
    Yj(              	         U d Z ddlmZ ddlZddlZddlZddlZddlZddlZddl	Z	ddl
Z
ddlZddlZddlZddlmZ ddlmZ ddlmZ ddlmZmZmZmZ ddlmZmZ dd	lmZmZ dd
lm Z m!Z!m"Z" ddl#m$Z$ dg dg dddg ddddZ%de&d<   dg g dZ'de&d<   ddie'd ejP                   ejR                  e'dd      jU                               jW                         iZ,de&d<    ejZ                  d       Z. ejZ                  d!      Z/dFd"Z0dGd#Z1dd$dHd%Z2dId&Z3dJd'Z4dKd(Z5	 	 	 	 dLd)Z6	 	 	 	 dMd*Z7	 	 	 	 	 	 dNd+Z8	 	 	 	 	 	 	 	 dOd,Z9	 	 	 	 	 	 dPd-Z:dQd.Z;dRd/Z<	 	 	 	 	 	 	 	 	 	 dSd0Z=	 	 	 	 	 	 	 	 	 	 	 	 dTd1Z>	 	 	 	 dUd2Z?	 	 	 	 	 	 dVd3Z@	 	 	 	 	 	 dWd4ZA	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 dXd5ZB	 	 	 	 	 	 	 	 dYd6ZC	 	 	 	 	 	 	 	 	 	 dZd7ZDd[d8ZE	 	 	 	 	 	 	 	 d\d9ZFdd:	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 d]d;ZGdd<	 	 	 	 	 	 	 	 	 d^d=ZHd_d>ZId`d?ZJ	 	 	 	 	 	 	 	 dad@ZK	 	 	 	 	 	 	 	 dbdAZLdddB	 	 	 	 	 	 	 	 	 	 	 	 	 dcdCZMdddDZNeOdEk(  r eP eN             y)ezHOffline rehydration and sealed expected-state checks for Task26 bundles.    )annotationsN)BytesParser)compat32)Path)AnyMappingSequencecast)InvalidRequirementRequirement)InvalidVersionVersion)qualification_tool_hashestrust_boundary_digestvalidate_product_binding)validate_snapshotz!task26-evidence-trust-boundary-v1)trusted_operator_accounthost_kernelselected_python_pip_toolchainsealed_wheel_bytes)content_identitydeterministic_tamper_detectionreproducibility*revocation_and_current_authority_selectionfail_closed_workflowzThese guarantees apply only while the trusted operator account, host kernel, selected Python/pip toolchain, and sealed wheel bytes remain trustworthy.zCoherent compromise of the trusted operator account or host administrator, including coherent modification of the repository, ledger, or verifier, is outside the Task26 threat model.)external_authenticitynon_repudiationowner_tamper_proof_or_worm+resistance_to_compromised_operator_or_adminFnone)schematrust_anchorsguarantees_within_boundaryscope_statementoutside_scopenot_claimedexternal_authenticity_claimedsignature_claimdict[str, object]TRUST_BOUNDARY	root_modedirectoriesentries_EMPTY_WHEELHOUSE_PAYLOADr!   %task26-sealed-wheelhouse-inventory-v1inventory_sha256T,:	sort_keys
separators_EMPTY_WHEELHOUSEz[-_.]+z^[0-9a-f]{64}$c                R    t        j                  | dddd      j                         S )NFTr2   )ensure_asciir6   r7   	allow_nan)jsondumpsencodevalues    /home/cube/projects/richard/traning coach/.omo/evidence/task26/task26-transcript-contract-installed-st_01a01574-v26/gateway/platforms/task26_final_state.py	canonicalrB   T   s+    :: fh    c                   t        j                         }| j                  d      5 t        fdd      D ]  }|j	                  |        	 d d d        |j                         S # 1 sw Y   |j                         S xY w)Nrbc                 &     j                  d      S )Ni   )read)streams   rA   <lambda>zsha256_file.<locals>.<lambda>a   s    &++k":rC   rC   )hashlibsha256openiterupdate	hexdigest)pathdigestchunkrH   s      @rA   sha256_filerS   ^   sh    ^^F	4F:C@EMM%  A 
  
 s   &A&&A>	directoryc                  | j                         }|rt        j                  nt        j                  }|rddhnddh}t        j                  |j
                        se ||j
                        rS|j                  t        j                         k7  s2|s|j                  dk7  s!t        j                  |j
                        |vrt        d|        y )N  i@          z sealed private path is invalid: )lstatstatS_ISDIRS_ISREGS_ISLNKst_modest_uidosgeteuidst_nlinkS_IMODE
ValueError)rP   rU   infoexpectedmodess        rA   _privaterj   f   s    ::<D(t||dllH'UENeU^ET\\"%;;"**,&dmmq0<<%U2;D6BCC 3rC   c                    t        | t              rt        d | D              rt        | d      t	        t        t
        t        f   |       S )Nc              3  >   K   | ]  }t        |t                 y wN)
isinstancestr).0keys     rA   	<genexpr>z_object.<locals>.<genexpr>u   s     )Tesjc.B*Be   z is invalid)rn   dictanyrf   r
   ro   r   )r@   labels     rA   _objectrw   t   s@    eT"c)Te)T&TE7+.//S#X&&rC   c                J    t         j                  d|       j                         S )N-)_NORMALIZE_PROJECTsublowerr?   s    rA   _normal_projectr}   z   s    !!#u-3355rC   c           	     d   t        |        	 t        j                  |       5 }|j                         }t	        |      t	        t        |            k7  st        d |D              rt        d      |D cg c]  }|j                  d      s| }}t	        |      dk7  rt        d      t        t              j                  |j                  |d               }d d d        t        j                  d	d
            j!                         }t        |j                  dd
            j!                         }|r|st        d      	 t        t#        |            }	t'        d |j)                  d      xs g D              }
t+        |      |	|
t-        |       | j/                         j0                  t/        j2                  | j/                         j4                        dS c c}w # 1 sw Y   xY w# t        j                  $ r}t        d      |d }~ww xY w# t$        $ r}t        d      |d }~ww xY w)Nc              3  p   K   | ].  }|j                  d       xs dt        |      j                  v  0 yw)/..N)
startswithr   parts)rp   names     rA   rr   z"_wheel_identity.<locals>.<genexpr>   s3     ZTYDts+GttDz7G7G/GGTYs   46zwheel members are invalidz.dist-info/METADATArZ   z%wheel METADATA cardinality is invalid)policyr   zdependency wheel is invalidName r   z$wheel project/version is unavailablezwheel version is invalidc              3  2   K   | ]  }t        |        y wrm   ro   )rp   r@   s     rA   rr   z"_wheel_identity.<locals>.<genexpr>   s     [3Y#e*3Y   zRequires-Dist)projectversionrequires_distrK   sizemode)rj   zipfileZipFilenamelistlensetru   rf   endswithr   r   
parsebytesrG   
BadZipFilero   getstripr   r   sortedget_allr}   rS   r\   st_sizere   r`   )rP   archivenamesr   metadata_namesmessageexcr   version_textr   requirementss              rA   _wheel_identityr   ~   s   TNA__T"g$$&EE
c#e*o-ZTYZZ !<==!&!&$--8M*N   >"a' !HII!2==^A./G #" '++fb)*002Gw{{9b1288:L,?@@>gl+, [7???3S3YWY3Y[[L"7+%d#		##TYY[001 ' #"  A67S@A  >34#=>s`   G. AG!4GGAG!G. H G!!G+&G. .HHH	H/H**H/c                `    t         d       g }g } g}|ry|j                         }t        |d       t        t        j                  |      d       D ]3  }t        |j                        }|j                         }t        j                  |j                        rt        d      t        j                  |j                        rmt        |d       |j                  |j                         j                         t        j                   |j                        d       |j                  |       t        j"                  |j                        r-|j$                  dk(  rt        |       |j                  |       +t        d       |ryt        | fd	      t        |d
       fS )NTrT   c                    | j                   S rm   )r   )items    rA   rI   z#_wheelhouse_files.<locals>.<lambda>   s    DIIrC   )rq   zwheelhouse symlink is forbidden)relative_pathr   z.whlz.wheelhouse contains an unbound non-wheel entryc                B    | j                        j                         S rm   )relative_toas_posix)rP   roots    rA   rI   z#_wheelhouse_files.<locals>.<lambda>   s    (8(8(>(G(G(IrC   c                    t        | d         S )Nr   r   )rows    rA   rI   z#_wheelhouse_files.<locals>.<lambda>   s    CO0D,ErC   )rj   popr   rb   scandirr   rP   r[   r\   r_   r`   rf   r]   appendr   r   re   r^   suffix)r   wheelsr-   pendingrU   entryrP   rg   s   `       rA   _wheelhouse_filesr      sO    TT"F+-KfG
KKM	d+BJJy17MNNE

