4jrQ pdZddlmZddlZddlZddlZddlZddlZddl Z ddl m Z e e jjdZgdZddgd gd gd gd gd gdgdgdgdgd ZgdZdZdZdZdZdZdZdZhdZd&dZd'dZd(d'dZd)dZd*dZd'd Z d+d!Z!d,d"Z"d#Z#d(d-d$Z$e%d%k(r e&e$y).u.task-2609 Track F — AUTO_PR_AND_MERGE_READINESS_DRY_RUN entrypoint. Verifies automated-PR-creation + automated-merge readiness purely via read-only consumption + dry-run + fixture evaluation. HARD CONSTRAINTS (회장 verbatim §2/§7): * read-only · dry-run · proposal-only * NO GitHub write · NO PR open · NO branch/commit/push · NO merge * NO credential raw exposure (BOT_GITHUB_TOKEN redacted preflight only) * NO OWNER PAT usage * additive-only: writes only task-2609.* allowlisted paths (§6) * the 10 consume modules are inspected byte-0 (sha256 + AST symbol probe, never executed) — no network, no subprocess, no mutation surface This module is import-safe (no side effects on import) so the regression suite can drive judge_case()/evaluate_conditions() with mock fixtures only. ) annotationsN)Path) zutils/merge_queue_executor.pyzutils/replacement_pr_runner.pyz utils/post_merge_smoke_runner.pyzutils/bot_merge_identity.pyzscripts/refresh_bot_token.pyz%utils/critical_escalation_reporter.pyzutils/merge_topology_gate.pyzutils/automation_contracts.pyz,scripts/run_post_merge_reconcile_closeout.pyzutils/gemini_gate_validator.py evaluate_prverify_head_lock_then_mergeReplacementPRRunnerrun_post_merge_smokeclassify_token_sourcerequest_installation_token process_eventclassifyCriticalEscalationType reconcile evaluate_gate queue_headexpected_files_exact_matchforbidden_path_zero!effective_diff_contamination_zerodependency_satisfiedserial_only_collision_zeroci_all_successgemini_unresolved_zeromerge_state_cleanhead_sha_lock_matchbot_token_is_ghs_appowner_pat_usage_zeropost_merge_smoke_configuredreconcile_evidence_configuredFORBIDDEN_PATH_INTRUSION9REPLACEMENT_PR_AUTO_CREATION_FAILED_FOR_CONTAMINATED_DIFF(GEMINI_REAL_BUG_REQUIRES_SCOPE_EXPANSION.BLOCK_OVERRIDE_REQUIRED_OR_REASON_INSUFFICIENT)DEPENDENCY_CYCLE_OR_SERIAL_ONLY_COLLISIONREPLACEMENT_PR_FAILEDPOST_MERGE_SMOKE_FAILED>HOLDWAIT CRITICAL7 FAIL_CLOSEDREPLACEMENT_REQUIREDMERGE_CANDIDATE_READYctjjtjjj dS)Nz%Y-%m-%dT%H:%M:%SZ)_dtdatetimenowtimezoneutcstrftimeG/home/jay/workspace/scripts/run_auto_pr_merge_readiness_dry_run_2609.py_utcnowr7`s- <<  CLL,, - 6 67K LLr5c dgddd}tD]}t|z }||jd}|js)d|d<d|d<d|d<g|d <|d j|Y|j }t j |j|d<t||d <g} tj|jd d |}tj|Dchc]G}t|tjtjtj fr |j"I}}t$j'|g} | D cgc] } | |vs|  }} | |d<||d <t)|t)| k7rd|d<|d j||Scc}wcc} w#t*$r} t-| |d<d|d<Yd} ~ Dd} ~ wwxYw)Nz9read-only