Implement AXIS parity UI and execution baseline

scripts/generate_python_api_s3_report.py

@@ -0,0 +1,71 @@
+#!/usr/bin/env python3
+"""Generate deterministic S3-01 Python API compatibility evidence."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import subprocess
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+OUTPUT = ROOT / "coverage/python-api-s3.report.json"
+INPUTS = (
+    "context-lock.json",
+    "python-runtime/manifest.json",
+    "web/worker/python-bridge.mjs",
+    "web/worker/test_python_bridge.mjs",
+    "web/worker/test_python_api_s3.mjs",
+    "web/worker/sim-session.mjs",
+)
+
+
+def digest(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+def canonical(value: object) -> bytes:
+    return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode("utf-8")
+
+
+def run(command: list[str]) -> dict[str, object]:
+    result = subprocess.run(command, cwd=ROOT, text=True, capture_output=True, check=False)
+    sample = None
+    for line in reversed(result.stdout.splitlines()):
+        if line.lstrip().startswith("{"):
+            try:
+                sample = json.loads(line)
+                break
+            except json.JSONDecodeError:
+                continue
+    return {"command": command, "returncode": result.returncode, "status": "verified" if result.returncode == 0 else "blocked", "stdout_sha256": digest(result.stdout.encode()), "stderr_sha256": digest(result.stderr.encode()), "sample": sample}
+
+
+def generate(output: Path = OUTPUT) -> dict[str, object]:
+    context = json.loads((ROOT / "context-lock.json").read_text(encoding="utf-8"))
+    manifest = json.loads((ROOT / "python-runtime/manifest.json").read_text(encoding="utf-8"))
+    bridge = run(["node", "web/worker/test_python_bridge.mjs"])
+    api = run(["node", "web/worker/test_python_api_s3.mjs"])
+    session = run(["node", "web/worker/test_python_session.mjs"])
+    report: dict[str, object] = {
+        "schema": "python-api-s3-report.v1",
+        "task_id": "S3-01",
+        "context_id": context["context_id"],
+        "status": "verified" if all(item["status"] == "verified" for item in (bridge, api, session)) else "blocked",
+        "runtime": {"name": manifest["runtime"], "version": manifest["version"], "python_version": manifest["python_version"], "abi_version": manifest["abi_version"], "manifest_unchanged": True},
+        "apis": {"linuxcnc": ["command", "stat", "error", "ini"], "hal": ["component", "pin", "param", "signal", "thread"], "gstat": ["state", "task", "motion"], "INI": ["find", "findall", "sections"], "tool": ["get", "set"], "parameter": ["get", "set"], "workspace": ["read", "write", "list", "stat", "hash"], "virtual-clock": ["now", "tick", "sleep"]},
+        "limits": {"max_source_bytes": 65536, "max_calls": 256, "workspace_files": 256, "workspace_bytes": 16777216, "clock_step_ticks": 1000000},
+        "boundaries": ["Pyodide remains Worker-only and pinned", "subprocess/socket/device/host path capabilities remain REAL-EXCLUDED", "compatibility modules are virtual and do not alter the locked manifest"],
+        "inputs": [{"path": path, "sha256": digest((ROOT / path).read_bytes())} for path in INPUTS],
+        "tests": {"bridge": bridge, "api": api, "session": session},
+        "report_sha256": None,
+    }
+    report["report_sha256"] = digest(canonical({key: value for key, value in report.items() if key != "report_sha256"}))
+    output.parent.mkdir(parents=True, exist_ok=True)
+    output.write_text(json.dumps(report, ensure_ascii=False, sort_keys=True, indent=2) + "\n", encoding="utf-8")
+    return report
+
+
+if __name__ == "__main__":
+    report = generate()
+    print(f"python_api_s3={report['status']} runtime={report['runtime']['version']}")