#D::<D||DLL) !BCC||DLL)."")-)9)9$)?)H)H)J $T\\ : t$dll+v0Ed# !QRR% O . 	vIJ{ EF rC   c                   i }t               }| D ]j  \  }}t        |j                  dd            }t        |j                  dd            }||f}||v s||v rt        d      |j	                  |       ||f||<   l | D ]*  \  }}|j                  d      }	t        |	t              st        d      |	D ]  }
	 t        t        |
            }|j                  t        d      |j                  |j                  j                         sV|j                  t        |j                              }|t        d	|j                         t        |d
   j                  dd            }|j                  s|j                  j                  |d      rt        d|j                          - y # t        $ r}t        d      |d }~ww xY w)Nr   r   r   z/duplicate project/version in explicit wheel setr   z)wheel dependency declarations are invalidz'wheel dependency declaration is invalidz%direct URL dependencies are forbiddenzmissing dependency: rZ   T)prereleaseszdependency version mismatch: )r   ro   r   rf   addrn   listr   r   urlmarkerevaluater}   r   	specifiercontains)r   projects
identitiesrP   identityr   r   rq   _pathr   rawrequirementr   
dependencyselected_versions                  rA   _validate_dependency_closurer      s    >@H'*uJ hhll9b12hll9b12 *8 3NOOs!8, ! "x||O4,-HIICU)#c(3 * !HII!!-k6H6H6Q6Q6S!ok6F6F&GHJ! #78H8H7I!JKK":a=#4#4Y#CD$$[-B-B-K-K d .L . !#@AQAQ@R!STT!  	 " & U !JKQTTUs   7F--	G6GGc                  |D cg c]  }|t        |      f }}| g }g }n]t        |       \  }}|D cg c]  }|t        |      f }}|D cg c](  \  }}d|j                  |       j                         i|* }}}| d}	g }n-t	        j
                  | j	                         j                        }	t        g ||       |	|d}
ddi|
dt        j                  t        |
            j                         iS c c}w c c}w c c}}w )zMBuild an exact recursive inventory and prove the explicit dependency closure.Nr   r+   r!   r0   r1   )r   r   r   r   r\   re   r`   r   rJ   rK   rB   rO   )
wheelhouserequired_wheelsrP   root_wheelsdependency_wheelsr.   pathsr-   r   r,   payloads              rA   build_wheelhouse_inventoryr      sN    >MM_TD/$/0_KMEG+-.z:{GLMutdOD$9:uM #4

 #4h  !1!1*!=!F!F!H #4 	 
  $	LL!2!:!:;	 !C;!C1B!CD"G 	9
 	GNN9W+=>HHJ 3 N N
s   C<D-Dc                  t        |d      }t        |      h dk7  s|j                  d      dk7  rt        d      |j                  d      }|j                  d      }|j                  d      ||d	}t	        |t
              rNt	        |t
              r>|j                  d
      t        j                  t        |            j                         k7  rt        d      t        | |      }||k7  rt        d      |S )Nsealed wheelhouse inventory>   r!   r.   r,   r-   r1   r!   r0   -sealed wheelhouse inventory schema is invalidr.   r-   r,   r+   r1   z-sealed wheelhouse inventory digest is invalidr   z4wheelhouse inventory differs from sealed expectation)rw   r   r   rf   rn   r   rJ   rK   rB   rO   r   )r   rh   r   documentr.   r-   r   actuals           rA   verify_wheelhouse_inventoryr     s     x!>?H
8}   

	0
1 HIIll9%G,,}-K\\+."G w%+t,<<*+>>)G,-779: HII'OF OPPMrC   c                   |j                  d      }t        |t              st        d      | |rt        d      g S g }|D ]~  }t	        |d      }|j                  d      }t        |t
              r0t        |      j                         sdt        |      j                  v rt        d      |j                  | |z          |S )Nr.   %sealed wheelhouse entries are invalidz sealed wheelhouse is unavailablezsealed wheelhouse rowr   r   z!sealed wheelhouse path is invalid)
r   rn   r   rf   rw   ro   r   is_absoluter   r   )r   	inventoryr.   r   r   r   relatives          rA   _bound_wheel_pathsr   9  s     mmI&Ggt$@AA?@@	Ec2377?+8S)H~))+tH~+++@AAZ(*+  LrC   c                    t        | t              r t        d | j                         D              S t        | t              rt        d | D              S y)Nc              3  D   K   | ]  \  }}|d v xs t        |        yw)>   record_pathraw_installed_record_sha256raw_installed_record_portable!raw_installed_records_nonportableN%_contains_nonportable_record_material)rp   rq   r   s      rA   rr   z8_contains_nonportable_record_material.<locals>.<genexpr>S  s>      

 +	T  ; 5T:; +s    c              3  2   K   | ]  }t        |        y wrm   r   rp   r   s     rA   rr   z8_contains_nonportable_record_material.<locals>.<genexpr>_  s     Q548>5r   F)rn   rt   ru   itemsr   r?   s    rA   r   r   Q  sN    % 

 #[[]

 

 
	