byte-0 (sha256 + ast.parse, no exec/import/net)T)modemodules all_presentall_symbols_ok)pathpresentFr;r<sha256 symbols_foundr:bytesutf-8replace)filenamesymbols_expected ast_error)CONSUME_MODULES REPO_ROOTis_fileappend read_byteshashlibr? hexdigestlenastparsedecodewalk isinstance FunctionDefAsyncFunctionDefClassDefnameEXPECTED_SYMBOLSgetset SyntaxErrorstr) outrelprecrawfoundtreennameswantedses r6consume_modules_readonlyriesN GC# Oqyy{3yy{!&C $)C ! CM#%C  N ! !# & llns+557H 3xG  *99SZZ;cJD%(XXd^^"1s8L8Lcll&[\VV^E^%))#r2F &51!u*Q5E5&,C" ##(C 5zS[((-$% Ic"7#8 J^6  *"1vC $)C ! *s=.>F-,A F#8F- F(F("(F-# F-- G6GGc |ttjn t|}|jddxsd}t |}|j drd}d}n!|j drd}d}n |rd}d }nd }d }d Dcgc]}|j|r|}}|||r4t j|jjdd nd||dk(|dk(xs t ||ddScc}w)NBOT_GITHUB_TOKENghs_GITHUB_APP_INSTALLATION_TOKEN)ghp_ github_pat_gho_ OWNER_PATpatUNKNOWNotherABSENTnone)rr PAT_TOKEN GITHUB_PATF)bot_token_present prefix_classfingerprint_sha256_8classified_sourceis_ghs_app_tokenowner_pat_detectedowner_pat_env_names_set raw_exposed) dictosenvironrYbool startswithrLr?encoderM)envtokr>sourcer|kowner_pat_env_namess r6redacted_token_preflightrs !k$rzz tCyC ''$b ) /RC3iG ~~f0 7 8   &N*!ggaj**%$$'") !=!G!G!I"1!M-1#"&EE$ 3Ptt|jddt|jddt|jdddk(t|jdd t|jddxrt|jd d t|jd d t|jd dt|jd ddk(t|jd ddk(t|jddt|jdddk(t|jdd t|jddt|jddd}|S)z;Map a mock fixture's inputs onto the 14 boolean conditions.rTrforbidden_path_countreffective_diff_contaminationFrdependency_cycleserial_only_collisionrgemini_unresolved_countmerge_state_statusCLEANrbot_token_sourcerlrnrrrr)rrYintr\)inpcs r6evaluate_conditionsrsf377<67&*3773OQU+V&W"377+A1#EF!KSWW;UCD D!%cgg.Dd&K!L"R)-cgg6H%.P)Q%QSWW4e<= =sww'7>?"%cgg.G&K"LPQ"Q )=w!GHGS#CGG,A4$HI *B/ 04S S$(1Eu)M$N N 6= > 8$? @) A, Hr5c `|jdi}t|}g}d}d}|ds d|dgz}}n |dsd|dgz}}||dsd t}}|jd n|jd s|jd rd t}}|jd n|jddk(rd t }}|jdn[|jddk(rd t }}|jdn-|jddk(rd t}}|jd||dsd}|jd||ds*|jddk(rdnd}|jdn|ds(|jdd d!vrd}|jd"n]|d#sd}|jd$nD|d%sd}|jd&n+|d's&|jdd(vrd}|jd)|<|d*s d+|d,gz}}n.|d-s d+|d.gz}}n |d's|jdd/vrd+|d0gz}}|ht|jrd1}|jd2n;d}|jDcgc] \}}|r | }}}|jd3||jd4|jd5|t|j||||jd6|jd7||jd6k(xr||jd7k(d8 Scc}}w)9zResolve a mock fixture case to a dry-run verdict by safety precedence. Precedence (highest first): FAIL_CLOSED > CRITICAL7 > REPLACEMENT_REQUIRED > HOLD > WAIT > MERGE_CANDIDATE_READY. inputsNrr*zHEAD SHA lock mismatchrzOWNER PAT detectedrr)zforbidden path > 0rrz(dependency cycle / serial_only collisionreplacement_pr_outcomefailurezreplacement PR failurepost_merge_smoke_outcomefailzpost-merge smoke failuregemini_severityreal_bugz(Gemini real bug requires