191 lines
8.5 KiB
Python
191 lines
8.5 KiB
Python
"""No-write drift verifier for controlled PChome mapping receipts."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import hashlib
|
|
import json
|
|
from pathlib import Path
|
|
from typing import Any
|
|
|
|
from services.pchome_mapping_backlog.artifacts import (
|
|
_canonical_retry_exception_artifact_bytes,
|
|
_resolve_retry_exception_artifact_path,
|
|
)
|
|
from services.pchome_mapping_backlog.policies import (
|
|
DIRECT_MAPPING_RETRY_CANDIDATE_EXCEPTION_CONTROLLED_APPLY_DRIFT_VERIFIER_POLICY,
|
|
)
|
|
|
|
|
|
def build_controlled_apply_drift_verifier_from_replay(
|
|
replay: dict[str, Any],
|
|
*,
|
|
root: Path,
|
|
run_id: str | None = None,
|
|
engine: Any = None,
|
|
source_receipt_replay: dict[str, Any] | None = None,
|
|
materialize_artifacts: bool = False,
|
|
) -> dict[str, Any]:
|
|
"""Verify replay readbacks and emit a bounded drift receipt."""
|
|
replay_summary = replay.get("summary") or {}
|
|
readbacks = list(replay.get("post_apply_readbacks") or [])
|
|
drift_items = [item for item in readbacks if item.get("passed") is not True]
|
|
selector_count = int(replay_summary.get("target_selector_count") or 0)
|
|
pass_count = int(replay_summary.get("post_apply_readback_pass_count") or 0)
|
|
receipt_hash_match_count = int(replay_summary.get("executor_receipt_hash_match_count") or 0)
|
|
source_ready = (
|
|
replay.get("result") == "DIRECT_MAPPING_RETRY_EXCEPTION_CONTROLLED_APPLY_RECEIPT_REPLAYED"
|
|
and selector_count > 0
|
|
and receipt_hash_match_count > 0
|
|
)
|
|
drift_verified = source_ready and not drift_items and pass_count == selector_count
|
|
|
|
if drift_items:
|
|
result = "DIRECT_MAPPING_RETRY_EXCEPTION_CONTROLLED_APPLY_DRIFT_DETECTED"
|
|
elif drift_verified:
|
|
result = "DIRECT_MAPPING_RETRY_EXCEPTION_CONTROLLED_APPLY_DRIFT_VERIFIED"
|
|
elif replay.get("missing_artifacts"):
|
|
result = "WAITING_FOR_RETRY_EXCEPTION_CONTROLLED_APPLY_DRIFT_ARTIFACTS"
|
|
else:
|
|
result = "WAITING_FOR_RETRY_EXCEPTION_CONTROLLED_APPLY_DRIFT_BASELINE"
|
|
|
|
checks = [
|
|
{"check": "source_replay_loaded", "passed": bool(replay)},
|
|
{"check": "source_receipt_hash_matches", "passed": receipt_hash_match_count > 0},
|
|
{"check": "target_selectors_present", "passed": selector_count > 0},
|
|
{"check": "all_current_readbacks_match_receipt", "passed": not drift_items and pass_count == selector_count},
|
|
{"check": "drift_verifier_does_not_write_database", "passed": True},
|
|
]
|
|
verifier_id_payload = {
|
|
"run_id": (replay.get("receipt_replay") or {}).get("run_id") or run_id or "",
|
|
"result": result,
|
|
"post_apply_readbacks": readbacks,
|
|
}
|
|
verifier_id = (
|
|
"pchome-retry-exception-controlled-apply-drift-verifier-"
|
|
+ hashlib.sha256(
|
|
json.dumps(verifier_id_payload, ensure_ascii=False, sort_keys=True, default=str).encode("utf-8")
|
|
).hexdigest()[:16]
|
|
)
|
|
summary = {
|
|
"target_selector_count": selector_count,
|
|
"post_apply_readback_count": int(replay_summary.get("post_apply_readback_count") or 0),
|
|
"post_apply_readback_pass_count": pass_count,
|
|
"drift_count": len(drift_items),
|
|
"drift_verified_count": 1 if drift_verified else 0,
|
|
"receipt_hash_match_count": receipt_hash_match_count,
|
|
"missing_artifact_count": int(replay_summary.get("missing_artifact_count") or 0),
|
|
"drift_verifier_artifact_materialized_count": 0,
|
|
"drift_verifier_artifact_hash_match_count": 0,
|
|
"writes_database_count": 0,
|
|
}
|
|
safety = {
|
|
"ai_controlled_apply": True,
|
|
"reads_artifact_files": True,
|
|
"reads_database": engine is not None or bool(source_receipt_replay),
|
|
"writes_database": False,
|
|
"writes_database_count": 0,
|
|
"writes_artifact_count": 0,
|
|
"syncs_external_offers": False,
|
|
"dispatches_telegram": False,
|
|
"gemini_allowed": False,
|
|
"requires_production_version_truth": True,
|
|
}
|
|
artifact_payload = {
|
|
"artifact_key": "retry_exception_controlled_apply_drift_verifier_receipt",
|
|
"verifier_id": verifier_id,
|
|
"run_id": verifier_id_payload["run_id"],
|
|
