fix(simulation): require gaussian runtime provenance

src/k1link/simulation/gaussian_pipeline_gateway.py

@@ -22,6 +22,8 @@ RESULT_SCHEMA: Final = "gaussian-pipeline.build-result/v1"
 CAPABILITIES_SCHEMA: Final = "gaussian-pipeline.capabilities/v1"
 SAFE_UPLOAD_ID: Final = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$")
 SHA256_PATTERN: Final = re.compile(r"^[a-f0-9]{64}$")
+SOURCE_REVISION_PATTERN: Final = re.compile(r"^[a-f0-9]{40}$")
+IMAGE_DIGEST_PATTERN: Final = re.compile(r"^sha256:[a-f0-9]{64}$")
 DEFAULT_CHUNK_BYTES: Final = 8 * 1024 * 1024
 MAX_JSON_RESPONSE_BYTES: Final = 32 * 1024 * 1024
 MAX_RETRIES: Final = 3
@@ -103,8 +105,10 @@ class GaussianPipelineGateway:
         if (
             document.get("schema_version") != CAPABILITIES_SCHEMA
             or document.get("service") != "ndc-gaussian-pipeline"
+            or document.get("api_version") != "gaussian-pipeline.api/v1"
         ):
             raise GaussianPipelineGatewayError("Gaussian provider capabilities do not match v1")
+        _validate_runtime_provenance(document)
         return document
 
     def upload_source(
@@ -185,6 +189,7 @@ class GaussianPipelineGateway:
         result = self._json("GET", f"/v1/jobs/{quote(job_id, safe='')}/result")
         if result.get("schema_version") != RESULT_SCHEMA or result.get("job_id") != job_id:
             raise GaussianPipelineGatewayError("Gaussian result identity does not match")
+        _validate_runtime_provenance(result)
         return result
 
     def download_artifact(
@@ -408,6 +413,21 @@ def _safe_id(value: str, label: str) -> None:
         raise GaussianPipelineGatewayError(f"Gaussian {label} is invalid")
 
 
+def _validate_runtime_provenance(document: Mapping[str, object]) -> None:
+    runtime = document.get("runtime")
+    if not isinstance(runtime, dict):
+        raise GaussianPipelineGatewayError("Gaussian runtime provenance is unavailable")
+    source_revision = runtime.get("source_revision")
+    image_digest = runtime.get("image_digest")
+    if (
+        not isinstance(source_revision, str)
+        or SOURCE_REVISION_PATTERN.fullmatch(source_revision) is None
+        or not isinstance(image_digest, str)
+        or IMAGE_DIGEST_PATTERN.fullmatch(image_digest) is None
+    ):
+        raise GaussianPipelineGatewayError("Gaussian runtime provenance is invalid")
+
+
 def _unavailable(message: str, error: httpx.HTTPError) -> GaussianPipelineGatewayError:
     if isinstance(error, httpx.TransportError):
         return GaussianPipelineUnavailableError(message)