mosaicstack/stack
1
0
Fork 0
Code Issues 82 Pull Requests 1 Actions Packages Projects Releases 15 Wiki Activity

test(827): isolate pinned runtime bytecode

Browse Source
This commit is contained in:
ms-lead-reviewer
2026-07-18 18:33:58 -05:00
parent 90dc68a31c
commit a92ad090ae
1 changed files with 20 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
docs/compaction-refresh/probes/p3_d4_focused_run.py
View File

@@ -495,6 +495,12 @@ def gated_launcher_precondition(
return closure return closure
def reject_pinned_bytecode(pinned_directory: Path) -> None:
cache_directory = pinned_directory / "__pycache__"
if cache_directory.exists() or any(pinned_directory.rglob("*.pyc")):
raise RuntimeError("D4 precondition: pinned bytecode cache is forbidden")
def launch_verified_pi( def launch_verified_pi(
launcher: Path, launcher: Path,
workspace: Path, workspace: Path,
@@ -504,6 +510,8 @@ def launch_verified_pi(
) -> PiRpc: ) -> PiRpc:
command = [ command = [
sys.executable, sys.executable,
"-I",
"-B",
str(launcher), str(launcher),
"--runtime", "--runtime",
"pi", "pi",
@@ -523,6 +531,7 @@ def launch_verified_pi(
"--extension", "--extension",
str(extension), str(extension),
] ]
reject_pinned_bytecode(launcher.parent)
# This is deliberately the statement immediately before Popen (inside # This is deliberately the statement immediately before Popen (inside
# PiRpc): the fixture-pinned launcher bytes are re-hashed then executed. # PiRpc): the fixture-pinned launcher bytes are re-hashed then executed.
if hashlib.sha256(launcher.read_bytes()).hexdigest() != GATED_LAUNCHER_SHA256: if hashlib.sha256(launcher.read_bytes()).hexdigest() != GATED_LAUNCHER_SHA256:
@@ -531,10 +540,16 @@ def launch_verified_pi(
def launch_verified_broker( def launch_verified_broker(
broker_path: Path, generation_path: Path, socket_path: Path, log_path: Path broker_path: Path,
generation_path: Path,
socket_path: Path,
log_path: Path,
environment: dict[str, str],
) -> subprocess.Popen[str]: ) -> subprocess.Popen[str]:
command = [ command = [
sys.executable, sys.executable,
"-I",
"-B",
str(broker_path), str(broker_path),
"--socket", "--socket",
str(socket_path), str(socket_path),
@@ -543,6 +558,7 @@ def launch_verified_broker(
"--generation-module", "--generation-module",
str(generation_path), str(generation_path),
] ]
reject_pinned_bytecode(broker_path.parent)
if hashlib.sha256(broker_path.read_bytes()).hexdigest() != GATED_BROKER_SHA256: if hashlib.sha256(broker_path.read_bytes()).hexdigest() != GATED_BROKER_SHA256:
raise RuntimeError("D4 precondition: pinned broker hash mismatch") raise RuntimeError("D4 precondition: pinned broker hash mismatch")
# The final helper re-hash is immediately adjacent to the broker Popen. # The final helper re-hash is immediately adjacent to the broker Popen.
@@ -550,6 +566,7 @@ def launch_verified_broker(
raise RuntimeError("D4 precondition: pinned helper hash mismatch") raise RuntimeError("D4 precondition: pinned helper hash mismatch")
return subprocess.Popen( return subprocess.Popen(
command, command,
env=environment,
text=True, text=True,
stdout=subprocess.PIPE, stdout=subprocess.PIPE,
stderr=subprocess.STDOUT, stderr=subprocess.STDOUT,
@@ -708,6 +725,7 @@ def isolated_environment(
"MOSAIC_HOME": str(fixture_mosaic_home), "MOSAIC_HOME": str(fixture_mosaic_home),
"MOSAIC_PI_FORCE_SKILLS": "", "MOSAIC_PI_FORCE_SKILLS": "",
"PI_SKIP_VERSION_CHECK": "1", "PI_SKIP_VERSION_CHECK": "1",
"PYTHONDONTWRITEBYTECODE": "1",
} }
if "PI_CODING_AGENT" in os.environ: if "PI_CODING_AGENT" in os.environ:
environment["PI_CODING_AGENT"] = os.environ["PI_CODING_AGENT"] environment["PI_CODING_AGENT"] = os.environ["PI_CODING_AGENT"]
@@ -744,7 +762,7 @@ def run_once(index: int) -> Path:
# the launcher registers before exec and can only read this fixture socket. # the launcher registers before exec and can only read this fixture socket.
closure = gated_launcher_precondition(root, socket_path, environment) closure = gated_launcher_precondition(root, socket_path, environment)
broker = launch_verified_broker( broker = launch_verified_broker(
closure.broker, closure.generation, socket_path, generation_log closure.broker, closure.generation, socket_path, generation_log, environment
) )
wait_path(socket_path) wait_path(socket_path)
pi = launch_verified_pi(closure.launcher, workspace, sessions, extension, environment) pi = launch_verified_pi(closure.launcher, workspace, sessions, extension, environment)