Pass 30 remote portability proof

.github/workflows/pass30-remote-proof.yml

@@ -0,0 +1,222 @@
+name: Pass 30 remote proof
+
+on:
+  push:
+    branches:
+      - agent/residue-remote-proof-pass30
+  pull_request:
+    branches:
+      - chatgpt/legacy-blake3-removal-pass12
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  portability:
+    name: ${{ matrix.host_label }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            host_label: ubuntu-latest
+          - os: macos-latest
+            host_label: macos-latest
+          - os: windows-latest
+            host_label: windows-latest
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Checkout proof carrier
+        uses: actions/checkout@v4
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Reconstruct Pass 30 executable workspace
+        shell: bash
+        env:
+          DELTA_SHA256: eb1c9e98091269b1e7e07e3bb82b396aea06130c2350aef82794cd8d0b17f8c0
+          FIXTURE_SHA256: 2b9cdafc3978f859c8c122bd5b3bc643091295ffee71d0d9f629c00db53a2114
+        run: |
+          python - <<'PY'
+          import base64
+          import hashlib
+          import os
+          from pathlib import Path
+          import shutil
+          import tarfile
+
+          root = Path.cwd()
+          parts = sorted((root / "remote-proof").glob("delta.part*.b64"))
+          if len(parts) != 11:
+              raise SystemExit(f"expected 11 delta parts, found {len(parts)}")
+          encoded = b"".join(part.read_bytes() for part in parts)
+          delta = base64.b64decode(encoded, validate=True)
+          expected = os.environ["DELTA_SHA256"]
+          actual = hashlib.sha256(delta).hexdigest()
+          if actual != expected:
+              raise SystemExit(f"delta hash mismatch: expected {expected}, got {actual}")
+
+          staging = Path(os.environ["RUNNER_TEMP"]) / "locus64-pass30-delta"
+          if staging.exists():
+              shutil.rmtree(staging)
+          staging.mkdir(parents=True)
+          archive = staging / "delta.tar.xz"
+          archive.write_bytes(delta)
+          extracted = staging / "extracted"
+          extracted.mkdir()
+          with tarfile.open(archive, "r:xz") as tf:
+              tf.extractall(extracted)
+
+          deleted = extracted / "deleted.txt"
+          for line in deleted.read_text(encoding="utf-8").splitlines():
+              if not line:
+                  continue
+              target = root / line
+              if target.is_dir():
+                  shutil.rmtree(target)
+              elif target.exists() or target.is_symlink():
+                  target.unlink()
+
+          overlay = extracted / "overlay"
+          shutil.copytree(overlay, root, dirs_exist_ok=True)
+          for retired in [
+              "l64-core", "l64-locus", "l64-research", "l64-kernel",
+              "l64-command", "l64-registry", "l64-selector", "l64-runtime",
