`data/codex-yoloforever/cycle-20260908T1446Z.BgRMQG/cody-run.py`

36 lines
import pathlib,json,hashlib,datetime,subprocess,os,math,urllib.request,urllib.error
p=pathlib.Path(__file__).parent
checks=[]; commands=[]
def sha(x): return hashlib.sha256(pathlib.Path(x).read_bytes()).hexdigest()
def check(n,ok,d): checks.append(dict(check=n,verdict='PASS' if ok else 'FAIL',detail=d))
def run(a):
 r=subprocess.run(a,text=True,capture_output=True,timeout=45);commands.append(dict(argv=a,exit_code=r.returncode,stdout=r.stdout,stderr=r.stderr));return r
scratch=run(['mktemp','-d','/private/tmp/cody-1446-XXXXXX']).stdout.strip()
base=json.loads((p/'preconditions.json').read_text()); queue=json.loads((p/'runner-queue.json').read_text()); a=json.loads((p/'assessment.json').read_text())
check('canonical guard and inherited environment', pathlib.Path('/Users/macstudio3/Projects/ticket-system/config/dtd-cost-mode').read_text()=='ZERO_COST_REQUIRED\n' and os.getenv('DTD_ZERO_COST')=='1',{'guard':'ZERO_COST_REQUIRED','environment':os.getenv('DTD_ZERO_COST'),'no_override':True})
for f,h in base['files'].items(): check('protected hash '+f,sha(f)==h,{'expected':h,'actual':sha(f)})
for f in list(base['files'])[1:4]:
 s=pathlib.Path(f).read_text(); force=s.index('ZERO_COST_REQUIRED) DTD_ZERO_COST=1'); credential=s.find('SECRETS_ENV') if 'SECRETS_ENV' in s else s.index('ENV="$HOME/Projects/secrets-manager/.env"')
 check('installed unconditional filesystem force before credentials '+f,force<credential and 'PAID_ALLOWED) DTD_ZERO_COST="${DTD_ZERO_COST:-0}"' in s,{'force_offset':force,'credential_offset':credential,'method':'source control-flow review, no guard/env mutation'})
r=run(['du','-sk','/Users/macstudio3/Projects/.git']); mb=math.floor(int(r.stdout.split()[0])/1024+.5)
r=run(['node','--input-type=module','-e',"import {classifyRepo,KNOWN_LEGIT} from '/Users/macstudio3/.claude/skills/dw-backup-canary/lib.mjs'; console.log(JSON.stringify({floor:KNOWN_LEGIT['(projects-root)'].floor_mb,result:classifyRepo({repo:'(projects-root)',mb:"+str(mb)+",remote:null,upstream:null,ahead:0})}));"]); canary=json.loads(r.stdout)
check('live installed canary confirms unresolved FAIL',r.returncode==0 and canary['result']['verdict']=='FAIL' and mb>3000,{'measured_mb':mb,'result':canary,'observation_not_operational_pass':True})
r=run(['launchctl','list','com.steve.dw-backup-canary']);check('scheduler read only observation',r.returncode==0,{'recovery_claim':False,'state':r.stdout})
sql=p.parent/'cycle-20260908T1322Z.m4gNE5/11250-pricing.sql'
r=run(['/opt/homebrew/bin/psql','-X','-w','-h','/tmp','-d','dw_unified','-At','--set','ON_ERROR_STOP=1','-f',str(sql)]); rows=[json.loads(x) for x in r.stdout.splitlines() if x.startswith('{')]
check('local pricing READ ONLY with ROLLBACK',r.returncode==0 and len(rows)==2 and rows[0]['read_only']=='on' and rows[0]['rows']==1470 and rows[0]['positive_cost']==rows[0]['positive_price']==rows[1]['price_columns']==0 and r.stdout.rstrip().endswith('ROLLBACK'),{'rows':rows,'sql_sha256':sha(sql),'scope':'local mirror only'})
for path,want in [('/healthz',200),('/api/tickets',401)]:
 try:
  with urllib.request.urlopen('http://127.0.0.1:9794'+path,timeout=10) as r: code=r.status;body=r.read().decode()
 except urllib.error.HTTPError as e: code=e.code;body=e.read().decode()
 check('localhost API '+path,code==want,{'status':code,'body':body[:100]})
r=run(['node','-e',"const l=require('/Users/macstudio3/Projects/ticket-system/lib');console.log(JSON.stringify([...l.tickets().values()].map(t=>({id:t.id,status:t.status,assignee:t.assignee,updated_at:t.updated_at}))))"]); board=json.loads(r.stdout);commands[-1]['stdout']='Full board omitted; selected owner state retained in checks.'
for t in queue['queue']:
 now=next(x for x in board if x['id']==t['id']);check('source ownership and status '+t['id'],all(now[k]==t[k] for k in ['status','assignee','updated_at']),{'before':{k:t[k] for k in ['id','status','assignee','updated_at']},'after':now})
check('board order and zero implementation accounting', [x['ticket'] for x in a['ordered_dispositions']]==[x['id'] for x in queue['queue']] and a['execution_iterations']==a['implementation_progress']==a['operational_closures']==a['new_preparation']==0 and a['in_flight_entries']==20 and all(x['operational_outcome']=='UNRESOLVED' for x in a['ordered_dispositions']),{'iterations':a['execution_iterations'],'operational_closures':a['operational_closures'],'in_flight_entries':20,'scope':'metadata only'})
r=run(['git','--git-dir=/Users/macstudio3/Projects/.git','show-ref']);check('root master protected', 'c539b5a08a4f84a551d8825a0fc73fa588bcbce8 refs/heads/master' in r.stdout,{'refs':r.stdout,'index_sha256':sha('/Users/macstudio3/Projects/.git/index'),'writer_may_advance':True})
for n,d in [('live root maintenance and scheduler-correlated recovery','Exact approval missing; historical rehearsal not rerun and not current recovery'),('authoritative wholesale and identity mapping','Local SQL does not prove external discovery or current Shopify state'),('parent acceptance, commit, final DTD and worker exit','Pending parent finalization; cannot attest future actions')]:checks.append({'check':n,'verdict':'SKIP','detail':d})
for f,h in base['files'].items():check('closing protected hash '+f,sha(f)==h,sha(f))
out={'schema_version':1,'task_id':'cycle-20260908T1446Z.BgRMQG/cody','ticket':'TK-11287','timestamp':datetime.datetime.now(datetime.timezone.utc).isoformat(),'risk_tier':'R0 review; underlying R4 outcomes unresolved','intent':'Independently verify bounded monitoring accuracy, not implement source recovery','baseline':base,'commands':commands,'checks':checks,'counts':{v:sum(x['verdict']==v for x in checks) for v in ['PASS','FAIL','SKIP']},'root_mb':mb,'operational_outcome':'UNRESOLVED','implementation_progress':0,'direct_paid_api_usd':0,'claude_invocations':0,'provider_key_reads':0,'scratch_retained':scratch,'cleanup':'SQL rolled back; fresh scratch retained; no source/control/runtime/status/owner mutations','inputs_sha256':{n:sha(p/n) for n in ['assessment.json','ordered-dispositions.json','runner-queue.json','monitor-initial.json','preconditions.json','pricing-inputs.json','canonical-start.json']}}
(p/'cody-proof.json').write_text(json.dumps(out,indent=2)+'\n');print(json.dumps({'counts':out['counts'],'root_mb':mb,'proof_sha256':sha(p/'cody-proof.json'),'scratch':scratch}))