K8: record blocked owner review and release evidence
This commit is contained in:
182
scripts/generate_remediation_evidence_roundup.py
Normal file
182
scripts/generate_remediation_evidence_roundup.py
Normal file
@@ -0,0 +1,182 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Generate the deterministic K8-REL-14 remediation evidence roundup."""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import argparse
|
||||
import hashlib
|
||||
import json
|
||||
from pathlib import Path
|
||||
from typing import Any
|
||||
|
||||
|
||||
CONTEXT = Path("context-lock.json")
|
||||
INTAKE = Path("coverage/release-remediation-intake.report.json")
|
||||
GATE = Path("coverage/release-candidate-gate.report.json")
|
||||
AUDIT = Path("coverage/post-release-audit.report.json")
|
||||
CLOSEOUT = Path("coverage/k8-milestone-closeout.report.json")
|
||||
REPORTS = (
|
||||
(Path("coverage/manifest-ownership-remediation.report.json"), "K8-REL-08"),
|
||||
(Path("coverage/release-acceptance-remediation.report.json"), "K8-REL-09"),
|
||||
(Path("coverage/official-oracle-remediation.report.json"), "K8-REL-10"),
|
||||
(Path("coverage/configuration-resource-remediation.report.json"), "K8-REL-11"),
|
||||
(Path("coverage/browser-matrix-remediation.report.json"), "K8-REL-12"),
|
||||
(Path("coverage/implementation-license-remediation.report.json"), "K8-REL-13"),
|
||||
)
|
||||
OUTPUT = Path("coverage/remediation-evidence-roundup.report.json")
|
||||
|
||||
|
||||
def canonical(value: Any) -> str:
|
||||
return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
|
||||
|
||||
|
||||
def digest(value: Any) -> str:
|
||||
return hashlib.sha256(canonical(value).encode("utf-8")).hexdigest()
|
||||
|
||||
|
||||
def file_digest(path: Path) -> str | None:
|
||||
if not path.is_file():
|
||||
return None
|
||||
handle = hashlib.sha256()
|
||||
with path.open("rb") as stream:
|
||||
for block in iter(lambda: stream.read(1024 * 1024), b""):
|
||||
handle.update(block)
|
||||
return handle.hexdigest()
|
||||
|
||||
|
||||
def read_json(root: Path, path: Path) -> tuple[dict[str, Any], str | None]:
|
||||
try:
|
||||
value = json.loads((root / path).read_text(encoding="utf-8"))
|
||||
if not isinstance(value, dict):
|
||||
raise ValueError(f"{path} must contain an object")
|
||||
return value, None
|
||||
except (OSError, UnicodeError, json.JSONDecodeError, ValueError) as exc:
|
||||
return {}, str(exc)
|
||||
|
||||
|
||||
def artifact(root: Path, path: Path, role: str) -> dict[str, Any]:
|
||||
full = root / path
|
||||
sha = file_digest(full)
|
||||
if sha is None:
|
||||
return {"path": path.as_posix(), "role": role, "status": "missing"}
|
||||
return {"path": path.as_posix(), "role": role, "status": "present", "bytes": full.stat().st_size, "sha256": sha}
|
||||
|
||||
|
||||
def report_self_hash(report: dict[str, Any]) -> bool:
|
||||
declared = report.get("report_sha256")
|
||||
return bool(declared) and declared == digest({key: value for key, value in report.items() if key != "report_sha256"})
|
||||
|
||||
|
||||
def generate(root: Path, output: Path = OUTPUT) -> dict[str, Any]:
|
||||
root = root.resolve()
|
||||
paths = (CONTEXT, INTAKE, GATE, AUDIT, CLOSEOUT, *(path for path, _task in REPORTS))
|
||||
documents: dict[Path, dict[str, Any]] = {}
|
||||
errors: dict[str, str] = {}
|
||||
for path in paths:
|
||||
documents[path], error = read_json(root, path)
|
||||
if error:
|
||||
errors[path.as_posix()] = error
|
||||
lock = documents[CONTEXT]
|
||||
intake = documents[INTAKE]
|
||||
gate = documents[GATE]
|
||||
audit = documents[AUDIT]
|
||||
closeout = documents[CLOSEOUT]
|
||||
remediation = []
|
||||
all_report_hashes = True
|
||||
all_context = bool(lock.get("context_id"))
|
||||
all_complete = True
|
||||
summaries: dict[str, Any] = {}
|
||||
for path, task_id in REPORTS:
|
||||
report = documents[path]
|
||||
self_hash = report_self_hash(report)
|
||||
context_ok = report.get("context_id") == lock.get("context_id")
|
||||
complete = report.get("status") == "complete" and str(report.get("remediation_status", "")).startswith("blocked_")
|
||||
all_report_hashes = all_report_hashes and self_hash
|
||||
all_context = all_context and context_ok
|
||||
all_complete = all_complete and complete
|
||||
summaries[task_id] = {
|
||||
"path": path.as_posix(),
|
||||
"status": report.get("status"),
|
||||
"remediation_status": report.get("remediation_status"),
|
||||
"report_sha256": report.get("report_sha256"),
|
||||
"self_hash": "verified" if self_hash else "blocked",
|
||||
"context": "verified" if context_ok else "blocked",
|
||||
}
|
||||
intake_ids = {row.get("id") for row in intake.get("work_items", []) if isinstance(row, dict)}
|
||||
gate_ids = {row.get("id") for row in gate.get("blockers", []) if isinstance(row, dict)}
|
||||
audit_ids = {row.get("id") for row in audit.get("blockers", []) if isinstance(row, dict)}
|
||||
