#!/usr/bin/env python3

-- coding: ascii --

"""FIX7 P0 - CI seal-vs-bytes gate :: off-production byte-drift test driver.

Materializes every spec in byte-drift-test-cases/ into a throwaway temp dir, runs the reference gate (ci_seal_vs_bytes_gate.py) as a subprocess against it, and checks the outcome against the spec's expectation:

• the control case must PASS (exit 0);
• every drift case must FAIL CLOSED (exit nonzero, expected failure codes present in output, and NO pass token printed).

LOCAL / OFF-PRODUCTION ONLY. No CI is triggered; no production is contacted. Emits ci-gate-test-results.json. """ import base64 import glob import json import os import subprocess import sys import tempfile

HERE = os.path.dirname(os.path.abspath(file)) GATE = os.path.join(HERE, "ci_seal_vs_bytes_gate.py") CASES_DIR = os.path.join(HERE, "byte-drift-test-cases") PASS_TOKEN = "CI_SEAL_VS_BYTES_GATE: PASS"

def run_case(spec): with tempfile.TemporaryDirectory(prefix="fix7-ci-drift.") as d: for rel, b in spec["files_base64"].items(): with open(os.path.join(d, rel), "wb") as fh: fh.write(base64.b64decode(b)) man = os.path.join(d, "seal-manifest.sha256") with open(man, "w", encoding="utf-8") as fh: fh.write(spec["seal_manifest_text"]) proc = subprocess.run([sys.executable, GATE, "--manifest", man, "--root", d], capture_output=True, text=True) exp = spec["expected"] out = proc.stdout + proc.stderr if exp["exit_zero"]: ok = (proc.returncode == 0 and PASS_TOKEN in out) else: ok = (proc.returncode != 0 and PASS_TOKEN not in out and all(code in out for code in exp["codes"])) return ok, proc.returncode, out

def main(): specs = sorted(glob.glob(os.path.join(CASES_DIR, "case-*.json"))) if not specs: print("NO_TEST_CASES_FOUND") sys.exit(1) results = [] for path in specs: with open(path, encoding="utf-8") as fh: spec = json.load(fh) ok, rc, out = run_case(spec) results.append({ "case": spec["case"], "description": spec["description"], "expected_exit_zero": spec["expected"]["exit_zero"], "expected_codes": spec["expected"]["codes"], "actual_exit_code": rc, "behaved_as_expected": bool(ok), "gate_output_first_lines": out.strip().splitlines()[:4], }) print("[%s] %s" % ("PASS" if ok else "FAIL", spec["case"])) all_ok = all(r["behaved_as_expected"] for r in results) drift = [r for r in results if not r["expected_exit_zero"]] payload = { "doc": "fix7-p0-ci-seal-vs-bytes-gate-test-results", "date": "2026-06-12", "scope": "LOCAL_OFF_PRODUCTION_ONLY_NO_CI_TRIGGER", "gate": "ci_seal_vs_bytes_gate.py (canonical 09c4b8c8..84937a)", "case_count": len(results), "drift_case_count": len(drift), "drift_cases_failed_closed": sum(1 for r in drift if r["behaved_as_expected"]), "control_passed": all(r["behaved_as_expected"] for r in results if r["expected_exit_zero"]), "cases": results, "all_behaved_as_expected": all_ok, "ci_triggered": False, "production_contact": False, } with open(os.path.join(HERE, "ci-gate-test-results.json"), "w", encoding="ascii") as fh: json.dump(payload, fh, indent=2, sort_keys=True, ensure_ascii=True) fh.write("\n") print("CI_GATE_BYTE_DRIFT_TESTS: %d/%d behaved as expected" % (sum(1 for r in results if r["behaved_as_expected"]), len(results))) print("CI_GATE_BYTE_DRIFT_TESTS_RESULT: %s" % ("PASS" if all_ok else "FAIL")) sys.exit(0 if all_ok else 1)

if name == "main": main()