owner.py

1"""Review-gated, single-attempt one-hour owner using the unchanged tested guardian."""
2import fcntl,json,os,sys
3from pathlib import Path
4from records import sha,digest,atomic_json
5HERE=Path(__file__).resolve().parent
6sys.path.insert(0,str(HERE.parents[0]/'elite-continuation-v1'))
7from training_deadline import create_or_resume,supervise
8
9def validate(config,approval,command,check_files=True):
10    if config['budget_seconds']!=3600 or config['resume_policy']!='single_attempt_no_resume':raise ValueError('one-hour single-attempt contract')
11    if approval!={'approved':True,'config_sha256':digest(config),'command':command}:raise ValueError('exact independent review release required')
12    if not check_files:return
13    for path,expected in config['runtime_sha256'].items():
14        if sha(path)!=expected:raise ValueError('reviewed runtime changed')
15    if sha(Path(config['dataset'])/'manifest.json')!=config['dataset_manifest_sha256']:raise ValueError('sealed data changed')
16    if sha(Path(config['dataset'])/'integrity.json')!=config['dataset_integrity_sha256'] or sha(Path(config['dataset'])/'journal.sqlite')!=config['dataset_journal_sha256']:raise ValueError('data integrity/provenance changed')
17    if sha(config['parent'])!=config['parent_sha256']:raise ValueError('parent changed')
18
19def run(config_path):
20    path=Path(config_path).resolve();config=json.loads(path.read_text());root=Path(config['output']).resolve()
21    command=[sys.executable,str(HERE/'train.py'),str(path)]
22    validate(config,json.loads((HERE/'approved-launch.json').read_text()),command,check_files=False)
23    root.mkdir(parents=True,exist_ok=True)
24    with (root/'run.lock').open('a+b') as lock:
25        fcntl.flock(lock,fcntl.LOCK_EX|fcntl.LOCK_NB)
26        # Any prior admission is terminal for this sanity experiment. A different
27        # path/config cannot reuse this approval since all paths are digest-bound.
28        if (root/'deadline.json').exists() or (root/'supervision.json').exists():raise ValueError('single attempt already admitted; no fresh budget')
29        value=create_or_resume(root/'deadline.json',{'run_id':config['run_id'],'config_sha256':digest(config),'command':command},budget=3600,margin=150)
30        env=dict(os.environ,CHESS_JOB_DEADLINE=str(root/'deadline.json'),CHESS_JOB_LOCK_FD=str(lock.fileno()))
31        result=supervise(command,value,env)
32        atomic_json(root/'supervision.json',result)
33        return result['returncode'] or (124 if result['deadline_expired'] else 0)
34
35if __name__=='__main__':
36    if len(sys.argv)!=2:raise SystemExit('one exact config required; no resume option')
37    raise SystemExit(run(sys.argv[1]))
38