audit: bind oral B recovery to D4 gate

1 files changed, 18 insertions, 2 deletions

diff --git a/experiments/analyze_bci_td_development.py b/experiments/analyze_bci_td_development.py
index 74e80e8..78dbceb 100644
--- a/experiments/analyze_bci_td_development.py
+++ b/experiments/analyze_bci_td_development.py
@@ -10,6 +10,8 @@ import os
 
 ETAS = (0.03, 0.1)
 TASK_SEEDS = (0, 1, 2)
+ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+PROTOCOL_PATH = os.path.join(ROOT, "ORAL_B_RECOVERY.md")
 
 
 def require(condition, message):
@@ -35,7 +37,7 @@ def finite_tree(value):
     return True
 
 
-def validate(row, path, d4_gate):
+def validate(row, path, d4_gate, d4_gate_sha256, protocol_sha256):
     require(row.get("schema_version") == 1, f"{path}: schema")
     protocol = row.get("protocol", {})
     require(protocol.get("name") == "oral_b_td_development_v1",
@@ -50,6 +52,10 @@ def validate(row, path, d4_gate):
     require(float(args.get("eta")) in ETAS, f"{path}: eta")
     require(protocol.get("evaluation_task_seed") == args["task_seed"] + 200_000,
             f"{path}: evaluation seed")
+    require(protocol.get("d4_gate_source") == d4_gate,
+            f"{path}: D4 gate source")
+    require(protocol.get("d4_gate_sha256") == d4_gate_sha256,
+            f"{path}: D4 gate digest")
     require(args.get("d4_gate") == d4_gate, f"{path}: D4 gate path")
     config = row.get("config", {})
     expected = {
@@ -68,6 +74,12 @@ def validate(row, path, d4_gate):
     require(source.get("git_tracked_dirty") is False, f"{path}: dirty")
     require(source.get("runner_and_protocol_tracked") is True,
             f"{path}: untracked")
+    require(source.get("d4_gate_tracked") is True,
+            f"{path}: untracked D4 gate")
+    require(source.get("d4_gate_sha256") == d4_gate_sha256,
+            f"{path}: provenance D4 gate digest")
+    require(source.get("protocol_sha256") == protocol_sha256,
+            f"{path}: protocol digest")
     require(len(source.get("git_commit", "")) == 40, f"{path}: commit")
     require(row.get("finite") is True and finite_tree(row), f"{path}: finite")
     for name in ("intact", "fixed_vectorizer", "plasticity_lesion",
@@ -127,6 +139,8 @@ def main():
             "kp_dynamic_neutral_projection_confirmation_v1", "D4 protocol")
     require(d4.get("status") == "passed", "D4 did not pass")
     require(d4.get("review_score_after") == 7, "D4 score rule")
+    d4_gate_sha256 = sha256(args.d4_gate)
+    protocol_sha256 = sha256(PROTOCOL_PATH)
     paths = sorted(glob.glob(os.path.join(args.results, "bci_td_v1_*.json")))
     require(len(paths) == 6, f"expected six R1 records, found {len(paths)}")
     records = {}
@@ -134,7 +148,7 @@ def main():
     for path in paths:
         with open(path) as handle:
             row = json.load(handle)
-        validate(row, path, args.d4_gate)
+        validate(row, path, args.d4_gate, d4_gate_sha256, protocol_sha256)
         key = (float(row["args"]["eta"]), row["args"]["task_seed"])
         require(key not in records, f"duplicate R1 cell {key}")
         records[key] = row
@@ -182,6 +196,8 @@ def main():
         "selected": selected,
         "candidates": candidates,
         "source_commit": next(iter(commits)),
+        "protocol_sha256": protocol_sha256,
+        "d4_gate_sha256": d4_gate_sha256,
         "source_sha256": {path: sha256(path) for path in paths},
         "oral_b_confirmation_opened": selected is not None,
         "review_score_before": 7,