+              "l64-canon", "l64-atlas", "l64-cert", "l64-testkit",
+          ]:
+              shutil.rmtree(root / retired, ignore_errors=True)
+
+          fixture_encoded = (root / "remote-proof/current-samples.tar.xz.b64").read_bytes()
+          fixture = base64.b64decode(fixture_encoded, validate=True)
+          fixture_expected = os.environ["FIXTURE_SHA256"]
+          fixture_actual = hashlib.sha256(fixture).hexdigest()
+          if fixture_actual != fixture_expected:
+              raise SystemExit(
+                  f"fixture hash mismatch: expected {fixture_expected}, got {fixture_actual}"
+              )
+          fixture_archive = staging / "current-samples.tar.xz"
+          fixture_archive.write_bytes(fixture)
+          shutil.rmtree(root / "samples", ignore_errors=True)
+          with tarfile.open(fixture_archive, "r:xz") as tf:
+              tf.extractall(root)
+          PY
+
+      - name: Test exact executable workspace
+        shell: bash
+        run: cargo test --locked --offline --workspace
+
+      - name: Write source-bound receipt
+        shell: bash
+        env:
+          HOST_LABEL: ${{ matrix.host_label }}
+          FULL_SOURCE_SHA256: 0b4af31494ec25c8fbc66f2a8f4383af34f76f304751828c57e8c3756cbafda2
+          BASE_COMMIT: 0ee9274c9ae4b574d89f94cfa2ae13078d28cbed
+          DELTA_SHA256: eb1c9e98091269b1e7e07e3bb82b396aea06130c2350aef82794cd8d0b17f8c0
+          FIXTURE_SHA256: 2b9cdafc3978f859c8c122bd5b3bc643091295ffee71d0d9f629c00db53a2114
+        run: |
+          mkdir -p receipts
+          rustc -vV > "$RUNNER_TEMP/rustc-version.txt"
+          python - <<'PY'
+          import json
+          import os
+          from pathlib import Path
+
+          rustc = Path(os.environ["RUNNER_TEMP"]).joinpath("rustc-version.txt").read_text(encoding="utf-8").strip()
+          receipt = {
+              "schema": "L64PORT1",
+              "proof_scope": "pass30-executable-workspace",
+              "source_ref": "archive-sha256:" + os.environ["FULL_SOURCE_SHA256"],
+              "full_source_archive_sha256": os.environ["FULL_SOURCE_SHA256"],
+              "base_commit": os.environ["BASE_COMMIT"],
+              "executable_delta_sha256": os.environ["DELTA_SHA256"],
+              "fixture_archive_sha256": os.environ["FIXTURE_SHA256"],
+              "host_label": os.environ["HOST_LABEL"],
+              "runner_os": os.environ["RUNNER_OS"],
+              "runner_arch": os.environ["RUNNER_ARCH"],
+              "rustc": rustc,
+              "package_count": 11,
+              "external_dependencies": 0,
+              "test_command": "cargo test --locked --offline --workspace",
+              "result": "pass",
+              "repository": os.environ["GITHUB_REPOSITORY"],
+              "workflow": os.environ["GITHUB_WORKFLOW"],
+              "run_id": os.environ["GITHUB_RUN_ID"],
+              "run_attempt": os.environ["GITHUB_RUN_ATTEMPT"],
