonovError(\\\"predictor runtime identity fields required\\\")\\n for n in (\\\"source_tree_hash\\\",\\\"dependency_lock_hash\\\",\\\"runtime_environment_hash\\\",\\\"executable_artifact_hash\\\",\\\"effective_config_hash\\\",\\\"feature_extractor_code_hash\\\",\\\"deployment_receipt_hash\\\"):\\n _hex64(getattr(self,n),n)\\n if self.predictor_runtime_id != self.content_hash:\\n raise DemonovError(\\\"predictor runtime id must be content-addressed\\\")\\n\\n @property\\n def content_hash(self) -> str:\\n return canonical_hash({k:getattr(self,k) for k in (\\n \\\"consumer_id\\\",\\\"source_tree_hash\\\",\\\"dependency_lock_hash\\\",\\\"runtime_environment_hash\\\",\\\"executable_artifact_hash\\\",\\\"effective_config_hash\\\",\\n \\\"final_model_registry_id\\\",\\\"feature_extractor_code_hash\\\",\\\"started_at\\\",\\\"ended_at\\\",\\\"deployment_receipt_hash\\\"\\n )})\\n\\n @classmethod\\n def build(cls, **kwargs) -> \\\"PredictorRuntimeManifest\\\":\\n payload={k:kwargs.get(k) for k in (\\n \\\"consumer_id\\\",\\\"source_tree_hash\\\",\\\"dependency_lock_hash\\\",\\\"runtime_environment_hash\\\",\\\"executable_artifact_hash\\\",\\\"effective_config_hash\\\",\\n \\\"final_model_registry_id\\\",\\\"feature_extractor_code_hash\\\",\\\"started_at\\\",\\\"ended_at\\\",\\\"deployment_receipt_hash\\\"\\n )}\\n return cls(predictor_runtime_id=canonical_hash(payload),**kwargs)\\n\\n def contains(self,t:datetime)->bool:\\n _aware(t,\\\"predictor runtime time\\\")\\n return self.started_at <= t and (self.ended_at is None or t < self.ended_at)\",\"source_sha256\":\"6514f10948abbeb0030fb06b509a8a75d796eea4d6ef4101b72e20f688985454\"},{\"name\":\"required_retained_hashes\",\"node\":\"FunctionDef\",\"path\":\"runtime_integrity.py\",\"source\":\"def required_retained_hashes(*, runtime_registry:RuntimeRegistry, model_registry:FinalModelRegistry,\\n state_snapshots:Sequence[StateSnapshotManifest]=(), predictor_runtime:PredictorRuntimeManifest | None=None)->Mapping[str,RetainedArtifactKind]:\\n \\\"\\\"\\\"Build the minimum blob-level replay corpus required by final prospective proof.\\n\\n Content-addressed policy objects remain in the handoff/registry. This function\\n targets blobs that cannot be reconstructed from identifiers alone.\\n \\\"\\\"\\\"\\n out:dict[str,RetainedArtifactKind]={}\\n for a in runtime_registry.artifacts:\\n out[a.source_tree_hash]=RetainedArtifactKind.SOURCE_TREE\\n out[a.dependency_lock_hash]=RetainedArtifactKind.DEPENDENCY_LOCK\\n out[a.build_recipe_hash]=RetainedArtifactKind.BUILD_RECIPE\\n out[a.executable_artifact_hash]=RetainedArtifactKind.EXECUTABLE_ARTIFACT\\n out[a.runtime_environment_hash]=RetainedArtifactKind.RUNTIME_ENVIRONMENT\\n for a in model_registry.artifacts:\\n out[a.model_freeze_hash]=RetainedArtifactKind.MODEL\\n out[a.transformer_freeze_hash]=RetainedArtifactKind.TRANSFORMER\\n out[a.calibration_freeze_hash]=RetainedArtifactKind.CALIBRATOR\\n out[a.feature_schema_hash]=RetainedArtifactKind.FEATURE_SCHEMA\\n out[a.feature_contract_hash]=RetainedArtifactKind.FEATURE_CONTRACT\\n out[a.training_data_hash]=RetainedArtifactKind.TRAINING_DATA\\n for s in state_snapshots:\\n out[s.serialized_state_hash]=RetainedArtifactKind.STATE_SNAPSHOT\\n if predictor_runtime is not None:\\n out[predictor_runtime.source_tree_hash]=RetainedArtifactKind.SOURCE_TREE\\n out[predictor_runtime.dependency_lock_hash]=RetainedArtifactKind.DEPENDENCY_LOCK\\n out[predictor_runtime.executable_artifact_hash]=RetainedArtifactKind.EXECUTABLE_ARTIFACT\\n out[predictor_runtime.runtime_environment_hash]=RetainedArtifactKind.RUNTIME_ENVIRONMENT\\n out[predictor_runtime.feature_extractor_code_hash]=RetainedArtifactKind.FEATURE_EXTRACTOR_CODE\\n out[predictor_runtime.effective_config_hash]=RetainedArtifactKind.EFFECTIVE_CONFIG\\n return out\",\"source_sha256\":\"ac6e18e76fcbd23144d1870ac03e3c2a4a1149dc4b5cf3f84fc0664228cdab1a\"},{\"name\":\"__post_init__\",\"node\":\"FunctionDef\",\"path\":\"runtime_integrity.py\",\"source\":\"def __post_init__(self) -> None:\\n for name in (\\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\"):\\n _hex64(getattr(self, name), name)\\n if self.artifact_id != self.content_hash:\\n raise DemonovError(\\\"runtime artifact id must be content-addressed\\\")\",\"source_sha256\":\"a7b5db332b3cd656bf1d8ec3b9fe7b0da2fcbddad84b529725384be99beea98a\"},{\"name\":\"content_hash\",\"node\":\"FunctionDef\",\"path\":\"runtime_integrity.py\",\"source\":\"def content_hash(self) -> str:\\n return canonical_hash({k: getattr(self, k) for k in (\\n \\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\"\\n )})\",\"source_sha256\":\"265c6eede8cfd8f93a315ea20905befdfb4f66947538978ef6e6013872668d94\"},{\"name\":\"build\",\"node\":\"FunctionDef\",\"path\":\"runtime_integrity.py\",\"source\":\"def build(cls, **kwargs) -> \\\"RuntimeArtifactManifest\\\":\\n payload = {k: kwargs[k] for k in (\\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\")}\\n return cls(artifact_id=canonical_hash(payload), **kwargs)\",\"source_sha256\":\"f4859325ffab449c366e56333f48078b1a221897653cdc2a348eea73fdd8ba28\"},{\"name\":\"__post_init__\",\"node\":\"FunctionDef\",\"path\":\"runtime_integrity.py\",\"source\":\"def __post_init__(self) -> None:\\n _aware(self.deployed_at, \\\"deployment deployed_at\\\"); _aware(self.issued_at, \\\"deployment issued_at\\\")\\n if self.issued_at < self.deployed_at:\\n raise DemonovError(\\\"deployment attestation cannot be issued before deployment\\\")\\n if not self.actor_id or not self.authority_provider_id:\\n raise DemonovError(\\\"deployment attestation identity fields are required\\\")\\n for n in (\\\"subject_id\\\",\\\"source_tree_hash\\\",\\\"dependency_lock_hash\\\",\\\"executable_artifact_hash\\\",\\n \\\"runtime_environment_hash\\\",\\\"effective_config_hash\\\",\\\"authority_receipt_hash\\\"):\\n _hex64(getattr(self,n),n)\\n if self.feature_extractor_code_hash: _hex64(self.feature_extractor_code_hash,\\\"feature_extractor_code_hash\\\")\\n if self.attestation_id != self.content_hash:\\n raise DemonovError(\\\"deployment attestation id must be content-addressed\\\")\",\"source_sha256\":\"a98af80953a22a18bb46c75e43b09921d13d2c60d952a2d111fdd663345f1b7a\"},{\"name\":\"content_hash\",\"node\":\"FunctionDef\",\"path\":\"runtime_integrity.py\",\"source\":\"def content_hash(self) -> str:\\n payload={\\\"subject_kind\\\":self.subject_kind,\\\"subject_id\\\":self.subject_id,\\\"actor_id\\\":self.actor_id,\\n \\\"source_tree_hash\\\":self.source_tree_hash,\\\"dependency_lock_hash\\\":self.dependency_lock_hash,\\n \\\"executable_artifact_hash\\\":self.executable_artifact_hash,\\\"runtime_environment_hash\\\":self.runtime_environment_hash,\\n \\\"effective_config_hash\\\":self.effective_config_hash,\\\"deployed_at\\\":self.deployed_at,\\\"issued_at\\\":self.issued_at,\\n \\\"authority_provider_id\\\":self.authority_provider_id,\\\"authority_receipt_hash\\\":self.authority_receipt_hash}\\n if self.feature_extractor_code_hash: payload[\\\"feature_extractor_code_hash\\\"]=self.feature_extractor_code_hash\\n return canonical_hash(payload)\",\"source_sha256\":\"544b46e605c9a988693451af639cce42e20f359ae9dd69baa47b3780e4525ed1\"},{\"name\":\"build\",\"node\":\"FunctionDef\",\"path\":\"runtime_integrity.py\",\"source\":\"def build(cls, **kwargs) -> \\\"DeploymentAttestation\\\":\\n payload={k:kwargs[k] for k in (\\\"subject_kind\\\",\\\"subject_id\\\",\\\"actor_id\\\",\\\"source_tree_hash\\\",\\\"dependency_lock_hash\\\",\\n \\\"executable_artifact_hash\\\",\\\"runtime_environment_hash\\\",\\\"effective_config_hash\\\",\\\"deployed_at\\\",\\\"issued_at\\\",\\n \\\"authority_provider_id\\\",\\\"authority_receipt_hash\\\")}\\n if kwargs.get(\\\"feature_extractor_code_hash\\\"): payload[\\\"feature_extractor_code_hash\\\"]=kwargs[\\\"feature_extractor_code_hash\\\"]\\n return cls(attestation_id=canonical_hash(payload),**kwargs)\",\"source_sha256\":\"58286208dcbf95fffbf6775c550cbb0e4cb2eee55a6e89610d3c55cf6a57183c\"},{\"name\":\"__post_init__\",\"node\":\"FunctionDef\",\"path\":\"runtime_integrity.py\",\"source\":\"def __post_init__(self) -> None:\\n _aware(self.started_at, \\\"predictor runtime started_at\\\")\\n if self.ended_at is not None:\\n _aware(self.ended_at, \\\"predictor runtime ended_at\\\")\\n if self.ended_at <= self.started_at: raise DemonovError(\\\"predictor runtime ended_at must follow started_at\\\")\\n if not self.consumer_id or not self.final_model_registry_id:\\n raise DemonovError(\\\"predictor runtime identity fields required\\\")\\n for n in (\\\"source_tree_hash\\\",\\\"dependency_lock_hash\\\",\\\"runtime_environment_hash\\\",\\\"executable_artifact_hash\\\",\\\"effective_config_hash\\\",\\\"feature_extractor_code_hash\\\",\\\"deployment_receipt_hash\\\"):\\n _hex64(getattr(self,n),n)\\n if self.predictor_runtime_id != self.content_hash:\\n raise DemonovError(\\\"predictor runtime id must be content-addressed\\\")\",\"source_sha256\":\"6387ddecd12c2c2af99dd5d683b4e12d35b045cf938d3ee15f672f1b1a67795f\"},{\"name\":\"content_hash\",\"node\":\"FunctionDef\",\"path\":\"runtime_integrity.py\",\"source\":\"def content_hash(self) -> str:\\n return canonical_hash({k:getattr(self,k) for k in (\\n \\\"consumer_id\\\",\\\"source_tree_hash\\\",\\\"dependency_lock_hash\\\",\\\"runtime_environment_hash\\\",\\\"executable_artifact_hash\\\",\\\"effective_config_hash\\\",\\n \\\"final_model_registry_id\\\",\\\"feature_extractor_code_hash\\\",\\\"started_at\\\",\\\"ended_at\\\",\\\"deployment_receipt_hash\\\"\\n )})\",\"source_sha256\":\"df6127715e3a641101bfec75454672d73e712342aa989fa0b674c865d3d4424d\"},{\"name\":\"build\",\"node\":\"FunctionDef\",\"path\":\"runtime_integrity.py\",\"source\":\"def build(cls, **kwargs) -> \\\"PredictorRuntimeManifest\\\":\\n payload={k:kwargs.get(k) for k in (\\n \\\"consumer_id\\\",\\\"source_tree_hash\\\",\\\"dependency_lock_hash\\\",\\\"runtime_environment_hash\\\",\\\"executable_artifact_hash\\\",\\\"effective_config_hash\\\",\\n \\\"final_model_registry_id\\\",\\\"feature_extractor_code_hash\\\",\\\"started_at\\\",\\\"ended_at\\\",\\\"deployment_receipt_hash\\\"\\n )}\\n return cls(predictor_runtime_id=canonical_hash(payload),**kwargs)\",\"source_sha256\":\"320b24f7f9b26161be45b818701ca5f9e0ec55be2b1ade043dbcd6c3df656f2b\"}],\"content_hash\":\"def content_hash(self) -> str:\\n return canonical_hash({k: getattr(self, k) for k in (\\n \\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\"\\n )})\",\"fields\":[\"artifact_id\",\"source_tree_hash\",\"dependency_lock_hash\",\"build_recipe_hash\",\"executable_artifact_hash\",\"runtime_environment_hash\"],\"formula\":null,\"post_init\":\"def __post_init__(self) -> None:\\n for name in (\\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\"):\\n _hex64(getattr(self, name), name)\\n if self.artifact_id != self.content_hash:\\n raise DemonovError(\\\"runtime artifact id must be content-addressed\\\")\"}\nSB043K_OLD_ARTIFACT_INPUTS={\"base_image_id\":\"sha256:008ab480142056d1f0b628e6c17bb6b99b30b8b4f59f24e31d972a4a128a8602\",\"base_image_ref\":\"8020-demonov-shadow:ac7094a76ddc06f376d71a76432af7c2dd10ec7d\",\"candidate_pool\":{\"base_image_id\":\"008ab480142056d1f0b628e6c17bb6b99b30b8b4f59f24e31d972a4a128a8602\",\"base_rootfs_layers_canonical\":\"caf591ce9164d30a1fa64b2ca25d9728b116468c9410a883543bf3d696f3ced1\",\"compose_sha256\":\"6461532b0a04decc60fe1d1885990020e886d40de40c0523e34e2849600af061\",\"dockerfile_sha256\":\"901951def73961f76d2c2a93c5428a0fbdcc50113d42b39da92983a5ce157cb8\",\"file:runtime_integrity.py\":\"99859b63e23d10fc051672965123f49d6e79d2ff767871c019ff7bdae2e2e39e\",\"file:runtime_manifest.py\":\"1064cfb74303fdc8e0bf50bae95b1e755556a5b1dfc28b2b062341becaba08f2\",\"old_application_image_id\":\"403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736\",\"old_dir_canonical_list_full\":\"af83cb6b6b1b0f01f5453bd2dd6048c42b1f194bee6f6323b91e90efec30ef1f\",\"old_dir_canonical_list_sha\":\"708d044de397034bcdde99398f1014aceee0e9f58a7870e459c6d57879e2b552\",\"old_dir_canonical_path_sha\":\"d32002a8dd2b78e63ac30bef3f1c8b4c18373509c98c92173a9f82386f53afd4\",\"old_dir_canonical_path_size_sha\":\"0c7eac692accfd22113cebffb7897863370052731578418a5103e4004b749c7c\",\"old_dir_concat_path_sha\":\"3a0e01804936792ff9159b896d17b5bcd2b0b0d61eacb331fd93ccaceb5411df\",\"old_dir_concat_sha\":\"b39e64671adfa8a6cfac27ff4bac745ee5dc5b0b90d28f1a9e24b48de307e6ae\",\"old_image_config\":\"403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736\",\"old_image_config_canonical\":\"27884bcdb5825bb3f2207da59a46451dac4e65a34b6af18db04266607e151d0e\",\"old_image_id\":\"403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736\",\"old_rootfs_layers_canonical\":\"624aba0d14a23d453be78b45a360bfa5c724ddd3d01946930f8a76a4341d17fa\",\"old_tar_canonical_list_full\":\"43b6ae1658ff777a219266ce66f2de7d8f9f3d9b3c8428f5d11b0c90aff6a581\",\"old_tar_canonical_list_sha\":\"c6a1b005a330a0e5a73658fcbf7557a0645b1fca9fa05fe87955c26c06d1e4ac\",\"old_tar_canonical_path_sha\":\"3b7df8cf67359efaa32f20d35a23636fe24a2a0f0f74d465c234eb92c6496733\",\"old_tar_canonical_path_size_sha\":\"0579c2e9c3cfbacf9db2c6d7b1a05705305e63e130a74f89ff42d01fc5802b0f\",\"old_tar_concat_path_sha\":\"dc1843e1ada353efcb935031b5783a677d5656310700c83e885c688829406f91\",\"old_tar_concat_sha\":\"b39e64671adfa8a6cfac27ff4bac745ee5dc5b0b90d28f1a9e24b48de307e6ae\",\"old_tar_strip_canonical_list_full\":\"af83cb6b6b1b0f01f5453bd2dd6048c42b1f194bee6f6323b91e90efec30ef1f\",\"old_tar_strip_canonical_list_sha\":\"708d044de397034bcdde99398f1014aceee0e9f58a7870e459c6d57879e2b552\",\"old_tar_strip_canonical_path_sha\":\"d32002a8dd2b78e63ac30bef3f1c8b4c18373509c98c92173a9f82386f53afd4\",\"old_tar_strip_canonical_path_size_sha\":\"0c7eac692accfd22113cebffb7897863370052731578418a5103e4004b749c7c\",\"old_tar_strip_concat_path_sha\":\"3a0e01804936792ff9159b896d17b5bcd2b0b0d61eacb331fd93ccaceb5411df\",\"old_tar_strip_concat_sha\":\"b39e64671adfa8a6cfac27ff4bac745ee5dc5b0b90d28f1a9e24b48de307e6ae\",\"package_gzip_sha256\":\"389e7aabca8887ee3b48b6ff0b4affe1163216005a4888013d9ccc82ea360e32\",\"package_tar_sha256\":\"431ddf9e8938d5e583553f05f9e3d019aff0b439c83b0b23c81808073b7d61a8\"},\"old_image_id\":\"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736\",\"old_manifest\":{\"application_image_id\":\"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736\",\"base_image_digest\":\"sha256:881d80734ee05dca6f7f42dcb080975652a53c7eda9ba1f03bb8da31aa6a6ec2\",\"code_identity\":\"e32760c69a4311728db9066ee8bf2bf66b1e5a70\",\"compose_hash\":\"6461532b0a04decc60fe1d1885990020e886d40de40c0523e34e2849600af061\",\"finality_policy_id\":\"BITFINEX_SEQ_ALL_D1_V1\",\"package_identity\":\"637acba19fb29c98408a8031dc9265a31dc36551c666fcf0b287e8af83d2b893\",\"runtime_manifest_id\":\"58d3b59200bdc0eb8d448612679d667b194263586cb3198dfc08597935053a1a\"},\"old_package_identity\":\"637acba19fb29c98408a8031dc9265a31dc36551c666fcf0b287e8af83d2b893\",\"tar_meta\":{\"gzip_bytes\":208049,\"gzip_sha256\":\"389e7aabca8887ee3b48b6ff0b4affe1163216005a4888013d9ccc82ea360e32\",\"tar_bytes\":1157120,\"tar_sha256\":\"431ddf9e8938d5e583553f05f9e3d019aff0b439c83b0b23c81808073b7d61a8\"}}\nSB043K_REPRODUCTION=[]\nSB043K_OLD_DEPLOY_REFERENCES=[{\"path\":\"demonov_forward_map/__init__.py\",\"snippets\":[\" ClockDomainKind, ClockDomainSpec, ClockDomainRegistry, ClockSynchronizationPolicy, ClockAttestation,\",\" verify_clock_synchronization, WindowClockClassification, classify_event_time_with_clock_guard,\",\" FrozenConfigMapping, EffectiveConfigSnapshot, RuntimeArtifactManifest, RuntimeEpoch, RuntimeRegistry,\",\" ProducerSessionDeclaration, ProducerSessionCatalog, CollectorTopologyPolicy, CollectorReceiptRecord,\",\" CollectorReceiptStore, AuthoritativeProducerWatermark, CaptureCompletenessPolicy, verify_capture_through_watermark,\"]},{\"path\":\"demonov_forward_map/runtime_integrity.py\",\"snippets\":[\"\",\"@dataclass(frozen=True)\",\"class RuntimeArtifactManifest:\",\" artifact_id: str\",\" source_tree_hash: str\",\"class RuntimeArtifactManifest:\",\" artifact_id: str\",\" source_tree_hash: str\",\" dependency_lock_hash: str\",\" build_recipe_hash: str\",\" artifact_id: str\",\" source_tree_hash: str\",\" dependency_lock_hash: str\",\" build_recipe_hash: str\",\" executable_artifact_hash: str\",\" source_tree_hash: str\",\" dependency_lock_hash: str\",\" build_recipe_hash: str\",\" executable_artifact_hash: str\",\" runtime_environment_hash: str\",\" dependency_lock_hash: str\",\" build_recipe_hash: str\",\" executable_artifact_hash: str\",\" runtime_environment_hash: str\",\"\",\"\",\" def __post_init__(self) -> None:\",\" for name in (\\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\"):\",\" _hex64(getattr(self, name), name)\",\" if self.artifact_id != self.content_hash:\",\" def content_hash(self) -> str:\",\" return canonical_hash({k: getattr(self, k) for k in (\",\" \\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\"\",\" )})\",\"\",\"\",\" @classmethod\",\" def build(cls, **kwargs) -> \\\"RuntimeArtifactManifest\\\":\",\" payload = {k: kwargs[k] for k in (\\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\")}\",\" return cls(artifact_id=canonical_hash(payload), **kwargs)\",\" @classmethod\",\" def build(cls, **kwargs) -> \\\"RuntimeArtifactManifest\\\":\",\" payload = {k: kwargs[k] for k in (\\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\")}\",\" return cls(artifact_id=canonical_hash(payload), **kwargs)\",\"\",\"class RuntimeRegistry:\",\" registry_id: str\",\" artifacts: Tuple[RuntimeArtifactManifest, ...]