"""Read-only verifier for the NutriCoach V1.5 V13 weekly-authority preseal.""" from __future__ import annotations import argparse import hashlib import json import sys from pathlib import Path from pydantic import JsonValue, TypeAdapter sys.path.insert(0, str(Path(__file__).resolve().parents[1])) from scripts.nutricoach_v150_detached_bootstrap import ( PRESEAL, verify_closure, verify_package_inventory, ) from scripts.nutricoach_v150_live_upgrade_common import canonical _OBJECT = TypeAdapter(dict[str, JsonValue]) _SOURCE_ROOT = Path("/home/cube/projects/richard/.worktrees/nutricoach-v150-combined") _BASE = Path("/home/cube/.hermes/migrations/nutricoach-v1.5.0-combined") _V12_DIGEST = "4627a832bd84bbc8b534deb06019643d74f5e567640fd612fbcd8b8d7690d3a1" _SUPERSEDED = { "a362d994b41a5d05ed2fcdafc76482e72d18ff69334cd8249eec061bff733acb", "869c1e8f080ce79600ed7af58e0bd33db54cf316fa9aff4efe924fee15409fa5", "94953fed9802b406e70341bb053532095db56b2d294b9fdf8e935bf688990818", "d23faa5cb136290d5dbd8b75430abe6aa98526fee7ca6f11201df5e2342b587d", "3fbaea7e19a77a1007e27f3f0a3610a727baeeb2ab7bded1f5301a3da5872dd9", "cb18dad93de038d355a6feea866d89cb98be7eb990decab33d2e3154e2222f41", "6033ff140f60822c34e588fefffbf64c6630ea17a8c74f8aa524408b7313cd25", "7e2c228a757083fe2f8cebe06b03e854fb40b02fae1b18e30fd471c8d1b187ee", "e1dd08b8b0333c462c17feb7f4e13e26ad9f49ab57125c66488570ce07638b42", "1835ddff25c2db60a4e2f8ea991f59051a0a3b1c89dcbc6a12f76cd08015c3f5", "f64ffbde677fa0f7413a7e5f0bafbcd9f442e61508b092ed56cb1f099ef2e92b", "e6ddec2ecc8802cb6bf94daa39a03672a19c61ae485d5e64ab387fbddb8f30c7", "9c2f7bcd06777bca77ea4d1c1d5f55588f6facd04a8eee4d22b3cc6394838ffb", _V12_DIGEST, } _REQUIRED_CLOSURE = { "scripts/nutricoach_v150_detached_bootstrap.py", "scripts/nutricoach_v150_host_operations.py", "scripts/nutricoach_v150_runtime_ops.py", "scripts/nutricoach_v150_sealed_controller.py", "scripts/nutricoach_v150_weekly_authority.py", "tests/nutricoach_v150_transaction_support.py", "tests/test_nutricoach_v150_live_binding.py", "tests/test_nutricoach_v150_preseal_v13.py", "tests/test_nutricoach_v150_sealed_controller.py", "tests/test_nutricoach_v150_v3_hardening.py", "tests/test_nutricoach_v150_weekly_authority.py", } _VALIDITY = { "issued_at": "2026-08-27T00:00:00+09:00", "expires_at": "2026-09-30T23:59:59+09:00", } class VerificationDenied(RuntimeError): """Stable weekly-authority preseal integrity denial.""" def _load(path: Path) -> dict[str, JsonValue]: return _OBJECT.validate_json(path.read_bytes()) def _text(value: JsonValue | None, label: str) -> str: if not isinstance(value, str): raise VerificationDenied(label) return value def _mapping(value: JsonValue | None, label: str) -> dict[str, JsonValue]: if not isinstance(value, dict): raise VerificationDenied(label) return value def validate_bound_contract( target: dict[str, JsonValue], package: dict[str, JsonValue], supersession: dict[str, JsonValue], ) -> None: """Validate the non-file semantic V13 authority bindings.""" digest = package.get("package_digest") phrase = package.get("approval_phrase") if ( not isinstance(digest, str) or digest in _SUPERSEDED or phrase != (f"AUTHORIZE NUTRICOACH V1.5 LIVE UPGRADE {digest}") ): raise VerificationDenied("superseded_package") payload = _mapping(package.get("payload"), "package_payload") if hashlib.sha256(canonical(payload)).hexdigest() != digest: raise VerificationDenied("package_digest") authority_id = target.get("authority_id") expected_id = "nutricoach-v150-v13-weekly-authority-39-066a794d" expected_paths = { "global_approval_ledger": str(_BASE / "live-authorization-v13" / expected_id), "execution_root": str(_BASE / "live-executions-v13" / expected_id), "controller_target_binding": str(PRESEAL / "sealed-target.json"), "permission_package": str( _BASE / "preflight-v13-weekly-authority/package.json" ), "protected_inventory": str( _BASE / "preflight-v13-weekly-authority/snapshot-before.json" ), } if authority_id != expected_id or any( target.get(key) != value for key, value in expected_paths.items() ): raise VerificationDenied("v13_paths") if ( target.get("package_digest") != digest or target.get("approval_phrase") != phrase ): raise VerificationDenied("target_package") weekly = _mapping(payload.get("weekly_authority"), "weekly_authority") expected_created = [ "/home/cube/.hermes/profiles/dualcoachtest/data/weekly-operations-authority", "/home/cube/.hermes/profiles/dualcoachtest/.strict-runtime/066a794d-v150", "/home/cube/.hermes/profiles/dualcoachtest/.strict-runtime/066a794d-v150/runtime-authority", ] if any(( weekly.get("capacity") != 5, weekly.get("channel_inbox_authorized") is not False, weekly.get("registry_identity") != "canonical-stat-and-content-binding-v1", weekly.get("receipt_validity") != _VALIDITY, weekly.get("authority_created_paths_rollback") != expected_created, weekly.get("external_events_authorized") != 0, weekly.get("telegram_customer_events_authorized") != 0, weekly.get("provider_events_authorized") != 0, )): raise VerificationDenied("weekly_authority") if ( target.get("archived_databases") != "stable" or target.get("root_logs_classification") != "all root logs/ files volatile" or target.get("root_runtime_state_volatile") != ["state.db", "state.db-shm", "state.db-wal"] or target.get("wheels") is None ): raise VerificationDenied("target_classification") rows = supersession.get("superseded") v12: dict[str, JsonValue] | None = None if isinstance(rows, list): for row in rows: if isinstance(row, dict) and row.get("package_digest") == _V12_DIGEST: v12 = row break if ( supersession.get("active_package_digest") != digest or not isinstance(v12, dict) or v12.get("consumed") is not True or v12.get("rolled_back") is not True or v12.get("approval_phrase_reusable") is not False or v12.get("postcommit_failure_bound") is not True ): raise VerificationDenied("v12_supersession") def verify() -> dict[str, JsonValue]: """Verify inventory, source closure, V12 evidence, and untouched V13 roots.""" verify_package_inventory(PRESEAL / "package-manifest.json", PRESEAL) closure_manifest = _load(PRESEAL / "controller-source-manifest.json") files = _mapping(closure_manifest.get("files"), "closure_files") if not _REQUIRED_CLOSURE.issubset(files): raise VerificationDenied("closure_incomplete") closure = verify_closure(PRESEAL / "controller-source-manifest.json", _SOURCE_ROOT) verifier_manifest = _load(PRESEAL / "verifier-source.json") verifier_files = _mapping(verifier_manifest.get("files"), "verifier_files") if set(verifier_files) != {"scripts/verify_nutricoach_v150_preseal_v13.py"}: raise VerificationDenied("verifier_closure") _ = verify_closure(PRESEAL / "verifier-source.json", _SOURCE_ROOT) target = _load(PRESEAL / "sealed-target.json") package_path = Path(_text(target.get("permission_package"), "package_path")) package_sha = hashlib.sha256(package_path.read_bytes()).hexdigest() if package_sha != target.get("permission_package_sha256"): raise VerificationDenied("permission_package") package = _load(package_path) supersession = _load(PRESEAL / "package-supersession.json") validate_bound_contract(target, package, supersession) evidence = _mapping(target.get("v12_terminal_evidence"), "v12_evidence") expected_evidence = { "authorization-consumed.json": "c102a4fd54c035f69b0ac66ea944cafebbc9303ed09658124d0a5f77be43014d", "phase-rolled-back.json": "8e429e77dd1bdf4c463ac27b23125b9c05543a598559ac91cbe19a6b3d3e3e7d", "postcommit-rollback-receipt.json": "07a07021d8696925261b017209408b42be6784972493b7ca11041f3d68b5140a", "v12-preseal-manifest.json": "2a51306027fc59567dfa40c500afe04010d475c932737cc88b3871b8fa24907b", } if evidence != expected_evidence: raise VerificationDenied("v12_evidence") for name, expected in expected_evidence.items(): if hashlib.sha256((PRESEAL / name).read_bytes()).hexdigest() != expected: raise VerificationDenied("v12_evidence_drift") ledger = Path(_text(target.get("global_approval_ledger"), "ledger")) execution = Path(_text(target.get("execution_root"), "execution")) if ledger.exists() or execution.exists(): raise VerificationDenied("v13_authority_touched") digest = _text(package.get("package_digest"), "package_digest") return { "approval_phrase": _text(package.get("approval_phrase"), "approval_phrase"), "closure_digest": closure, "package_digest": digest, "package_sha256": package_sha, "status": "V13_WEEKLY_AUTHORITY_PRESEAL_VERIFIED", } def main() -> int: parser = argparse.ArgumentParser(description=__doc__) _ = parser.add_argument("--verify", action="store_true", required=True) _ = parser.parse_args() try: result = verify() except (OSError, VerificationDenied) as exc: print(f"DENIED:{exc}", file=sys.stderr) return 2 print(json.dumps(result, sort_keys=True, separators=(",", ":"))) return 0 if __name__ == "__main__": raise SystemExit(main())