 %Q5QQQrC   c           	        t        | d      }t        |j                  d      d      }t        |j                  d      d      }|j                  d      }|j                  d      dk7  sFt        |      s;|j                  d      d	k7  s'|d
dddk7  st        |t              rt        |      dk7  rt        d      ddg}t        ||d      D ]  \  }\  }}t        |d      }	|	j                  d      }
t        |	      h dk7  s|	j                  d      |k7  s|	j                  d      |k7  st        |
t              rt        |
      j                         sndt        |
      j                  v sWt        j                  t        |	j                  dd                  )t        |	j                  d            t         us	|	d   dk  st        d       y )Nportable installed runtimeorigin_proofzportable origin proof	executionzportable origin executionmodulesr!   $installed-golden-runtime-portable-v2 task26-installed-origin-proof-v1private_empty_controlledTFcwd_authoritypython_isolatedpythonpath_inherited   z*portable installed origin proof is invalidgatewayhermescheckin_cliprofilestrictzportable origin moduleinstalled_relative_path>   r   modulerK   distributionr   r   r   r   rK   r   r   rZ   z1portable installed origin module proof is invalid)rw   r   r   rn   r   r   rf   zipr   ro   r   r   r   _HEX_DIGEST	fullmatchtypeint)runtime_portableruntimeproofr   r   expected_pairsr   r   r   r   r   s              rA   "_validate_portable_origin_contractr
  c  s   &(DEGGKK/1HIE		+.0KLIii	"GH!GG0999X"DD7#$)

 '4(w<1EFF+-GHN'*7N4'P##flc347745H wwx F*ww~&,6h,H~))+tH~+++$$S2)>%?@HCGGFO$C/6{QPQQ+ (QrC   c          	        t        | d      }t        |      h dk7  rt        d      |j                         D ci c]  \  }}|dk7  s|| }}}t        |j	                  d      d      }t        |j	                  d      d      }	|j	                  d      d	k7  sv|j	                  d
      |k7  sb|j	                  d      |k7  sN|j	                  d      t        j                  t        |            j                         k7  st        |      ddhk7  rt        d      dD ]c  }
t        |j	                  |
      |
 d      }t        |	j	                  |
      |
 d      }|j	                  d      }t        |      h dk7  s|j	                  d      |j	                  d      k7  s|j	                  d      |j	                  d      k7  s|j	                  d      |j	                  d      k7  st        j                  t        |j	                  dd                  	 b|j	                  d      dusO|j	                  d      dk7  s;t        |t              r+|t        t        |            k7  st        d |D              s[t        d        |S c c}}w )!Nz"nonportable installed RECORD audit>   r!   audit_sha256install_roledistributionscandidate_digestz4nonportable installed RECORD audit schema is invalidr  r  znonportable audit distributionszportable runtime distributionsr!   z,task26-nonportable-installed-record-audit-v1r  r  r   r   z5nonportable installed RECORD audit binding is invalidr   r   z raw RECORD auditz portable distributionpath_dependent_classifications>   reasonr   wheel_sha256portable_projection_sha256r   r   r  r   distribution_namer  r  !portable_record_projection_sha256r   r   r   Fr  Avalidated_path_dependent_installer_material_may_change_raw_recordc              3  $   K   | ]  }|d v 
 yw)>   path_dependent_launcherconsole_entry_point_launcherN r   s     rA   rr   z5_validate_nonportable_record_audit.<locals>.<genexpr>  s&       ,D 
 ,s   z1nonportable installed RECORD audit row is invalid)rw   r   rf   r   r   rJ   rK   rB   rO   r  r  ro   rn   r   r   ru   )r@   r  r  r  auditrq   r   unsignedaudit_distributionsportable_distributionsroler   portableclassificationss                 rA   "_validate_nonportable_record_auditr#    s~    E?@E
5z   OPP+0;;=R=ic4C><QT	=HR!		/"$E %_-/O 			(MM99^$499'(,<<99^$>>)H-.88:;"#	8'<<PQQ%)--d3v=N5OP"&&t,6L.M
 ''"BCH	 ww~&(,,7J*KKww~&(,,~*FFww34||?@A$$CGG92>?  ww67uDwwx RSot4&_)=">>  ,  PQQO &P Lq Ss   J	Jc                  t        | d||      }t        |d||      }t        |j                  d      d      }t        |j                  d      d      }i }	dD ]  }
t        |j                  |
      d|
 d	      }t        |j                  |
      d
|
 d	      }|j                  d      }||j                  d      k7  s#|j                  d      |j                  d      k7  rt        d      ||	|
<    d||d|	dS )zDValidate both raw audits without comparing their nonportable hashes.originalr  r  r  
rehydratedr  zoriginal portable distributionsz!rehydrated portable distributionsr  z	original  distributionzrehydrated r  r  z3original and rehydrated portable projection differsz.task26-frozen-installed-record-verification-v2F)r!   !original_nonportable_record_audit#rehydrated_nonportable_record_audit,raw_record_hash_equality_required_or_claimedr  )r#  rw   r   rf   )r%  r'  r  original_runtime_portablerehydrated_runtime_portableoriginal_auditrehydrated_auditoriginal_distributionsrehydrated_distributionsprojection_digestsr   original_distributionrehydrated_distribution
projections                 rA   $verify_nonportable_record_audit_pairr6    sP    8)2	N :!)4	 %!%%o6)  '#''8+  -/% '"&&t,	$}.M!
 #*$((.+dV=0Q#
 +../

 &**+NOP$((8&**>:; RSS#-4 # && C-;/?8=&8 rC   c                    t        t        |             }d|d   |d}t        j                  t	        |            j                         |d<   |S )zIBind the complete canonical product derivation, never a digest tautology."task26-outer-candidate-manifest-v2r  )r!   r  product_bindingmanifest_sha256)r   rt   rJ   rK   rB   rO   )r9  	validatedr   s      rA   build_outer_candidate_manifestr<    sR     )o)>?I6%&89$#H
 #*..81D"E"O"O"QHOrC   c                   t        |      }|j                         sd|j                  v rt        d      | |z  }t	        |       t        t        j                  |j                  d            d      }t        |      h dk7  rt        d      |j                         D ci c]  \  }}|dk7  s|| }}}t        |j                  d	            }t        |j                  d
d            }	|j                  d      dk7  sF|	|d
   k7  s>|j                  d      t        j                  t!        |            j#                         k7  rt        d      |	t%        |      |fS c c}}w )Nr   (outer candidate manifest path is invalidutf-8encodingzouter candidate manifest>   r!   r:  r9  r  z*outer candidate manifest schema is invalidr:  r9  r  r   r!   r8  z+outer candidate manifest binding is invalid)r   r   r   rf   rj   rw   r<   loads	read_textr   r   r   r   ro   rJ   rK   rB   rO   rS   )
bundler   r   rP   r   rq   r@   r  r9  	candidates
             rA    _verify_outer_candidate_manifestrF  !  sX    M"H!7CDDHDTN