\",\" configs: Tuple[EffectiveConfigSnapshot, ...]\",\" epochs: Tuple[RuntimeEpoch, ...]\",\" for e in self.epochs:\",\" if e.artifact_id not in amap or e.config_id not in cmap: raise DemonovError(\\\"runtime epoch references missing artifact/config\\\")\",\" if e.producer_code_hash != amap[e.artifact_id].source_tree_hash:\",\" raise DemonovError(\\\"runtime epoch producer_code_hash must equal frozen artifact source_tree_hash\\\")\",\" # No overlapping epochs per producer; otherwise event->runtime binding is ambiguous.\",\" if e.artifact_id not in amap or e.config_id not in cmap: raise DemonovError(\\\"runtime epoch references missing artifact/config\\\")\",\" if e.producer_code_hash != amap[e.artifact_id].source_tree_hash:\",\" raise DemonovError(\\\"runtime epoch producer_code_hash must equal frozen artifact source_tree_hash\\\")\",\" # No overlapping epochs per producer; otherwise event->runtime binding is ambiguous.\",\" for producer in {e.producer_id for e in self.epochs}:\",\"\",\" @classmethod\",\" def build(cls, *, artifacts: Iterable[RuntimeArtifactManifest], configs: Iterable[EffectiveConfigSnapshot], epochs: Iterable[RuntimeEpoch]) -> \\\"RuntimeRegistry\\\":\",\" a, c, e = tuple(artifacts), tuple(configs), tuple(epochs)\",\" payload = {\\\"artifacts\\\": tuple(sorted(x.artifact_id for x in a)), \\\"configs\\\": tuple(sorted(x.config_id for x in c)), \\\"epochs\\\": tuple(sorted(x.epoch_id for x in e))}\",\" subject_id: str\",\" actor_id: str\",\" source_tree_hash: str\",\" dependency_lock_hash: str\",\" executable_artifact_hash: str\",\" actor_id: str\",\" source_tree_hash: str\",\" dependency_lock_hash: str\",\" executable_artifact_hash: str\",\" runtime_environment_hash: str\",\" source_tree_hash: str\",\" dependency_lock_hash: str\",\" executable_artifact_hash: str\",\" runtime_environment_hash: str\",\" effective_config_hash: str\"]},{\"path\":\"runtime_manifest.json\",\"snippets\":[\" \\\"compose_hash\\\": \\\"6461532b0a04decc60fe1d1885990020e886d40de40c0523e34e2849600af061\\\",\",\" \\\"finality_policy_id\\\": \\\"BITFINEX_SEQ_ALL_D1_V1\\\",\",\" \\\"package_identity\\\": \\\"637acba19fb29c98408a8031dc9265a31dc36551c666fcf0b287e8af83d2b893\\\",\",\" \\\"runtime_manifest_id\\\": \\\"58d3b59200bdc0eb8d448612679d667b194263586cb3198dfc08597935053a1a\\\"\",\"}\"]}]\nSB043K_SOURCE_COUNTS={\"new_files\":57,\"old_files\":57}\nSB043K_HOLDS=[\"ARTIFACT_CONTENT_HASH_FORMULA_NOT_EXTRACTED\",\"OLD_PACKAGE_ID_NOT_REPRODUCED\"]\nSB043K_DECISION=HOLD_ARTIFACT_CONTENT_HASH_FORMULA_NOT_EXTRACTED__OLD_PACKAGE_ID_NOT_REPRODUCED\nSB043K_MUTATION_SCOPE=NONE_READ_ONLY\nSIGNALBOT043K_DECISION=HOLD_GUEST_PACKAGE_RCA\n" +} diff --git a/runtime/history/SIGNALBOT-260908-PACKAGE-SEAL-RCA-043PKG.txt b/runtime/history/SIGNALBOT-260908-PACKAGE-SEAL-RCA-043PKG.txt new file mode 100644 index 00000000..1e68d0b6 --- /dev/null +++ b/runtime/history/SIGNALBOT-260908-PACKAGE-SEAL-RCA-043PKG.txt @@ -0,0 +1,45 @@ +CHAT_OUTPUT_BEGIN +COMMAND_ID=SIGNALBOT-260908-PACKAGE-SEAL-RCA-043PKG +STATUS=FAIL +RC=3 +HOST=pve01 +MODE=read-only +COMPONENT=signalbot-cr0116-package-seal-rca +REFERENCE_REGISTER_CHECK=OK +REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66 +ERROR_REGISTER_CHECK=OK +ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0 +COMMAND_SHA256=08ece8490c12004f2f6511bfb5dbcef29ab38d4385dbb224a48ba5d4a3dbfbaf +DUPLICATE_FAILED_COMMAND_BLOCKED=false +EXECUTION_STARTED=true +CHANGE_DECLARED=false +RESULT_CONTRACT_VALID=true +RESULT_CONTRACT_STATUS=NOT_APPLICABLE +RESULT_CONTRACT_ERROR=NONE +COMMAND_RC=3 +CHANGES_MADE=false +ROLLBACK_STARTED=false +ROLLBACK_RESTORED=null +MUTATION_OUTCOME=NO_MUTATION +SANITIZED=yes +SECRETS_INCLUDED=no +PRIVATE_ADDRESSES_INCLUDED=no +RAW_EVIDENCE_SHA256=5a54891c071a17faf298b6f4df768f618290aac210aadeb4e5117d67b35ab713 +SANITIZED_OUTPUT_SHA256=5a54891c071a17faf298b6f4df768f618290aac210aadeb4e5117d67b35ab713 +OUTPUT_BEGIN +ERROR_REGISTER_CHECK=OK +REFERENCE_CHECK=OK +AUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED +SB043K_PRESTATE={"active_env":{"APP_IMAGE":"8020-demonov-shadow:e32760c69a4311728db9066ee8bf2bf66b1e5a70","CODE_IDENTITY":"e32760c69a4311728db9066ee8bf2bf66b1e5a70","COLLECTION_START_AT":"2026-09-07T00:00:00+00:00","EXPERIMENT_ID":"ec477ea41ecbd5cfdef5afc259595aab20674a7d933f41a389329ff05098b338","RUNTIME_MANIFEST_ID":"58d3b59200bdc0eb8d448612679d667b194263586cb3198dfc08597935053a1a"},"services":[{"container_id":"a546a70c3e8c263d9b590cd78ee206bcda0cfcdb6662327e8415ca0e29ad1501","image":"8020-demonov-shadow:e32760c69a4311728db9066ee8bf2bf66b1e5a70","image_id":"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736","restart_count":14,"running":true,"service":"collector","started_at":"2026-09-08T07:38:09.79483772Z"},{"container_id":"d8023f4cbf91f9382e39eec0436c9cebc7665535b42b950e95408c03ff9bf30d","image":"8020-demonov-shadow:e32760c69a4311728db9066ee8bf2bf66b1e5a70","image_id":"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736","restart_count":0,"running":true,"service":"relay","started_at":"2026-09-06T18:48:20.603414848Z"},{"container_id":"1feeca2d9428cd5a277c026bef34534db307657dcdcd63aff98ea66e44f8b9c5","image":"8020-demonov-shadow:e32760c69a4311728db9066ee8bf2bf66b1e5a70","image_id":"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736","restart_count":0,"running":true,"service":"shadow","started_at":"2026-09-06T18:48:20.768190553Z"},{"container_id":"889be41d2cee9d327811da78388f834ba6eafe4c0eeae456867ed0df76832d01","image":"8020-demonov-shadow:e32760c69a4311728db9066ee8bf2bf66b1e5a70","image_id":"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736","restart_count":0,"running":true,"service":"worker","started_at":"2026-09-06T18:48:20.586788319Z"}],"stage_result":{"active_env_unchanged":true,"build_context":"/opt/stacks/8020-demonov-shadow/.deploy/SIGNALBOT-260908-DEPLOY-STAGE-042FIX5","collector_source_sha256":"193dd0c7f9890fdb4026c24dbc5add825f1641d92097e881806705ca452812d5","copy_source":"/opt/stacks/8020-demonov-shadow/.deploy/SIGNALBOT-260908-DEPLOY-STAGE-042FIX5/demonov_forward_map","decision":"DEPLOY_STAGE_READY","dockerfile":"/opt/stacks/8020-demonov-shadow/.deploy/SIGNALBOT-260908-DEPLOY-STAGE-042FIX5/Dockerfile","helper_candidates":{"demonov_forward_map.live_prospective":[{"name":"_hash","pure_candidate":true,"signature":"(value: 'object') -> 'str'"}],"demonov_forward_map.runtime_integrity":[{"name":"canonical_hash","pure_candidate":true,"signature":"(payload: 'Any') -> 'str'"},{"name":"verify_experiment_seal_receipt","pure_candidate":true,"signature":"(*, bundle: 'FinalProspectiveSealBundle', receipt: 'ExperimentSealReceipt', collection_start_at: 'datetime', receipt_verifier: 'Callable[[ExperimentSealReceipt], bool]') -> 'None'"},{"name":"required_retained_hashes","pure_candidate":true,"signature":"(*, runtime_registry: 'RuntimeRegistry', model_registry: 'FinalModelRegistry', state_snapshots: 'Sequence[StateSnapshotManifest]' = (), predictor_runtime: 'PredictorRuntimeManifest | None' = None) -> 'Mapping[str, RetainedArtifactKind]'"}],"demonov_forward_map.runtime_manifest":[{"name":"canonical_hash","pure_candidate":true,"signature":"(payload: 'Any') -> 'str'"},{"name":"verify_runtime_manifest","pure_candidate":true,"signature":"(manifest: 'RuntimeDeploymentManifestV1', *, expected_code_identity: 'str', actual_image_id: 'str', actual_package_identity: 'str') -> 'None'"}]},"new_image":"8020-demonov-shadow:76e1f58baa544a0e208bba317f0150e5b6d74dbd","new_image_id":"sha256:341f71a906c91d3fa9c1d50bd89df2a849dfb0b168bb4551efb444bf61c4ab99","policy":{"close_timeout":5,"open_timeout":10,"ping_interval":20,"ping_timeout":60},"runtime_activated":false,"service_identity_unchanged":true,"stage_path":"/opt/stacks/8020-demonov-shadow/.deploy/SIGNALBOT-260908-DEPLOY-STAGE-042FIX5","websockets_version":"15.0.1"}} +SB043K_ARTIFACT_CLASS={"constructors":[{"name":"RuntimeArtifactManifest","node":"ClassDef","path":"runtime_integrity.py","source":"class RuntimeArtifactManifest:\n artifact_id: str\n source_tree_hash: str\n dependency_lock_hash: str\n build_recipe_hash: str\n executable_artifact_hash: str\n runtime_environment_hash: str\n\n def __post_init__(self) -> None:\n for name in (\"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\"):\n _hex64(getattr(self, name), name)\n if self.artifact_id != self.content_hash:\n raise DemonovError(\"runtime artifact id must be content-addressed\")\n\n @property\n def content_hash(self) -> str:\n return canonical_hash({k: getattr(self, k) for k in (\n \"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\"\n )})\n\n @classmethod\n def build(cls, **kwargs) -> \"RuntimeArtifactManifest\":\n payload = {k: kwargs[k] for k in (\"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\")}\n return cls(artifact_id=canonical_hash(payload), **kwargs)","source_sha256":"8cd1ebf70c003cd4d7b91f18602841426b19c2f54f2d803309c53c22f38cd5c7"},{"name":"DeploymentAttestation","node":"ClassDef","path":"runtime_integrity.py","source":"class DeploymentAttestation:\n attestation_id: str\n subject_kind: DeploymentSubjectKind\n subject_id: str\n actor_id: str\n source_tree_hash: str\n dependency_lock_hash: str\n executable_artifact_hash: str\n runtime_environment_hash: str\n effective_config_hash: str\n deployed_at: datetime\n issued_at: datetime\n authority_provider_id: str\n authority_receipt_hash: str\n feature_extractor_code_hash: str = \"\"\n\n def __post_init__(self) -> None:\n _aware(self.deployed_at, \"deployment deployed_at\"); _aware(self.issued_at, \"deployment issued_at\")\n if self.issued_at < self.deployed_at:\n raise DemonovError(\"deployment attestation cannot be issued before deployment\")\n if not self.actor_id or not self.authority_provider_id:\n raise DemonovError(\"deployment attestation identity fields are required\")\n for n in (\"subject_id\",\"source_tree_hash\",\"dependency_lock_hash\",\"executable_artifact_hash\",\n \"runtime_environment_hash\",\"effective_config_hash\",\"authority_receipt_hash\"):\n _hex64(getattr(self,n),n)\n if self.feature_extractor_code_hash: _hex64(self.feature_extractor_code_hash,\"feature_extractor_code_hash\")\n if self.attestation_id != self.content_hash:\n raise DemonovError(\"deployment attestation id must be content-addressed\")\n\n @property\n def content_hash(self) -> str:\n payload={\"subject_kind\":self.subject_kind,\"subject_id\":self.subject_id,\"actor_id\":self.actor_id,\n \"source_tree_hash\":self.source_tree_hash,\"dependency_lock_hash\":self.dependency_lock_hash,\n \"executable_artifact_hash\":self.executable_artifact_hash,\"runtime_environment_hash\":self.runtime_environment_hash,\n \"effective_config_hash\":self.effective_config_hash,\"deployed_at\":self.deployed_at,\"issued_at\":self.issued_at,\n \"authority_provider_id\":self.authority_provider_id,\"authority_receipt_hash\":self.authority_receipt_hash}\n if self.feature_extractor_code_hash: payload[\"feature_extractor_code_hash\"]=self.feature_extractor_code_hash\n return canonical_hash(payload)\n\n @classmethod\n def build(cls, **kwargs) -> \"DeploymentAttestation\":\n payload={k:kwargs[k] for k in (\"subject_kind\",\"subject_id\",\"actor_id\",\"source_tree_hash\",\"dependency_lock_hash\",\n \"executable_artifact_hash\",\"runtime_environment_hash\",\"effective_config_hash\",\"deployed_at\",\"issued_at\",\n \"authority_provider_id\",\"authority_receipt_hash\")}\n if kwargs.get(\"feature_extractor_code_hash\"): payload[\"feature_extractor_code_hash\"]=kwargs[\"feature_extractor_code_hash\"]\n return cls(attestation_id=canonical_hash(payload),**kwargs)","source_sha256":"1b0ca84bb035dfb7ff441ce73bbe8ee5f140a07b4a821f5a9f55770b585ffac7"},{"name":"verify_final_deployment_attestations","node":"FunctionDef","path":"runtime_integrity.py","source":"def verify_final_deployment_attestations(*, runtime_registry: RuntimeRegistry, producer_id: str,\n predictor_runtime: \"PredictorRuntimeManifest\",\n attestations: Sequence[DeploymentAttestation],\n policy: DeploymentAttestationPolicy,\n collection_start_at: datetime,\n receipt_verifier: Callable[[DeploymentAttestation], bool]) -> None:\n _aware(collection_start_at,\"collection_start_at\")\n relevant_epochs=[e for e in runtime_registry.epochs if e.producer_id==producer_id and e.contains(collection_start_at)]\n if len(relevant_epochs)!=1:\n raise DemonovError(\"collection start must resolve to exactly one producer runtime epoch for deployment proof\")\n epoch=relevant_epochs[0]\n artifact=next((a for a in runtime_registry.artifacts if a.artifact_id==epoch.artifact_id),None)\n if artifact is None: raise DemonovError(\"producer deployment proof references missing runtime artifact\")\n expected={\n (DeploymentSubjectKind.PRODUCER_RUNTIME_EPOCH,epoch.epoch_id):(\n producer_id,artifact.source_tree_hash,artifact.dependency_lock_hash,artifact.executable_artifact_hash,\n artifact.runtime_environment_hash,epoch.config_id,\"\",epoch.started_at),\n (DeploymentSubjectKind.PREDICTOR_RUNTIME,predictor_runtime.predictor_runtime_id):(\n predictor_runtime.consumer_id,predictor_runtime.source_tree_hash,predictor_runtime.dependency_lock_hash,\n predictor_runtime.executable_artifact_hash,predictor_runtime.runtime_environment_hash,predictor_runtime.effective_config_hash,\n predictor_runtime.feature_extractor_code_hash,predictor_runtime.started_at),\n }\n amap={(a.subject_kind,a.subject_id):a for a in attestations}\n if len(amap)!=len(attestations): raise DemonovError(\"duplicate deployment attestation subject\")\n if set(amap)!=set(expected): raise DemonovError(\"deployment attestation set differs from exact producer/predictor subjects\")\n for key,(actor,src,dep,exe,env,cfg,feature,start) in expected.items():\n a=amap[key]\n if a.authority_provider_id!