build(worker): package M4.8R3 shadow release

tests/test_m48r3_worker_shadow_artifact.py

@@ -0,0 +1,62 @@
+from __future__ import annotations
+
+import hashlib
+import importlib.util
+import json
+import tarfile
+from pathlib import Path
+
+REPOSITORY_ROOT = Path(__file__).resolve().parents[1]
+BUILDER_PATH = REPOSITORY_ROOT / "scripts/build_m48r3_worker_shadow_artifact.py"
+SPEC = importlib.util.spec_from_file_location("m48r3_worker_shadow_builder", BUILDER_PATH)
+assert SPEC is not None and SPEC.loader is not None
+BUILDER = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(BUILDER)
+
+
+def _sha256(value: bytes) -> str:
+    return hashlib.sha256(value).hexdigest()
+
+
+def _regular_files(archive: tarfile.TarFile) -> dict[str, bytes]:
+    result: dict[str, bytes] = {}
+    for member in archive.getmembers():
+        if not member.isfile():
+            continue
+        stream = archive.extractfile(member)
+        assert stream is not None
+        result[member.name] = stream.read()
+    return result
+
+
+def test_m48r3_worker_artifact_is_deterministic_and_bounded(tmp_path: Path) -> None:
+    patch_id = "mission-core-m48r3-low-step-unit-001"
+    revision = "a" * 40
+    first = BUILDER.build_artifact(patch_id, tmp_path / "first", revision=revision)
+    second = BUILDER.build_artifact(patch_id, tmp_path / "second", revision=revision)
+
+    first_bytes = Path(first["artifact"]).read_bytes()
+    assert first_bytes == Path(second["artifact"]).read_bytes()
+    assert first["sha256"] == _sha256(first_bytes)
+    with tarfile.open(first["artifact"], "r:gz") as archive:
+        members = archive.getmembers()
+        regular = _regular_files(archive)
+    assert all(not member.issym() and not member.islnk() for member in members)
+    assert set(regular) == {
+        "manifest.env",
+        "files.txt",
+        *(f"payload/{name}" for name in first["payload_files"]),
+    }
+    assert regular["files.txt"].decode().splitlines() == first["payload_files"]
+    release = json.loads(regular["payload/release.json"])
+    assert release["code_revision"] == revision
+    assert release["geometry_provider_id"] == (
+        "ravnoves00-additive-low-step-geometry/v1"
+    )
+    assert release["candidate_accepted"] is False
+    assert release["production_accepted"] is False
+    assert release["durable_worker_action"] == "none"
+    assert release["canonical_triton_action"] == "none"
+    serialized = json.dumps(release).lower()
+    assert "private key" not in serialized
+    assert "password=" not in serialized