4>>7>346PH 8}   EFF%-^^%5%5zsE@Q9QU
%5   /x||<M/NOOHLL!3R89IX"FF(:;;<<)*>>)H-.88:; FGGk$'88s   "E 0E c                  t        | j                  d      | d      }t        | j                  d      | d      }t        |j                  d      | d      }t        | j                  d      | d      }| j                  d	      }| j                  d
      }t        | j                  d      | d      }t        | j                  d            }	|j                         D 
ci c]  \  }
}|
dk7  r|
| }}
}| j                  d      |k7  st        j                  t        |            t        j                  t        |            |j                  d      |k7  st        j                  t        |j                  dd                  	 lt        j                  t        |j                  dd                  	 <t        j                  t        |j                  dd                  |j                  d      dk7  s|j                  d      |k7  s|j                  d      d| dk7  st        j                  t        |j                  dd                  	 |j                  d      dk7  s|j                  d	      |k7  spt        j                  t        |j                  dd                  	 @t        j                  t        |j                  dd                  	 t        j                  t        |j                  dd                  	 |j                  d      |j                  d      k(  s||j                  d      |j                  d      hv s|d||j                  d      |j                  d      |j                  d      |j                  d      d k7  sR|j                  d      t        j                  t        |            j                         k7  s|	j                  d	      |k7  rt        | d!      |||d   |d   |j                  d      |j                  d      |||	|d"
S c c}}
w )#Ncandidate_authorityz
 authoritytask26_contractz Task26 contractlocal_socket_transcriptz local socket transcriptdeployment_wheelsz deployment wheelsr  source_tree_digestcapability_identity_receiptz capability identity receiptruntime_authority_snapshotreceipt_sha256runtime_modecurrent_qualified_candidateregistry_head_sha256r   ledger_head_sha256
chain_headr!   z4task26-local-http-telegram-api-transcript-binding-v1r   z'data/task26-local-http-telegram-api-qa-.jsontranscript_sha256z"task26-deployment-wheel-binding-v1 candidate_product_binding_sha256hermes_wheel_sha256profile_wheel_sha256z.task26-delivery-capability-identity-receipt-v1)r!   r  rW  rX  rY  wheel_digestz- candidate or authority projection is invalid)
r  rL  task26_chain_headauthority_current_candidateauthority_registry_headauthority_ledger_headrK  rM  rN  rJ  )rw   r   r   r   r  r  ro   rJ   rK   rB   rO   rf   )resultr   	authoritycontract
transcript
deploymentrE  source_treecapability_identityrN  rq   r@   capability_unsigneds                rA   _candidate_result_projectionrg  B  s>    

#89dV:;NOIvzz"34>N6OPH./&()J $78TFBT:UVJ

-.I**12K!

01&,- "3

/0"
 .3355JC"" 	U
5   	

>"d*  Y08  [!12:==679D  	4b9:
    	2B78
    X\\,%C!DEM>>(#AB>>.)T1>>/*4TF%@A  
2B78
  >>(#'KK>>,-:  
A2FG
    
4b9:
    
5r:;
  >>/0>>012NN01NN12


 F )0:21 $.>>2G#H$.NN3I$J&NN+@A	


 ""#34>>)$789CCEF%))*<=JD6!NOPP%)%l3'01N'O#,==1G#H!*/C!D'':&@#- Cs   &P>c               L   t        |d      }t        |d      }t        | |      \  }	}
}t        |j                  d      d      }|d   |d   k7  rt	        d      t        |d   d	      }t        |d   d
      }|j                  d      dk7  sZ|j                  d      dk7  sF|j                  d      |j                  d      k(  s#|j                  d      |j                  d      k(  rt	        d      |d   |d   k7  slt        |d   d      j                  d      |d   k7  sHt        |d   d      j                  d      |d   k7  s$t        |d   d      j                  d      |d   k7  rt	        d      t        fd|d   |d   |d   |d   |	fD              rt	        d      ||fD ]6  }t        |      }|j                         sd|j                  v s-t	        d       d||||||
|	|d   dd}t        j                  t        |            j                         |d<   |S ) Nsourcer   	installedderivation_inputsouter product derivation inputsrL  z3source and installed tree provenance digests differrJ  zsource local socket transcriptz!installed local socket transcriptrP  r   rV  z8source and installed socket transcripts were substitutedrK  source deployment wheelsrW  binding_sha256rX  rY  z5source and installed deployment wheel receipts differc              3  (   K   | ]	  }|k7    y wrm   r  )rp   r@   r  s     rA   rr   z)build_candidate_parity.<locals>.<genexpr>  s#      	
E 	!!
   r  r\  9source, installed, authority, and outer candidates differr   z'candidate parity bundle path is invalid%task26-cross-mode-candidate-parity-v1)r   rK   r  product_binding_sha256)r!   r  source_bundle_relative_pathinstalled_bundle_relative_pathri  rk  outer_manifestparity_sha256)rg  rF  rw   r   rf   ru   r   r   r   rJ   rK   rB   rO   )rD  r  source_resultinstalled_resultru  rv  outer_manifest_relative_pathri  rk  outer_candidate	outer_shar9  product_inputssource_transcriptinstalled_transcriptr   rP   r   s    `                rA   build_candidate_parityr    s    *-hGF,-=KPI2R,3/OY /02SN "#y1E'FFNOO()+K #+,.Q 	n-9##N3{B  1##O45  !45##$789 STT"#y1D'EE6-.0JKOO.
 +,- 6-.0JKOO!
 /01 6-.0JKOO"
 012
 PQQ
 	 %&01()34
	 	 TUU02PQH~!3FGG R
 :,'B*H9 /&56F&G	
#H !(y/B C M M OH_OrC   c          
        t        |d      }t        |      h dk7  rt        d      |j                         D ci c]  \  }}|dk7  s|| }}}t        |j	                  d      d      }|j	                  d      }|j	                  d      d	k7  sb|j	                  d
      k7  sN|j	                  d      t        j                  t        |            j                         k7  st        |t              st        d      t        | |      \  }	}
}t        |j	                  d      d      }t        |j	                  d      d      }t        |j	                  d      d      }t        |j	                  d      d      }|j	                  d      |j	                  d      k7  s-|j	                  d      |j	                  d      k7  s	|j	                  d      |j	                  d      k7  s|j	                  d      |j	                  d      k7  s|j	                  d      |j	                  d      k7  s|j	                  d      |
k7  s|j	                  d
      |	k7  sx|j	                  d      |j	                  d      k7  sUt        fd|	|j	                  d
      |j	                  d      |j	                  d
      |j	                  d      fD              rt        d      t        t        t        t        f   |      S c c}}w )Ncandidate parity>   r!   ri  rk  rx  rw  r  ru  rv  z"candidate parity schema is invalidrx  rw  outer manifest parityr   r!   rs  r  z"candidate parity digest is invalidri  zsource candidate parityrk  zinstalled candidate parityrl  rm  rK  rn  rL  rW  ro  rX  rY  rK   rt  c              3  (   K   | ]	  }|k7    y wrm   r  )rp   r@   expected_candidates     rA   rr   z*verify_candidate_parity.<locals>.<genexpr>,  s#      	
 ''rq  r\  rr  )rw   r   rf   r   r   rJ   rK   rB   rO   rn   ro   rF  ru   r
   rt   object)rD  parityr  r   rq   r@   r  outerr   r|  r}  r9  ri  rk  r~  source_deployments     `             rA   verify_candidate_parityr    s    v12H
8} 	 	 =>>%-^^%5%5zsE9OU
%5   HLL!124KLEyy)HX"II<<*+/AA<<(>>)H-.88:;(C(=>>2R3/OY X\\(+-FGF[13OPI/02SN  

&')C 	

'(IMM:N,OO::)*imm<O.PP  !CD/01  !67345  !7845699X)+99'(O;99-./01 	
  

-.