=policy.authority_provider_id or not receipt_verifier(a):\n raise DemonovError(\"deployment attestation authority verification failed\")\n if (a.actor_id,a.source_tree_hash,a.dependency_lock_hash,a.executable_artifact_hash,a.runtime_environment_hash,a.effective_config_hash)!=(actor,src,dep,exe,env,cfg):\n raise DemonovError(\"deployment attestation artifact/config identity mismatch\")\n if key[0] is DeploymentSubjectKind.PREDICTOR_RUNTIME and a.feature_extractor_code_hash!=feature:\n raise DemonovError(\"predictor deployment attestation feature extractor mismatch\")\n if key[0] is DeploymentSubjectKind.PRODUCER_RUNTIME_EPOCH and a.feature_extractor_code_hash:\n raise DemonovError(\"producer deployment attestation must not invent challenger feature extractor\")\n if abs((a.deployed_at-start).total_seconds()) > policy.max_start_skew_seconds:\n raise DemonovError(\"deployment attestation outside frozen runtime-start skew\")\n if policy.require_precollection_attestation and a.issued_at >= collection_start_at:\n raise DemonovError(\"deployment attestation must be externally issued strictly before collection start\")","source_sha256":"9fc5b8d032d6a7b31f6b4e21d15142fe20b1fde4fe30a06fb758ad264bdeac9d"},{"name":"PredictorRuntimeManifest","node":"ClassDef","path":"runtime_integrity.py","source":"class PredictorRuntimeManifest:\n predictor_runtime_id: str\n consumer_id: str\n source_tree_hash: str\n dependency_lock_hash: str\n runtime_environment_hash: str\n executable_artifact_hash: str\n effective_config_hash: str\n final_model_registry_id: str\n feature_extractor_code_hash: str\n started_at: datetime\n ended_at: datetime | None\n deployment_receipt_hash: str\n\n def __post_init__(self) -> None:\n _aware(self.started_at, \"predictor runtime started_at\")\n if self.ended_at is not None:\n _aware(self.ended_at, \"predictor runtime ended_at\")\n if self.ended_at <= self.started_at: raise DemonovError(\"predictor runtime ended_at must follow started_at\")\n if not self.consumer_id or not self.final_model_registry_id:\n raise DemonovError(\"predictor runtime identity fields required\")\n for n in (\"source_tree_hash\",\"dependency_lock_hash\",\"runtime_environment_hash\",\"executable_artifact_hash\",\"effective_config_hash\",\"feature_extractor_code_hash\",\"deployment_receipt_hash\"):\n _hex64(getattr(self,n),n)\n if self.predictor_runtime_id != self.content_hash:\n raise DemonovError(\"predictor runtime id must be content-addressed\")\n\n @property\n def content_hash(self) -> str:\n return canonical_hash({k:getattr(self,k) for k in (\n \"consumer_id\",\"source_tree_hash\",\"dependency_lock_hash\",\"runtime_environment_hash\",\"executable_artifact_hash\",\"effective_config_hash\",\n \"final_model_registry_id\",\"feature_extractor_code_hash\",\"started_at\",\"ended_at\",\"deployment_receipt_hash\"\n )})\n\n @classmethod\n def build(cls, **kwargs) -> \"PredictorRuntimeManifest\":\n payload={k:kwargs.get(k) for k in (\n \"consumer_id\",\"source_tree_hash\",\"dependency_lock_hash\",\"runtime_environment_hash\",\"executable_artifact_hash\",\"effective_config_hash\",\n \"final_model_registry_id\",\"feature_extractor_code_hash\",\"started_at\",\"ended_at\",\"deployment_receipt_hash\"\n )}\n return cls(predictor_runtime_id=canonical_hash(payload),**kwargs)\n\n def contains(self,t:datetime)->bool:\n _aware(t,\"predictor runtime time\")\n return self.started_at <= t and (self.ended_at is None or t < self.ended_at)","source_sha256":"6514f10948abbeb0030fb06b509a8a75d796eea4d6ef4101b72e20f688985454"},{"name":"required_retained_hashes","node":"FunctionDef","path":"runtime_integrity.py","source":"def required_retained_hashes(*, runtime_registry:RuntimeRegistry, model_registry:FinalModelRegistry,\n state_snapshots:Sequence[StateSnapshotManifest]=(), predictor_runtime:PredictorRuntimeManifest | None=None)->Mapping[str,RetainedArtifactKind]:\n \"\"\"Build the minimum blob-level replay corpus required by final prospective proof.\n\n Content-addressed policy objects remain in the handoff/registry. This function\n targets blobs that cannot be reconstructed from identifiers alone.\n \"\"\"\n out:dict[str,RetainedArtifactKind]={}\n for a in runtime_registry.artifacts:\n out[a.source_tree_hash]=RetainedArtifactKind.SOURCE_TREE\n out[a.dependency_lock_hash]=RetainedArtifactKind.DEPENDENCY_LOCK\n out[a.build_recipe_hash]=RetainedArtifactKind.BUILD_RECIPE\n out[a.executable_artifact_hash]=RetainedArtifactKind.EXECUTABLE_ARTIFACT\n out[a.runtime_environment_hash]=RetainedArtifactKind.RUNTIME_ENVIRONMENT\n for a in model_registry.artifacts:\n out[a.model_freeze_hash]=RetainedArtifactKind.MODEL\n out[a.transformer_freeze_hash]=RetainedArtifactKind.TRANSFORMER\n out[a.calibration_freeze_hash]=RetainedArtifactKind.CALIBRATOR\n out[a.feature_schema_hash]=RetainedArtifactKind.FEATURE_SCHEMA\n out[a.feature_contract_hash]=RetainedArtifactKind.FEATURE_CONTRACT\n out[a.training_data_hash]=RetainedArtifactKind.TRAINING_DATA\n for s in state_snapshots:\n out[s.serialized_state_hash]=RetainedArtifactKind.STATE_SNAPSHOT\n if predictor_runtime is not None:\n out[predictor_runtime.source_tree_hash]=RetainedArtifactKind.SOURCE_TREE\n out[predictor_runtime.dependency_lock_hash]=RetainedArtifactKind.DEPENDENCY_LOCK\n out[predictor_runtime.executable_artifact_hash]=RetainedArtifactKind.EXECUTABLE_ARTIFACT\n out[predictor_runtime.runtime_environment_hash]=RetainedArtifactKind.RUNTIME_ENVIRONMENT\n out[predictor_runtime.feature_extractor_code_hash]=RetainedArtifactKind.FEATURE_EXTRACTOR_CODE\n out[predictor_runtime.effective_config_hash]=RetainedArtifactKind.EFFECTIVE_CONFIG\n return out","source_sha256":"ac6e18e76fcbd23144d1870ac03e3c2a4a1149dc4b5cf3f84fc0664228cdab1a"},{"name":"__post_init__","node":"FunctionDef","path":"runtime_integrity.py","source":"def __post_init__(self) -> None:\n for name in (\"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\"):\n _hex64(getattr(self, name), name)\n if self.artifact_id != self.content_hash:\n raise DemonovError(\"runtime artifact id must be content-addressed\")","source_sha256":"a7b5db332b3cd656bf1d8ec3b9fe7b0da2fcbddad84b529725384be99beea98a"},{"name":"content_hash","node":"FunctionDef","path":"runtime_integrity.py","source":"def content_hash(self) -> str:\n return canonical_hash({k: getattr(self, k) for k in (\n \"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\"\n )})","source_sha256":"265c6eede8cfd8f93a315ea20905befdfb4f66947538978ef6e6013872668d94"},{"name":"build","node":"FunctionDef","path":"runtime_integrity.py","source":"def build(cls, **kwargs) -> \"RuntimeArtifactManifest\":\n payload = {k: kwargs[k] for k in (\"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\")}\n return cls(artifact_id=canonical_hash(payload), **kwargs)","source_sha256":"f4859325ffab449c366e56333f48078b1a221897653cdc2a348eea73fdd8ba28"},{"name":"__post_init__","node":"FunctionDef","path":"runtime_integrity.py","source":"def __post_init__(self) -> None:\n _aware(self.deployed_at, \"deployment deployed_at\"); _aware(self.issued_at, \"deployment issued_at\")\n if self.issued_at < self.deployed_at:\n raise DemonovError(\"deployment attestation cannot be issued before deployment\")\n if not self.actor_id or not self.authority_provider_id:\n raise DemonovError(\"deployment attestation identity fields are required\")\n for n in (\"subject_id\",\"source_tree_hash\",\"dependency_lock_hash\",\"executable_artifact_hash\",\n \"runtime_environment_hash\",\"effective_config_hash\",\"authority_receipt_hash\"):\n _hex64(getattr(self,n),n)\n if self.feature_extractor_code_hash: _hex64(self.feature_extractor_code_hash,\"feature_extractor_code_hash\")\n if self.attestation_id != self.content_hash:\n raise DemonovError(\"deployment attestation id must be content-addressed\")","source_sha256":"a98af80953a22a18bb46c75e43b09921d13d2c60d952a2d111fdd663345f1b7a"},{"name":"content_hash","node":"FunctionDef","path":"runtime_integrity.py","source":"def content_hash(self) -> str:\n payload={\"subject_kind\":self.subject_kind,\"subject_id\":self.subject_id,\"actor_id\":self.actor_id,\n \"source_tree_hash\":self.source_tree_hash,\"dependency_lock_hash\":self.dependency_lock_hash,\n \"executable_artifact_hash\":self.executable_artifact_hash,\"runtime_environment_hash\":self.runtime_environment_hash,\n \"effective_config_hash\":self.effective_config_hash,\"deployed_at\":self.deployed_at,\"issued_at\":self.issued_at,\n \"authority_provider_id\":self.authority_provider_id,\"authority_receipt_hash\":self.authority_receipt_hash}\n if self.feature_extractor_code_hash: payload[\"feature_extractor_code_hash\"]=self.feature_extractor_code_hash\n return canonical_hash(payload)","source_sha256":"544b46e605c9a988693451af639cce42e20f359ae9dd69baa47b3780e4525ed1"},{"name":"build","node":"FunctionDef","path":"runtime_integrity.py","source":"def build(cls, **kwargs) -> \"DeploymentAttestation\":\n payload={k:kwargs[k] for k in (\"subject_kind\",\"subject_id\",\"actor_id\",\"source_tree_hash\",\"dependency_lock_hash\",\n \"executable_artifact_hash\",\"runtime_environment_hash\",\"effective_config_hash\",\"deployed_at\",\"issued_at\",\n \"authority_provider_id\",\"authority_receipt_hash\")}\n if kwargs.get(\"feature_extractor_code_hash\"): payload[\"feature_extractor_code_hash\"]=kwargs[\"feature_extractor_code_hash\"]\n return cls(attestation_id=canonical_hash(payload),**kwargs)","source_sha256":"58286208dcbf95fffbf6775c550cbb0e4cb2eee55a6e89610d3c55cf6a57183c"},{"name":"__post_init__","node":"FunctionDef","path":"runtime_integrity.py","source":"def __post_init__(self) -> None:\n _aware(self.started_at, \"predictor runtime started_at\")\n if self.ended_at is not None:\n _aware(self.ended_at, \"predictor runtime ended_at\")\n if self.ended_at <= self.started_at: raise DemonovError(\"predictor runtime ended_at must follow started_at\")\n if not self.consumer_id or not self.final_model_registry_id:\n raise DemonovError(\"predictor runtime identity fields required\")\n for n in (\"source_tree_hash\",\"dependency_lock_hash\",\"runtime_environment_hash\",\"executable_artifact_hash\",\"effective_config_hash\",\"feature_extractor_code_hash\",\"deployment_receipt_hash\"):\n _hex64(getattr(self,n),n)\n if self.predictor_runtime_id != self.content_hash:\n raise DemonovError(\"predictor runtime id must be content-addressed\")","source_sha256":"6387ddecd12c2c2af99dd5d683b4e12d35b045cf938d3ee15f672f1b1a67795f"},{"name":"content_hash","node":"FunctionDef","path":"runtime_integrity.py","source":"def content_hash(self) -> str:\n return canonical_hash({k:getattr(self,k) for k in (\n \"consumer_id\",\"source_tree_hash\",\"dependency_lock_hash\",\"runtime_environment_hash\",\"executable_artifact_hash\",\"effective_config_hash\",\n \"final_model_registry_id\",\"feature_extractor_code_hash\",\"started_at\",\"ended_at\",\"deployment_receipt_hash\"\n )})","source_sha256":"df6127715e3a641101bfec75454672d73e712342aa989fa0b674c865d3d4424d"},{"name":"build","node":"FunctionDef","path":"runtime_integrity.py","source":"def build(cls, **kwargs) -> \"PredictorRuntimeManifest\":\n payload={k:kwargs.get(k) for k in (\n \"consumer_id\",\"source_tree_hash\",\"dependency_lock_hash\",\"runtime_environment_hash\",\"executable_artifact_hash\",\"effective_config_hash\",\n \"final_model_registry_id\",\"feature_extractor_code_hash\",\"started_at\",\"ended_at\",\"deployment_receipt_hash\"\n )}\n return cls(predictor_runtime_id=canonical_hash(payload),**kwargs)","source_sha256":"320b24f7f9b26161be45b818701ca5f9e0ec55be2b1ade043dbcd6c3df656f2b"}],"content_hash":"def content_hash(self) -> str:\n return canonical_hash({k: getattr(self, k) for k in (\n \"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\"\n )})","fields":["artifact_id","source_tree_hash","dependency_lock_hash","build_recipe_hash","executable_artifact_hash","runtime_environment_hash"],"formula":null,"post_init":"def __post_init__(self) -> None:\n for name in (\"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\"):\n _hex64(getattr(self, name), name)\n if self.artifact_id != self.content_hash:\n raise DemonovError(\"runtime artifact id must be content-addressed\")"} +SB043K_OLD_ARTIFACT_INPUTS={"base_image_id":"sha256:008ab480142056d1f0b628e6c17bb6b99b30b8b4f59f24e31d972a4a128a8602","base_image_ref":"8020-demonov-shadow:ac7094a76ddc06f376d71a76432af7c2dd10ec7d","candidate_pool":{"base_image_id":"008ab480142056d1f0b628e6c17bb6b99b30b8b4f59f24e31d972a4a128a8602","base_rootfs_layers_canonical":"caf591ce9164d30a1fa64b2ca25d9728b116468c9410a883543bf3d696f3ced1","compose_sha256":"6461532b0a04decc60fe1d1885990020e886d40de40c0523e34e2849600af061","dockerfile_sha256":"901951def73961f76d2c2a93c5428a0fbdcc50113d42b39da92983a5ce157cb8","file:runtime_integrity.py":"99859b63e23d10fc051672965123f49d6e79d2ff767871c019ff7bdae2e2e39e","file:runtime_manifest.py":"1064cfb74303fdc8e0bf50bae95b1e755556a5b1dfc28b2b062341becaba08f2","old_application_image_id":"403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736","old_dir_canonical_list_full":"af83cb6b6b1b0f01f5453bd2dd6048c42b1f194bee6f6323b91e90efec30ef1f","old_dir_canonical_list_sha":"708d044de397034bcdde99398f1014aceee0e9f58a7870e459c6d57879e2b552","old_dir_canonical_path_sha":"d32002a8dd2b78e63ac30bef3f1c8b4c18373509c98c92173a9f82386f53afd4","old_dir_canonical_path_size_sha":"0c7eac692accfd22113cebffb7897863370052731578418a5103e4004b749c7c","old_dir_concat_path_sha":"3a0e01804936792ff9159b896d17b5bcd2b0b0d61eacb331fd93ccaceb5411df","old_dir_concat_sha":"b39e64671adfa8a6cfac27ff4bac745ee5dc5b0b90d28f1a9e24b48de307e6ae","old_image_config":"403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736","old_image_config_canonical":"27884bcdb5825bb3f2207da59a46451dac4e65a34b6af18db04266607e151d0e","old_image_id":"403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736","old_rootfs_layers_canonical":"624aba0d14a23d453be78b45a360bfa5c724ddd3d01946930f8a76a4341d17fa","old_tar_canonical_list_full":"43b6ae1658ff777a219266ce66f2de7d8f9f3d9b3c8428f5d11b0c90aff6a581","old_tar_canonical_list_sha":"c6a1b005a330a0e5a73658fcbf7557a0645b1fca9fa05fe87955c26c06d1e4ac","old_tar_canonical_path_sha":"3b7df8cf67359efaa32f20d35a23636fe24a2a0f0f74d465c234eb92c6496733","old_tar_canonical_path_size_sha":"0579c2e9c3cfbacf9db2c6d7b1a05705305e63e130a74f89ff42d01fc5802b0f","old_tar_concat_path_sha":"dc1843e1ada353efcb935031b5783a677d5656310700c83e885c688829406f91","old_tar_concat_sha":"b39e64671adfa8a6cfac27ff4bac745ee5dc5b0b90d28f1a9e24b48de307e6ae","old_tar_strip_canonical_list_full":"af83cb6b6b1b0f01f5453bd2dd6048c42b1f194bee6f6323b91e90efec30ef1f","old_tar_strip_canonical_list_sha":"708d044de397034bcdde99398f1014aceee0e9f58a7870e459c6d57879e2b552","old_tar_strip_canonical_path_sha":"d32002a8dd2b78e63ac30bef3f1c8b4c18373509c98c92173a9f82386f53afd4","old_tar_strip_canonical_path_size_sha":"0c7eac692accfd22113cebffb7897863370052731578418a5103e4004b749c7c","old_tar_strip_concat_path_sha":"3a0e01804936792ff9159b896d17b5bcd2b0b0d61eacb331fd93ccaceb5411df","old_tar_strip_concat_sha":"b39e64671adfa8a6cfac27ff4bac745ee5dc5b0b90d28f1a9e24b48de307e6ae","package_gzip_sha256":"389e7aabca8887ee3b48b6ff0b4affe1163216005a4888013d9ccc82ea360e32","package_tar_sha256":"431ddf9e8938d5e583553f05f9e3d019aff0b439c83b0b23c81808073b7d61a8"},"old_image_id":"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736","old_manifest":{"application_image_id":"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736","base_image_digest":"sha256:881d80734ee05dca6f7f42dcb080975652a53c7eda9ba1f03bb8da31aa6a6ec2","code_identity":"e32760c69a4311728db9066ee8bf2bf66b1e5a70","compose_hash":"6461532b0a04decc60fe1d1885990020e886d40de40c0523e34e2849600af061","finality_policy_id":"BITFINEX_SEQ_ALL_D1_V1","package_identity":"637acba19fb29c98408a8031dc9265a31dc36551c666fcf0b287e8af83d2b893","runtime_manifest_id":"58d3b59200bdc0eb8d448612679d667b194263586cb3198dfc08597935053a1a"},"old_package_identity":"637acba19fb29c98408a8031dc9265a31dc36551c666fcf0b287e8af83d2b893","tar_meta":{"gzip_bytes":208049,"gzip_sha256":"389e7aabca8887ee3b48b6ff0b4affe1163216005a4888013d9ccc82ea360e32","tar_bytes":1157120,"tar_sha256":"431ddf9e8938d5e583553f05f9e3d019aff0b439c83b0b23c81808073b7d61a8"}} +SB043K_REPRODUCTION=[] +SB043K_OLD_DEPLOY_REFERENCES=[{"path":"demonov_forward_map/__init__.py","snippets":[" ClockDomainKind, ClockDomainSpec, ClockDomainRegistry, ClockSynchronizationPolicy, ClockAttestation,"," verify_clock_synchronization, WindowClockClassification, classify_event_time_with_clock_guard,"," FrozenConfigMapping, EffectiveConfigSnapshot, RuntimeArtifactManifest, RuntimeEpoch, RuntimeRegistry,"," ProducerSessionDeclaration, ProducerSessionCatalog, CollectorTopologyPolicy, CollectorReceiptRecord,"," CollectorReceiptStore, AuthoritativeProducerWatermark, CaptureCompletenessPolicy, verify_capture_through_watermark,"]},{"path":"demonov_forward_map/runtime_integrity.py","snippets":["","@dataclass(frozen=True)","class