+              "head_sha": os.environ["GITHUB_SHA"],
+          }
+          out = Path("receipts") / f"portability-{os.environ['HOST_LABEL']}.json"
+          out.write_text(json.dumps(receipt, indent=2, sort_keys=True) + "\n", encoding="utf-8")
+          PY
+
+      - name: Upload host receipt
+        uses: actions/upload-artifact@v4
+        with:
+          name: pass30-portability-${{ matrix.host_label }}
+          path: receipts/portability-${{ matrix.host_label }}.json
+          if-no-files-found: error
+          retention-days: 30
+
+  aggregate:
+    name: aggregate receipts
+    needs: portability
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download host receipts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: pass30-portability-*
+          path: receipts
+          merge-multiple: true
+
+      - name: Verify receipt convergence
+        shell: bash
+        run: |
+          python - <<'PY'
+          import json
+          from pathlib import Path
+
+          files = sorted(Path("receipts").glob("portability-*.json"))
+          if len(files) != 3:
+              raise SystemExit(f"expected 3 receipts, found {len(files)}")
+          receipts = [json.loads(path.read_text(encoding="utf-8")) for path in files]
+          expected_hosts = {"ubuntu-latest", "macos-latest", "windows-latest"}
+          hosts = {r["host_label"] for r in receipts}
+          if hosts != expected_hosts:
+              raise SystemExit(f"host set mismatch: {hosts}")
+          invariant_fields = [
+              "schema", "proof_scope", "source_ref", "full_source_archive_sha256",
+              "base_commit", "executable_delta_sha256", "fixture_archive_sha256",
+              "package_count",
+              "external_dependencies", "test_command", "result", "head_sha",
+          ]
+          for field in invariant_fields:
+              values = {json.dumps(r[field], sort_keys=True) for r in receipts}
+              if len(values) != 1:
+                  raise SystemExit(f"receipt divergence in {field}: {values}")
+          if any(r["result"] != "pass" for r in receipts):
+              raise SystemExit("non-passing receipt")
+          summary = {
+              "schema": "L64PORTSET1",
+              "proof_scope": receipts[0]["proof_scope"],
+              "source_ref": receipts[0]["source_ref"],
+              "base_commit": receipts[0]["base_commit"],
+              "executable_delta_sha256": receipts[0]["executable_delta_sha256"],
+              "fixture_archive_sha256": receipts[0]["fixture_archive_sha256"],
+              "hosts": sorted(hosts),
+              "result": "pass",
+              "receipts": [path.name for path in files],
+          }
+          Path("receipts/portability-set.json").write_text(
+              json.dumps(summary, indent=2, sort_keys=True) + "\n", encoding="utf-8"
+          )
+          PY
+
