0hmX/am3352

scripts/finalize-ddr-evidence-metadata.ts

/** Refresh current artifact hashes without creating a report/budget hash cycle. */
import { readFileSync, writeFileSync } from 'node:fs'
import { resolve } from 'node:path'
import { objectHash } from './improve-ddr-a9-power-launches'
import { verifyDdrCapture } from './ddr-capture-provenance'

export async function finalizeDdrEvidenceMetadata(dir: string, capture: string) {
  const read = (name: string) => JSON.parse(readFileSync(resolve(dir, name), 'utf8'))
  const write = (name: string, value: unknown) => writeFileSync(resolve(dir, name), JSON.stringify(value, null, 2) + '\n')
  const { captureHash } = verifyDdrCapture(capture)
  const candidate = read('candidate.circuit.json'), host = read('host-bundle.json'), report = read('report.json')
  if (report.captureHash !== captureHash || report.candidateCircuitSha256 !== objectHash(candidate) || host.traces.some((t: any) => objectHash(t) !== objectHash(candidate.find((e: any) => e.pcb_trace_id === t.pcb_trace_id)))) throw Error('Current artifact identity differs')
  const power = read('ram-power-launch-audit.json'), reference = read('host-reference-coverage.json')
  if (power.captureHash !== captureHash || reference.candidateCircuitSha256 !== objectHash(candidate) || reference.hostTracesSha256 !== objectHash(host.traces)) throw Error('Current audit identity differs')
  if (report.currentByteBudgetsSha256) report.priorByteBudgetsSha256 = report.currentByteBudgetsSha256
  delete report.currentByteBudgetsSha256
  Object.assign(report, {
    sourceProvenanceSha256: objectHash(read('source-provenance.json')),
    originalCopperReplacementsSha256: objectHash(read('original-copper-replacements.json')),
    supportCircuitSha256: objectHash(candidate), hostBundleSha256: objectHash(host), hostTracesSha256: objectHash(host.traces),
    launchQualified: power.launchQualified, launchAuditSha256: objectHash(power), hostReferenceCoverageSha256: objectHash(reference),
    ramCacheSha256: objectHash(read('ram-byte0-facing-progress.trace-paths.json')),
    ramByte1CacheSha256: objectHash(read('ram-byte1-facing-progress.trace-paths.json')),
    currentEvidenceManifest: 'current-evidence-manifest.json',
  })
  write('report.json', report)
  const audit = Bun.spawn(['bun', 'scripts/audit-ddr-current-byte-budgets.ts', resolve(capture), resolve(dir), resolve(dir, 'current-byte-budgets.json')], { stdout: 'ignore', stderr: 'inherit' })
  if (await audit.exited !== 0) throw Error('Current byte budget audit failed')
  const names = ['candidate.circuit.json', 'host-bundle.json', 'routing-input.json', 'report.json', 'original-copper-replacements.json', 'source-provenance.json', 'ram-power-launch-audit.json', 'host-reference-coverage.json', 'current-byte-budgets.json', 'ram-byte0-facing-progress.trace-paths.json', 'ram-byte1-facing-progress.trace-paths.json', 'exit-contract.json', 'ram-byte1-exit-contract.json']
  write('current-evidence-manifest.json', { captureHash, candidateCircuitSha256: objectHash(candidate), files: Object.fromEntries(names.map(name => [name, objectHash(read(name))])), scope: 'Current object hashes. The budget audit binds the finalized report; its hash lives here to avoid a cyclic report/budget dependency. Geometry was not changed by metadata finalization.' })
}
if (import.meta.main) {
  const [dir, capture] = process.argv.slice(2)
  if (!capture) throw Error('Usage: current-artifact capture')
  await finalizeDdrEvidenceMetadata(dir!, capture)
  console.log(resolve(dir!, 'current-evidence-manifest.json'))
}