RuntimeArtifactManifest:"," artifact_id: str"," source_tree_hash: str","class RuntimeArtifactManifest:"," artifact_id: str"," source_tree_hash: str"," dependency_lock_hash: str"," build_recipe_hash: str"," artifact_id: str"," source_tree_hash: str"," dependency_lock_hash: str"," build_recipe_hash: str"," executable_artifact_hash: str"," source_tree_hash: str"," dependency_lock_hash: str"," build_recipe_hash: str"," executable_artifact_hash: str"," runtime_environment_hash: str"," dependency_lock_hash: str"," build_recipe_hash: str"," executable_artifact_hash: str"," runtime_environment_hash: str","",""," def __post_init__(self) -> None:"," for name in (\"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\"):"," _hex64(getattr(self, name), name)"," if self.artifact_id != self.content_hash:"," def content_hash(self) -> str:"," return canonical_hash({k: getattr(self, k) for k in ("," \"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\""," )})","",""," @classmethod"," def build(cls, **kwargs) -> \"RuntimeArtifactManifest\":"," payload = {k: kwargs[k] for k in (\"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\")}"," return cls(artifact_id=canonical_hash(payload), **kwargs)"," @classmethod"," def build(cls, **kwargs) -> \"RuntimeArtifactManifest\":"," payload = {k: kwargs[k] for k in (\"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\")}"," return cls(artifact_id=canonical_hash(payload), **kwargs)","","class RuntimeRegistry:"," registry_id: str"," artifacts: Tuple[RuntimeArtifactManifest, ...]"," configs: Tuple[EffectiveConfigSnapshot, ...]"," epochs: Tuple[RuntimeEpoch, ...]"," for e in self.epochs:"," if e.artifact_id not in amap or e.config_id not in cmap: raise DemonovError(\"runtime epoch references missing artifact/config\")"," if e.producer_code_hash != amap[e.artifact_id].source_tree_hash:"," raise DemonovError(\"runtime epoch producer_code_hash must equal frozen artifact source_tree_hash\")"," # No overlapping epochs per producer; otherwise event->runtime binding is ambiguous."," if e.artifact_id not in amap or e.config_id not in cmap: raise DemonovError(\"runtime epoch references missing artifact/config\")"," if e.producer_code_hash != amap[e.artifact_id].source_tree_hash:"," raise DemonovError(\"runtime epoch producer_code_hash must equal frozen artifact source_tree_hash\")"," # No overlapping epochs per producer; otherwise event->runtime binding is ambiguous."," for producer in {e.producer_id for e in self.epochs}:",""," @classmethod"," def build(cls, *, artifacts: Iterable[RuntimeArtifactManifest], configs: Iterable[EffectiveConfigSnapshot], epochs: Iterable[RuntimeEpoch]) -> \"RuntimeRegistry\":"," a, c, e = tuple(artifacts), tuple(configs), tuple(epochs)"," payload = {\"artifacts\": tuple(sorted(x.artifact_id for x in a)), \"configs\": tuple(sorted(x.config_id for x in c)), \"epochs\": tuple(sorted(x.epoch_id for x in e))}"," subject_id: str"," actor_id: str"," source_tree_hash: str"," dependency_lock_hash: str"," executable_artifact_hash: str"," actor_id: str"," source_tree_hash: str"," dependency_lock_hash: str"," executable_artifact_hash: str"," runtime_environment_hash: str"," source_tree_hash: str"," dependency_lock_hash: str"," executable_artifact_hash: str"," runtime_environment_hash: str"," effective_config_hash: str"]},{"path":"runtime_manifest.json","snippets":[" \"compose_hash\": \"6461532b0a04decc60fe1d1885990020e886d40de40c0523e34e2849600af061\","," \"finality_policy_id\": \"BITFINEX_SEQ_ALL_D1_V1\","," \"package_identity\": \"637acba19fb29c98408a8031dc9265a31dc36551c666fcf0b287e8af83d2b893\","," \"runtime_manifest_id\": \"58d3b59200bdc0eb8d448612679d667b194263586cb3198dfc08597935053a1a\"","}"]}] +SB043K_SOURCE_COUNTS={"new_files":57,"old_files":57} +SB043K_HOLDS=["ARTIFACT_CONTENT_HASH_FORMULA_NOT_EXTRACTED","OLD_PACKAGE_ID_NOT_REPRODUCED"] +SB043K_DECISION=HOLD_ARTIFACT_CONTENT_HASH_FORMULA_NOT_EXTRACTED__OLD_PACKAGE_ID_NOT_REPRODUCED +SB043K_MUTATION_SCOPE=NONE_READ_ONLY +SIGNALBOT043K_DECISION=HOLD_GUEST_PACKAGE_RCA + +OUTPUT_END +CHAT_OUTPUT_END diff --git a/runtime/latest.json b/runtime/latest.json index cae7ad4c..1dcc83c0 100644 --- a/runtime/latest.json +++ b/runtime/latest.json @@ -1,19 +1,19 @@ { "schema_version": 1, "channel": "homelab-runtime", - "command_id": "NEWFI-260908-A-STAGINGEDGE-WAN-FORENSIC4", - "status": "OK", - "rc": 0, + "command_id": "SIGNALBOT-260908-PACKAGE-SEAL-RCA-043PKG", + "status": "FAIL", + "rc": 3, "host": "pve01", "mode": "read-only", - "component": "newfi-staging-edge-wan-ingress-fingerprint-readonly", - "started_at_utc": "2026-09-08T07:52:51Z", - "finished_at_utc": "2026-09-08T07:53:38Z", + "component": "signalbot-cr0116-package-seal-rca", + "started_at_utc": "2026-09-08T07:53:58Z", + "finished_at_utc": "2026-09-08T07:54:00Z", "reference_register_checked": true, "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66", "error_register_checked": true, "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0", - "command_sha256": "c48937b9e90fbb12e1163dd4fe9f9069aeadf0727df5f3dd9fa9e6463eafcf71", + "command_sha256": "08ece8490c12004f2f6511bfb5dbcef29ab38d4385dbb224a48ba5d4a3dbfbaf", "duplicate_failed_command_blocked": false, "block_reason": null, "execution_started": true, @@ -21,7 +21,7 @@ "result_contract_valid": true, "result_contract_status": null, "result_contract_error": null, - "command_rc": 0, + "command_rc": 3, "changes_made": false, "rollback_started": false, "rollback_restored": null, @@ -30,9 +30,9 @@ "secrets_included": false, "private_addresses_included": false, "raw_evidence_retained_locally": true, - "raw_evidence_sha256": "1c2a8d51054b0e77c038cc7faf67b9051421f348c323a853d9a1c3dfe476d63c", - "sanitized_output_sha256": "44c61172b647a23279b3079ec7ed28adf5bf9c5aabe5f14df66dbbe60d7f1085", + "raw_evidence_sha256": "5a54891c071a17faf298b6f4df768f618290aac210aadeb4e5117d67b35ab713", + "sanitized_output_sha256": "5a54891c071a17faf298b6f4df768f618290aac210aadeb4e5117d67b35ab713", "output_truncated_in_json": false, "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", - "output": "WAN_FORENSIC4_BEGIN=true\nCOMMAND_ID=NEWFI-260908-A-STAGINGEDGE-WAN-FORENSIC4\nMODE=read-only\nMUTATIONS_PERFORMED=NO\nERROR_REGISTER_CHECK=OK\nERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0\nREFERENCE_CHECK=OK\nREFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66\nAUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED\nPRIOR_FORENSIC3_GATE=PASS\nPRIOR_FORENSIC3_HISTORY_SHA256=9ea1a89282975837b1a5ceaf5a2dcc47227f57b74b18db2dcae0d4c0044f9810\nEDGE_IDENTITY={\"err\":\"\",\"hostname\":\"edge-vm\",\"rc\":0}\nEDGE_PRIMARY_LAN_ROUTE={\"err\":\"\",\"raw\":\"[{\\\"dst\\\":\\\"[PRIVATE_IP]\\\",\\\"dev\\\":\\\"eth0\\\",\\\"prefsrc\\\":\\\"[PRIVATE_IP]\\\",\\\"flags\\\":[],\\\"uid\\\":0,\\\"cache\\\":[]}]\",\"rc\":0,\"sources\":[\"[PRIVATE_IP]\"]}\nEDGE_EGRESS_TWO_PROBES={\"err\":\"\",\"rc\":0,\"valid_public_ipv4\":[\"85.121.4.192\",\"85.121.4.192\"],\"values\":[\"85.121.4.192\",\"85.121.4.192\"]}\nLOCAL_NPMPLUS_GIT_CERT={\"cert\":\"sha256 Fingerprint=70:7E:D6:56:03:3C:03:C4:B4:2F:DE:D8:3F:97:00:C1:0C:EF:FD:2D:2E:2D:98:A7:56:C8:B1:9C:DF:1D:AB:63\\nsubject=CN=git.gram1.ru\\nissuer=C=US, O=Let's Encrypt, CN=YE1\\nserial=05499CF6D49C49CDFC8DBF28C4B9F9FBC55A\\nnotBefore=Aug 13 22:08:59 2026 GMT\\nnotAfter=Nov 11 22:08:58 2026 GMT\",\"err\":\"\",\"fingerprint\":\"707ED656033C03C4B42FDED83F9700C10CEFFD2D2E2D98A756C8B19CDF1DAB63\",\"rc\":0}\nDIRECT_PRIVATE_EDGE_GIT_PROBES=[{\"cert\":\"sha256 Fingerprint=70:7E:D6:56:03:3C:03:C4:B4:2F:DE:D8:3F:97:00:C1:0C:EF:FD:2D:2E:2D:98:A7:56:C8:B1:9C:DF:1D:AB:63\\nsubject=CN=git.gram1.ru\\nissuer=C=US, O=Let's Encrypt, CN=YE1\\nserial=05499CF6D49C49CDFC8DBF28C4B9F9FBC55A\\nnotBefore=Aug 13 22:08:59 2026 GMT\\nnotAfter=Nov 11 22:08:58 2026 GMT\",\"curl\":{\"err\":\"\",\"http\":\"200\",\"rc\":0},\"err\":\"\",\"fingerprint\":\"707ED656033C03C4B42FDED83F9700C10CEFFD2D2E2D98A756C8B19CDF1DAB63\",\"ip\":\"[PRIVATE_IP]\",\"rc\":0}]\nEDGE_EGRESS_GIT_PROBES=[{\"cert\":\"\",\"curl\":{\"err\":\"curl: (28) Connection timed out after 18002 milliseconds\\n\",\"http\":\"000\",\"rc\":28},\"err\":\"Could not find certificate from \\n\",\"fingerprint\":null,\"ip\":\"85.121.4.192\",\"rc\":1}]\nOLD_PUBLIC_GIT_CERT={\"cert\":\"sha256 Fingerprint=EC:B6:9D:0F:A8:39:FE:D0:4D:C2:3E:E2:43:F9:F8:67:3C:BF:CD:0A:00:88:BF:D3:EF:7D:8B:94:33:14:D6:CB\\nsubject=CN=git.gram1.ru\\nissuer=C=US, O=Let's Encrypt, CN=YE1\\nserial=0668B385C8D6C5BBB0435761F84FADD0DB23\\nnotBefore=Aug 17 02:03:29 2026 GMT\\nnotAfter=Nov 15 02:03:28 2026 GMT\",\"curl\":{\"err\":\"\",\"http\":\"200\",\"rc\":0},\"err\":\"\",\"fingerprint\":\"ECB69D0FA839FED04DC23EE243F9F8673CBFCD0A0088BFD3EF7D8B943314D6CB\",\"ip\":\"185.225.35.6\",\"rc\":0}\nWAN_INGRESS_FINGERPRINT_DECISION={\"egress_match_count\":0,\"egress_match_ips\":[],\"egress_two_probes_same\":true,\"local_fingerprint\":\"707ED656033C03C4B42FDED83F9700C10CEFFD2D2E2D98A756C8B19CDF1DAB63\",\"old_public_fingerprint\":\"ECB69D0FA839FED04DC23EE243F9F8673CBFCD0A0088BFD3EF7D8B943314D6CB\",\"old_public_matches_local\":false,\"private_match_count\":1,\"private_match_ips\":[\"[PRIVATE_IP]\"]}\nFINAL_DECISION=EDGE_EGRESS_NOT_YET_PROVEN_AS_NPMPLUS_PUBLIC_INGRESS\nWAN_FORENSIC4_END=true\n" + "output": "ERROR_REGISTER_CHECK=OK\nREFERENCE_CHECK=OK\nAUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED\nSB043K_PRESTATE={\"active_env\":{\"APP_IMAGE\":\"8020-demonov-shadow:e32760c69a4311728db9066ee8bf2bf66b1e5a70\",\"CODE_IDENTITY\":\"e32760c69a4311728db9066ee8bf2bf66b1e5a70\",\"COLLECTION_START_AT\":\"2026-09-07T00:00:00+00:00\",\"EXPERIMENT_ID\":\"ec477ea41ecbd5cfdef5afc259595aab20674a7d933f41a389329ff05098b338\",\"RUNTIME_MANIFEST_ID\":\"58d3b59200bdc0eb8d448612679d667b194263586cb3198dfc08597935053a1a\"},\"services\":[{\"container_id\":\"a546a70c3e8c263d9b590cd78ee206bcda0cfcdb6662327e8415ca0e29ad1501\",\"image\":\"8020-demonov-shadow:e32760c69a4311728db9066ee8bf2bf66b1e5a70\",\"image_id\":\"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736\",\"restart_count\":14,\"running\":true,\"service\":\"collector\",\"started_at\":\"2026-09-08T07:38:09.79483772Z\"},{\"container_id\":\"d8023f4cbf91f9382e39eec0436c9cebc7665535b42b950e95408c03ff9bf30d\",\"image\":\"8020-demonov-shadow:e32760c69a4311728db9066ee8bf2bf66b1e5a70\",\"image_id\":\"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736\",\"restart_count\":0,\"running\":true,\"service\":\"relay\",\"started_at\":\"2026-09-06T18:48:20.603414848Z\"},{\"container_id\":\"1feeca2d9428cd5a277c026bef34534db307657dcdcd63aff98ea66e44f8b9c5\",\"image\":\"8020-demonov-shadow:e32760c69a4311728db9066ee8bf2bf66b1e5a70\",\"image_id\":\"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736\",\"restart_count\":0,\"running\":true,\"service\":\"shadow\",\"started_at\":\"2026-09-06T18:48:20.768190553Z\"},{\"container_id\":\"889be41d2cee9d327811da78388f834ba6eafe4c0eeae456867ed0df76832d01\",\"image\":\"8020-demonov-shadow:e32760c69a4311728db9066ee8bf2bf66b1e5a70\",\"image_id\":\"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736\",\"restart_count\":0,\"running\":true,\"service\":\"worker\",\"started_at\":\"2026-09-06T18:48:20.586788319Z\"}],\"stage_result\":{\"active_env_unchanged\":true,\"build_context\":\"/opt/stacks/8020-demonov-shadow/.deploy/SIGNALBOT-260908-DEPLOY-STAGE-042FIX5\",\"collector_source_sha256\":\"193dd0c7f9890fdb4026c24dbc5add825f1641d92097e881806705ca452812d5\",\"copy_source\":\"/opt/stacks/8020-demonov-shadow/.deploy/SIGNALBOT-260908-DEPLOY-STAGE-042FIX5/demonov_forward_map\",\"decision\":\"DEPLOY_STAGE_READY\",\"dockerfile\":\"/opt/stacks/8020-demonov-shadow/.deploy/SIGNALBOT-260908-DEPLOY-STAGE-042FIX5/Dockerfile\",\"helper_candidates\":{\"demonov_forward_map.live_prospective\":[{\"name\":\"_hash\",\"pure_candidate\":true,\"signature\":\"(value: 'object') -> 'str'\"}],\"demonov_forward_map.runtime_integrity\":[{\"name\":\"canonical_hash\",\"pure_candidate\":true,\"signature\":\"(payload: 'Any') -> 'str'\"},{\"name\":\"verify_experiment_seal_receipt\",\"pure_candidate\":true,\"signature\":\"(*, bundle: 'FinalProspectiveSealBundle', receipt: 'ExperimentSealReceipt', collection_start_at: 'datetime', receipt_verifier: 'Callable[[ExperimentSealReceipt], bool]') -> 'None'\"},{\"name\":\"required_retained_hashes\",\"pure_candidate\":true,\"signature\":\"(*, runtime_registry: 'RuntimeRegistry', model_registry: 'FinalModelRegistry', state_snapshots: 'Sequence[StateSnapshotManifest]' = (), predictor_runtime: 'PredictorRuntimeManifest | None' = None) -> 'Mapping[str, RetainedArtifactKind]'\"}],\"demonov_forward_map.runtime_manifest\":[{\"name\":\"canonical_hash\",\"pure_candidate\":true,\"signature\":\"(payload: 'Any') -> 'str'\"},{\"name\":\"verify_runtime_manifest\",\"pure_candidate\":true,\"signature\":\"(manifest: 'RuntimeDeploymentManifestV1', *, expected_code_identity: 'str', actual_image_id: 'str', actual_package_identity: 'str') -> 'None'\"}]},\"new_image\":\"8020-demonov-shadow:76e1f58baa544a0e208bba317f0150e5b6d74dbd\",\"new_image_id\":\"sha256:341f71a906c91d3fa9c1d50bd89df2a849dfb0b168bb4551efb444bf61c4ab99\",\"policy\":{\"close_timeout\":5,\"open_timeout\":10,\"ping_interval\":20,\"ping_timeout\":60},\"runtime_activated\":false,\"service_identity_unchanged\":true,\"stage_path\":\"/opt/stacks/8020-demonov-shadow/.deploy/SIGNALBOT-260908-DEPLOY-STAGE-042FIX5\",\"websockets_version\":\"15.0.1\"}}\nSB043K_ARTIFACT_CLASS={\"constructors\":[{\"name\":\"RuntimeArtifactManifest\",\"node\":\"ClassDef\",\"path\":\"runtime_integrity.py\",\"source\":\"class RuntimeArtifactManifest:\\n artifact_id: str\\n source_tree_hash: str\\n dependency_lock_hash: str\\n build_recipe_hash: str\\n executable_artifact_hash: str\\n runtime_environment_hash: str\\n\\n def __post_init__(self) -> None:\\n for name in (\\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\"):\\n _hex64(getattr(self, name), name)\\n if self.artifact_id != self.content_hash:\\n raise DemonovError(\\\"runtime artifact id must be content-addressed\\\")\\n\\n @property\\n def content_hash(self) -> str:\\n return canonical_hash({k: getattr(self, k) for k in (\\n \\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\"\\n )})\\n\\n @classmethod\\n def build(cls, **kwargs) -> \\\"RuntimeArtifactManifest\\\":\\n payload = {k: kwargs[k] for k in (\\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\")}\\n return cls(artifact_id=canonical_hash(payload), **kwargs)\",\"source_sha256\":\"8cd1ebf70c003cd4d7b91f18602841426b19c2f54f2d803309c53c22f38cd5c7\"},{\"name\":\"DeploymentAttestation\",\"node\":\"ClassDef\",\"path\":\"runtime_integrity.py\",\"source\":\"class