File size: 8,439 Bytes
4879fc7 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 | """Verification-status index for promoted results.
``results/verification_status.json`` is a flat map of result filename ->
verification state (``pending`` | ``valid`` | ``invalid``). A human (or a
downstream verifier) flips entries to ``valid`` / ``invalid``; every newly
promoted result is inserted as ``pending`` so nothing slips through unreviewed.
Maintaining it is a read-modify-write of a single shared JSON object, so a
process-wide lock serialises the update — the Space runs a single uvicorn worker
and sync endpoints share a threadpool, the same assumption ``DurableJobQuota``
relies on. The update is **best-effort and non-fatal**: by the time we get here
the result file is already promoted, so a storage hiccup must not fail the
request — we log and move on, and the next promotion (or a manual reconcile)
heals the index.
Two safety properties:
- **Verdicts are never clobbered.** A filename already present (whatever its
state) is left untouched — we only ever *insert* a missing entry as
``pending``, never overwrite an existing ``valid`` / ``invalid``.
- **Fail SAFE on read.** If the index can't be read (transport error) or parsed
(corrupt/non-object JSON), we refuse to write — overwriting would erase every
human verdict. We skip and log loudly so it can be fixed by hand.
``set_verdict`` (the automated verifier's write path, §5.7) extends the first
property with a **side-ledger compare-and-set**: every verdict the verifier
writes is recorded in the private audit bucket
(``verification_runs/<filename>/verdict.json``), and the index is only updated
when the current entry is ``pending``/absent **or** equals the verifier's own
last-written value. Any other ``valid``/``invalid`` must have been set (or
changed) by a human, and the human verdict wins — even over the verifier's own
earlier one. The index itself stays a flat ``{filename: state}`` map; verdict
provenance lives only in the private ledger.
"""
from __future__ import annotations
import json
import logging
import threading
from app.hub import HubClient
from app.naming import VERIFICATION_STATUS_PATH, stamp_iso, utc_now
log = logging.getLogger(__name__)
PENDING = "pending"
VALID = "valid"
INVALID = "invalid"
# set_verdict outcomes.
WRITTEN = "written" # index updated, ledger record stored
DEFERRED = "deferred" # a human verdict is in place; left untouched
SKIPPED = "skipped" # index unreadable/corrupt — fail-safe, no write
class VerificationStatusStore:
def __init__(
self,
hub: HubClient,
path: str = VERIFICATION_STATUS_PATH,
runs_prefix: str = "verification_runs",
):
self._hub = hub
self._path = path
self._runs_prefix = runs_prefix.strip("/")
self._lock = threading.Lock()
def _load(self) -> dict | None:
"""Current index, or ``None`` if it cannot be safely read/parsed.
``None`` means "do not write" — distinct from ``{}``, a genuinely absent
index that is safe to create from scratch.
"""
try:
raw = self._hub.read_central_bytes_optional(self._path)
except Exception as exc:
log.warning("verification-status read failed for %s: %s", self._path, exc)
return None
if raw is None:
return {}
try:
data = json.loads(raw.decode("utf-8"))
except (json.JSONDecodeError, UnicodeDecodeError) as exc:
log.error(
"verification-status index at %s is unparseable (%s); refusing to "
"overwrite", self._path, exc,
)
return None
if not isinstance(data, dict):
log.error(
"verification-status index at %s is not a JSON object; refusing to "
"overwrite", self._path,
)
return None
return data
def mark_pending(self, filename: str) -> None:
"""Insert ``filename`` as ``pending`` if absent. Best-effort; never raises.
Serialised by a process-wide lock so two concurrent promotions cannot
read-then-write the same index and drop each other's entry. Existing
entries (including human ``valid`` / ``invalid`` verdicts) are preserved.
"""
with self._lock:
data = self._load()
if data is None:
return # read/parse failed — fail safe, leave the index untouched
if filename in data:
return # already tracked; don't rewrite or clobber a verdict
data[filename] = PENDING
body = json.dumps(data, indent=2, sort_keys=True) + "\n"
try:
self._hub.write_text_central(self._path, body)
except Exception as exc:
log.warning(
"verification-status write failed for %s: %s", self._path, exc
)
# ───────────────────── automated verdicts (§5.7) ─────────────────────
def _ledger_path(self, filename: str) -> str:
return f"{self._runs_prefix}/{filename}/verdict.json"
def ledger_state(self, filename: str) -> str | None:
"""The last state THIS verifier wrote for ``filename``, or None.
Read from the private audit bucket. A transport error degrades to None
— the CAS then treats a non-pending index entry as human-authored and
defers, which is the safe direction.
"""
try:
raw = self._hub.read_audit_bytes(self._ledger_path(filename))
except Exception as exc:
log.warning("verdict-ledger read failed for %s: %s", filename, exc)
return None
if raw is None:
return None
try:
data = json.loads(raw.decode("utf-8"))
except (json.JSONDecodeError, UnicodeDecodeError) as exc:
log.warning("verdict-ledger record for %s unparseable: %s", filename, exc)
return None
if not isinstance(data, dict):
return None
state = data.get("state")
return str(state) if state is not None else None
def set_verdict(
self,
filename: str,
new_state: str,
*,
by: str,
details: dict | None = None,
) -> str:
"""Record an automated verdict, never overwriting a human one.
Compare-and-set against the side-ledger: write the index iff the
current entry is ``pending``/absent or equals the verifier's own
last-written state. Returns WRITTEN, DEFERRED, or SKIPPED. Serialised
by the same process-wide lock as ``mark_pending``.
"""
if new_state not in (VALID, INVALID):
raise ValueError(f"verdict must be '{VALID}' or '{INVALID}', got {new_state!r}")
with self._lock:
data = self._load()
if data is None:
log.error(
"set_verdict(%s, %s): index unreadable; refusing to write "
"(fail-safe)", filename, new_state,
)
return SKIPPED
cur = data.get(filename)
if cur not in (None, PENDING) and cur != self.ledger_state(filename):
log.info(
"deferring to human verdict for %s: index=%s, not "
"verifier-authored", filename, cur,
)
return DEFERRED
data[filename] = new_state
body = json.dumps(data, indent=2, sort_keys=True) + "\n"
self._hub.write_text_central(self._path, body)
record = {
"filename": filename,
"state": new_state,
"by": by,
"at": stamp_iso(utc_now()),
**(details or {}),
}
try:
self._hub.write_bytes_audit(
self._ledger_path(filename),
(json.dumps(record, indent=2, sort_keys=True) + "\n").encode("utf-8"),
)
except Exception:
# Index already updated; a missing ledger record only makes a
# FUTURE re-verify defer to the (now verifier-authored) entry —
# conservative, never destructive.
log.exception("verdict-ledger write failed for %s", filename)
return WRITTEN
|