scope expansionrr+u4effective diff contamination → replacement PR pathrsuccessr'u5expected_files mismatch → HOLD/REPLACEMENT_REQUIREDrrrl)rlrvuBOT token absent → HOLDru!post-merge smoke missing → HOLDru#reconcile evidence missing → HOLDr)highcriticalu(Gemini unresolved high/critical → HOLDrr(uCI not green → WAITru!mergeStateStatus≠CLEAN → WAIT)lowmediumNu%Gemini unresolved low/medium → WAITr,zall 14 conditions truezresidual failed conditions: idrWexpected_verdictexpected_critical7) rrW conditionsconditions_all_trueverdictcritical7_typereasonsrrmatch) rYrC7_FORBIDDEN_PATHrJ C7_DEP_CYCLEC7_REPLACEMENT_FAILEDC7_SMOKE_FAILEDC7_GEMINI_REAL_BUGallvaluesitems) casercondrr critical7rvfaileds r6 judge_casers ((8R C s #DGGI % &('5M4N*N ( )('5I4J*J)*!,.?YG NN/ 0 WW' (CGG4K,L!,lYG NNE F WW- .) ;!,.CYG NN3 4 WW/ 0F :!,oYG NN5 6 WW& ': 5!,.@YG NNE Ft$GH(MN0103(1*-617, ?56G NN@ A./CGG!5#&:5;G NNE F$%%w2I1J'JWG)*%w2U1V'VWG./CGG!5#&=5>%w2Y1Z'ZWG t{{} -G NN3 4G$(JJL:DAqa:F: NN9&B Chhtn "4;;=1# HH%78"hh';<TXX&899B488,@#AA  ;s < L*L*cttjd}gd}g}|D](}|j|dkDs|j |*||| dS)uStatic self-audit: this module must not reference any GitHub/git write. Scans its own source for forbidden write tokens. Any hit = the engine would be capable of a live mutation → fail closed. rBencoding) z gh pr mergez gh pr createzgit pushz git commitz git mergez git branch -z --no-dry-runzsubprocess.runzsubprocess.Popenz os.systemr)forbidden_tokens_scanned violationsno_live_write_surface)r__file__ read_textcountrJ)src forbiddenhitsrs r6assert_no_live_write_surfacer%sm x. " "G " 4C2I D 99S>A  KK   )2)-X //r5ctdz }tj|jdd}|Dcgc] }t |}}t }t }t}td|D}td|Dd} t| xr| ddk(} |d xr|d } |d  } |xr| xr|d xr | xr|d  } | xrtd|D}idddddddtddd| d|d| d| dttdt|d|d| d |d d d!d"d#d$| xr| xr| d%d&i}|rt||||||||||d'Scc}w)(Nz.memory/fixtures/task-2609.critical7-cases.jsonrBrcasesc3&K|] }|d yw)rNr4.0rs r6 zrun..Ds01AgJ0sc30K|]}|ddk(r|yw)rW all14_trueNr4rs r6rzrun..Es#5QF)|35srr,r;r<rrrc3:K|]}|ddvxr|d yw)r)r*r)rNr4rs r6rzrun..Os0.  ) 44GQwZG.stask task-2609trackFtitle#AUTO_PR_AND_MERGE_READINESS_DRY_RUN generated_atr9u2read-only · dry-run · proposal-only · mock-only track_passhold_for_chairauto_pr_creation_readinessauto_merge_readinessconditions_countregression_countregression_all_matchconsume_byte0_okowner_pat_usedFreal_write_or_merge_attemptsr-next_step_limited_live_pr_open_pilot_possibleauthority_noteuareadiness/proposal-only — Track F PASS confers NO automatic real PR/merge permission (§8/§10))summaryresultsconsumetoken_preflight write_guard)rHjsonloadsrrrirrrnextranyr7rNCONDITION_KEYS_emit_artifacts)emit fixture_pathrrrrtoken_pfr all_match ready_case auto_pr_ready consume_ok no_owner_patrrrs r6runr<sUOOL JJ|--w-? @ IE&+,z!