blocker_identity = intake_ids == gate_ids == audit_ids and len(intake_ids) == 6
|
||||
stop_ok = all(
|
||||
report.get("release_action") == "STOP_RELEASE"
|
||||
and report.get("candidate_eligible") is False
|
||||
for report in (intake, gate, audit, closeout)
|
||||
) and all(
|
||||
documents[path].get("release_action") == "STOP_RELEASE"
|
||||
and documents[path].get("candidate_eligible") is False
|
||||
for path, _task in REPORTS
|
||||
)
|
||||
no_promotion = (
|
||||
documents[REPORTS[0][0]].get("counts", {}).get("accepted_by_this_artifact") == 0
|
||||
and documents[REPORTS[1][0]].get("counts", {}).get("eligible_for_acceptance") == 0
|
||||
and documents[REPORTS[1][0]].get("counts", {}).get("manifest_accepted") == 0
|
||||
and documents[REPORTS[2][0]].get("oracle_inventory", {}).get("official_inputs_added") == 0
|
||||
and documents[REPORTS[2][0]].get("oracle_inventory", {}).get("official_goldens_added") == 0
|
||||
and documents[REPORTS[3][0]].get("counts", {}).get("resolved_by_this_artifact") == 0
|
||||
and documents[REPORTS[4][0]].get("declared_matrix", {}).get("minimum") == {"chromium": "TBD", "firefox": "TBD", "safari": "TBD"}
|
||||
and documents[REPORTS[5][0]].get("counts", {}).get("approved_by_this_artifact") == 0
|
||||
)
|
||||
checks = {
|
||||
"remediation_reports_complete": {"status": "verified" if all_complete else "blocked", "reports": summaries},
|
||||
"remediation_report_self_hashes": {"status": "verified" if all_report_hashes else "blocked"},
|
||||
"context_consistency": {"status": "verified" if all_context else "blocked", "context_id": lock.get("context_id")},
|
||||
"blocker_identity_preserved": {"status": "verified" if blocker_identity else "blocked", "count": len(intake_ids), "ids": sorted(str(value) for value in intake_ids)},
|
||||
"no_promotion_or_fabrication": {"status": "verified" if no_promotion else "blocked"},
|
||||
"stop_release_preserved": {"status": "verified" if stop_ok else "blocked", "release_action": "STOP_RELEASE" if stop_ok else None},
|
||||
}
|
||||
checks_ok = not errors and all(value["status"] == "verified" for value in checks.values())
|
||||
report: dict[str, Any] = {
|
||||
"schema": "remediation-evidence-roundup.v1",
|
||||
"context_id": lock.get("context_id"),
|
||||
"task_id": "K8-REL-14",
|
||||
"status": "complete" if checks_ok else "blocked",
|
||||
"roundup_status": "blocked_pending_owner_actions",
|
||||
"release_decision": "blocked_not_release_candidate",
|
||||
"release_action": "STOP_RELEASE",
|
||||
"candidate_eligible": False,
|
||||
"inputs": [artifact(root, CONTEXT, "context_lock"), artifact(root, INTAKE, "remediation_intake"), artifact(root, GATE, "release_candidate_gate"), artifact(root, AUDIT, "post_release_audit"), artifact(root, CLOSEOUT, "k8_closeout")] + [artifact(root, path, task_id) for path, task_id in REPORTS],
|
||||
"checks": checks,
|
||||
"remediation_reports": summaries,
|
||||
"remaining_owner_actions": [
|
||||
{"blocker": "manifest_seed_unassigned", "action": "review proposed workstream roles and approve a manifest/context update"},
|
||||
{"blocker": "accepted_entries_missing", "action": "supply ready official oracle/context evidence before any acceptance"},
|
||||
{"blocker": "official_oracle_missing", "action": "add or approve locked official oracle inputs"},
|
||||
{"blocker": "configuration_resources_missing", "action": "review reference candidates and restore/index resources"},
|
||||
{"blocker": "browser_matrix_unverified", "action": "pin minimums and run Chromium/Firefox/Safari matrix"},
|
||||
{"blocker": "license_closure_incomplete", "action": "approve SPDX/NOTICE policy for Web/WASM implementation"},
|
||||
],
|
||||
"review_policy": {
|
||||
"next_transition": "owner review plus new context/gate regeneration",
|
||||
"forbidden": ["promote_blocked_to_accepted", "delete_samples", "lower_checks", "reclassify_as_REAL-EXCLUDED", "overwrite_context_lock_in_place"],
|
||||
},
|
||||
"errors": errors,
|
||||
"report_sha256": None,
|
||||
}
|
||||
report["report_sha256"] = digest({key: value for key, value in report.items() if key != "report_sha256"})
|
||||
destination = output if output.is_absolute() else root / output
|
||||
destination.parent.mkdir(parents=True, exist_ok=True)
|
||||
destination.write_text(json.dumps(report, ensure_ascii=False, sort_keys=True, indent=2) + "\n", encoding="utf-8")
|
||||
return report
|
||||
|
||||
|
||||
def main() -> int:
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument("--repo-root", type=Path, default=Path(__file__).resolve().parents[1])
|
||||
parser.add_argument("--output", type=Path, default=OUTPUT)
|
||||
args = parser.parse_args()
|
||||
report = generate(args.repo_root, args.output)
|
||||
print("remediation_roundup=" + report["status"] + " release=" + report["release_action"] + " checks=" + str(len(report["checks"])))
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
raise SystemExit(main())
|
||||
Reference in New Issue
Block a user