kangshifu-board/scripts/package-industry-request-guard.py

"""Build r6 from the immutable r5 release plus explicit request-guard changes only."""
import argparse
import difflib
from datetime import datetime, timezone
import hashlib
import json
from pathlib import Path
import shutil
import sqlite3
import zipfile

ROOT = Path(__file__).resolve().parents[1]
BASE = ROOT / 'artifacts/ksf-industry-monitor-20261107-r5/package'
WORK = ROOT / 'work/industry-monitoring-20261107-r1'
RELEASE = 'ksf-industry-monitor-20261107-r6'
INTEGRATION = """            from monitoring_dispatch import projection as dispatch_projection
            pipeline['requestGuard'] = dispatch_projection(self.task_store, self.data['generation'])
"""


def sha(raw):
    return hashlib.sha256(raw).hexdigest()


def main():
    p = argparse.ArgumentParser(description=__doc__)
    p.add_argument('--out', required=True, type=Path)
    p.add_argument('--seal', action='store_true', help='Seal an accepted candidate after receipts are written')
    args = p.parse_args()
    out = args.out.resolve()
    if args.seal:
        release = json.loads((out / 'RELEASE.json').read_text('utf-8'))
        receipt = json.loads((out / 'evidence/implementation-receipt-v6.json').read_text('utf-8'))
        if release['release'] != RELEASE or not receipt.get('browserPassed') or receipt.get('tests', {}).get('python') != 61:
            raise ValueError('CANDIDATE_ACCEPTANCE_REQUIRED')
        for name, digest in receipt['testedFilesSha256'].items():
            if sha((out / name).read_bytes()) != digest:
                raise ValueError('TESTED_SOURCE_CHANGED')
        archive = out.parent / (RELEASE + '.zip')
        if archive.exists():
            raise ValueError('SEALED_ARCHIVE_ALREADY_EXISTS')
        files = sorted(path for path in out.rglob('*') if path.is_file() and path != out / 'FILES.sha256')
        (out / 'FILES.sha256').write_text(''.join(sha(path.read_bytes()) + '  ' + path.relative_to(out).as_posix() + '\n' for path in files), 'utf-8')
        with zipfile.ZipFile(archive, 'x', zipfile.ZIP_DEFLATED) as z:
            for path in sorted(out.rglob('*')):
                if path.is_file():
                    z.write(path, path.relative_to(out).as_posix())
        print(json.dumps({'ok': True, 'archive': str(archive), 'bytes': archive.stat().st_size,
                          'sha256': sha(archive.read_bytes()), 'productionDeployed': False, 'paidCalls': 0}, ensure_ascii=False))
        return
    if out.exists():
        raise ValueError('RELEASE_DIRECTORY_MUST_BE_NEW')
    # Do not copy unrelated work-in-progress innovation views or shared module changes.
    for line in (BASE / 'FILES.sha256').read_text('utf-8').splitlines():
        digest, name = line.split('  ', 1)
        if sha((BASE / name).read_bytes()) != digest:
            raise ValueError('R5_FROZEN_BASELINE_CHANGED')
    shutil.copytree(BASE, out)
    before = (BASE / 'server/voc-library/industry_monitor.py').read_text('utf-8')
    anchor = "                                           self.task_query.get('pipelinePage', 1), self.task_query.get('pipelineRevision'))\n"
    if before.count(anchor) != 1:
        raise ValueError('R5_INTEGRATION_ANCHOR_CHANGED')
    updated = before.replace(anchor, anchor + INTEGRATION)
    (out / 'server/voc-library/industry_monitor.py').write_text(updated, 'utf-8')
    names = ['server/voc-library/monitoring_dispatch.py', 'server/voc-library/test_monitoring_dispatch.py',
             'scripts/manage-industry-dispatch.py']
    for name in names:
        shutil.copyfile(ROOT / name, out / name)
    shutil.copyfile(ROOT / 'src/pages/industry-pipeline-view.js', out / 'payload/src/pages/industry-pipeline-view.js')
    # Verify the only UI change to the frozen module is the guard section.