DeploymentAttestation:\\n attestation_id: str\\n subject_kind: DeploymentSubjectKind\\n subject_id: str\\n actor_id: str\\n source_tree_hash: str\\n dependency_lock_hash: str\\n executable_artifact_hash: str\\n runtime_environment_hash: str\\n effective_config_hash: str\\n deployed_at: datetime\\n issued_at: datetime\\n authority_provider_id: str\\n authority_receipt_hash: str\\n feature_extractor_code_hash: str = \\\"\\\"\\n\\n def __post_init__(self) -> None:\\n _aware(self.deployed_at, \\\"deployment deployed_at\\\"); _aware(self.issued_at, \\\"deployment issued_at\\\")\\n if self.issued_at < self.deployed_at:\\n raise DemonovError(\\\"deployment attestation cannot be issued before deployment\\\")\\n if not self.actor_id or not self.authority_provider_id:\\n raise DemonovError(\\\"deployment attestation identity fields are required\\\")\\n for n in (\\\"subject_id\\\",\\\"source_tree_hash\\\",\\\"dependency_lock_hash\\\",\\\"executable_artifact_hash\\\",\\n \\\"runtime_environment_hash\\\",\\\"effective_config_hash\\\",\\\"authority_receipt_hash\\\"):\\n _hex64(getattr(self,n),n)\\n if self.feature_extractor_code_hash: _hex64(self.feature_extractor_code_hash,\\\"feature_extractor_code_hash\\\")\\n if self.attestation_id != self.content_hash:\\n raise DemonovError(\\\"deployment attestation id must be content-addressed\\\")\\n\\n @property\\n def content_hash(self) -> str:\\n payload={\\\"subject_kind\\\":self.subject_kind,\\\"subject_id\\\":self.subject_id,\\\"actor_id\\\":self.actor_id,\\n \\\"source_tree_hash\\\":self.source_tree_hash,\\\"dependency_lock_hash\\\":self.dependency_lock_hash,\\n \\\"executable_artifact_hash\\\":self.executable_artifact_hash,\\\"runtime_environment_hash\\\":self.runtime_environment_hash,\\n \\\"effective_config_hash\\\":self.effective_config_hash,\\\"deployed_at\\\":self.deployed_at,\\\"issued_at\\\":self.issued_at,\\n \\\"authority_provider_id\\\":self.authority_provider_id,\\\"authority_receipt_hash\\\":self.authority_receipt_hash}\\n if self.feature_extractor_code_hash: payload[\\\"feature_extractor_code_hash\\\"]=self.feature_extractor_code_hash\\n return canonical_hash(payload)\\n\\n @classmethod\\n def build(cls, **kwargs) -> \\\"DeploymentAttestation\\\":\\n payload={k:kwargs[k] for k in (\\\"subject_kind\\\",\\\"subject_id\\\",\\\"actor_id\\\",\\\"source_tree_hash\\\",\\\"dependency_lock_hash\\\",\\n \\\"executable_artifact_hash\\\",\\\"runtime_environment_hash\\\",\\\"effective_config_hash\\\",\\\"deployed_at\\\",\\\"issued_at\\\",\\n \\\"authority_provider_id\\\",\\\"authority_receipt_hash\\\")}\\n if kwargs.get(\\\"feature_extractor_code_hash\\\"): payload[\\\"feature_extractor_code_hash\\\"]=kwargs[\\\"feature_extractor_code_hash\\\"]\\n return cls(attestation_id=canonical_hash(payload),**kwargs)\",\"source_sha256\":\"1b0ca84bb035dfb7ff441ce73bbe8ee5f140a07b4a821f5a9f55770b585ffac7\"},{\"name\":\"verify_final_deployment_attestations\",\"node\":\"FunctionDef\",\"path\":\"runtime_integrity.py\",\"source\":\"def verify_final_deployment_attestations(*, runtime_registry: RuntimeRegistry, producer_id: str,\\n predictor_runtime: \\\"PredictorRuntimeManifest\\\",\\n attestations: Sequence[DeploymentAttestation],\\n policy: DeploymentAttestationPolicy,\\n collection_start_at: datetime,\\n receipt_verifier: Callable[[DeploymentAttestation], bool]) -> None:\\n _aware(collection_start_at,\\\"collection_start_at\\\")\\n relevant_epochs=[e for e in runtime_registry.epochs if e.producer_id==producer_id and e.contains(collection_start_at)]\\n if len(relevant_epochs)!=1:\\n raise DemonovError(\\\"collection start must resolve to exactly one producer runtime epoch for deployment proof\\\")\\n epoch=relevant_epochs[0]\\n artifact=next((a for a in runtime_registry.artifacts if a.artifact_id==epoch.artifact_id),None)\\n if artifact is None: raise DemonovError(\\\"producer deployment proof references missing runtime artifact\\\")\\n expected={\\n (DeploymentSubjectKind.PRODUCER_RUNTIME_EPOCH,epoch.epoch_id):(\\n producer_id,artifact.source_tree_hash,artifact.dependency_lock_hash,artifact.executable_artifact_hash,\\n artifact.runtime_environment_hash,epoch.config_id,\\\"\\\",epoch.started_at),\\n (DeploymentSubjectKind.PREDICTOR_RUNTIME,predictor_runtime.predictor_runtime_id):(\\n predictor_runtime.consumer_id,predictor_runtime.source_tree_hash,predictor_runtime.dependency_lock_hash,\\n predictor_runtime.executable_artifact_hash,predictor_runtime.runtime_environment_hash,predictor_runtime.effective_config_hash,\\n predictor_runtime.feature_extractor_code_hash,predictor_runtime.started_at),\\n }\\n amap={(a.subject_kind,a.subject_id):a for a in attestations}\\n if len(amap)!=len(attestations): raise DemonovError(\\\"duplicate deployment attestation subject\\\")\\n if set(amap)!=set(expected): raise DemonovError(\\\"deployment attestation set differs from exact producer/predictor subjects\\\")\\n for key,(actor,src,dep,exe,env,cfg,feature,start) in expected.items():\\n a=amap[key]\\n if a.authority_provider_id!=policy.authority_provider_id or not receipt_verifier(a):\\n raise DemonovError(\\\"deployment attestation authority verification failed\\\")\\n if (a.actor_id,a.source_tree_hash,a.dependency_lock_hash,a.executable_artifact_hash,a.runtime_environment_hash,a.effective_config_hash)!=(actor,src,dep,exe,env,cfg):\\n raise DemonovError(\\\"deployment attestation artifact/config identity mismatch\\\")\\n if key[0] is DeploymentSubjectKind.PREDICTOR_RUNTIME and a.feature_extractor_code_hash!=feature:\\n raise DemonovError(\\\"predictor deployment attestation feature extractor mismatch\\\")\\n if key[0] is DeploymentSubjectKind.PRODUCER_RUNTIME_EPOCH and a.feature_extractor_code_hash:\\n raise DemonovError(\\\"producer deployment attestation must not invent challenger feature extractor\\\")\\n if abs((a.deployed_at-start).total_seconds()) > policy.max_start_skew_seconds:\\n raise DemonovError(\\\"deployment attestation outside frozen runtime-start skew\\\")\\n if policy.require_precollection_attestation and a.issued_at >= collection_start_at:\\n raise DemonovError(\\\"deployment attestation must be externally issued strictly before collection start\\\")\",\"source_sha256\":\"9fc5b8d032d6a7b31f6b4e21d15142fe20b1fde4fe30a06fb758ad264bdeac9d\"},{\"name\":\"PredictorRuntimeManifest\",\"node\":\"ClassDef\",\"path\":\"runtime_integrity.py\",\"source\":\"class PredictorRuntimeManifest:\\n predictor_runtime_id: str\\n consumer_id: str\\n source_tree_hash: str\\n dependency_lock_hash: str\\n runtime_environment_hash: str\\n executable_artifact_hash: str\\n effective_config_hash: str\\n final_model_registry_id: str\\n feature_extractor_code_hash: str\\n started_at: datetime\\n ended_at: datetime | None\\n deployment_receipt_hash: str\\n\\n def __post_init__(self) -> None:\\n _aware(self.started_at, \\\"predictor runtime started_at\\\")\\n if self.ended_at is not None:\\n _aware(self.ended_at, \\\"predictor runtime ended_at\\\")\\n if self.ended_at <= self.started_at: raise DemonovError(\\\"predictor runtime ended_at must follow started_at\\\")\\n if not self.consumer_id or not self.final_model_registry_id:\\n raise DemonovError(\\\"predictor runtime identity fields required\\\")\\n for n in (\\\"source_tree_hash\\\",\\\"dependency_lock_hash\\\",\\\"runtime_environment_hash\\\",\\\"executable_artifact_hash\\\",\\\"effective_config_hash\\\",\\\"feature_extractor_code_hash\\\",\\\"deployment_receipt_hash\\\"):\\n _hex64(getattr(self,n),n)\\n if self.predictor_runtime_id != self.content_hash:\\n raise DemonovError(\\\"predictor runtime id must be content-addressed\\\")\\n\\n @property\\n def content_hash(self) -> str:\\n return canonical_hash({k:getattr(self,k) for k in (\\n \\\"consumer_id\\\",\\\"source_tree_hash\\\",\\\"dependency_lock_hash\\\",\\\"runtime_environment_hash\\\",\\\"executable_artifact_hash\\\",\\\"effective_config_hash\\\",\\n \\\"final_model_registry_id\\\",\\\"feature_extractor_code_hash\\\",\\\"started_at\\\",\\\"ended_at\\\",\\\"deployment_receipt_hash\\\"\\n )})\\n\\n @classmethod\\n def build(cls, **kwargs) -> \\\"PredictorRuntimeManifest\\\":\\n payload={k:kwargs.get(k) for k in (\\n \\\"consumer_id\\\",\\\"source_tree_hash\\\",\\\"dependency_lock_hash\\\",\\\"runtime_environment_hash\\\",\\\"executable_artifact_hash\\\",\\\"effective_config_hash\\\",\\n \\\"final_model_registry_id\\\",\\\"feature_extractor_code_hash\\\",\\\"started_at\\\",\\\"ended_at\\\",\\\"deployment_receipt_hash\\\"\\n )}\\n return cls(predictor_runtime_id=canonical_hash(payload),**kwargs)\\n\\n def contains(self,t:datetime)->bool:\\n _aware(t,\\\"predictor runtime time\\\")\\n return self.started_at <= t and (self.ended_at is None or t < self.ended_at)\",\"source_sha256\":\"6514f10948abbeb0030fb06b509a8a75d796eea4d6ef4101b72e20f688985454\"},{\"name\":\"required_retained_hashes\",\"node\":\"FunctionDef\",\"path\":\"runtime_integrity.py\",\"source\":\"def required_retained_hashes(*, runtime_registry:RuntimeRegistry, model_registry:FinalModelRegistry,\\n state_snapshots:Sequence[StateSnapshotManifest]=(), predictor_runtime:PredictorRuntimeManifest | None=None)->Mapping[str,RetainedArtifactKind]:\\n \\\"\\\"\\\"Build the minimum blob-level replay corpus required by final prospective proof.\\n\\n Content-addressed policy objects remain in the handoff/registry. This function\\n targets blobs that cannot be reconstructed from identifiers alone.\\n \\\"\\\"\\\"\\n out:dict[str,RetainedArtifactKind]={}\\n for a in runtime_registry.artifacts:\\n out[a.source_tree_hash]=RetainedArtifactKind.SOURCE_TREE\\n out[a.dependency_lock_hash]=RetainedArtifactKind.DEPENDENCY_LOCK\\n out[a.build_recipe_hash]=RetainedArtifactKind.BUILD_RECIPE\\n out[a.executable_artifact_hash]=RetainedArtifactKind.EXECUTABLE_ARTIFACT\\n out[a.runtime_environment_hash]=RetainedArtifactKind.RUNTIME_ENVIRONMENT\\n for a in model_registry.artifacts:\\n out[a.model_freeze_hash]=RetainedArtifactKind.MODEL\\n out[a.transformer_freeze_hash]=RetainedArtifactKind.TRANSFORMER\\n out[a.calibration_freeze_hash]=RetainedArtifactKind.CALIBRATOR\\n out[a.feature_schema_hash]=RetainedArtifactKind.FEATURE_SCHEMA\\n out[a.feature_contract_hash]=RetainedArtifactKind.FEATURE_CONTRACT\\n out[a.training_data_hash]=RetainedArtifactKind.TRAINING_DATA\\n for s in state_snapshots:\\n out[s.serialized_state_hash]=RetainedArtifactKind.STATE_SNAPSHOT\\n if predictor_runtime is not None:\\n out[predictor_runtime.source_tree_hash]=RetainedArtifactKind.SOURCE_TREE\\n out[predictor_runtime.dependency_lock_hash]=RetainedArtifactKind.DEPENDENCY_LOCK\\n out[predictor_runtime.executable_artifact_hash]=RetainedArtifactKind.EXECUTABLE_ARTIFACT\\n out[predictor_runtime.runtime_environment_hash]=RetainedArtifactKind.RUNTIME_ENVIRONMENT\\n out[predictor_runtime.feature_extractor_code_hash]=RetainedArtifactKind.FEATURE_EXTRACTOR_CODE\\n out[predictor_runtime.effective_config_hash]=RetainedArtifactKind.EFFECTIVE_CONFIG\\n return out\",\"source_sha256\":\"ac6e18e76fcbd23144d1870ac03e3c2a4a1149dc4b5cf3f84fc0664228cdab1a\"},{\"name\":\"__post_init__\",\"node\":\"FunctionDef\",\"path\":\"runtime_integrity.py\",\"source\":\"def __post_init__(self) -> None:\\n for name in (\\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\"):\\n _hex64(getattr(self, name), name)\\n if self.artifact_id != self.content_hash:\\n raise DemonovError(\\\"runtime artifact id must be content-addressed\\\")\",\"source_sha256\":\"a7b5db332b3cd656bf1d8ec3b9fe7b0da2fcbddad84b529725384be99beea98a\"},{\"name\":\"content_hash\",\"node\":\"FunctionDef\",\"path\":\"runtime_integrity.py\",\"source\":\"def content_hash(self) -> str:\\n return canonical_hash({k: getattr(self, k) for k in (\\n \\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\"\\n )})\",\"source_sha256\":\"265c6eede8cfd8f93a315ea20905befdfb4f66947538978ef6e6013872668d94\"},{\"name\":\"build\",\"node\":\"FunctionDef\",\"path\":\"runtime_integrity.py\",\"source\":\"def build(cls, **kwargs) -> \\\"RuntimeArtifactManifest\\\":\\n payload = {k: kwargs[k] for k in (\\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\")}\\n return cls(artifact_id=canonical_hash(payload), **kwargs)\",\"source_sha256\":\"f4859325ffab449c366e56333f48078b1a221897653cdc2a348eea73fdd8ba28\"},{\"name\":\"__post_init__\",\"node\":\"FunctionDef\",\"path\":\"runtime_integrity.py\",\"source\":\"def __post_init__(self) -> None:\\n _aware(self.deployed_at, \\\"deployment deployed_at\\\"); _aware(self.issued_at, \\\"deployment issued_at\\\")\\n if self.issued_at < self.deployed_at:\\n raise DemonovError(\\\"deployment attestation cannot be issued before deployment\\\")\\n if not self.actor_id or not self.authority_provider_id:\\n raise DemonovError(\\\"deployment attestation identity fields are required\\\")\\n for n in (\\\"subject_id\\\",\\\"source_tree_hash\\\",\\\"dependency_lock_hash\\\",\\\"executable_artifact_hash\\\",\\n \\\"runtime_environment_hash\\\",\\\"effective_config_hash\\\",\\\"authority_receipt_hash\\\"):\\n _hex64(getattr(self,n),n)\\n if self.feature_extractor_code_hash: _hex64(self.feature_extractor_code_hash,\\\"feature_extractor_code_hash\\\")\\n if self.attestation_id != self.content_hash:\\n raise DemonovError(\\\"deployment attestation id must be content-addressed\\\")\",\"source_sha256\":\"a98af80953a22a18bb46c75e43b09921d13d2c60d952a2d111fdd663345f1b7a\"},{\"name\":\"content_hash\",\"node\":\"FunctionDef\",\"path\":\"runtime_integrity.py\",\"source\":\"def content_hash(self) -> str:\\n payload={\\\"subject_kind\\\":self.subject_kind,\\\"subject_id\\\":self.subject_id,\\\"actor_id\\\":self.actor_id,\\n \\\"source_tree_hash\\\":self.source_tree_hash,\\\"dependency_lock_hash\\\":self.dependency_lock_hash,\\n \\\"executable_artifact_hash\\\":self.executable_artifact_hash,\\\"runtime_environment_hash\\\":self.runtime_environment_hash,\\n \\\"effective_config_hash\\\":self.effective_config_hash,\\\"deployed_at\\\":self.deployed_at,\\\"issued_at\\\":self.issued_at,\\n \\\"authority_provider_id\\\":self.authority_provider_id,\\\"authority_receipt_hash\\\":self.authority_receipt_hash}\\n if self.feature_extractor_code_hash: payload[\\\"feature_extractor_code_hash\\\"]=self.feature_extractor_code_hash\\n return canonical_hash(payload)\",\"source_sha256\":\"544b46e605c9a988693451af639cce42e20f359ae9dd69baa47b3780e4525ed1\"},{\"name\":\"build\",\"node\":\"FunctionDef\",\"path\":\"runtime_integrity.py\",\"source\":\"def build(cls, **kwargs) -> \\\"DeploymentAttestation\\\":\\n payload={k:kwargs[k] for k in (\\\"subject_kind\\\",\\\"subject_id\\\",\\\"actor_id\\\",\\\"source_tree_hash\\\",\\\"dependency_lock_hash\\\",\\n \\\"executable_artifact_hash\\\",\\\"runtime_environment_hash\\\",\\\"effective_config_hash\\\",\\\"deployed_at\\\",\\\"issued_at\\\",\\n \\\"authority_provider_id\\\",\\\"authority_receipt_hash\\\")}\\n if kwargs.get(\\\"feature_extractor_code_hash\\\"): payload[\\\"feature_extractor_code_hash\\\"]=kwargs[\\\"feature_extractor_code_hash\\\"]\\n return cls(attestation_id=canonical_hash(payload),**kwargs)\",\"source_sha256\":\"58286208dcbf95fffbf6775c550cbb0e4cb2eee55a6e89610d3c55cf6a57183c\"},{\"name\":\"__post_init__\",\"node\":\"FunctionDef\",\"path\":\"runtime_integrity.py\",\"source\":\"def __post_init__(self) -> None:\\n _aware(self.started_at, \\\"predictor runtime started_at\\\")\\n if self.ended_at is not None:\\n _aware(self.ended_at, \\\"predictor runtime ended_at\\\")\\n if self.ended_at <= self.started_at: raise DemonovError(\\\"predictor runtime ended_at must follow started_at\\\")\\n if not self.consumer_id or not self.final_model_registry_id:\\n raise DemonovError(\\\"predictor