SILVER/NODEDC_MISSION_CORE
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

bind M4.7 graph results to Worker runtime

Browse Source
This commit is contained in:
DCCONSTRUCTIONS
2026-08-23 20:57:20 +03:00
parent 4ac07f7671
commit 64860be4ae
6 changed files with 268 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/k1link/perception/reference_graph_cli.py
+9 -1
View File
@@ -8,6 +8,7 @@ import time
from pathlib import Path
from .graph_contracts import GraphRunMode, GraphRunResultV2
from .reference_graph_identity import ReferenceGraphRuntimeIdentity
from .reference_graph_parity import compare_reference_graph_to_accepted_ledgers
from .reference_graph_result import seal_reference_graph_result
from .reference_graph_runtime import ReferenceGraphRuntimePaths, build_reference_graph_runtime
@@ -35,8 +36,12 @@ def main(argv: list[str] | None = None) -> int:
default=GraphRunMode.LOSSLESS_REPLAY.value,
)
parser.add_argument("--expected-frames", type=int, default=4489)
parser.add_argument("--runtime-identity", type=Path, required=True)
parser.add_argument("--output-root", type=Path, required=True)
args = parser.parse_args(argv)
runtime_identity = ReferenceGraphRuntimeIdentity.from_dict(
json.loads(args.runtime_identity.resolve(strict=True).read_text("utf-8"))
)
paths = ReferenceGraphRuntimePaths(
graph_config=args.graph_config,
baseline_profile=args.baseline_profile,
@@ -65,17 +70,20 @@ def main(argv: list[str] | None = None) -> int:
threat_frames_path=args.threat_parity_frames,
expected_frames=args.expected_frames,
)
execution_elapsed_seconds = (time.perf_counter_ns() - started_ns) / 1_000_000_000
sealed = seal_reference_graph_result(
graph_result,
output_root=args.output_root,
expected_frames=args.expected_frames,
parity=parity,
runtime_identity=runtime_identity,
execution_elapsed_seconds=execution_elapsed_seconds,
)
print(
json.dumps(
{
"accepted": sealed.accepted,
"elapsed_seconds": (time.perf_counter_ns() - started_ns) / 1_000_000_000,
"elapsed_seconds": execution_elapsed_seconds,
"result_id": sealed.result_id,
"result_root": str(sealed.result_root),
},
src/k1link/perception/reference_graph_identity.py
+185
View File
@@ -0,0 +1,185 @@
"""Strict execution identity for the isolated M4.7 reference graph shadow."""
from __future__ import annotations
import datetime as dt
import re
from dataclasses import dataclass
from typing import Final
from .graph_contracts import REFERENCE_GRAPH_ID_V2
REFERENCE_GRAPH_RUNTIME_IDENTITY_SCHEMA: Final = "missioncore.reference-graph-runtime-identity/v3"
_SHA256 = re.compile(r"^[a-f0-9]{64}$")
_GIT_REVISION = re.compile(r"^[a-f0-9]{40}$")
_DOCKER_IMAGE_ID = re.compile(r"^sha256:[a-f0-9]{64}$")
_IDENTIFIER = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_.:/-]{0,255}$")
class ReferenceGraphRuntimeIdentityError(ValueError):
"""The Worker execution identity is incomplete or exceeds shadow authority."""