    old_ui = (BASE / 'payload/src/pages/industry-pipeline-view.js').read_text('utf-8')
    new_ui = (out / 'payload/src/pages/industry-pipeline-view.js').read_text('utf-8')
    lines = [line for line in new_ui.splitlines(True) if 'class="request-guard"' not in line]
    if ''.join(lines) != old_ui:
        raise ValueError('UNRELATED_PIPELINE_UI_CHANGES')
    with (out / 'evidence/ui.patch').open('a', encoding='utf-8') as stream:
        stream.write(''.join(difflib.unified_diff(old_ui.splitlines(True), new_ui.splitlines(True),
                                                fromfile='r5/src/pages/industry-pipeline-view.js',
                                                tofile='r6/src/pages/industry-pipeline-view.js')))
    shutil.copyfile(ROOT / 'docs/industry-monitoring-20261107/request-guard.md', out / 'docs/request-guard.md')
    for name in ('dispatch-closeout-import.json', 'dispatch-paid-replay-verification.json'):
        shutil.copyfile(WORK / name, out / 'evidence' / name)
    # Auxiliary working copy only. The active research snapshot is never packaged or altered.
    dest = out / 'data/monitoring-registry/monitoring.sqlite'
    with sqlite3.connect((WORK / 'monitoring-registry/monitoring.sqlite').resolve().as_uri() + '?mode=ro', uri=True) as source:
        with sqlite3.connect(dest) as c:
            source.backup(c)
            c.execute("UPDATE pipeline_workers SET state='ARCHIVED_COPY'")
            c.execute("UPDATE dispatch_audits SET state='ARCHIVED_COPY'")
            c.commit()
    for file in (WORK / 'monitoring-registry/assets').iterdir():
        target = out / 'data/monitoring-registry/assets' / file.name
        if not target.exists():
            shutil.copyfile(file, target)
    # Refresh release identity and the publisher's source-byte manifest; preserve all public baselines.
    manifest_path = out / 'deploy/industry-ui-files.json'
    manifest = json.loads(manifest_path.read_text('utf-8'))
    manifest['release'] = RELEASE
    for entry in manifest['files']:
        entry['sha256'] = sha((out / 'payload' / entry['path']).read_bytes())
    manifest_path.write_text(json.dumps(manifest, ensure_ascii=False, indent=2) + '\n', 'utf-8')
    publisher = out / 'scripts/publish-industry-ui.mjs'
    publisher.write_text(publisher.read_text('utf-8').replace('ksf-industry-monitor-20261107-r5', RELEASE), 'utf-8')
    for directory in ('docs', 'deploy'):
        for path in (out / directory).iterdir():
            if path.is_file() and path.suffix in ('.md', '.example'):
                path.write_text(path.read_text('utf-8-sig').replace('ksf-industry-monitor-20261107-r5', RELEASE), 'utf-8')
    with (out / 'docs/README.md').open('a', encoding='utf-8') as stream:
        stream.write('\n\n## r6：请求前核对与认领\n\n新增已结算76条请求保护、批次查重、并发核对认领和停费状态投影；操作见 [request-guard.md](request-guard.md)。上游执行端尚未接入，收费保持停止。本包仅在已冻结r5上追加本轮变更。\n')
    release_path = out / 'RELEASE.json'
    release = json.loads(release_path.read_text('utf-8'))
    release.update(release=RELEASE, createdAt=datetime.now(timezone.utc).isoformat(),
                   builtFromFrozenRelease='ksf-industry-monitor-20261107-r5',
                   requestGuardImplemented=True, externalCollectorsIntegrated=False,
                   newPaidCalls=0, settledCloseoutIdentifiedRows=76, overallComplete=False)
    release['backendFiles'].append('server/voc-library/monitoring_dispatch.py')
    release_path.write_text(json.dumps(release, ensure_ascii=False, indent=2) + '\n', 'utf-8')
    # Browser acceptance and final test receipts are added before sealing, never after ZIP creation.
    print(json.dumps({'ok': True, 'candidate': str(out), 'sealed': False, 'paidCalls': 0}, ensure_ascii=False))


if __name__ == '__main__':
    main()