8901;<	
 	
 TUUS&[!8,,cs   K4
K4c          
     
   t        | d       t        |       t        |       t        |       t        t        j                  |j	                  d            d      }t        |      h dk7  s|j                  d      dk7  rt        d	      |j                  d
      }|j                         D ci c]  \  }}|d
k7  s|| }}}|t        j                  t        |            j                         k7  rt        d      |j                  d      t        k7  rt        d      t        |j                  d             t        |j                  d      dt!        |j                  dd            t        |j                  d      d             t#        | |j                  d      t!        |j                  dd                  }	t        |j                  d      d      }
t        |	j                  d      d      }t        |	j                  d      d      }|
|j                  d      |j                  d      dk7  rt        d      d |fd!|ffD ]J  \  }}t        |j                  |      |      }||j$                  t'        |      d"k7  s=t        d#| d$       t        |j                  d%      d&      }t        |      h d'k7  rt        d(      |j                  d)      }t)        |t*              st        d*      t        |j                  d      d+      }t        |j                  d,      d-      }|j                  d.      }t)        |t               st        d/      t-        | |      \  }}}t/        |t1        | d0z  t3        t4              j7                         j8                  d1   2      t;        t              t!        |d3         t=        |      ||4       t?        |j                  d5      t!        |j                  dd            |6       d7D ]  }t        |j                  |      |      }|j                  d.      }t)        |t               r0t3        |      jA                         sd8t3        |      jB                  v rt        d#| d9      | |z  }t        |       |j                  d:      t'        |      k7  st        d#| d$       t        |j                  d;      d<      }d=D ]O  }| d>z  |z  }t        |       |j                  |jE                  d?      d@z         t'        |      k7  sFt        dA       |S c c}}w )BzGValidate the hash-bound portable expectation before creating a runtime.TrT   r?  r@  zsealed expected state>   r!   verifierr`  r   hermes_wheelprofile_wheeltrust_boundarydocument_sha256expected_statusr  candidate_parityfrozen_bootstrapr  provenance_helperexpected_result_sha256hermetic_ty_attestationlocal_socket_transcriptsindependent_candidate_verifierr)  r!   task26-sealed-final-state-v6z'sealed expected-state schema is invalidr  z'sealed expected-state digest is invalidr  z)sealed evidence trust boundary is invalidr  r)  r%  r  r   r   r&  r  r  r  zsealed local socket transcriptsri  source candidate projectionrk  installed candidate projectionrJ  ri  rk  z.sealed local socket transcript bindings differr  r  filenamerK   sealed  digest differsr   r   >   r!   r.   r,   r-   r1   r   r.   r   r  rw  r  r   r>  verification-toolsr   scripts_dirpackage_rootr1   expected_tool_hashesexpected_trust_boundary_sha256$expected_wheelhouse_inventory_sha256expected_wheelhouse_entry_countactual_hermes_wheelactual_profile_wheelr  r  r9  )r  r  r  r  r   z path is invalidrK   r`  zsealed authority)zregistry.jsonzqualification-ledger.jsonzcandidate-authorityrU  _sha256zsealed authority digest differs)#rj   rw   r<   rB  rC  r   r   rf   r   rJ   rK   rB   rO   r*   r
  r#  ro   r  r   rS   rn   r   rF  r   r   r   __file__resolveparentsr   r   !_validate_hermetic_ty_attestationr   r   removesuffix)rD  expected_pathr  r  rh   claimedrq   r@   r  verified_paritytranscript_bindingssource_projectioninstalled_projectionrv   rP   bindingr   r.   r  r  r   _r9  targetr`  r   s                             rA   verify_expected_stater  ;  s    Vt$]\]

=**G*<=H 8}  ( 
h	#A	ABCCll,-G-5^^-=Z-=zsEHYAYU
-=HZ'..8!45??AABCC||$%7DEE&x||4F'GH&89X\\*<bAB LL+,.J
	 .'(x||,>CDO
 "/0)  H%'D #K(*J #''(AB)--.GH  IJJ	&	-(t (,,u-u5499D8IJJwug_=>> l35RSJ
:   HIInnY'Ggt$@AAX\\"457IJFFJJ/02IJEyy)Hh$CDD<VXNAq/6!55h//199!<
 (=^'L-0<N1O-P(+G(* &./X\\*<bAB'
 (,,u-u5;;/8S)H~))+tH~+++wug-=>??(";;x K$77wug_=>>#$ [13EFI>//$6==**73i?@KE
 
 >?? ? OM [s   1T>?T>c                ^    | j                         D ci c]  \  }}|dvr|| c}}S c c}}w )N>   package_authorityrehydration_origin_proof)r   )r_  rq   r@   s      rA   _portable_verifier_resultr    s@     !,,.(JCGG 	U
(  s   )c               L   t        | d      t              h dk7  rt        d      t        |j                  d      d      }t        |j                  d      d      }j	                         D ci c]  \  }}|dk7  s|| }}}j                  d	      d
k7  sj                  d      |k7  sj                  d      |j                  d      k7  sj                  d      |j                  d      k7  sj                  d      |j                  d      k7  szt        fddD              sft        j                  d            t        usFd   dk  s>j                  d      t        j                  t        |            j                         k7  rt        d      S c c}}w )Nzsealed hermetic Ty attestation>
   r!   
ty_versionrO  r  attestation_sha256binary_member_sha256raw_diagnostics_countraw_diagnostics_sha256corrected_ty_wheel_sha256execution_provenance_sha256z0sealed hermetic Ty attestation schema is invalidrl  zproduct inputshermetic_tyzhermetic Ty bindingr  r!   z(task26-sealed-hermetic-ty-attestation-v1r  r  r  r  c           	   3  ~   K   | ]4  }t         j                  t        j                  |d                   du  6 yw)r   N)r  r  ro   r   )rp   fieldattestations     rA   rr   z4_validate_hermetic_ty_attestation.<locals>.<genexpr>  s=      
 !!#kooeR&@"ABdJs   :=)r  r  rO  r  rZ   z1sealed hermetic Ty attestation binding is invalid)rw   r   rf   r   r   ru   r  r  rJ   rK   rB   rO   )	r@   r  r9  inputsr  rq   r   r  r  s	           @rA   r  r    s    %!ABK
;   KLL_(()<=?OPF&**]35JKK#.#4#4#6#6ic4#AU:UT	#6   	!%OO??-.2BB??67??678??<(KOOL,II??12??123 