@dataclass(frozen=True, slots=True)
class ReferenceGraphRuntimeIdentity:
worker_id: str
worker_node: str
worker_container_id: str
worker_image_id: str
isolated_triton_container_id: str
isolated_triton_image_id: str
historical_worker_container_id: str
historical_worker_running: bool
historical_triton_container_id: str
historical_triton_running: bool
artifact_sha256: str
patch_id: str
code_revision: str
graph_id: str
started_at_utc: str
source_mount_read_only: bool
isolated_model_service: bool
public_worker_port_added: bool
commands_enabled: bool
actuation_allowed: bool
def __post_init__(self) -> None:
if self.worker_id != "worker-006":
raise ReferenceGraphRuntimeIdentityError("M4.7 shadow must run on Worker 006")
_identifier(self.worker_node, "worker node")
_identifier(self.patch_id, "patch id")
for value, label in (
(self.worker_container_id, "worker container id"),
(self.isolated_triton_container_id, "isolated Triton container id"),
(self.historical_worker_container_id, "historical worker container id"),
(self.historical_triton_container_id, "historical Triton container id"),
):
if _SHA256.fullmatch(value) is None:
raise ReferenceGraphRuntimeIdentityError(f"{label} must be a full digest")
for value, label in (
(self.worker_image_id, "worker image id"),
(self.isolated_triton_image_id, "isolated Triton image id"),
):
if _DOCKER_IMAGE_ID.fullmatch(value) is None:
raise ReferenceGraphRuntimeIdentityError(f"{label} must be a full image digest")
if _SHA256.fullmatch(self.artifact_sha256) is None:
raise ReferenceGraphRuntimeIdentityError("artifact must be digest-bound")
if _GIT_REVISION.fullmatch(self.code_revision) is None:
raise ReferenceGraphRuntimeIdentityError("code revision must be a full Git SHA")
if self.graph_id != REFERENCE_GRAPH_ID_V2:
raise ReferenceGraphRuntimeIdentityError("runtime graph id changed")
try:
started = dt.datetime.fromisoformat(self.started_at_utc.replace("Z", "+00:00"))
except ValueError as error:
raise ReferenceGraphRuntimeIdentityError(
"runtime start must be an ISO-8601 UTC timestamp"
) from error
if started.tzinfo != dt.UTC:
raise ReferenceGraphRuntimeIdentityError("runtime start must use UTC")
if not self.source_mount_read_only:
raise ReferenceGraphRuntimeIdentityError("source mounts must be read-only")
if not self.isolated_model_service:
raise ReferenceGraphRuntimeIdentityError("model service must be isolated")
if self.public_worker_port_added:
raise ReferenceGraphRuntimeIdentityError("shadow must not add a public port")
if self.commands_enabled or self.actuation_allowed:
raise ReferenceGraphRuntimeIdentityError("shadow authority must remain disabled")
def to_dict(self) -> dict[str, object]:
return {
"schema_version": REFERENCE_GRAPH_RUNTIME_IDENTITY_SCHEMA,
"worker_id": self.worker_id,
"worker_node": self.worker_node,
"worker_container_id": self.worker_container_id,
"worker_image_id": self.worker_image_id,
"isolated_triton_container_id": self.isolated_triton_container_id,
"isolated_triton_image_id": self.isolated_triton_image_id,
"historical_worker_container_id": self.historical_worker_container_id,
"historical_worker_running": self.historical_worker_running,
"historical_triton_container_id": self.historical_triton_container_id,
"historical_triton_running": self.historical_triton_running,
"artifact_sha256": self.artifact_sha256,
"patch_id": self.patch_id,
"code_revision": self.code_revision,
"graph_id": self.graph_id,
"started_at_utc": self.started_at_utc,
"source_mount_read_only": self.source_mount_read_only,
"isolated_model_service": self.isolated_model_service,
"public_worker_port_added": self.public_worker_port_added,
"commands_enabled": self.commands_enabled,
"actuation_allowed": self.actuation_allowed,
}
@classmethod
def from_dict(cls, value: object) -> ReferenceGraphRuntimeIdentity:
if not isinstance(value, dict) or any(not isinstance(key, str) for key in value):
raise ReferenceGraphRuntimeIdentityError("runtime identity must be an object")
fields = {
"worker_id",
"worker_node",
"worker_container_id",
"worker_image_id",
"isolated_triton_container_id",
"isolated_triton_image_id",
"historical_worker_container_id",
"historical_worker_running",
"historical_triton_container_id",
"historical_triton_running",
"artifact_sha256",
"patch_id",
"code_revision",
"graph_id",
"started_at_utc",
"source_mount_read_only",
"isolated_model_service",
"public_worker_port_added",
"commands_enabled",
"actuation_allowed",
}
if set(value) != fields | {"schema_version"}:
raise ReferenceGraphRuntimeIdentityError("runtime identity fields changed")
if value.get("schema_version") != REFERENCE_GRAPH_RUNTIME_IDENTITY_SCHEMA:
raise ReferenceGraphRuntimeIdentityError("runtime identity schema changed")
strings = {