runtime identity fields required\\\")\\n for n in (\\\"source_tree_hash\\\",\\\"dependency_lock_hash\\\",\\\"runtime_environment_hash\\\",\\\"executable_artifact_hash\\\",\\\"effective_config_hash\\\",\\\"feature_extractor_code_hash\\\",\\\"deployment_receipt_hash\\\"):\\n _hex64(getattr(self,n),n)\\n if self.predictor_runtime_id != self.content_hash:\\n raise DemonovError(\\\"predictor runtime id must be content-addressed\\\")\",\"source_sha256\":\"6387ddecd12c2c2af99dd5d683b4e12d35b045cf938d3ee15f672f1b1a67795f\"},{\"name\":\"content_hash\",\"node\":\"FunctionDef\",\"path\":\"runtime_integrity.py\",\"source\":\"def content_hash(self) -> str:\\n return canonical_hash({k:getattr(self,k) for k in (\\n \\\"consumer_id\\\",\\\"source_tree_hash\\\",\\\"dependency_lock_hash\\\",\\\"runtime_environment_hash\\\",\\\"executable_artifact_hash\\\",\\\"effective_config_hash\\\",\\n \\\"final_model_registry_id\\\",\\\"feature_extractor_code_hash\\\",\\\"started_at\\\",\\\"ended_at\\\",\\\"deployment_receipt_hash\\\"\\n )})\",\"source_sha256\":\"df6127715e3a641101bfec75454672d73e712342aa989fa0b674c865d3d4424d\"},{\"name\":\"build\",\"node\":\"FunctionDef\",\"path\":\"runtime_integrity.py\",\"source\":\"def build(cls, **kwargs) -> \\\"PredictorRuntimeManifest\\\":\\n payload={k:kwargs.get(k) for k in (\\n \\\"consumer_id\\\",\\\"source_tree_hash\\\",\\\"dependency_lock_hash\\\",\\\"runtime_environment_hash\\\",\\\"executable_artifact_hash\\\",\\\"effective_config_hash\\\",\\n \\\"final_model_registry_id\\\",\\\"feature_extractor_code_hash\\\",\\\"started_at\\\",\\\"ended_at\\\",\\\"deployment_receipt_hash\\\"\\n )}\\n return cls(predictor_runtime_id=canonical_hash(payload),**kwargs)\",\"source_sha256\":\"320b24f7f9b26161be45b818701ca5f9e0ec55be2b1ade043dbcd6c3df656f2b\"}],\"content_hash\":\"def content_hash(self) -> str:\\n return canonical_hash({k: getattr(self, k) for k in (\\n \\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\"\\n )})\",\"fields\":[\"artifact_id\",\"source_tree_hash\",\"dependency_lock_hash\",\"build_recipe_hash\",\"executable_artifact_hash\",\"runtime_environment_hash\"],\"formula\":null,\"post_init\":\"def __post_init__(self) -> None:\\n for name in (\\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\"):\\n _hex64(getattr(self, name), name)\\n if self.artifact_id != self.content_hash:\\n raise DemonovError(\\\"runtime artifact id must be content-addressed\\\")\"}\nSB043K_OLD_ARTIFACT_INPUTS={\"base_image_id\":\"sha256:008ab480142056d1f0b628e6c17bb6b99b30b8b4f59f24e31d972a4a128a8602\",\"base_image_ref\":\"8020-demonov-shadow:ac7094a76ddc06f376d71a76432af7c2dd10ec7d\",\"candidate_pool\":{\"base_image_id\":\"008ab480142056d1f0b628e6c17bb6b99b30b8b4f59f24e31d972a4a128a8602\",\"base_rootfs_layers_canonical\":\"caf591ce9164d30a1fa64b2ca25d9728b116468c9410a883543bf3d696f3ced1\",\"compose_sha256\":\"6461532b0a04decc60fe1d1885990020e886d40de40c0523e34e2849600af061\",\"dockerfile_sha256\":\"901951def73961f76d2c2a93c5428a0fbdcc50113d42b39da92983a5ce157cb8\",\"file:runtime_integrity.py\":\"99859b63e23d10fc051672965123f49d6e79d2ff767871c019ff7bdae2e2e39e\",\"file:runtime_manifest.py\":\"1064cfb74303fdc8e0bf50bae95b1e755556a5b1dfc28b2b062341becaba08f2\",\"old_application_image_id\":\"403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736\",\"old_dir_canonical_list_full\":\"af83cb6b6b1b0f01f5453bd2dd6048c42b1f194bee6f6323b91e90efec30ef1f\",\"old_dir_canonical_list_sha\":\"708d044de397034bcdde99398f1014aceee0e9f58a7870e459c6d57879e2b552\",\"old_dir_canonical_path_sha\":\"d32002a8dd2b78e63ac30bef3f1c8b4c18373509c98c92173a9f82386f53afd4\",\"old_dir_canonical_path_size_sha\":\"0c7eac692accfd22113cebffb7897863370052731578418a5103e4004b749c7c\",\"old_dir_concat_path_sha\":\"3a0e01804936792ff9159b896d17b5bcd2b0b0d61eacb331fd93ccaceb5411df\",\"old_dir_concat_sha\":\"b39e64671adfa8a6cfac27ff4bac745ee5dc5b0b90d28f1a9e24b48de307e6ae\",\"old_image_config\":\"403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736\",\"old_image_config_canonical\":\"27884bcdb5825bb3f2207da59a46451dac4e65a34b6af18db04266607e151d0e\",\"old_image_id\":\"403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736\",\"old_rootfs_layers_canonical\":\"624aba0d14a23d453be78b45a360bfa5c724ddd3d01946930f8a76a4341d17fa\",\"old_tar_canonical_list_full\":\"43b6ae1658ff777a219266ce66f2de7d8f9f3d9b3c8428f5d11b0c90aff6a581\",\"old_tar_canonical_list_sha\":\"c6a1b005a330a0e5a73658fcbf7557a0645b1fca9fa05fe87955c26c06d1e4ac\",\"old_tar_canonical_path_sha\":\"3b7df8cf67359efaa32f20d35a23636fe24a2a0f0f74d465c234eb92c6496733\",\"old_tar_canonical_path_size_sha\":\"0579c2e9c3cfbacf9db2c6d7b1a05705305e63e130a74f89ff42d01fc5802b0f\",\"old_tar_concat_path_sha\":\"dc1843e1ada353efcb935031b5783a677d5656310700c83e885c688829406f91\",\"old_tar_concat_sha\":\"b39e64671adfa8a6cfac27ff4bac745ee5dc5b0b90d28f1a9e24b48de307e6ae\",\"old_tar_strip_canonical_list_full\":\"af83cb6b6b1b0f01f5453bd2dd6048c42b1f194bee6f6323b91e90efec30ef1f\",\"old_tar_strip_canonical_list_sha\":\"708d044de397034bcdde99398f1014aceee0e9f58a7870e459c6d57879e2b552\",\"old_tar_strip_canonical_path_sha\":\"d32002a8dd2b78e63ac30bef3f1c8b4c18373509c98c92173a9f82386f53afd4\",\"old_tar_strip_canonical_path_size_sha\":\"0c7eac692accfd22113cebffb7897863370052731578418a5103e4004b749c7c\",\"old_tar_strip_concat_path_sha\":\"3a0e01804936792ff9159b896d17b5bcd2b0b0d61eacb331fd93ccaceb5411df\",\"old_tar_strip_concat_sha\":\"b39e64671adfa8a6cfac27ff4bac745ee5dc5b0b90d28f1a9e24b48de307e6ae\",\"package_gzip_sha256\":\"389e7aabca8887ee3b48b6ff0b4affe1163216005a4888013d9ccc82ea360e32\",\"package_tar_sha256\":\"431ddf9e8938d5e583553f05f9e3d019aff0b439c83b0b23c81808073b7d61a8\"},\"old_image_id\":\"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736\",\"old_manifest\":{\"application_image_id\":\"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736\",\"base_image_digest\":\"sha256:881d80734ee05dca6f7f42dcb080975652a53c7eda9ba1f03bb8da31aa6a6ec2\",\"code_identity\":\"e32760c69a4311728db9066ee8bf2bf66b1e5a70\",\"compose_hash\":\"6461532b0a04decc60fe1d1885990020e886d40de40c0523e34e2849600af061\",\"finality_policy_id\":\"BITFINEX_SEQ_ALL_D1_V1\",\"package_identity\":\"637acba19fb29c98408a8031dc9265a31dc36551c666fcf0b287e8af83d2b893\",\"runtime_manifest_id\":\"58d3b59200bdc0eb8d448612679d667b194263586cb3198dfc08597935053a1a\"},\"old_package_identity\":\"637acba19fb29c98408a8031dc9265a31dc36551c666fcf0b287e8af83d2b893\",\"tar_meta\":{\"gzip_bytes\":208049,\"gzip_sha256\":\"389e7aabca8887ee3b48b6ff0b4affe1163216005a4888013d9ccc82ea360e32\",\"tar_bytes\":1157120,\"tar_sha256\":\"431ddf9e8938d5e583553f05f9e3d019aff0b439c83b0b23c81808073b7d61a8\"}}\nSB043K_REPRODUCTION=[]\nSB043K_OLD_DEPLOY_REFERENCES=[{\"path\":\"demonov_forward_map/__init__.py\",\"snippets\":[\" ClockDomainKind, ClockDomainSpec, ClockDomainRegistry, ClockSynchronizationPolicy, ClockAttestation,\",\" verify_clock_synchronization, WindowClockClassification, classify_event_time_with_clock_guard,\",\" FrozenConfigMapping, EffectiveConfigSnapshot, RuntimeArtifactManifest, RuntimeEpoch, RuntimeRegistry,\",\" ProducerSessionDeclaration, ProducerSessionCatalog, CollectorTopologyPolicy, CollectorReceiptRecord,\",\" CollectorReceiptStore, AuthoritativeProducerWatermark, CaptureCompletenessPolicy, verify_capture_through_watermark,\"]},{\"path\":\"demonov_forward_map/runtime_integrity.py\",\"snippets\":[\"\",\"@dataclass(frozen=True)\",\"class RuntimeArtifactManifest:\",\" artifact_id: str\",\" source_tree_hash: str\",\"class RuntimeArtifactManifest:\",\" artifact_id: str\",\" source_tree_hash: str\",\" dependency_lock_hash: str\",\" build_recipe_hash: str\",\" artifact_id: str\",\" source_tree_hash: str\",\" dependency_lock_hash: str\",\" build_recipe_hash: str\",\" executable_artifact_hash: str\",\" source_tree_hash: str\",\" dependency_lock_hash: str\",\" build_recipe_hash: str\",\" executable_artifact_hash: str\",\" runtime_environment_hash: str\",\" dependency_lock_hash: str\",\" build_recipe_hash: str\",\" executable_artifact_hash: str\",\" runtime_environment_hash: str\",\"\",\"\",\" def __post_init__(self) -> None:\",\" for name in (\\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\"):\",\" _hex64(getattr(self, name), name)\",\" if self.artifact_id != self.content_hash:\",\" def content_hash(self) -> str:\",\" return canonical_hash({k: getattr(self, k) for k in (\",\" \\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\"\",\" )})\",\"\",\"\",\" @classmethod\",\" def build(cls, **kwargs) -> \\\"RuntimeArtifactManifest\\\":\",\" payload = {k: kwargs[k] for k in (\\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\")}\",\" return cls(artifact_id=canonical_hash(payload), **kwargs)\",\" @classmethod\",\" def build(cls, **kwargs) -> \\\"RuntimeArtifactManifest\\\":\",\" payload = {k: kwargs[k] for k in (\\\"source_tree_hash\\\", \\\"dependency_lock_hash\\\", \\\"build_recipe_hash\\\", \\\"executable_artifact_hash\\\", \\\"runtime_environment_hash\\\")}\",\" return cls(artifact_id=canonical_hash(payload), **kwargs)\",\"\",\"class RuntimeRegistry:\",\" registry_id: str\",\" artifacts: Tuple[RuntimeArtifactManifest, ...]\",\" configs: Tuple[EffectiveConfigSnapshot, ...]\",\" epochs: Tuple[RuntimeEpoch, ...]\",\" for e in self.epochs:\",\" if e.artifact_id not in amap or e.config_id not in cmap: raise DemonovError(\\\"runtime epoch references missing artifact/config\\\")\",\" if e.producer_code_hash != amap[e.artifact_id].source_tree_hash:\",\" raise DemonovError(\\\"runtime epoch producer_code_hash must equal frozen artifact source_tree_hash\\\")\",\" # No overlapping epochs per producer; otherwise event->runtime binding is ambiguous.\",\" if e.artifact_id not in amap or e.config_id not in cmap: raise DemonovError(\\\"runtime epoch references missing artifact/config\\\")\",\" if e.producer_code_hash != amap[e.artifact_id].source_tree_hash:\",\" raise DemonovError(\\\"runtime epoch producer_code_hash must equal frozen artifact source_tree_hash\\\")\",\" # No overlapping epochs per producer; otherwise event->runtime binding is ambiguous.\",\" for producer in {e.producer_id for e in self.epochs}:\",\"\",\" @classmethod\",\" def build(cls, *, artifacts: Iterable[RuntimeArtifactManifest], configs: Iterable[EffectiveConfigSnapshot], epochs: Iterable[RuntimeEpoch]) -> \\\"RuntimeRegistry\\\":\",\" a, c, e = tuple(artifacts), tuple(configs), tuple(epochs)\",\" payload = {\\\"artifacts\\\": tuple(sorted(x.artifact_id for x in a)), \\\"configs\\\": tuple(sorted(x.config_id for x in c)), \\\"epochs\\\": tuple(sorted(x.epoch_id for x in e))}\",\" subject_id: str\",\" actor_id: str\",\" source_tree_hash: str\",\" dependency_lock_hash: str\",\" executable_artifact_hash: str\",\" actor_id: str\",\" source_tree_hash: str\",\" dependency_lock_hash: str\",\" executable_artifact_hash: str\",\" runtime_environment_hash: str\",\" source_tree_hash: str\",\" dependency_lock_hash: str\",\" executable_artifact_hash: str\",\" runtime_environment_hash: str\",\" effective_config_hash: str\"]},{\"path\":\"runtime_manifest.json\",\"snippets\":[\" \\\"compose_hash\\\": \\\"6461532b0a04decc60fe1d1885990020e886d40de40c0523e34e2849600af061\\\",\",\" \\\"finality_policy_id\\\": \\\"BITFINEX_SEQ_ALL_D1_V1\\\",\",\" \\\"package_identity\\\": \\\"637acba19fb29c98408a8031dc9265a31dc36551c666fcf0b287e8af83d2b893\\\",\",\" \\\"runtime_manifest_id\\\": \\\"58d3b59200bdc0eb8d448612679d667b194263586cb3198dfc08597935053a1a\\\"\",\"}\"]}]\nSB043K_SOURCE_COUNTS={\"new_files\":57,\"old_files\":57}\nSB043K_HOLDS=[\"ARTIFACT_CONTENT_HASH_FORMULA_NOT_EXTRACTED\",\"OLD_PACKAGE_ID_NOT_REPRODUCED\"]\nSB043K_DECISION=HOLD_ARTIFACT_CONTENT_HASH_FORMULA_NOT_EXTRACTED__OLD_PACKAGE_ID_NOT_REPRODUCED\nSB043K_MUTATION_SCOPE=NONE_READ_ONLY\nSIGNALBOT043K_DECISION=HOLD_GUEST_PACKAGE_RCA\n" } diff --git a/runtime/latest.txt b/runtime/latest.txt index 7b5a8c80..1e68d0b6 100644 --- a/runtime/latest.txt +++ b/runtime/latest.txt @@ -1,22 +1,22 @@ CHAT_OUTPUT_BEGIN -COMMAND_ID=NEWFI-260908-A-STAGINGEDGE-WAN-FORENSIC4 -STATUS=OK -RC=0 +COMMAND_ID=SIGNALBOT-260908-PACKAGE-SEAL-RCA-043PKG +STATUS=FAIL +RC=3 HOST=pve01 MODE=read-only -COMPONENT=newfi-staging-edge-wan-ingress-fingerprint-readonly +COMPONENT=signalbot-cr0116-package-seal-rca REFERENCE_REGISTER_CHECK=OK REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66 ERROR_REGISTER_CHECK=OK ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0 -COMMAND_SHA256=c48937b9e90fbb12e1163dd4fe9f9069aeadf0727df5f3dd9fa9e6463eafcf71 +COMMAND_SHA256=08ece8490c12004f2f6511bfb5dbcef29ab38d4385dbb224a48ba5d4a3dbfbaf DUPLICATE_FAILED_COMMAND_BLOCKED=false EXECUTION_STARTED=true CHANGE_DECLARED=false RESULT_CONTRACT_VALID=true RESULT_CONTRACT_STATUS=NOT_APPLICABLE RESULT_CONTRACT_ERROR=NONE -COMMAND_RC=0 +COMMAND_RC=3 CHANGES_MADE=false ROLLBACK_STARTED=false ROLLBACK_RESTORED=null @@ -24,30 +24,22 @@ MUTATION_OUTCOME=NO_MUTATION SANITIZED=yes SECRETS_INCLUDED=no PRIVATE_ADDRESSES_INCLUDED=no -RAW_EVIDENCE_SHA256=1c2a8d51054b0e77c038cc7faf67b9051421f348c323a853d9a1c3dfe476d63c -SANITIZED_OUTPUT_SHA256=44c61172b647a23279b3079ec7ed28adf5bf9c5aabe5f14df66dbbe60d7f1085 +RAW_EVIDENCE_SHA256=5a54891c071a17faf298b6f4df768f618290aac210aadeb4e5117d67b35ab713 +SANITIZED_OUTPUT_SHA256=5a54891c071a17faf298b6f4df768f618290aac210aadeb4e5117d67b35ab713 OUTPUT_BEGIN -WAN_FORENSIC4_BEGIN=true -COMMAND_ID=NEWFI-260908-A-STAGINGEDGE-WAN-FORENSIC4 -MODE=read-only -MUTATIONS_PERFORMED=NO ERROR_REGISTER_CHECK=OK -ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0 REFERENCE_CHECK=OK -REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66 AUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED -PRIOR_FORENSIC3_GATE=PASS -PRIOR_FORENSIC3_HISTORY_SHA256=9ea1a89282975837b1a5ceaf5a2dcc47227f57b74b18db2dcae0d4c0044f9810 -EDGE_IDENTITY={"err":"","hostname":"edge-vm","rc":0} -EDGE_PRIMARY_LAN_ROUTE={"err":"","raw":"[{\"dst\":\"[PRIVATE_IP]\",\"dev\":\"eth0\",\"prefsrc\":\"[PRIVATE_IP]\",\"flags\":[],\"uid\":0,\"cache\":[]}]","rc":0,"sources":["[PRIVATE_IP]"]} -EDGE_EGRESS_TWO_PROBES={"err":"","rc":0,"valid_public_ipv4":["85.121.4.192","85.121.4.192"],"values":["85.121.4.192","85.121.4.192"]} -LOCAL_NPMPLUS_GIT_CERT={"cert":"sha256 Fingerprint=70:7E:D6:56:03:3C:03:C4:B4:2F:DE:D8:3F:97:00:C1:0C:EF:FD:2D:2E:2D:98:A7:56:C8:B1:9C:DF:1D:AB:63\nsubject=CN=git.gram1.ru\nissuer=C=US, O=Let's Encrypt, CN=YE1\nserial=05499CF6D49C49CDFC8DBF28C4B9F9FBC55A\nnotBefore=Aug 13 22:08:59 2026 GMT\nnotAfter=Nov 11 22:08:58 2026 GMT","err":"","fingerprint":"707ED656033C03C4B42FDED83F9700C10CEFFD2D2E2D98A756C8B19CDF1DAB63","rc":0} -DIRECT_PRIVATE_EDGE_GIT_PROBES=[{"cert":"sha256 Fingerprint=70:7E:D6:56:03:3C:03:C4:B4:2F:DE:D8:3F:97:00:C1:0C:EF:FD:2D:2E:2D:98:A7:56:C8:B1:9C:DF:1D:AB:63\nsubject=CN=git.gram1.ru\nissuer=C=US, O=Let's Encrypt, CN=YE1\nserial=05499CF6D49C49CDFC8DBF28C4B9F9FBC55A\nnotBefore=Aug 13 22:08:59 2026 GMT\nnotAfter=Nov 11 22:08:58 2026 GMT","curl":{"err":"","http":"200","rc":0},"err":"","fingerprint":"707ED656033C03C4B42FDED83F9700C10CEFFD2D2E2D98A756C8B19CDF1DAB63","ip":"[PRIVATE_IP]","rc":0}] -EDGE_EGRESS_GIT_PROBES=[{"cert":"","curl":{"err":"curl: (28) Connection timed out after 18002 milliseconds\n","http":"000","rc":28},"err":"Could not find certificate from \n","fingerprint":null,"ip":"85.121.4.192","rc":1}] -OLD_PUBLIC_GIT_CERT={"cert":"sha256 Fingerprint=EC:B6:9D:0F:A8:39:FE:D0:4D:C2:3E:E2:43:F9:F8:67:3C:BF:CD:0A:00:88:BF:D3:EF:7D:8B:94:33:14:D6:CB\nsubject=CN=git.gram1.ru\nissuer=C=US, O=Let's Encrypt, CN=YE1\nserial=0668B385C8D6C5BBB0435761F84FADD0DB23\nnotBefore=Aug 17 02:03:29 2026 GMT\nnotAfter=Nov 15 02:03:28 2026 