94 lines
5.2 KiB
JavaScript
94 lines
5.2 KiB
JavaScript
'use strict';
|
|
|
|
const assert = require('node:assert/strict');
|
|
const crypto = require('node:crypto');
|
|
const fs = require('node:fs');
|
|
const path = require('node:path');
|
|
const test = require('node:test');
|
|
|
|
const ROOT = path.resolve(__dirname, '../..');
|
|
const PATCH = path.join(ROOT, 'tools', 'ps5-kstuff-diagnostics', 'route-selection-observability.patch');
|
|
const READER = path.join(ROOT, 'tools', 'ps5-kstuff-diagnostics', 'route-selection-reader.c');
|
|
const MAKEFILE = path.join(ROOT, 'tools', 'ps5-kstuff-diagnostics', 'route-selection-reader.mk');
|
|
const BUILD_SCRIPT = path.join(ROOT, 'scripts', 'autonomous', 'p15-a7-build-route-selection.sh');
|
|
const DOCKERFILE = path.join(ROOT, 'tools', 'ps5-kstuff-diagnostics', 'Dockerfile.route-selection');
|
|
const BUILD_EVIDENCE = path.join(ROOT, 'docs', 'autonomous', 'evidence', 'P15_A7_ROUTE_SELECTION_BUILD_2026-08-25.json');
|
|
const PLAN = path.join(ROOT, 'docs', 'autonomous', 'evidence', 'P15_A7_ROUTE_SELECTION_PLAN.json');
|
|
|
|
function sha256Text(file) {
|
|
const canonical = fs.readFileSync(file, 'utf8').replace(/\r\n/g, '\n');
|
|
return crypto.createHash('sha256').update(canonical, 'utf8').digest('hex');
|
|
}
|
|
|
|
test('A7 runtime patch changes observability plumbing only', () => {
|
|
const patch = fs.readFileSync(PATCH, 'utf8');
|
|
for (const file of ['uelf/shared_area.h', 'uelf/log.h', 'uelf/log.c', 'uelf/utils.c']) {
|
|
assert.match(patch, new RegExp(`diff --git a/ps5-kstuff/${file.replaceAll('/', '\\/')}`));
|
|
}
|
|
for (const forbiddenFile of ['fpkg.c', 'pfs_crypto.c', 'fakekeys.c', 'mailbox.c', 'fself.c', 'npdrm.c']) {
|
|
assert.doesNotMatch(patch, new RegExp(`diff --git a/ps5-kstuff/uelf/${forbiddenFile.replace('.', '\\.')}`));
|
|
}
|
|
const additions = patch.split(/\r?\n/).filter(line => /^\+(?!\+\+)/.test(line)).join('\n');
|
|
for (const forbidden of ['DMEM', 'copy_to_kernel', 'key_data', 'eekpfs', 'crypt_seed', 'mailboxBuffer', 'log_word', 'log_msg']) {
|
|
assert.doesNotMatch(additions, new RegExp(forbidden, 'i'));
|
|
}
|
|
assert.match(additions, /debug_register_arm_successes/);
|
|
assert.match(additions, /debug_register_finish_restore_failures/);
|
|
});
|
|
|
|
test('A7 reader exports only bounded counters and scrubs the source snapshot', () => {
|
|
const source = fs.readFileSync(READER, 'utf8');
|
|
assert.match(source, /schema=chimera\.p15-a7-route-selection-metrics\.v1/);
|
|
assert.match(source, /volatile_scrub\(&snapshot, sizeof\(snapshot\)\)/);
|
|
assert.match(source, /route nmount_dispatch=/);
|
|
assert.match(source, /dbgarm attempt=/);
|
|
assert.match(source, /mailbox total=/);
|
|
assert.match(source, /fpkg verify=/);
|
|
for (const forbidden of ['word_log', 'msg_log', 'ioctl_com_table', 'key_data', 'mailbox-capture', 'decrypt_regs']) {
|
|
assert.doesNotMatch(source, new RegExp(forbidden, 'i'));
|
|
}
|
|
});
|
|
|
|
test('A7 toolchain pins the loader dependency and artifact builds remain offline', () => {
|
|
const dockerfile = fs.readFileSync(DOCKERFILE, 'utf8');
|
|
const evidence = JSON.parse(fs.readFileSync(BUILD_EVIDENCE, 'utf8'));
|
|
assert.match(dockerfile, /releases\/download\/v0\.39\/ps5-payload-dev\.tar\.gz/);
|
|
assert.match(dockerfile, /14ac4113523ed61bc1d42a0d0b7b8981b2bc6aac35a68949c169b0ed0aaf5cdb/);
|
|
assert.doesNotMatch(dockerfile, /releases\/latest/);
|
|
assert.equal(evidence.toolchain.networkDuringArtifactBuild, 'none');
|
|
assert.equal(evidence.toolchain.containerRootFilesystem, 'read-only');
|
|
assert.equal(evidence.reproducibility.runs, 2);
|
|
assert.equal(evidence.reproducibility.exactMatch, true);
|
|
assert.equal(evidence.artifacts.loader.embeddedPayloadOccurrences, 1);
|
|
assert.equal(evidence.artifacts.loader.embeddedPayloadExactMatch, true);
|
|
});
|
|
|
|
test('A7 plan is host-qualified but grants no live action', () => {
|
|
const plan = JSON.parse(fs.readFileSync(PLAN, 'utf8'));
|
|
assert.equal(plan.status, 'host_qualified_live_blocked');
|
|
assert.equal(plan.liveBudget.used, 0);
|
|
assert.equal(plan.liveBudget.stagingAllowedByThisArtifact, false);
|
|
assert.equal(plan.liveBudget.loadingAllowedByThisArtifact, false);
|
|
assert.equal(plan.liveBudget.launchAllowedByThisArtifact, false);
|
|
assert.equal(plan.gates.explicitExactConfirmationRecorded, false);
|
|
});
|
|
|
|
test('A7 committed evidence records both host build runs without requiring ignored binaries', () => {
|
|
const evidence = JSON.parse(fs.readFileSync(BUILD_EVIDENCE, 'utf8'));
|
|
assert.equal(evidence.retention.artifactsCommitted, false);
|
|
assert.equal(evidence.retention.repositoryCiReopensHostArtifacts, false);
|
|
assert.equal(evidence.retention.artifactIntegritySource, 'recorded-host-qualification-hashes');
|
|
assert.equal(sha256Text(PATCH), evidence.source.observabilityPatch.sha256);
|
|
assert.equal(sha256Text(READER), evidence.reader.sourceSha256);
|
|
assert.equal(sha256Text(MAKEFILE), evidence.reader.makefileSha256);
|
|
assert.equal(sha256Text(BUILD_SCRIPT), evidence.toolchain.buildScriptSha256);
|
|
assert.equal(sha256Text(DOCKERFILE), evidence.toolchain.dockerfileSha256);
|
|
for (const artifact of Object.values(evidence.artifacts)) {
|
|
assert.ok(Number.isSafeInteger(artifact.size) && artifact.size > 0);
|
|
assert.match(artifact.sha256, /^[a-f0-9]{64}$/);
|
|
}
|
|
assert.equal(evidence.artifacts.loader.embeddedPayloadOffset, 1214114);
|
|
assert.equal(evidence.artifacts.loader.embeddedPayloadOccurrences, 1);
|
|
assert.equal(evidence.artifacts.loader.embeddedPayloadExactMatch, true);
|
|
});
|