field: _string(value.get(field), field)
for field in fields
if field
not in {
"historical_worker_running",
"historical_triton_running",
"source_mount_read_only",
"isolated_model_service",
"public_worker_port_added",
"commands_enabled",
"actuation_allowed",
}
}
booleans = {
field: _boolean(value.get(field), field) for field in fields if field not in strings
}
return cls(**strings, **booleans)
def _string(value: object, label: str) -> str:
if not isinstance(value, str) or not value:
raise ReferenceGraphRuntimeIdentityError(f"{label} must be a non-empty string")
return value
def _boolean(value: object, label: str) -> bool:
if not isinstance(value, bool):
raise ReferenceGraphRuntimeIdentityError(f"{label} must be boolean")
return value
def _identifier(value: str, label: str) -> None:
if _IDENTIFIER.fullmatch(value) is None:
raise ReferenceGraphRuntimeIdentityError(f"{label} is invalid")
__all__ = [
"REFERENCE_GRAPH_RUNTIME_IDENTITY_SCHEMA",
"ReferenceGraphRuntimeIdentity",
"ReferenceGraphRuntimeIdentityError",
]
src/k1link/perception/reference_graph_result.py
+19 -11
View File
@@ -4,6 +4,7 @@ from __future__ import annotations
import hashlib
import json
import math
import os
import shutil
import uuid
@@ -13,6 +14,7 @@ from pathlib import Path
from typing import Final
from .graph_contracts import GraphRunMode, GraphRunResultV2, GraphState, TerminalOutcomeType
from .reference_graph_identity import ReferenceGraphRuntimeIdentity
from .reference_graph_parity import ReferenceGraphParityReport
REFERENCE_GRAPH_RESULT_PREFIX: Final = "m47-reference-graph-"
@@ -39,9 +41,15 @@ def seal_reference_graph_result(
output_root: Path,
expected_frames: int,
parity: ReferenceGraphParityReport,
runtime_identity: ReferenceGraphRuntimeIdentity,
execution_elapsed_seconds: float,
) -> SealedReferenceGraphResult:
if expected_frames < 1:
raise ReferenceGraphResultError("expected frame count must be positive")
if not math.isfinite(execution_elapsed_seconds) or execution_elapsed_seconds < 0.0:
raise ReferenceGraphResultError("execution elapsed seconds must be finite and non-negative")
if runtime_identity.graph_id != result.graph_id:
raise ReferenceGraphResultError("runtime and graph result identities differ")
outcomes = Counter(item.outcome.value for item in result.terminal_outcomes)
gates = {
"lossless_replay_mode": result.run_mode is GraphRunMode.LOSSLESS_REPLAY,
@@ -58,6 +66,7 @@ def seal_reference_graph_result(
"accepted_m45r_m46_parity": parity.accepted,
}
accepted = all(gates.values())
runtime = runtime_identity.to_dict()
report: dict[str, object] = {
"schema_version": REFERENCE_GRAPH_REPORT_SCHEMA,
"graph_id": result.graph_id,
@@ -73,6 +82,10 @@ def seal_reference_graph_result(
"accepted_parity": parity.to_dict(),
"gates": gates,
"accepted": accepted,
"execution": {
"elapsed_seconds": execution_elapsed_seconds,
"runtime_identity": runtime,
},
"authority": {
"physical_live": False,
"commands_enabled": False,
@@ -90,6 +103,7 @@ def seal_reference_graph_result(
frames_path = staging / "frames.jsonl"
outcomes_path = staging / "outcomes.jsonl"
report_path = staging / "report.json"
runtime_path = staging / "runtime.json"
_write_json_lines(
frames_path,
tuple(delivery.canonical_dict() for delivery in result.deliveries),
@@ -99,18 +113,20 @@ def seal_reference_graph_result(
tuple(outcome.to_dict() for outcome in result.terminal_outcomes),
)
_write_json(report_path, report)
_write_json(runtime_path, runtime)
file_rows = {
name: {
"sha256": _sha256_file(staging / name),
"bytes": (staging / name).stat().st_size,
}
for name in ("frames.jsonl", "outcomes.jsonl", "report.json")
for name in ("frames.jsonl", "outcomes.jsonl", "report.json", "runtime.json")
}
identity: dict[str, object] = {
"graph_id": result.graph_id,
"source_profile_id": result.source_profile_id,
"run_mode": result.run_mode.value,
"canonical_payload_sha256": result.canonical_payload_sha256,
"runtime": runtime,
"files": file_rows,
}
identity_sha256 = hashlib.sha256(_canonical_json(identity)).hexdigest()
@@ -156,16 +172,8 @@ def _publish_immutable(staging: Path, target: Path) -> None:
if target.exists():
if target.is_symlink() or not target.is_dir():
raise ReferenceGraphResultError("immutable result target is not a real directory")
expected = {
path.name: _sha256_file(path)
for path in staging.iterdir()
if path.is_file()
}
observed = {
path.name: _sha256_file(path)
for path in target.iterdir()
if path.is_file()
}
expected = {path.name: _sha256_file(path) for path in staging.iterdir() if path.is_file()}
observed = {path.name: _sha256_file(path) for path in target.iterdir() if path.is_file()}
if expected != observed:
raise ReferenceGraphResultError("immutable result identity collision")
shutil.rmtree(staging)