GMT","curl":{"err":"","http":"200","rc":0},"err":"","fingerprint":"ECB69D0FA839FED04DC23EE243F9F8673CBFCD0A0088BFD3EF7D8B943314D6CB","ip":"185.225.35.6","rc":0} -WAN_INGRESS_FINGERPRINT_DECISION={"egress_match_count":0,"egress_match_ips":[],"egress_two_probes_same":true,"local_fingerprint":"707ED656033C03C4B42FDED83F9700C10CEFFD2D2E2D98A756C8B19CDF1DAB63","old_public_fingerprint":"ECB69D0FA839FED04DC23EE243F9F8673CBFCD0A0088BFD3EF7D8B943314D6CB","old_public_matches_local":false,"private_match_count":1,"private_match_ips":["[PRIVATE_IP]"]} -FINAL_DECISION=EDGE_EGRESS_NOT_YET_PROVEN_AS_NPMPLUS_PUBLIC_INGRESS -WAN_FORENSIC4_END=true +SB043K_PRESTATE={"active_env":{"APP_IMAGE":"8020-demonov-shadow:e32760c69a4311728db9066ee8bf2bf66b1e5a70","CODE_IDENTITY":"e32760c69a4311728db9066ee8bf2bf66b1e5a70","COLLECTION_START_AT":"2026-09-07T00:00:00+00:00","EXPERIMENT_ID":"ec477ea41ecbd5cfdef5afc259595aab20674a7d933f41a389329ff05098b338","RUNTIME_MANIFEST_ID":"58d3b59200bdc0eb8d448612679d667b194263586cb3198dfc08597935053a1a"},"services":[{"container_id":"a546a70c3e8c263d9b590cd78ee206bcda0cfcdb6662327e8415ca0e29ad1501","image":"8020-demonov-shadow:e32760c69a4311728db9066ee8bf2bf66b1e5a70","image_id":"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736","restart_count":14,"running":true,"service":"collector","started_at":"2026-09-08T07:38:09.79483772Z"},{"container_id":"d8023f4cbf91f9382e39eec0436c9cebc7665535b42b950e95408c03ff9bf30d","image":"8020-demonov-shadow:e32760c69a4311728db9066ee8bf2bf66b1e5a70","image_id":"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736","restart_count":0,"running":true,"service":"relay","started_at":"2026-09-06T18:48:20.603414848Z"},{"container_id":"1feeca2d9428cd5a277c026bef34534db307657dcdcd63aff98ea66e44f8b9c5","image":"8020-demonov-shadow:e32760c69a4311728db9066ee8bf2bf66b1e5a70","image_id":"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736","restart_count":0,"running":true,"service":"shadow","started_at":"2026-09-06T18:48:20.768190553Z"},{"container_id":"889be41d2cee9d327811da78388f834ba6eafe4c0eeae456867ed0df76832d01","image":"8020-demonov-shadow:e32760c69a4311728db9066ee8bf2bf66b1e5a70","image_id":"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736","restart_count":0,"running":true,"service":"worker","started_at":"2026-09-06T18:48:20.586788319Z"}],"stage_result":{"active_env_unchanged":true,"build_context":"/opt/stacks/8020-demonov-shadow/.deploy/SIGNALBOT-260908-DEPLOY-STAGE-042FIX5","collector_source_sha256":"193dd0c7f9890fdb4026c24dbc5add825f1641d92097e881806705ca452812d5","copy_source":"/opt/stacks/8020-demonov-shadow/.deploy/SIGNALBOT-260908-DEPLOY-STAGE-042FIX5/demonov_forward_map","decision":"DEPLOY_STAGE_READY","dockerfile":"/opt/stacks/8020-demonov-shadow/.deploy/SIGNALBOT-260908-DEPLOY-STAGE-042FIX5/Dockerfile","helper_candidates":{"demonov_forward_map.live_prospective":[{"name":"_hash","pure_candidate":true,"signature":"(value: 'object') -> 'str'"}],"demonov_forward_map.runtime_integrity":[{"name":"canonical_hash","pure_candidate":true,"signature":"(payload: 'Any') -> 'str'"},{"name":"verify_experiment_seal_receipt","pure_candidate":true,"signature":"(*, bundle: 'FinalProspectiveSealBundle', receipt: 'ExperimentSealReceipt', collection_start_at: 'datetime', receipt_verifier: 'Callable[[ExperimentSealReceipt], bool]') -> 'None'"},{"name":"required_retained_hashes","pure_candidate":true,"signature":"(*, runtime_registry: 'RuntimeRegistry', model_registry: 'FinalModelRegistry', state_snapshots: 'Sequence[StateSnapshotManifest]' = (), predictor_runtime: 'PredictorRuntimeManifest | None' = None) -> 'Mapping[str, RetainedArtifactKind]'"}],"demonov_forward_map.runtime_manifest":[{"name":"canonical_hash","pure_candidate":true,"signature":"(payload: 'Any') -> 'str'"},{"name":"verify_runtime_manifest","pure_candidate":true,"signature":"(manifest: 'RuntimeDeploymentManifestV1', *, expected_code_identity: 'str', actual_image_id: 'str', actual_package_identity: 'str') -> 'None'"}]},"new_image":"8020-demonov-shadow:76e1f58baa544a0e208bba317f0150e5b6d74dbd","new_image_id":"sha256:341f71a906c91d3fa9c1d50bd89df2a849dfb0b168bb4551efb444bf61c4ab99","policy":{"close_timeout":5,"open_timeout":10,"ping_interval":20,"ping_timeout":60},"runtime_activated":false,"service_identity_unchanged":true,"stage_path":"/opt/stacks/8020-demonov-shadow/.deploy/SIGNALBOT-260908-DEPLOY-STAGE-042FIX5","websockets_version":"15.0.1"}} +SB043K_ARTIFACT_CLASS={"constructors":[{"name":"RuntimeArtifactManifest","node":"ClassDef","path":"runtime_integrity.py","source":"class RuntimeArtifactManifest:\n artifact_id: str\n source_tree_hash: str\n dependency_lock_hash: str\n build_recipe_hash: str\n executable_artifact_hash: str\n runtime_environment_hash: str\n\n def __post_init__(self) -> None:\n for name in (\"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\"):\n _hex64(getattr(self, name), name)\n if self.artifact_id != self.content_hash:\n raise DemonovError(\"runtime artifact id must be content-addressed\")\n\n @property\n def content_hash(self) -> str:\n return canonical_hash({k: getattr(self, k) for k in (\n \"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\"\n )})\n\n @classmethod\n def build(cls, **kwargs) -> \"RuntimeArtifactManifest\":\n payload = {k: kwargs[k] for k in (\"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\")}\n return cls(artifact_id=canonical_hash(payload), **kwargs)","source_sha256":"8cd1ebf70c003cd4d7b91f18602841426b19c2f54f2d803309c53c22f38cd5c7"},{"name":"DeploymentAttestation","node":"ClassDef","path":"runtime_integrity.py","source":"class DeploymentAttestation:\n attestation_id: str\n subject_kind: DeploymentSubjectKind\n subject_id: str\n actor_id: str\n source_tree_hash: str\n dependency_lock_hash: str\n executable_artifact_hash: str\n runtime_environment_hash: str\n effective_config_hash: str\n deployed_at: datetime\n issued_at: datetime\n authority_provider_id: str\n authority_receipt_hash: str\n feature_extractor_code_hash: str = \"\"\n\n def __post_init__(self) -> None:\n _aware(self.deployed_at, \"deployment deployed_at\"); _aware(self.issued_at, \"deployment issued_at\")\n if self.issued_at < self.deployed_at:\n raise DemonovError(\"deployment attestation cannot be issued before deployment\")\n if not self.actor_id or not self.authority_provider_id:\n raise DemonovError(\"deployment attestation identity fields are required\")\n for n in (\"subject_id\",\"source_tree_hash\",\"dependency_lock_hash\",\"executable_artifact_hash\",\n \"runtime_environment_hash\",\"effective_config_hash\",\"authority_receipt_hash\"):\n _hex64(getattr(self,n),n)\n if self.feature_extractor_code_hash: _hex64(self.feature_extractor_code_hash,\"feature_extractor_code_hash\")\n if self.attestation_id != self.content_hash:\n raise DemonovError(\"deployment attestation id must be content-addressed\")\n\n @property\n def content_hash(self) -> str:\n payload={\"subject_kind\":self.subject_kind,\"subject_id\":self.subject_id,\"actor_id\":self.actor_id,\n \"source_tree_hash\":self.source_tree_hash,\"dependency_lock_hash\":self.dependency_lock_hash,\n \"executable_artifact_hash\":self.executable_artifact_hash,\"runtime_environment_hash\":self.runtime_environment_hash,\n \"effective_config_hash\":self.effective_config_hash,\"deployed_at\":self.deployed_at,\"issued_at\":self.issued_at,\n \"authority_provider_id\":self.authority_provider_id,\"authority_receipt_hash\":self.authority_receipt_hash}\n if self.feature_extractor_code_hash: payload[\"feature_extractor_code_hash\"]=self.feature_extractor_code_hash\n return canonical_hash(payload)\n\n @classmethod\n def build(cls, **kwargs) -> \"DeploymentAttestation\":\n payload={k:kwargs[k] for k in (\"subject_kind\",\"subject_id\",\"actor_id\",\"source_tree_hash\",\"dependency_lock_hash\",\n \"executable_artifact_hash\",\"runtime_environment_hash\",\"effective_config_hash\",\"deployed_at\",\"issued_at\",\n \"authority_provider_id\",\"authority_receipt_hash\")}\n if kwargs.get(\"feature_extractor_code_hash\"): payload[\"feature_extractor_code_hash\"]=kwargs[\"feature_extractor_code_hash\"]\n return cls(attestation_id=canonical_hash(payload),**kwargs)","source_sha256":"1b0ca84bb035dfb7ff441ce73bbe8ee5f140a07b4a821f5a9f55770b585ffac7"},{"name":"verify_final_deployment_attestations","node":"FunctionDef","path":"runtime_integrity.py","source":"def verify_final_deployment_attestations(*, runtime_registry: RuntimeRegistry, producer_id: str,\n predictor_runtime: \"PredictorRuntimeManifest\",\n attestations: Sequence[DeploymentAttestation],\n policy: DeploymentAttestationPolicy,\n collection_start_at: datetime,\n receipt_verifier: Callable[[DeploymentAttestation], bool]) -> None:\n _aware(collection_start_at,\"collection_start_at\")\n relevant_epochs=[e for e in runtime_registry.epochs if e.producer_id==producer_id and e.contains(collection_start_at)]\n if len(relevant_epochs)!=1:\n raise DemonovError(\"collection start must resolve to exactly one producer runtime epoch for deployment proof\")\n epoch=relevant_epochs[0]\n artifact=next((a for a in runtime_registry.artifacts if a.artifact_id==epoch.artifact_id),None)\n if artifact is None: raise DemonovError(\"producer deployment proof references missing runtime artifact\")\n expected={\n (DeploymentSubjectKind.PRODUCER_RUNTIME_EPOCH,epoch.epoch_id):(\n producer_id,artifact.source_tree_hash,artifact.dependency_lock_hash,artifact.executable_artifact_hash,\n artifact.runtime_environment_hash,epoch.config_id,\"\",epoch.started_at),\n (DeploymentSubjectKind.PREDICTOR_RUNTIME,predictor_runtime.predictor_runtime_id):(\n predictor_runtime.consumer_id,predictor_runtime.source_tree_hash,predictor_runtime.dependency_lock_hash,\n predictor_runtime.executable_artifact_hash,predictor_runtime.runtime_environment_hash,predictor_runtime.effective_config_hash,\n predictor_runtime.feature_extractor_code_hash,predictor_runtime.started_at),\n }\n amap={(a.subject_kind,a.subject_id):a for a in attestations}\n if len(amap)!=len(attestations): raise DemonovError(\"duplicate deployment attestation subject\")\n if set(amap)!=set(expected): raise DemonovError(\"deployment attestation set differs from exact producer/predictor subjects\")\n for key,(actor,src,dep,exe,env,cfg,feature,start) in expected.items():\n a=amap[key]\n if a.authority_provider_id!=policy.authority_provider_id or not receipt_verifier(a):\n raise DemonovError(\"deployment attestation authority verification failed\")\n if (a.actor_id,a.source_tree_hash,a.dependency_lock_hash,a.executable_artifact_hash,a.runtime_environment_hash,a.effective_config_hash)!=(actor,src,dep,exe,env,cfg):\n raise DemonovError(\"deployment attestation artifact/config identity mismatch\")\n if key[0] is DeploymentSubjectKind.PREDICTOR_RUNTIME and a.feature_extractor_code_hash!=feature:\n raise DemonovError(\"predictor deployment attestation feature extractor mismatch\")\n if key[0] is DeploymentSubjectKind.PRODUCER_RUNTIME_EPOCH and a.feature_extractor_code_hash:\n raise DemonovError(\"producer deployment attestation must not invent challenger feature extractor\")\n if abs((a.deployed_at-start).total_seconds()) > policy.max_start_skew_seconds:\n raise DemonovError(\"deployment attestation outside frozen runtime-start skew\")\n if policy.require_precollection_attestation and a.issued_at >= collection_start_at:\n raise DemonovError(\"deployment attestation must be externally issued strictly before collection start\")","source_sha256":"9fc5b8d032d6a7b31f6b4e21d15142fe20b1fde4fe30a06fb758ad264bdeac9d"},{"name":"PredictorRuntimeManifest","node":"ClassDef","path":"runtime_integrity.py","source":"class PredictorRuntimeManifest:\n predictor_runtime_id: str\n consumer_id: str\n source_tree_hash: str\n dependency_lock_hash: str\n runtime_environment_hash: str\n executable_artifact_hash: str\n effective_config_hash: str\n final_model_registry_id: str\n feature_extractor_code_hash: str\n started_at: datetime\n ended_at: datetime | None\n deployment_receipt_hash: str\n\n def __post_init__(self) -> None:\n _aware(self.started_at, \"predictor runtime started_at\")\n if self.ended_at is not None:\n _aware(self.ended_at, \"predictor runtime ended_at\")\n if self.ended_at <= self.started_at: raise DemonovError(\"predictor runtime ended_at must follow started_at\")\n if not self.consumer_id or not self.final_model_registry_id:\n raise DemonovError(\"predictor runtime identity fields required\")\n for n in (\"source_tree_hash\",\"dependency_lock_hash\",\"runtime_environment_hash\",\"executable_artifact_hash\",\"effective_config_hash\",\"feature_extractor_code_hash\",\"deployment_receipt_hash\"):\n _hex64(getattr(self,n),n)\n if self.predictor_runtime_id != self.content_hash:\n raise DemonovError(\"predictor runtime id must be content-addressed\")\n\n @property\n def content_hash(self) -> str:\n return canonical_hash({k:getattr(self,k) for k in (\n \"consumer_id\",\"source_tree_hash\",\"dependency_lock_hash\",\"runtime_environment_hash\",\"executable_artifact_hash\",\"effective_config_hash\",\n \"final_model_registry_id\",\"feature_extractor_code_hash\",\"started_at\",\"ended_at\",\"deployment_receipt_hash\"\n )})\n\n @classmethod\n def build(cls, **kwargs) -> \"PredictorRuntimeManifest\":\n payload={k:kwargs.get(k) for k in (\n \"consumer_id\",\"source_tree_hash\",\"dependency_lock_hash\",\"runtime_environment_hash\",\"executable_artifact_hash\",\"effective_config_hash\",\n \"final_model_registry_id\",\"feature_extractor_code_hash\",\"started_at\",\"ended_at\",\"deployment_receipt_hash\"\n )}\n return cls(predictor_runtime_id=canonical_hash(payload),**kwargs)\n\n def contains(self,t:datetime)->bool:\n _aware(t,\"predictor runtime time\")\n return self.started_at <= t and (self.ended_at is None or t < self.ended_at)","source_sha256":"6514f10948abbeb0030fb06b509a8a75d796eea4d6ef4101b72e20f688985454"},{"name":"required_retained_hashes","node":"FunctionDef","path":"runtime_integrity.py","source":"def required_retained_hashes(*, runtime_registry:RuntimeRegistry, model_registry:FinalModelRegistry,\n state_snapshots:Sequence[StateSnapshotManifest]=(), predictor_runtime:PredictorRuntimeManifest | None=None)->Mapping[str,RetainedArtifactKind]:\n \"\"\"Build the minimum blob-level replay corpus required by final prospective proof.\n\n Content-addressed policy objects remain in the handoff/registry. This function\n targets blobs that cannot be reconstructed from identifiers alone.