 
  789D./!3??/0>>)H-.88:; LMM3s   2F  F )r   c          	        t        |	j                  d      d      }t        |       |t        t              nt        |||f      }t        | |      \  }}}|j                  d      }t        |t              st        d      t        |t        | dz  t        t              j                         j                  d         t!        t"              t%        |d	         t'        |      ||
       t        |      }t)        t        |      d||      }t+        t        |      ||      }t-        | ||
|	|||      }t        |j                  d      d      }t        |j                  d      d      }i ddd|d|d|d|d|j.                  t1        |      dd|j.                  t1        |      dd|d|t1        | |z        dd|t1        | |z        dd d!t1        | d!z        dd"d#t1        | d#z        dd$|	j                  d%      d&t3        j4                  t7        t9        |	                  j;                         d't1        | d(z        t1        | d)z        |j                  d*      |j                  d+      d,d-|d.|d/   |d/   d0d1t"        i}t3        j4                  t7        |            j;                         |d2<   |S )3zIBuild, but do not write or freeze, one successor expected-state document.rH  zcandidate authority resultr   r.   zwheelhouse entries are invalidr  r   r  r1   r  r%  r&  r  )r  ry  rz  ru  rv  r{  ri  r  rk  r  r!   r  r  r  r)  r  r  r  r  r   r  )r   rK   r  r  z-verification-tools/task26_frozen_bootstrap.pyr  z2verification-tools/independent_verify_candidate.pyr  statusr  r`  z!candidate-authority/registry.jsonz-candidate-authority/qualification-ledger.jsonrR  rS  )registry_sha256zqualification-ledger_sha256rR  rS  r  r  rJ  r  r  r  )rw   r   r
  rt   r8   r   rF  rn   r   rf   r   r   r   r  r  r  r   r*   ro   r   r#  r  r  r   rS   rJ   rK   rB   r  rO   )rD  r  r  r)  r  r  r  verifier_relative_pathprovenance_relative_pathverifier_resultsource_verifier_resultru  rv  r{  r   authority_resultwheelhouse_inventoryr  outer_product_bindingwheelhouse_entriesruntime_expectationr.  sealed_ty_attestationr  r  r  r   s                              rA   build_expected_stater    s   & 124P ''78  	'(E
  #C,#Aq
 .11)<($/9::6!55h//199!<
 (=^'L-0 !34.
 ),,>(?(* /07./),	N >$%)-
 .),($?'E%A  X&(E #[)+K9#09#,9# 	/9# 	,^	9#
 	"#89# 	$))!,/
9# 	%**!-0
9# 	*9# 	3!&+A"AB
9#& 	5!&+C"CD
'9#. 	L!HH
/9#: 	)D!MM	+
;9#J 	?..x8K9#L 	!'../@A#

)+Q9#R 	*<<  ,7HH, %5$8$89O$P"2"6"67K"L	
S9#f 	,g9#h 	#'(AB-.GH%
i9#p 	.q9#Ht #*..81D"E"O"O"QHOrC   controlled_cwdc          	        t        |d      }t        |j                  d      d      }|j                  d      dk7  s|j                  d      dk7  s~|j                  d      d	uskt        |      d
dhk7  s[t        |j                  d      t              r<|Et        t	        |d               j                  d      |j                  d      k7  rt        d      t        | j                  d      d      }g }dD ]  \  }}	|j                  |      }
t        |
t              st        d      t        |
      }	 |j                  d      }|j                  |j                  d            j                         }|j                         }|j                         s.t        j                  |j                        r|j                  dk7  rt        d      t        |j                  |	      |	 d      }|j                  d      }t        |t               st        d      |D cg c]2  }t        |t"              r |j                  d      |k(  rt        |d      4 }}t%        |      }t'        |      dk7  s8|d   j                  d      |k7  s!|d   j                  d      |j(                  k7  rt        d      |j+                  |	||||j(                  d         d!d"dd	d#|d$S # t        t        f$ r}t        d      |d}~ww xY wc c}w )%z@Bind imported package origins to exact installed inventory rows.zrehydrated origin prober   zrehydrated module originsr!   z!task26-rehydrated-origin-probe-v1isolatedrZ   pythonpath_presentFr   r   cwdNTr   z,rehydrated Python isolation proof is invalidr  runtime distributions)r   r   z#rehydrated module origin is invalidz1module origin is outside rehydrated site-packagesz.rehydrated module origin is not a regular filer(  installed_inventoryzinstalled inventory is invalidrP   zinstalled inventory rowr   rK   r   z5module origin differs from installed RECORD inventory)r   r   r   rK   r   r   r   r   )r!   r   r   )rw   r   r   rn   ro   r   r  rf   r   r   OSErrorr\   
is_symlinkr^   r`   rd   r   rt   rS   r   r   r   )r  site_packagesprober  evidencer   r  
proof_rowsr   r   raw_pathrP   resolvedr   r   metadatar   r   r   matchesrQ   s                        rA   verify_runtime_origin_proofr    s    u78Hhll9-/JKGX"EE<<
#q(<<,-U:w<I}55(,,u-s3&S%)*22$2?%%T%23 GHHGKK8:QRM*,JK;;v&(C(BCCH~	||4|0H++M,A,A,A,NOXXZH
 ==?!<< 0 01  A%MNN}0064&8NO $$%:;	)T*=>> !
 #t$H)D C23  	 

 X&LAqz~~h'61qz~~f%)9)99TUU $ +3  ((	
G LZ 57#$)

  I $ 	C	
s   7AK"7L"L1K==Lc                   t        | j                  d      d      }i }dD ]U  }t        |j                  |      | d      }|j                  d      }t        |t              rt	        d |D              rt        | d      |D cg c]^  }dt        t        |j                  d	d
                  j                  vr,t        |j                  d	d
            j                  d      s|` }}dD ci c]  }||j                  |       }	}t        |j                  d      | d      }
|
j                  d      |	d<   ||	d<   t        j                  t        |            j                         |	d<   |	||<   X t        | j                  d      d      }d|j                  d      |j                  d      d|| j                  d      dS c c}w c c}w )Nr  r  r  r(  r  c              3  >   K   | ]  }t        |t                 y wrm   )rn   rt   )rp   r   s     rA   rr   z$_portable_runtime.<locals>.<genexpr>  s      6
1>#
3%%rs   z installed inventory is invalidr   rP   r   z.dist-info/RECORD)r  distribution_versionmetadata_sha256wheel_filenamer  wheel_record_sha256portable_record_projectionz portable RECORD projectionprojection_sha256r  installed_inventory_sha256interpreterzruntime interpreterr   rK   r   )rK   r   r   )r!   r  r  r   )rw   r   rn   r   ru   rf   r   ro   r   r   rJ   rK   rB   rO   )r  r  r  r   r   raw_inventoryr   r   rq   portable_distributionr5  r  s               rA   _portable_runtimer    s   GKK8:QRM02%}0064&8NO$(()>?-.# 6
1>6
 3
 v%DEFF %
$4CGGFB$7 89???+,556IJ $ 	 

4
 !!#&& 	 
4
 9:f/0

 FP^^F
AB 8A34>Enni ?