+      - name: Upload converged receipt set
+        uses: actions/upload-artifact@v4
+        with:
+          name: locus64-pass30-portability-receipts
+          path: receipts/*.json
+          if-no-files-found: error
+          retention-days: 90

remote-proof/current-samples.tar.xz.b64

@@ -0,0 +1 @@
+/Td6WFoAAATm1rRGBMDzH4DgAyEBFgAAAAAAAEnOF8vg7/8P610AOZhJ/u/k7p/MArxxrwHupLnvyd6Pvi/c2ul/0q/oCByCWOgC4dQrbVefqxUaa4FGYloj+OzOrZAPbB7wS3JnC3B6nvNFpxpPfiUrlDGLcb9Rv0L1xXF1J4WrRhcyyQ9vcjvLl0AhpRO6gr+YlsA508WddQYAO3vzVWeWunMoqVLe0e/+WXqmSRuNZ0L/Xq9drZ2R5P3tcRSpr9g51Q5rOvB6/ZOTtuBr1ABkFzs0KDlozDrxcQOVaeGMggrpiNQemjhpe3ldw9J7oKH1BESfZqB/1iSDAVTDbvotZF5AH3bT10zgEVxzhy7TgyPBEtKw4ZfCxYfHdmCpJ3aeE6wVUoBwjVyh8eLSf9N48I/USmYVMhmSpcWPmuXF2uNlBQw3EPEAEUNrUXq4b0LdUwrnZSlp8nOpOqibH+9/e78fTDBhh8ThWsFsY2OAmVMVnMuX5y2jSsqR3ptunFPJYNgOwA3axSY1O+YZBgspi2fXRTHatU9xL576mUk+lxK9/FyyloeWjeDUzm3QX+6QRfV4RiCjGvpRhYz5HJxHwnZRXR/AeZM7RmEB4kNQ4vcuh6hnR65UIrYMEtkIjL/bZ3UwmZsug0FhxMf8ujsTKA1+Rr+KrmJlhUl8tWQgzozXVAkCBmEM0zCpahK3+wMP/aUgnW5MC/X2RE7orGrfySKt/OTQwDpD4Ha+CavsOSWOmql70iZTZO8ApN6KXlG4EraIIFB+/hmIC+4zLu12mYR1ZoCVhCM7ykn7+/7R78KBLfkX3T6OdE3OUal5Y50dhH2fW5OiprjCLFh9Jlu7siZJntMs2EJugewV9O3mYTPtDsbr/bJr9GyFUEm7qy4VpnMIBv/eHeFu9wueTCWoOaLdADLNx9pmtgjm5giRZs3F6J6O0dKxBoboRwTd5idxnErwcezdhuV2mX+YCf8MRrtN0vZnuhMYuO+McNeLbdCCVXGkPaBbTFAcUBuCW4m6o4aggyKuodJrF0ZLOekk+xZSGB3elv2yICAXyxGq1/ynLRHgOWvsKgoDKhObWQfTO4RQR+A5BpyfkNRsIqTeg3nuFogs+fBYUbvZ21Egr2KEG8D0LKW8HKLIONbDYoPHHnkW0YW6K85o3sZl5ajvvxYHJFJOyDsucDTqToh60OlWLTFtrtW07At2y6hx8HB9SJOCG0liCXJH3jJXvVoMOYMi8FG4gzqQz7+Ayaa+VqSkfo17G41s5yyBE5p6B5LfMHNivAkWzo+FajkkNKkmkIawCttyqFPfm96rPuTfhD9Rpuf8NVh073j6VWd2VMaOVCTermYFy0XX9j8tm34J7aeMg/LDlkLEDEtQLSCNQz1DxD7wTbPJCtJ3AzEN8Kt3DPpEFr00syDBoXEtFMU00dwRvmJOw1sPBYWqzm6Ea2V2eIjoyPJ8oHGxinqGXQNMPDVEjDFcRL1bCpsy6y7lJmo6/WspcOqoBIfJp4HZAZfTFWPv9046ee/k8MtyFh3LevWg7387iZ0gbT2pM39/l9HoKX8B36pe3b1MuLdSGcA+yROCRPkapW1V5Ru44U0OzidqQ0CMAlZsExn768GgBZvUdPgOIpQZ7+3/tjAx89DYE4zqzGDJiiySPFtU20mUmaxOjgQ5ct3rw4s0qf2hY0Femdcx/mYjWXx5RVpnaqxKFr/1STdZVkliP03JYzEQEZVcfFyRBBBGEXwTooLxhWlBy24EmSzD8H45fgfNRbolAKbp7CJHWdaivwROYbmnGnzlfh0vDk1bQaBpSa6QwVRsHk8wVgb1Tt3cwKvCl1k+DBeKHudsfj0Q+ko4tcBD4Dj2aE4n2hcdz/hErhsFb4TXqdoRG+Wr6nZAwmsTuRvpji/4JzqbXuv6BYRCtGBV/q9eI2jCnJYCcI9hNEOv70mmHXsjUXRH8LzbYgn8nzTt9bOsc0ExnR5RZrxLM6aIQy76+SglDrAOx1MndjivZc28SjmKk6JKru+ouZGPnJx58oJO46a/9hIb8Al60qL5ChrWww3xf/jzyUxegdFZyPZg6V7S1PrqWNedtlQ0WYCDLAHuXcNLqYQaEGbKaeyvzHglUUuLIWUiKPxF3zkzrZl/cpCyEO4MEm/7j+Bz4G0JDlbu0CITfSUtAdlimIlFacIlt9HYhIB7bud/m0V31ojJ1OlkSjbd24/c1tQzZIqbe7N3s6iSaPliHbf3JsPOUdSyS3Lvhg71MAmF5+GPTblEPV72fMNtl0aIgpiXJ8w34fES/dgcNIIHNwRJ+3zFirLeyypa+oh9T1hqoa5vbM5dDG5SZydnAmc0Luf05zENsudPBDWWuiEpHSLhFKVr2udtqvWgLWlwgrSlP/mD29TcKtJvivaLI6p0o/tE6YkVSeyBEl7ahdg74glerccr8aAWxlE45u7u+vAttcVIl1UjmDaZX2Samy/JLTGHg1LSFF4oCjaJ/4/8m1nFoAEflmiw4pTVFS5UyTdSMpHXxTcAB6AMLrScBahKDLgq97fLw9ZShN8qAeoMZts+KTFzeMF9Vng/QUCov/aUmyZfMF/67KlxY418b89SBcPYH/EoaJbByAzNP1pKRKN2V0a1muAH4dZx2mSJJtKf0IdxIlCvGLe1r0L5Yc6+qraNSDSJ8Ezx7vcDdXl8/PxIGcjWLc6U5oxz04+rqAjgZx/OspmroESMehsoX33FGroUpNA3u2VFKfafS69urnfRIA9RvaL54XdTrLFVrL4eVcv+d9c8JriJxQDorz2fHW/EuMD66ydCCbcBTWdNaCmKq/wXXxonKBLBl7wKSg1zUtWAOYHd6/lFG7rf9gW5dH+NeYSHNS8l8yabpkg3eF/EHEpasT/ivFOW4JbaexPEvtmk2ch2UVB1NcwU+m99GENb6S7taY78E4t4/qiZBA2YSCKksbYcbm1kTL9suLep4OmHS1lbkCP0n2USPf0rudy8IUcQEZd37ARaE+OTBadsbGJvi0NiNooHZPo3dfN+FftscRUFezAE1HJwK/Bm68V8DQgNDP8UhCfHoxLRXxbKhbO9yAwXpcJ4zVd0LBVMCNmC1wZNQCFYaVJjvluWNaQGbnNlyyz68cQYOoDy6qcbzPsjcR7vF7k3qqMuUfFlQkrgOJ95LkUTm5QIBe8vmSnbillpvxJBX2zmpe/2DxHyNU1s+RhFDdkB7UiIWw9Wo8Bz4fRSxGJzcCxOvi41pe1AE8eVt3As7lXh2Hro6aI4rvsXDhIH/dnQeNSnuaEUhbYFiOK44hDVLFbWIWCUti8SsXmNJb3IL2PU4EaZ8XaCQ+Zi5IKNCmrpXc5NfpfCdL3dFrFEVqvO26VMcgnIjTwhhhdLdVQrM5KJSB13ZAigHFtE0/EqSSCUSsU3j3s7oG7rs6cn5GYxxxYrvmIhpvrA8WmYNjHeX/uzLXgOZgf9LD+zxExbrEgq8sQZTdbH3bSQDuTpNvhkBTvX7vKcaZNWjI9gsCa0rFTTCf2ioK8UKpEcS1+WQ5k/KiOuU4ri//fpwHtLjGAGGFFEtbOJJ7Nf95DCjXwhSiwXEv33y9+PyZGzvbxVd3byijGD4xoVcbxHYlzrsIPT2BZYTDTIqGchfai8Q4O/DfGiDzlSD8hGd7sakUSwObsrGRaI+swK3oV2yH9cluIHEw6x/r+I4O/B31G9X38w/oPtTE6Ul5ubB3mEtDvLpF4aAHyVpzlZsD/qxM5o/GZxTPVttdTKPxe8KlYApJsqWhOGz0g392bcqKHtaneCXIrPVZJqCjw8U2RYhwR0O/vActUZGL3apTFYDbSdSKOzzTzuAZELsdZ8Jd1BdC/jdvwx6qD4drx3w3Wx8+cK/MuyVoVRxDcEizFPMINVvjAO12pol1ML865kZTRIuVb1buqMPjcGVfDbmlwTKJI1OTZ6snUtjuF8eeizqtaHlWUKwcXo8ynxwFIT63w/SmJ0wr14a6ltLbOh2fSSbY5Ud4bSbs/AiYPF3RtbNqcBJO3wv5RoX5SMY6FNNZrWwJboZKrvmd3s8uIZH7Bw1W4z8lJGHhcLT6gAhgbM+JRPk8vL33XZV1Yc64BOhPTtDWIVSfWIWNLbjVgN31ibaTVfcOyYHnMeZWdypipGkDokyzUiL4JoBBMdODDgjY49aUqy+o057rtWouzNdK6vhF/vyD4s+QAzX7lfDNqH1ZKFDppl34zMhO5JVYQ415yy8l8QCyGhVgD16ZUHsCJJXv6LeIq1euqmWvrxC29tYUD5klebR/5Jx3j7P9nwT6Y7ruC1qeKQP9t2h9bXwezMAGE/I2/pOjBP2a8wES0wvWvDgJQ/tn8AJ3doxh5JAUW8Wzzq2DEEGzWrO++wwWkRBS0M6oHSDQqCe0ROM5SOUJ79lOA9YXAkQ3RyWHC5jBE3iJ4GMQ0tNzHxLJY9B9ulBQK8W/vR9Q+hfHKkC6XTuQ7V1Trfu5ywETTdkXgYkc8xjkjuHYeHhxy3G2VMK74KGAO4U7giplAZkna0sR/0sPBVZJxVofPiVJWJAr3V5MHVfbAIhaM/Bolpxrg/hAoV2I6XJHIxRX2rQ9FPZy3m6LMMpWkNPf380w5e1hpJOCSgb8nzX+MIlknKok1twrH7yqXnor3waPji8hLZWwseSLehH7VL4Noml+wZ9Ne+9oOOLlAJRADgqte5EgWovJcbpIWZ9LazdSubFiGuQgwx69yyG5IzJi6CGil5CGLoyvDiukrwW4zPCjUEDDXUG6OjIGqxJQNsFFHxji+N1hawPV+pInPw8hpolxS0fJhF9Lb1rYZdrFTLOGNFhhrLxdw4Tx4+7NTVlCCTGShsQMY1OVAEn/FZtaUEP+lwcm0CH77hOg73g3I0KDs6Q7WdPJJjMkgpfL+zOihRF7fp9mQfca7NfZ3HyN+P+Isx6ZODRY386BLzUyslmxwBBjHu4aibMrilGfaZ6U1jjUo8FYTM/A6ch+B95KQ/9bd5oVdD6ND0TJEsLYDBvtYL0FoMKhYrDKLxqGCcZR2eBNojB78MSOq8/giUtdJKPD+QH2x9q8yr+0qTGoRMSmsjRv/7QubGUCeIcsOTeHOWFSyVdaq04genCdri7kaopior/yF16J+BXk6xW8AQeZQ1s+Zto1PMa4d5hU3l4QVhEEy01ko0Bf6lFgYHr+/p1oBlo29YxODKlrI5EVIFWcFEmD2qIAGw/+Tissb18a395hLfDT9lLTxuSzAigRzb596OnNtpdDX3Zz7ZgHT4IYg9/Nh4CFUDg2U00X4smNpcpdGWIZ+lel0iN6UFQw6HtINUN2r1g2s082OD2Nnz2zRSFR5nMkF0gNvpVtWG+/zQQ0lEsvg+27FsoMBmbHxDH7YCYWeDe9ERkVhSnqHXhmG7aKopzq1TfMtTSIm32DL5boPPV3MzLGCPI9VNVp5kmHM5sKtXsgK2RLgTcvJHqufQGoceCpsMXbSwN5nI1tIXZ/s0gQYhAAAAXjr8dVE5+7IAAY8ggOADAIxo5IKxxGf7AgAAAAAEWVo=