\n \"\"\"\n out:dict[str,RetainedArtifactKind]={}\n for a in runtime_registry.artifacts:\n out[a.source_tree_hash]=RetainedArtifactKind.SOURCE_TREE\n out[a.dependency_lock_hash]=RetainedArtifactKind.DEPENDENCY_LOCK\n out[a.build_recipe_hash]=RetainedArtifactKind.BUILD_RECIPE\n out[a.executable_artifact_hash]=RetainedArtifactKind.EXECUTABLE_ARTIFACT\n out[a.runtime_environment_hash]=RetainedArtifactKind.RUNTIME_ENVIRONMENT\n for a in model_registry.artifacts:\n out[a.model_freeze_hash]=RetainedArtifactKind.MODEL\n out[a.transformer_freeze_hash]=RetainedArtifactKind.TRANSFORMER\n out[a.calibration_freeze_hash]=RetainedArtifactKind.CALIBRATOR\n out[a.feature_schema_hash]=RetainedArtifactKind.FEATURE_SCHEMA\n out[a.feature_contract_hash]=RetainedArtifactKind.FEATURE_CONTRACT\n out[a.training_data_hash]=RetainedArtifactKind.TRAINING_DATA\n for s in state_snapshots:\n out[s.serialized_state_hash]=RetainedArtifactKind.STATE_SNAPSHOT\n if predictor_runtime is not None:\n out[predictor_runtime.source_tree_hash]=RetainedArtifactKind.SOURCE_TREE\n out[predictor_runtime.dependency_lock_hash]=RetainedArtifactKind.DEPENDENCY_LOCK\n out[predictor_runtime.executable_artifact_hash]=RetainedArtifactKind.EXECUTABLE_ARTIFACT\n out[predictor_runtime.runtime_environment_hash]=RetainedArtifactKind.RUNTIME_ENVIRONMENT\n out[predictor_runtime.feature_extractor_code_hash]=RetainedArtifactKind.FEATURE_EXTRACTOR_CODE\n out[predictor_runtime.effective_config_hash]=RetainedArtifactKind.EFFECTIVE_CONFIG\n return out","source_sha256":"ac6e18e76fcbd23144d1870ac03e3c2a4a1149dc4b5cf3f84fc0664228cdab1a"},{"name":"__post_init__","node":"FunctionDef","path":"runtime_integrity.py","source":"def __post_init__(self) -> None:\n for name in (\"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\"):\n _hex64(getattr(self, name), name)\n if self.artifact_id != self.content_hash:\n raise DemonovError(\"runtime artifact id must be content-addressed\")","source_sha256":"a7b5db332b3cd656bf1d8ec3b9fe7b0da2fcbddad84b529725384be99beea98a"},{"name":"content_hash","node":"FunctionDef","path":"runtime_integrity.py","source":"def content_hash(self) -> str:\n return canonical_hash({k: getattr(self, k) for k in (\n \"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\"\n )})","source_sha256":"265c6eede8cfd8f93a315ea20905befdfb4f66947538978ef6e6013872668d94"},{"name":"build","node":"FunctionDef","path":"runtime_integrity.py","source":"def build(cls, **kwargs) -> \"RuntimeArtifactManifest\":\n payload = {k: kwargs[k] for k in (\"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\")}\n return cls(artifact_id=canonical_hash(payload), **kwargs)","source_sha256":"f4859325ffab449c366e56333f48078b1a221897653cdc2a348eea73fdd8ba28"},{"name":"__post_init__","node":"FunctionDef","path":"runtime_integrity.py","source":"def __post_init__(self) -> None:\n _aware(self.deployed_at, \"deployment deployed_at\"); _aware(self.issued_at, \"deployment issued_at\")\n if self.issued_at < self.deployed_at:\n raise DemonovError(\"deployment attestation cannot be issued before deployment\")\n if not self.actor_id or not self.authority_provider_id:\n raise DemonovError(\"deployment attestation identity fields are required\")\n for n in (\"subject_id\",\"source_tree_hash\",\"dependency_lock_hash\",\"executable_artifact_hash\",\n \"runtime_environment_hash\",\"effective_config_hash\",\"authority_receipt_hash\"):\n _hex64(getattr(self,n),n)\n if self.feature_extractor_code_hash: _hex64(self.feature_extractor_code_hash,\"feature_extractor_code_hash\")\n if self.attestation_id != self.content_hash:\n raise DemonovError(\"deployment attestation id must be content-addressed\")","source_sha256":"a98af80953a22a18bb46c75e43b09921d13d2c60d952a2d111fdd663345f1b7a"},{"name":"content_hash","node":"FunctionDef","path":"runtime_integrity.py","source":"def content_hash(self) -> str:\n payload={\"subject_kind\":self.subject_kind,\"subject_id\":self.subject_id,\"actor_id\":self.actor_id,\n \"source_tree_hash\":self.source_tree_hash,\"dependency_lock_hash\":self.dependency_lock_hash,\n \"executable_artifact_hash\":self.executable_artifact_hash,\"runtime_environment_hash\":self.runtime_environment_hash,\n \"effective_config_hash\":self.effective_config_hash,\"deployed_at\":self.deployed_at,\"issued_at\":self.issued_at,\n \"authority_provider_id\":self.authority_provider_id,\"authority_receipt_hash\":self.authority_receipt_hash}\n if self.feature_extractor_code_hash: payload[\"feature_extractor_code_hash\"]=self.feature_extractor_code_hash\n return canonical_hash(payload)","source_sha256":"544b46e605c9a988693451af639cce42e20f359ae9dd69baa47b3780e4525ed1"},{"name":"build","node":"FunctionDef","path":"runtime_integrity.py","source":"def build(cls, **kwargs) -> \"DeploymentAttestation\":\n payload={k:kwargs[k] for k in (\"subject_kind\",\"subject_id\",\"actor_id\",\"source_tree_hash\",\"dependency_lock_hash\",\n \"executable_artifact_hash\",\"runtime_environment_hash\",\"effective_config_hash\",\"deployed_at\",\"issued_at\",\n \"authority_provider_id\",\"authority_receipt_hash\")}\n if kwargs.get(\"feature_extractor_code_hash\"): payload[\"feature_extractor_code_hash\"]=kwargs[\"feature_extractor_code_hash\"]\n return cls(attestation_id=canonical_hash(payload),**kwargs)","source_sha256":"58286208dcbf95fffbf6775c550cbb0e4cb2eee55a6e89610d3c55cf6a57183c"},{"name":"__post_init__","node":"FunctionDef","path":"runtime_integrity.py","source":"def __post_init__(self) -> None:\n _aware(self.started_at, \"predictor runtime started_at\")\n if self.ended_at is not None:\n _aware(self.ended_at, \"predictor runtime ended_at\")\n if self.ended_at <= self.started_at: raise DemonovError(\"predictor runtime ended_at must follow started_at\")\n if not self.consumer_id or not self.final_model_registry_id:\n raise DemonovError(\"predictor runtime identity fields required\")\n for n in (\"source_tree_hash\",\"dependency_lock_hash\",\"runtime_environment_hash\",\"executable_artifact_hash\",\"effective_config_hash\",\"feature_extractor_code_hash\",\"deployment_receipt_hash\"):\n _hex64(getattr(self,n),n)\n if self.predictor_runtime_id != self.content_hash:\n raise DemonovError(\"predictor runtime id must be content-addressed\")","source_sha256":"6387ddecd12c2c2af99dd5d683b4e12d35b045cf938d3ee15f672f1b1a67795f"},{"name":"content_hash","node":"FunctionDef","path":"runtime_integrity.py","source":"def content_hash(self) -> str:\n return canonical_hash({k:getattr(self,k) for k in (\n \"consumer_id\",\"source_tree_hash\",\"dependency_lock_hash\",\"runtime_environment_hash\",\"executable_artifact_hash\",\"effective_config_hash\",\n \"final_model_registry_id\",\"feature_extractor_code_hash\",\"started_at\",\"ended_at\",\"deployment_receipt_hash\"\n )})","source_sha256":"df6127715e3a641101bfec75454672d73e712342aa989fa0b674c865d3d4424d"},{"name":"build","node":"FunctionDef","path":"runtime_integrity.py","source":"def build(cls, **kwargs) -> \"PredictorRuntimeManifest\":\n payload={k:kwargs.get(k) for k in (\n \"consumer_id\",\"source_tree_hash\",\"dependency_lock_hash\",\"runtime_environment_hash\",\"executable_artifact_hash\",\"effective_config_hash\",\n \"final_model_registry_id\",\"feature_extractor_code_hash\",\"started_at\",\"ended_at\",\"deployment_receipt_hash\"\n )}\n return cls(predictor_runtime_id=canonical_hash(payload),**kwargs)","source_sha256":"320b24f7f9b26161be45b818701ca5f9e0ec55be2b1ade043dbcd6c3df656f2b"}],"content_hash":"def content_hash(self) -> str:\n return canonical_hash({k: getattr(self, k) for k in (\n \"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\"\n )})","fields":["artifact_id","source_tree_hash","dependency_lock_hash","build_recipe_hash","executable_artifact_hash","runtime_environment_hash"],"formula":null,"post_init":"def __post_init__(self) -> None:\n for name in (\"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\"):\n _hex64(getattr(self, name), name)\n if self.artifact_id != self.content_hash:\n raise DemonovError(\"runtime artifact id must be content-addressed\")"} +SB043K_OLD_ARTIFACT_INPUTS={"base_image_id":"sha256:008ab480142056d1f0b628e6c17bb6b99b30b8b4f59f24e31d972a4a128a8602","base_image_ref":"8020-demonov-shadow:ac7094a76ddc06f376d71a76432af7c2dd10ec7d","candidate_pool":{"base_image_id":"008ab480142056d1f0b628e6c17bb6b99b30b8b4f59f24e31d972a4a128a8602","base_rootfs_layers_canonical":"caf591ce9164d30a1fa64b2ca25d9728b116468c9410a883543bf3d696f3ced1","compose_sha256":"6461532b0a04decc60fe1d1885990020e886d40de40c0523e34e2849600af061","dockerfile_sha256":"901951def73961f76d2c2a93c5428a0fbdcc50113d42b39da92983a5ce157cb8","file:runtime_integrity.py":"99859b63e23d10fc051672965123f49d6e79d2ff767871c019ff7bdae2e2e39e","file:runtime_manifest.py":"1064cfb74303fdc8e0bf50bae95b1e755556a5b1dfc28b2b062341becaba08f2","old_application_image_id":"403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736","old_dir_canonical_list_full":"af83cb6b6b1b0f01f5453bd2dd6048c42b1f194bee6f6323b91e90efec30ef1f","old_dir_canonical_list_sha":"708d044de397034bcdde99398f1014aceee0e9f58a7870e459c6d57879e2b552","old_dir_canonical_path_sha":"d32002a8dd2b78e63ac30bef3f1c8b4c18373509c98c92173a9f82386f53afd4","old_dir_canonical_path_size_sha":"0c7eac692accfd22113cebffb7897863370052731578418a5103e4004b749c7c","old_dir_concat_path_sha":"3a0e01804936792ff9159b896d17b5bcd2b0b0d61eacb331fd93ccaceb5411df","old_dir_concat_sha":"b39e64671adfa8a6cfac27ff4bac745ee5dc5b0b90d28f1a9e24b48de307e6ae","old_image_config":"403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736","old_image_config_canonical":"27884bcdb5825bb3f2207da59a46451dac4e65a34b6af18db04266607e151d0e","old_image_id":"403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736","old_rootfs_layers_canonical":"624aba0d14a23d453be78b45a360bfa5c724ddd3d01946930f8a76a4341d17fa","old_tar_canonical_list_full":"43b6ae1658ff777a219266ce66f2de7d8f9f3d9b3c8428f5d11b0c90aff6a581","old_tar_canonical_list_sha":"c6a1b005a330a0e5a73658fcbf7557a0645b1fca9fa05fe87955c26c06d1e4ac","old_tar_canonical_path_sha":"3b7df8cf67359efaa32f20d35a23636fe24a2a0f0f74d465c234eb92c6496733","old_tar_canonical_path_size_sha":"0579c2e9c3cfbacf9db2c6d7b1a05705305e63e130a74f89ff42d01fc5802b0f","old_tar_concat_path_sha":"dc1843e1ada353efcb935031b5783a677d5656310700c83e885c688829406f91","old_tar_concat_sha":"b39e64671adfa8a6cfac27ff4bac745ee5dc5b0b90d28f1a9e24b48de307e6ae","old_tar_strip_canonical_list_full":"af83cb6b6b1b0f01f5453bd2dd6048c42b1f194bee6f6323b91e90efec30ef1f","old_tar_strip_canonical_list_sha":"708d044de397034bcdde99398f1014aceee0e9f58a7870e459c6d57879e2b552","old_tar_strip_canonical_path_sha":"d32002a8dd2b78e63ac30bef3f1c8b4c18373509c98c92173a9f82386f53afd4","old_tar_strip_canonical_path_size_sha":"0c7eac692accfd22113cebffb7897863370052731578418a5103e4004b749c7c","old_tar_strip_concat_path_sha":"3a0e01804936792ff9159b896d17b5bcd2b0b0d61eacb331fd93ccaceb5411df","old_tar_strip_concat_sha":"b39e64671adfa8a6cfac27ff4bac745ee5dc5b0b90d28f1a9e24b48de307e6ae","package_gzip_sha256":"389e7aabca8887ee3b48b6ff0b4affe1163216005a4888013d9ccc82ea360e32","package_tar_sha256":"431ddf9e8938d5e583553f05f9e3d019aff0b439c83b0b23c81808073b7d61a8"},"old_image_id":"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736","old_manifest":{"application_image_id":"sha256:403c4266282a56cb210bed95cd58295692296502913e7440e2133d7b5664c736","base_image_digest":"sha256:881d80734ee05dca6f7f42dcb080975652a53c7eda9ba1f03bb8da31aa6a6ec2","code_identity":"e32760c69a4311728db9066ee8bf2bf66b1e5a70","compose_hash":"6461532b0a04decc60fe1d1885990020e886d40de40c0523e34e2849600af061","finality_policy_id":"BITFINEX_SEQ_ALL_D1_V1","package_identity":"637acba19fb29c98408a8031dc9265a31dc36551c666fcf0b287e8af83d2b893","runtime_manifest_id":"58d3b59200bdc0eb8d448612679d667b194263586cb3198dfc08597935053a1a"},"old_package_identity":"637acba19fb29c98408a8031dc9265a31dc36551c666fcf0b287e8af83d2b893","tar_meta":{"gzip_bytes":208049,"gzip_sha256":"389e7aabca8887ee3b48b6ff0b4affe1163216005a4888013d9ccc82ea360e32","tar_bytes":1157120,"tar_sha256":"431ddf9e8938d5e583553f05f9e3d019aff0b439c83b0b23c81808073b7d61a8"}} +SB043K_REPRODUCTION=[] +SB043K_OLD_DEPLOY_REFERENCES=[{"path":"demonov_forward_map/__init__.py","snippets":[" ClockDomainKind, ClockDomainSpec, ClockDomainRegistry, ClockSynchronizationPolicy, ClockAttestation,"," verify_clock_synchronization, WindowClockClassification, classify_event_time_with_clock_guard,"," FrozenConfigMapping, EffectiveConfigSnapshot, RuntimeArtifactManifest, RuntimeEpoch, RuntimeRegistry,"," ProducerSessionDeclaration, ProducerSessionCatalog, CollectorTopologyPolicy, CollectorReceiptRecord,"," CollectorReceiptStore, AuthoritativeProducerWatermark, CaptureCompletenessPolicy, verify_capture_through_watermark,"]},{"path":"demonov_forward_map/runtime_integrity.py","snippets":["","@dataclass(frozen=True)","class RuntimeArtifactManifest:"," artifact_id: str"," source_tree_hash: str","class RuntimeArtifactManifest:"," artifact_id: str"," source_tree_hash: str"," dependency_lock_hash: str"," build_recipe_hash: str"," artifact_id: str"," source_tree_hash: str"," dependency_lock_hash: str"," build_recipe_hash: str"," executable_artifact_hash: str"," source_tree_hash: str"," dependency_lock_hash: str"," build_recipe_hash: str"," executable_artifact_hash: str"," runtime_environment_hash: str"," dependency_lock_hash: str"," build_recipe_hash: str"," executable_artifact_hash: str"," runtime_environment_hash: str","",""," def __post_init__(self) -> None:"," for name in (\"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\"):"," _hex64(getattr(self, name), name)"," if self.artifact_id != self.content_hash:"," def content_hash(self) -> str:"," return canonical_hash({k: getattr(self, k) for k in ("," \"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\""," )})","",""," @classmethod"," def build(cls, **kwargs) -> \"RuntimeArtifactManifest\":"," payload = {k: kwargs[k] for k in (\"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\")}"," return cls(artifact_id=canonical_hash(payload), **kwargs)"," @classmethod"," def build(cls, **kwargs) -> \"RuntimeArtifactManifest\":"," payload = {k: kwargs[k] for k in (\"source_tree_hash\", \"dependency_lock_hash\", \"build_recipe_hash\", \"executable_artifact_hash\", \"runtime_environment_hash\")}"," return cls(artifact_id=canonical_hash(payload), **kwargs)","","class RuntimeRegistry:"," registry_id: str"," artifacts: Tuple[RuntimeArtifactManifest, ...]"," configs: Tuple[EffectiveConfigSnapshot, ...]"," epochs: Tuple[RuntimeEpoch, ...]"," for e in self.epochs:"," if e.artifact_id not in amap or e.config_id not in cmap: raise DemonovError(\"runtime epoch references missing artifact/config\")"," if e.producer_code_hash != amap[e.artifact_id].source_tree_hash:"," raise DemonovError(\"runtime epoch producer_code_hash must equal frozen artifact source_tree_hash\")"," # No overlapping epochs per producer; otherwise event->runtime binding is ambiguous."," if e.artifact_id not in amap or e.config_id not in cmap: raise DemonovError(\"runtime epoch references missing artifact/config\")"," if e.producer_code_hash != amap[e.artifact_id].source_tree_hash:"," raise DemonovError(\"runtime epoch producer_code_hash must equal frozen artifact source_tree_hash\")"," # No overlapping epochs per producer; otherwise event->runtime binding is ambiguous."," for producer in {e.producer_id for e in self.epochs}:",""," @classmethod"," def build(cls, *, artifacts: Iterable[RuntimeArtifactManifest], configs: Iterable[EffectiveConfigSnapshot], epochs: Iterable[RuntimeEpoch]) -> \"RuntimeRegistry\":"," a, c, e = tuple(artifacts), tuple(configs), tuple(epochs)"," payload = {\"artifacts\": tuple(sorted(x.artifact_id for x in a)), \"configs\": tuple(sorted(x.config_id for x in c)), \"epochs\": tuple(sorted(x.epoch_id for x in e))}"," subject_id: str"," actor_id: str"," source_tree_hash: str"," dependency_lock_hash: str"," executable_artifact_hash: str"," actor_id: str"," source_tree_hash: str"," dependency_lock_hash: str"," executable_artifact_hash: str"," runtime_environment_hash: str"," source_tree_hash: str"," dependency_lock_hash: str"," executable_artifact_hash: str"," runtime_environment_hash: str"," effective_config_hash: str"]},{"path":"runtime_manifest.json","snippets":[" \"compose_hash\": \"6461532b0a04decc60fe1d1885990020e886d40de40c0523e34e2849600af061\","," \"finality_policy_id\": \"BITFINEX_SEQ_ALL_D1_V1\","," \"package_identity\": \"637acba19fb29c98408a8031dc9265a31dc36551c666fcf0b287e8af83d2b893\","," \"runtime_manifest_id\": \"58d3b59200bdc0eb8d448612679d667b194263586cb3198dfc08597935053a1a\"","}"]}] +SB043K_SOURCE_COUNTS={"new_files":57,"old_files":57} +SB043K_HOLDS=["ARTIFACT_CONTENT_HASH_FORMULA_NOT_EXTRACTED","OLD_PACKAGE_ID_NOT_REPRODUCED"] +SB043K_DECISION=HOLD_ARTIFACT_CONTENT_HASH_FORMULA_NOT_EXTRACTED__OLD_PACKAGE_ID_NOT_REPRODUCED +SB043K_MUTATION_SCOPE=NONE_READ_ONLY +SIGNALBOT043K_DECISION=HOLD_GUEST_PACKAGE_RCA OUTPUT_END CHAT_OUTPUT_END