},G,&(G')H.0K000I5'56:E!#r5c *d|dt|Dcgc]}|d|d|d|d|ddc}d }dd |Dcgc]}|d|d|dd |dd c}d d}dd |Dcgc]}|d|d|dd|dd|dd!c}dd}|Dcgc] }|ddvs |} }d| Dcgc]}|d|d|d|d|d|ddc}d} dd|drdn|drdnd|d|d|d d d!|d"d#d d$ } dd|drd%n|drdnd&|||||d'} td(|td)|td*|td+| td,|td-| td.| td/| td0| ycc}wcc}wcc}wcc}wcc}w)1NrrrrWrrr)rrWrrr)rrrper_caseTr)rrWrru.no gh/git call — fixture-driven dry-run only)rdry_runqueue_head_evaluationnoterr)rrWsmoke_configuredreconcile_configuredrzYpost_merge_smoke_runner / run_post_merge_reconcile_closeout consumed byte-0; no execution)rrpost_merge_smoker)r)r*rr)rrWrrexpectedr)rcritical7_and_fail_closed_casesrr TRACK_F_PASSrHOLD_FOR_CHAIR TRACK_F_FAILrrFrz$independent ANU key c119085addb0f8b7) rrdecisionrauto_pr_readinessr proposal_only confers_real_pr_merge_permissionrcallback_owner executor_self_callback_forbiddenPASSFAIL)rrstatusrregression_results consume_byte0bot_token_redacted_preflightrz.memory/events/task-2609.merge_gate_matrix.jsonz/memory/events/task-2609.queue_head_dry_run.jsonz?memory/events/task-2609.post_merge_smoke_reconcile_dry_run.jsonz>memory/events/task-2609.critical7_failure_fixture_results.jsonz9memory/events/task-2609.bot_token_redacted_preflight.jsonz;memory/events/task-2609.auto_pr_merge_readiness.result.jsonz=memory/events/task-2609.auto_pr_merge_readiness.decision.jsonz#memory/events/task-2609.result.jsonz%memory/events/task-2609.decision.json)rr ) rrrrrrmatrixr smoke_reconc7 c7_fixturer result_docs r6rrxs!7>3J* %, - ! #$D'1V9*+L/'(|./0@.AC-.F&!:A,B56tWai%&|_\%B"#I,0,BK LJ'4;B (C 67  gqylO,IJlO,KL#$Y< 1(C* +K M) 0L L! MB M% 68 69 12 tWai"#I,)*+;)<#$%7#8 !' ,69:Jc'.|'<^/67G/H+ ./$%AB '(> ?,1 C D@,0H c#L1& '(8 9 v% (0!, J7@8*EHGBHMDF,j9.9K-,B (C N69s"E< F!$F F F '"Fc\tjd}|jddd|jddd|j|}t |j }|j s |j s$tt j|d d d |d drdSdS)Nztask-2609 Track F dry-run) descriptionz--emit store_truez'write task-2609.* allowlisted artifacts)actionhelpz--jsonzprint summary json to stdout)rrFrrrrr) argparseArgumentParser add_argument parse_argsrrrprintr )argvapargsr]s r6mainr7s  -H IBOOH\BDOOH\79 == D 499 C yy  djjYeAFGI|,13!3r5__main__)returnr\)r9r)N)rrr9r)rrr9r)rrr9r)r^r\r9None)r9r)'__doc__ __future__rr/rOr/r.rLrrpathlibrrresolverrHrGrXrrC7_REPLACEMENT_CONTAMINATEDrC7_BLOCK_OVERRIDErrrVERDICTSr7rirrrrrr rr7__name__ SystemExitr4r5r6rDs"#   N " " $ , ,Q /  '45R%S'<&=)?(@$;#<%A$B.=->%/L&>%?5@M'6&7 $/Y?D: /+ M F@ 6^D/.2(j#H:V 4 z TV r5