)+ 	:; (=t$G &H '++m46KLK8!ooh/"y1
 0N3 =

4
s   A#G0Gc                     t         j                  j                         D  ci c]*  \  } }| j                  d      s| j                  d      s| |, }} }|j	                  dt         j
                  ddd       |S c c}} w )NPYTHONPIP1)PYTHONNOUSERSITEPIP_CONFIG_FILEPIP_NO_INDEXPIP_DISABLE_PIP_VERSION_CHECK)rb   environr   r   rN   devnull)rq   r@   environments      rA   _clean_environmentr	    s     ****,,JC~~h'u0E 	U
,  
  #!zz-0		
 s   /A:c               
   t        |d       t        |j                               rt        d      t	        j
                  t        |       d|t        |      dd      }t        |j                               rt        d      |S )NTrT   z"controlled Python cwd is not empty)checkr  envcapture_outputtextz)Python subprocess wrote to controlled cwd)rj   ru   iterdirrf   
subprocessrunr   rt   )commandr  r  	completeds       rA   _run_pythonr  $  sy     ^t,
>!!#$=>>WI >!!#$DEErC   c                    d|fd|ffD ]J  \  }}t        | j                  |      |      }||j                  t        |      dk7  s=t	        d| d       y )Nr  r  r  r  r  )rw   r   r   rS   rf   )rh   r  r  rv   rP   r  s         rA   _verify_bound_wheel_hashesr  :  se     
&	-(t (,,u-u5499D8IJJwug_=>>rC   )r   temp_parentc                  &'()*+ t         |||      }t        ||j                  d      ||f      }t        t	        j
                  d|            }|j                  d       |dz  &&j                  d       t               '	 |d	z  }	t        t        j                  d
dd	t        |	      g&'       |	j                  d       |	t        j                  dk(  rdndz  )t        ||||f      }t        |||       t!        ||      }
t        )      d
ddddddgd |
D        t        |      t        |      }t        |&'       t        t        )      d
ddg&'      j"                  j%                         }t        |      }|dz  * t        t'        |d   d      d         z  }d}t        t        )      d
d|t        |      t        |	      t        |      t        |      t        |      t        |j                  dd            g
&'      j"                  }t'        t)        j*                  |      d      }t'        |j                  d       d!      }t-        |||j                  d"      &#      }||d$<   t/        |      }|j                  d%      }||j                  d&      k7  rt1        d'      t3        |j                  d(      t        |j                  dd            t'        t5         t        t'        t'        |j                  d)      d*      j                  d+      d,      j                  dd                  d-   d.      /      }|t1        d0      t7        t8        t:           |j                  d1g             D cg c]V  }t'        |d2      j                  d3      |j                  d4      k(  r'|t        t'        |d2      j                  d            z  X }}t=        |      d5k7  rt1        d6      |d7z  } d8z  } d9z  }t        t        )      d
t        |      d:t        |d;z        d<t        |d=         d>t        |d4         d?t        |d@         dAt        |      dBt        |      g&'      }t'        t)        j*                  |j"                        dC      }t'        |j                  dD      dE      }t'        |j                  dF      dG      }|j                  dH      |j                  d4      k7  s|j                  dI      |j                  d@      k7  s|j                  dJ      |j                  dJ      k7  si|j                  dK      |j                  dK      k7  sF|j                  dL      |j                  dM      k7  s#|j                  dN      |j                  dN      k7  rt1        dO      *j?                  tA        |      dPz          *j                  dQ        t        t'        |dR   dR      d         z  +tC         |j                  d)      t        |j                  dd            S      (dn &'()*+fdT}  | dUdV      }! | dWdX      }"tE        |!dY      (j                  dY      k7  stE        |"dZ      (j                  dZ      k7  rt1        d[      t'        |"j                  d\      d]      }#t'        |j                  d^      d_      }$|"j                  d`      |j                  da      k7  s|"j                  d      |j                  d      k7  s|#j                  db      |$j                  db      k7  sj|#j                  dc      |$j                  dc      k7  sGtG        jH                  tA        tK        |"                  jM                         |j                  dd      k7  rt1        de      tO        |j                  df      |t        |j                  dd            t'        |j                  d&      dg      |h      |"di<   ||"d(<   ||"dj<   |"	 t        ||||f       t        |||       |jQ                         rc|jS                  dk      D ]7  }%	 |%jU                         r|%j                  |%jW                         rdndQ       9 t[        j\                  |dlm       S S c c}w # tX        $ r Y cw xY w# |jQ                         rr|jS                  dk      D ]F  }%	 |%jU                         r|%j                  |%jW                         rdndQ       9# tX        $ r Y Dw xY w t[        j\                  |dlm       w w xY w# 	 t        ||||f       t        |||       |jQ                         rr|jS                  dk      D ]F  }%	 |%jU                         r|%j                  |%jW                         rdndQ       9# tX        $ r Y Dw xY w t[        j\                  |dlm       w w # |jQ                         rr|jS                  dk      D ]F  }%	 |%jU                         r|%j                  |%jW                         rdndQ       9# tX        $ r Y Dw xY w t[        j\                  |dlm       w w xY wxY w)ozECreate an isolated offline runtime, rerun verification, and scrub it.)r  r  r   r   ztask26-rehydrate-)prefixdirrW   zcontrolled-cwdrj  venv-Iz-mr  r  ntzScripts/python.exez
bin/pythonpipinstallz
--no-indexz	--no-depsz--no-compilec              3  2   K   | ]  }t        |        y wrm   r   )rp   rP   s     rA   rr   z'rehydrate_and_verify.<locals>.<genexpr>z  s     5$4Dc$i$4r   z-cz9import sysconfig; print(sysconfig.get_paths()['purelib'])zruntime.jsonr  zprovenance helperr   a=  import hashlib,importlib.util,json,os,pathlib,sys;p=pathlib.Path(sys.argv[1]);s=importlib.util.spec_from_file_location('sealed_provenance',p);m=importlib.util.module_from_spec(s);s.loader.exec_module(m);r=m.collect_installed_runtime(venv=pathlib.Path(sys.argv[2]),site_packages=pathlib.Path(sys.argv[3]),profile_wheel=pathlib.Path(sys.argv[4]),hermes_wheel=pathlib.Path(sys.argv[5]));a=m.nonportable_installed_record_audit(r,install_role='rehydrated',candidate_digest=sys.argv[6]);import checkin_cli,gateway;o={'schema':'task26-rehydrated-origin-probe-v1','isolated':sys.flags.isolated,'pythonpath_present':'PYTHONPATH' in os.environ,'cwd':os.getcwd(),'modules':{'gateway':gateway.__file__,'checkin_cli':checkin_cli.__file__}};print(json.dumps({'runtime':r,'record_audit':a,'origin_probe':o},sort_keys=True,separators=(',',':')))r  r   zrehydrated probe documentr  zrehydrated runtimeorigin_prober  r   record_auditr  z5rehydrated runtime differs from sealed portable bytesr  r  r  rw  r  r   zouter product bindingr  z-sealed corrected Ty wheelhouse is unavailabler.   zwheelhouse rowrK   r  rZ   z(sealed corrected Ty wheel is unavailablezty-attestationz/verification-tools/task26_hermetic_ty_runner.pyz,verification-tools/task26_ty_surface_gate.pyz--sourcez'gateway/platforms/nutrition_coaching.pyz
--ty-wheelr   z--expected-wheel-sha256z--expected-executable-sha256r  z--gate-toolz--output-directoryzrehydrated hermetic Ty resultexecution_provenancez"rehydrated Ty execution provenancesurface_receiptzrehydrated Ty surface receiptty_wheel_sha256installed_executable_sha256r  r  provenance_sha256r  rO  z*rehydrated hermetic Ty attestation differs   
rX   r  r  c           
        t        t        j                  | d                  }|z  }t        t        	      dt              t        |      dt        
      g      }t	        t        j                  |j                        |      S )Nr   r  z--rehydrated-runtimer  )r   ro   r   r  rw   r<   rB  stdout)relative_keyrv   r   target_bundler  rD  r  r  r  pythonruntime_pathr  s        rA   run_verifierz*rehydrate_and_verify.<locals>.run_verifier  s    C