"source_policy": DIRECT_MAPPING_RETRY_CANDIDATE_EXCEPTION_CONTROLLED_APPLY_DRIFT_VERIFIER_POLICY,
|
|
"source_receipt_replay_result": replay.get("result"),
|
|
"result": result,
|
|
"summary": summary,
|
|
"drift_items": drift_items,
|
|
"post_apply_readbacks": readbacks,
|
|
"checks": checks,
|
|
"safety": safety,
|
|
}
|
|
artifact_bytes = _canonical_retry_exception_artifact_bytes(artifact_payload)
|
|
artifact_relative_path = (
|
|
f"artifacts/pchome_growth/retry_exception_closeout/"
|
|
f"controlled_apply_drift_verifier/{verifier_id}.json"
|
|
)
|
|
drift_verifier_artifact = {
|
|
"key": "retry_exception_controlled_apply_drift_verifier_receipt",
|
|
"artifact_type": "controlled_apply_drift_verifier_receipt",
|
|
"relative_path": artifact_relative_path,
|
|
"payload_sha256": hashlib.sha256(artifact_bytes).hexdigest(),
|
|
"byte_count": len(artifact_bytes),
|
|
"payload": artifact_payload,
|
|
"materialized": False,
|
|
"writes_database": False,
|
|
}
|
|
materialized_drift_artifacts: list[dict[str, Any]] = []
|
|
if materialize_artifacts and selector_count:
|
|
target_path = _resolve_retry_exception_artifact_path(root, artifact_relative_path)
|
|
target_path.parent.mkdir(parents=True, exist_ok=True)
|
|
target_path.write_bytes(artifact_bytes)
|
|
materialized_drift_artifacts.append({
|
|
"key": drift_verifier_artifact["key"],
|
|
"relative_path": artifact_relative_path,
|
|
"absolute_path": str(target_path),
|
|
"payload_sha256": drift_verifier_artifact["payload_sha256"],
|
|
"written_byte_count": target_path.stat().st_size,
|
|
"writes_database": False,
|
|
})
|
|
drift_verifier_artifact["materialized"] = True
|
|
drift_verifier_artifact["absolute_path"] = str(target_path)
|
|
artifact_path = _resolve_retry_exception_artifact_path(root, artifact_relative_path)
|
|
artifact_sha = hashlib.sha256(artifact_path.read_bytes()).hexdigest() if artifact_path.exists() else ""
|
|
artifact_hash_match = bool(artifact_sha) and artifact_sha == drift_verifier_artifact["payload_sha256"]
|
|
summary["drift_verifier_artifact_materialized_count"] = len(materialized_drift_artifacts) or (1 if artifact_hash_match else 0)
|
|
summary["drift_verifier_artifact_hash_match_count"] = 1 if artifact_hash_match else 0
|
|
safety["writes_artifact_count"] = len(materialized_drift_artifacts)
|
|
checks.extend([
|
|
{
|
|
"check": "drift_artifact_materialized_when_requested",
|
|
"passed": (not materialize_artifacts) or (selector_count > 0 and artifact_path.exists()),
|
|
},
|
|
{
|
|
"check": "drift_artifact_hash_matches_expected",
|
|
"passed": (not materialize_artifacts) or artifact_hash_match,
|
|
},
|
|
])
|
|
return {
|
|
"policy": DIRECT_MAPPING_RETRY_CANDIDATE_EXCEPTION_CONTROLLED_APPLY_DRIFT_VERIFIER_POLICY,
|
|
"result": result,
|
|
"success": result == "DIRECT_MAPPING_RETRY_EXCEPTION_CONTROLLED_APPLY_DRIFT_VERIFIED",
|
|
"summary": summary,
|
|
"drift_verifier": {
|
|
"verifier_id": verifier_id,
|
|
"stage": "P2_retry_exception_controlled_apply_drift_verifier",
|
|
"status": result,
|
|
"source_receipt_replay_result": replay.get("result"),
|
|
"ready": drift_verified,
|
|
"materialize_artifacts": bool(materialize_artifacts),
|
|
"requires_production_version_truth": True,
|
|
},
|
|
"drift_items": drift_items,
|
|
"post_apply_readbacks": readbacks,
|
|
"source_receipt_replay_summary": replay_summary,
|
|
"drift_verifier_artifact": drift_verifier_artifact,
|
|
"materialized_drift_artifacts": materialized_drift_artifacts,
|
|
"post_drift_verifier_artifact_verifier": {
|
|
"expected_sha256": drift_verifier_artifact["payload_sha256"],
|
|
"actual_sha256": artifact_sha,
|
|
"hash_match": artifact_hash_match,
|
|
"writes_database": False,
|
|
},
|
|
"checks": checks,
|
|
"check_count": len(checks),
|
|
"all_checks_passed": all(check.get("passed") is True for check in checks),
|
|
"next_actions": [
|
|
"Keep this verifier on the readiness surface so DB drift is visible without manual table review.",
|
|
"If drift is detected, use the receipt replay readbacks as rollback or re-apply evidence.",
|
|
],
|
|
"safety": safety,
|
|
}
|
|
|
|
|
|
__all__ = (
|
|
"build_controlled_apply_drift_verifier_from_replay",
|
|
)
|