< <=>H"X-M#KM&*%  .'I 4::i&6&67??rC   ru  z!rehydrated source verifier resultrv  z$rehydrated installed verifier resultri  rk  z4rehydrated source/installed candidate parity differsrH  zrehydrated authorityr`  zexpected authorityr  r  rR  rS  r  z=rehydrated verifier result differs from sealed expected stater)  zoriginal portable runtime)r  r,  r-  installed_record_provenancer  *F)ignore_errors)r,  ro   rv   ro   returndict[str, Any])/r  r   r   r   tempfilemkdtempchmodmkdirr	  r  sys
executablero   rb   r   r  r   r+  r   rw   r<   rB  r  r  rf   r  rF  r
   r   r  r   write_bytesrB   r  rg  rJ   rK   r  rO   r6  existsrglobr  is_dirr  shutilrmtree),rD  r  r  r  r   r  rh   r   	temporaryr  dependency_pathsr   site_packages_textr  helperr  probe_outputprobe_documentruntime_documentr   rehydrated_portabler/  	sealed_tyr   ty_wheel_matches	ty_output	ty_runnerty_gatety_completed	ty_resultty_provenance
ty_receiptr0  ry  r_  r`  expected_authorityrP   r  r  r  r.  r/  r  s,   `                                     @@@@@@rA   rehydrate_and_verifyrT  F  s
    %!#	H ,\"&5I
 X%%-@kRSIOOE!11Ne$$&KS>6!^^T4T;)#	

 	

5D-lS/*L9
	
 	#8\=I-j)DK
 6$45
 
 
 	N	
 )FK	 *#	
 & 	 /0 >1#H013FG
 
4 	& #FFD	M"M"L!HLL!3R89 *#
 & 	  !JJ|$&A
 #y)+?
 3~.)	
 ,8(/0@A)--n=(,,/A"BBTUU5LL23 .@"!EF#0# (-? @ 2 "c"233 #or2  (
	& LMM DL)--	2*FG
Gs,-11(;}}89: WS*:;??PQQG 	 
  A%GHH 00	NN	II"FIM$MMN$Q'()I9:;.I456G$I" *#'
* JJ|**+-L
	  MM010
 MM+,.M

 MM+,}}89:}}:;}}345}}56}}567  !89}}456  !45}}:;<~~./}}-./ IJJ  +;!<u!DE5!CHZ(*5oF
 
 )LL+,"8<<0BB#GH
	@ 	@" %)+N
 ,.T
 )XFzz(#$+FEzz+&' STTJJ,-/E
	 %LL%';
 JJx HLL1B$CCzz,->P1QQ}}34!%%&<=>}}12!%%&:;<~~3F;<ik||456
 O  1@A !$X\\2Db%I!J*1LL!34/+ -@	 	,- -6()-9)*	>'!. =
 'x}M!%OOC0D??,$

DKKM5uE	 1 iu= "a
l #  !%OOC0D??,$

DKKM5uE"  1 iu= "	>'!. =
 'x}M!%OOC0D??,$

DKKM5uE"  1 iu= "y!%OOC0D??,$

DKKM5uE"  1 iu= "s   	K=e Ab&!P3e b:b+(#b+&e +	b76b7:%d> d0d>1#dd>	d!d> d!!d>i*g# $i*f:i*#f:9i*:	g	i*g	i*#%i'	h>
i'#h>
=i'>	i
i'	i

i''i*c            	     .   t        j                         } | j                  dt               | j                  dt               | j                  dt        d       | j                  dt        d       | j                  dt               | j                  d	t               | j	                         }	 t        |j                  |j                  |j                  |j                  |j                  |j                  
      }t%        t!        j&                  |dd             y# t        t        t        j                  t         j"                  f$ rF}t%        t!        j&                  dt)        |      dd      t*        j,                         Y d }~yd }~ww xY w)NrD  )r  expected_statez--hermes-wheelT)r  requiredz--profile-wheelz--wheelhousez--temp-parent)r  r  r   r  TASK26_REHYDRATION_FAIL)r  r  )r6   )filerZ   r2   r5   r   )argparseArgumentParseradd_argumentr   
parse_argsrT  rD  rV  r  r  r   r  r  rf   r  SubprocessErrorr<   JSONDecodeErrorprintr=   ro   r:  stderr)parserargsr_  r   s       rA   mainrd  v  sQ   $$&F
t,
(t4
(tdC
)tD
T2
d3D%KK**,,((
, 
$**Vt

CD 	""	  	JJ4CI 	
 s   2AD! !-F<FF__main__)r@   r  r4  bytes)rP   r   r4  ro   )rP   r   rU   boolr4  None)r@   r  rv   ro   r4  r5  )r@   ro   r4  ro   )rP   r   r4  r)   )r   r   r4  z*tuple[list[Path], list[dict[str, object]]])r   z+Sequence[tuple[Path, Mapping[str, object]]]r4  rh  )r   Path | Noner   Sequence[Path]r4  r)   )r   ri  rh   r  r   rj  r4  r)   )r   ri  r   Mapping[str, object]r4  z
list[Path])r@   r  r4  rg  )r  r  r4  rh  )
r@   r  r  ro   r  ro   r  rk  r4  r)   )r%  r  r'  r  r  ro   r,  rk  r-  rk  r4  r)   )r9  rk  r4  r)   )rD  r   r   ro   r4  z"tuple[str, str, dict[str, object]])r_  rk  r   ro   r4  r)   )rD  r   r  ro   ry  rk  rz  rk  ru  ro   rv  ro   r{  ro   r4  r)   )rD  r   r  r  r  ro   r4  r)   )
rD  r   r  r   r  r   r  r   r4  r5  )r_  rk  r4  r)   )r@   r  r  ro   r9  rk  r4  r)   ) rD  r   r  ro   r  rk  r)  rk  r  rk  r  r   r  r   r  ro   r  ro   r  rk  r  rk  ru  ro   rv  ro   r{  ro   r   ri  r4  r)   )
r  rk  r  r   r  r  r  ri  r4  r)   )r  rk  r4  r)   )r4  zdict[str, str])r  zSequence[str]r  r   r  zMapping[str, str]r4  z subprocess.CompletedProcess[str])rh   rk  r  r   r  r   r4  rh  )rD  r   r  r   r  r   r  r   r   ri  r  ri  r4  r)   )r4  r  )Q__doc__
__future__r   rZ  rJ   r<   rb   rer@  r\   r  r:  r6  r   email.parserr   email.policyr   pathlibr   typingr   r   r	   r
   packaging.requirementsr   r   packaging.versionr   r   -gateway.platforms.task26_candidate_derivationr   r   r   *gateway.platforms.task26_runtime_authorityr   r*   __annotations__r/   rK   r=   r>   rO   r8   compilerz   r  rB   rS   rj   rw   r}   r   r   r   r   r   r   r   r
  r#  r6  r<  rF  rg  r  r  r  r  r  r  r  r  r	  r  r  rT  rd  __name__
SystemExitr  rC   rA   <module>r{     s   N "    	 	    
   $ !  / / B 5 
 I 2#	
	+ &+A!%! !F 0 ,  5
(
( 

%!	
 &( ik
( $ 
  RZZ	* bjj*+ /4 D'6$N 
 / F!U7!U	!UH## $# 	#L$$$ $	$
 $N(<0$)RXHH H 	H
 +H HV666 	6
  46 "66 6r)99!$9'9B_ _+.__DQQ Q (	Q
 +Q "%Q %(Q #&Q Qh@-@- @-9<@-@-FMMM 	M
 M M`// / *	/
 /D #!HH H +	H
 (<H 2H H H  H "H *H 1H "%H %(H #&H  !H" #H` #'M!MM M
  M M`0f"  #	
 &,	?"	?26	?GK	?		?$ ##m>m>m> 	m>
 m> m> m> m>`	!H z
TV
 rC   